CVE-2015-1326 - OpenCVE

python-dbusmock before version 0.15.1 AddTemplate() D-Bus method call or DBusTestCase.spawn_server_template() method could be tricked into executing malicious code if an attacker supplies a .pyc file.

No CVSS v4.0

No CVSS v3.1

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction Required

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Complete

Integrity Impact Complete

Availability Impact Complete

AV:N/AC:M/Au:N/C:C/I:C/A:C

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Python-dbusmock Project	Python-dbusmock

Configuration 1 [-]

cpe:2.3:a:python-dbusmock_project:python-dbusmock:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://github.com/martinpitt/python-dbusmock/commit/4e7d0df9093

History

No history.

MITRE

Status: PUBLISHED

Assigner: canonical

Published: 2019-04-22T15:35:59.213418Z

Updated: 2024-09-16T23:46:40.134Z

Reserved: 2015-01-22T00:00:00

Link: CVE-2015-1326

Vulnrichment

No data.

NVD

Status : Modified

Published: 2019-04-22T16:29:00.770

Modified: 2019-10-09T23:13:11.283

Link: CVE-2015-1326

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "python-dbusmock", "vendor": "Ubuntu", "versions": [{"lessThan": "0.15.1", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "Simon McVittie"}], "datePublic": "2015-05-12T00:00:00", "descriptions": [{"lang": "en", "value": "python-dbusmock before version 0.15.1 AddTemplate() D-Bus method call or DBusTestCase.spawn_server_template() method could be tricked into executing malicious code if an attacker supplies a .pyc file."}], "metrics": [{"cvssV3_0": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 5.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L", "version": "3.0"}}], "problemTypes": [{"descriptions": [{"description": "Untrusted compiled bytecode", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2019-04-22T15:35:59", "orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "shortName": "canonical"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://github.com/martinpitt/python-dbusmock/commit/4e7d0df9093"}], "source": {"defect": ["https://bugs.launchpad.net/python-dbusmock/+bug/1453815"], "discovery": "EXTERNAL"}, "title": "python-dbusmock arbitrary code execution or file overwrite when templates are loaded from /tmp", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@ubuntu.com", "DATE_PUBLIC": "2015-05-12T00:00:00.000Z", "ID": "CVE-2015-1326", "STATE": "PUBLIC", "TITLE": "python-dbusmock arbitrary code execution or file overwrite when templates are loaded from /tmp"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "python-dbusmock", "version": {"version_data": [{"affected": "<", "version_affected": "<", "version_value": "0.15.1"}]}}]}, "vendor_name": "Ubuntu"}]}}, "credit": [{"lang": "eng", "value": "Simon McVittie"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "python-dbusmock before version 0.15.1 AddTemplate() D-Bus method call or DBusTestCase.spawn_server_template() method could be tricked into executing malicious code if an attacker supplies a .pyc file."}]}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 5.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L", "version": "3.0"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Untrusted compiled bytecode"}]}]}, "references": {"reference_data": [{"name": "https://github.com/martinpitt/python-dbusmock/commit/4e7d0df9093", "refsource": "MISC", "url": "https://github.com/martinpitt/python-dbusmock/commit/4e7d0df9093"}]}, "source": {"defect": ["https://bugs.launchpad.net/python-dbusmock/+bug/1453815"], "discovery": "EXTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T04:40:18.219Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/martinpitt/python-dbusmock/commit/4e7d0df9093"}]}]}, "cveMetadata": {"assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "assignerShortName": "canonical", "cveId": "CVE-2015-1326", "datePublished": "2019-04-22T15:35:59.213418Z", "dateReserved": "2015-01-22T00:00:00", "dateUpdated": "2024-09-16T23:46:40.134Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:python-dbusmock_project:python-dbusmock:*:*:*:*:*:*:*:*", "matchCriteriaId": "FC0A6348-374B-4C66-BDF1-0AC858D62A8A", "versionEndExcluding": "0.15.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "python-dbusmock before version 0.15.1 AddTemplate() D-Bus method call or DBusTestCase.spawn_server_template() method could be tricked into executing malicious code if an attacker supplies a .pyc file."}, {"lang": "es", "value": "python-dbusmock versiones anteriores a la 0.15.1 AddTemplate() D-Bus method call o DBusTestCase.spawn_server_stemplate() method podr\u00edan ser enga\u00f1ados para que ejecuten c\u00f3digo malicioso si un atacante proporciona un archivo .pyc."}], "id": "CVE-2015-1326", "lastModified": "2019-10-09T23:13:11.283", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 9.3, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 5.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L", "version": "3.0"}, "exploitabilityScore": 1.5, "impactScore": 3.7, "source": "security@ubuntu.com", "type": "Secondary"}]}, "published": "2019-04-22T16:29:00.770", "references": [{"source": "security@ubuntu.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/martinpitt/python-dbusmock/commit/4e7d0df9093"}], "sourceIdentifier": "security@ubuntu.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "nvd@nist.gov", "type": "Primary"}]}