What is the CVSS score of CVE-2015-1572?

CVE-2015-1572 has a CVSS 2.0 base score of 4.6 (Medium). CVSS vector: AV:L/AC:L/Au:N/C:P/I:P/A:P. EPSS exploitation probability: 0.1%.

E2Fsprogs CVE-2015-1572

MEDIUM

Buffer Overflow (CWE-119)

2015-02-24 cve@mitre.org

RCE Buffer Overflow E2Fsprogs Debian Linux Ubuntu Linux

4.6

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

4.6 MEDIUM

AV:L/AC:L/Au:N/C:P/I:P/A:P

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:L/AC:L/Au:N/C:P/I:P/A:P

Attack Vector

Local

Attack Complexity

Low

Confidentiality

Integrity

Availability

Lifecycle Timeline

CVE Published

Feb 24, 2015 - 15:59 cve.org

MEDIUM 4.6

DescriptionCVE.org

Heap-based buffer overflow in closefs.c in the libext2fs library in e2fsprogs before 1.42.12 allows local users to execute arbitrary code by causing a crafted block group descriptor to be marked as dirty. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-0247.

AnalysisAI

Heap-based buffer overflow in closefs.c in the libext2fs library in e2fsprogs before 1.42.12 allows local users to execute arbitrary code by causing a crafted block group descriptor to be marked as. Rated medium severity (CVSS 4.6), this vulnerability is low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Buffer Overflow (CWE-119), which allows attackers to corrupt memory to execute arbitrary code or crash the application. Heap-based buffer overflow in closefs.c in the libext2fs library in e2fsprogs before 1.42.12 allows local users to execute arbitrary code by causing a crafted block group descriptor to be marked as dirty. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-0247. Affected products include: E2Fsprogs Project E2Fsprogs, Debian Debian Linux, Canonical Ubuntu Linux. Version information: before 1.42.12.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Use memory-safe languages or bounds-checking. Enable ASLR, DEP/NX, stack canaries. Use safe string functions.