CVE-2015-8768: Critical severity Click Project Click vulnerability
click/install.py in click does not require files in package filesystem tarballs to start with ./ (dot slash), which allows remote attackers to install an alternate security policy and gain privileges via a crafted package, as demonstrated by the test.mmrow app for Ubuntu phone.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2015-8768?
CVE-2015-8768 has a medium severity level due to its potential to allow unauthorized privilege escalation.
How do I fix CVE-2015-8768?
To fix CVE-2015-8768, ensure that the package filesystem tarballs start with './' to prevent the installation of unverified policy packages.
What systems are affected by CVE-2015-8768?
CVE-2015-8768 affects the Click framework used in Ubuntu Linux versions 14.04 and 15.04.
Can CVE-2015-8768 be exploited remotely?
Yes, CVE-2015-8768 can be exploited remotely, allowing attackers to install modified packages that could lead to privilege escalation.
What is the impact of exploiting CVE-2015-8768?
Exploiting CVE-2015-8768 can lead to unauthorized access and privilege escalation on affected systems.