CVE-2015-1326 python-dbusmock arbitrary code execution or file overwrite when templates are loaded from /tmp

2019-04-2215:35:59

canonical

www.cve.org

CVSS3

5.7

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

AI Score

8.6

Confidence

High

EPSS

0.002

Percentile

57.9%

JSON

python-dbusmock before version 0.15.1 AddTemplate() D-Bus method call or DBusTestCase.spawn_server_template() method could be tricked into executing malicious code if an attacker supplies a .pyc file.

CNA Affected

[
  {
    "product": "python-dbusmock",
    "vendor": "Ubuntu",
    "versions": [
      {
        "lessThan": "0.15.1",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]