What is the CVSS score of CVE-2015-0842?

CVE-2015-0842 has a contested CVSS base score of 9.8 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Ubuntu are affected by CVE-2015-0842?

Organizations using yubiserver before 0.6 face critical risk from CVE-2015-0842, a SQL injection vulnerability rated CVSS 9.8.. A patch is available.

How to fix or mitigate CVE-2015-0842?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Validate that input sanitization is in place for all user-controlled parameters.

Ubuntu CVE-2015-0842

EUVD-2015-0854 CRITICAL

SQL Injection (CWE-89)

2025-06-26 security@debian.org

Authentication Bypass SQLi Ubuntu Debian Yubiserver

Critical

Disputed · 9.8 NVD

Severity by source

Sources disagree (Medium–Critical)

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Ubuntu

MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 15, 2026 - 23:54 euvd

EUVD-2015-0854

Analysis Generated

Mar 15, 2026 - 23:54 vuln.today

CVE Published

Jun 26, 2025 - 22:15 nvd

CRITICAL 9.8

DescriptionCVE.org

yubiserver before 0.6 is prone to SQL injection issues, potentially leading to an authentication bypass.

Analysis

yubiserver before 0.6 is prone to SQL injection issues, potentially leading to an authentication bypass.

Technical ContextAI

SQL injection occurs when user-supplied input is incorporated into SQL queries without proper sanitization or parameterized queries.

RemediationAI

Use parameterized queries or prepared statements. Apply input validation and escape special characters. Implement least-privilege database accounts.

More in Yubiserver

View all

CVE-2015-0843 CRITICAL Act Now

9.8 Jun 26

yubiserver before 0.6 is prone to buffer overflows due to misuse of sprintf.

Same weakness CWE-89 – SQL Injection

View all

CVE-2023-48788 CRITICAL POC

9.8

CVE-2025-57819 CRITICAL POC

10.0

CVE-2017-8917 CRITICAL POC

9.8

CVE-2024-27956 CRITICAL POC

9.9

CVE-2014-3704 HIGH POC

7.5

CVE-2016-2555 CRITICAL POC

9.8

CVE-2016-8582 CRITICAL POC

9.8

CVE-2015-7297 HIGH POC

7.5

Same technique Authentication Bypass

View all

CVE-2023-22515 CRITICAL POC

9.8

CVE-2012-4681 CRITICAL POC

9.8

CVE-2013-2465 CRITICAL POC

9.8

CVE-2011-3544 CRITICAL POC

9.8

CVE-2012-1723 CRITICAL POC

9.8

CVE-2017-10271 HIGH POC

7.5

CVE-2015-1427 CRITICAL POC

9.8

CVE-2025-3248 CRITICAL POC

9.8

Vendor StatusVendor

Ubuntu

Priority: Medium

yubiserver

Release	Status	Version
artful	ignored	end of life
bionic	not-affected	0.6-3
cosmic	not-affected	0.6-3
disco	not-affected	0.6-3
precise	ignored	end of life
upstream	released	0.6-1
utopic	ignored	end of life
vivid	ignored	end of life
wily	ignored	end of life
xenial	not-affected	0.6-3
yakkety	ignored	end of life
zesty	ignored	end of life
trusty	DNE	trusty/esm was DNE [trusty was needed]

Debian

Bug #796495

yubiserver

Release	Status	Fixed Version	Urgency
bookworm, bullseye	fixed	0.6-3.1	-
trixie	fixed	0.6-3.2	-
(unstable)	fixed	0.6-1	-

CVE-2015-0842 vulnerability details – vuln.today

Back

Ubuntu CVE-2015-0842

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

Analysis

Technical ContextAI

RemediationAI

More in Yubiserver

Same weakness CWE-89 – SQL Injection

Same technique Authentication Bypass

Vendor StatusVendor

Ubuntu

Debian

Share

External POC / Exploit Code