CVE-2015-4035

NONE EPSS 58.3%
Published Jul 25, 20178y ago · Modified Jun 17, 20262w ago
Find Similar
Published Jul 25, 2017 8y ago
Last Modified Jun 17, 2026 2w ago

Description

scripts/xzgrep.in in xzgrep 5.2.x before 5.2.0, before 5.0.0 does not properly process file names containing semicolons, which allows remote attackers to execute arbitrary code by having a user run xzgrep on a crafted file name.

Threat Intelligence

EPSS Exploit Probability
58.3% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available

Weaknesses 1

CWE-20 Improper Input Validation Validation

Affected Products 3

VendorProductVersionRange
tukaanixz* ≤4.999.9
redhatenterprise_linux5.0any
redhatenterprise_linux6.0any

References 4

  • seclists.org http://seclists.org/oss-sec/2015/q2/484
    Mailing ListThird Party Advisory
  • openwall.com http://www.openwall.com/lists/oss-security/2015/05/19/13
    Mailing ListThird Party Advisory
  • bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=1223341
    Issue TrackingVendor Advisory
  • git.tukaani.org https://git.tukaani.org/?p=xz.git%3Ba=commitdiff%3Bh=f4b2b52624b802c786e4e2a8eb6895794dd93b24

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.