Use-after-free in Fedora - CVE-2015-7687

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU38065

Use-after-free in Fedora - CVE-2015-7687

Published: October 16, 2017 / Updated: August 8, 2020


Vulnerability identifier: #VU38065
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2015-7687
CWE-ID: CWE-416
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing vectors involving req_ca_vrfy_smtp and req_ca_vrfy_mta. A remote attackers can cause a denial of service (crash) or execute arbitrary code.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.


Affected software

Fedora
opensmtpd

How to mitigate CVE-2015-7687

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

opensmtpd - addressed in versions 5.7.2p1-1.el6, 5.7.2p1-1.el7, 5.7.2p1-1.fc22, 5.7.2p1-1.fc23, 5.7.3p1-1.el6, 5.7.3p1-1.el7, 5.7.3p1-1.fc22, 5.7.3p1-1.fc23

External References

Related Security Bulletins