CVE-2015-4035

7.8 HIGH

Published: July 25, 2017 Modified: May 13, 2026

Description

scripts/xzgrep.in in xzgrep 5.2.x before 5.2.0, before 5.0.0 does not properly process file names containing semicolons, which allows remote attackers to execute arbitrary code by having a user run xzgrep on a crafted file name.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

CVSS v3.x Details

0.0 Low Medium High Critical 10.0

Vector String

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory

http://seclists.org/oss-sec/2015/q2/484

Source: cve@mitre.org

Mailing List Third Party Advisory

http://www.openwall.com/lists/oss-security/2015/05/19/13

Source: cve@mitre.org

Mailing List Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=1223341

Source: cve@mitre.org

Issue Tracking Vendor Advisory

https://git.tukaani.org/?p=xz.git%3Ba=commitdiff%3Bh=f4b2b52624b802c786e4e2a8eb6895794dd93b24

Source: cve@mitre.org

http://seclists.org/oss-sec/2015/q2/484

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List Third Party Advisory

http://www.openwall.com/lists/oss-security/2015/05/19/13

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=1223341

Source: af854a3a-2127-422b-91ae-364da2661108

Issue Tracking Vendor Advisory

https://git.tukaani.org/?p=xz.git%3Ba=commitdiff%3Bh=f4b2b52624b802c786e4e2a8eb6895794dd93b24

Source: af854a3a-2127-422b-91ae-364da2661108

8 reference(s) from NVD

Quick Stats

CVSS v3 Score

7.8 / 10.0

EPSS (Exploit Probability)

0.6%

70th percentile

Exploitation Status

Not in CISA KEV

Weaknesses (CWE)

CWE-20

Affected Vendors

tukaani redhat

Related CVEs