What is the CVSS score of CVE-2015-5295?

CVE-2015-5295 has a CVSS 3.0 base score of 5.4 (Medium). CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L. EPSS exploitation probability: 1.6%.

Is there a patch available for CVE-2015-5295?

Yes, a patch is available for CVE-2015-5295. Update the affected software to the latest version immediately.

Orchestration Api CVE-2015-5295

MEDIUM

Buffer Overflow (CWE-119)

2016-01-20 secalert@redhat.com

Denial Of Service Buffer Overflow Orchestration Api Openstack Fedora Solaris

5.4

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

Low

Lifecycle Timeline

CVE Published

Jan 20, 2016 - 16:59 cve.org

MEDIUM 5.4

DescriptionCVE.org

The template-validate command in OpenStack Orchestration API (Heat) before 2015.1.3 (kilo) and 5.0.x before 5.0.1 (liberty) allows remote authenticated users to cause a denial of service (memory consumption) or determine the existence of local files via the resource type in a template, as demonstrated by file:///dev/zero.

AnalysisAI

The template-validate command in OpenStack Orchestration API (Heat) before 2015.1.3 (kilo) and 5.0.x before 5.0.1 (liberty) allows remote authenticated users to cause a denial of service (memory. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Buffer Overflow vulnerability could allow attackers to corrupt memory to execute arbitrary code or crash the application.

Technical ContextAI

This vulnerability is classified as Buffer Overflow (CWE-119), which allows attackers to corrupt memory to execute arbitrary code or crash the application. The template-validate command in OpenStack Orchestration API (Heat) before 2015.1.3 (kilo) and 5.0.x before 5.0.1 (liberty) allows remote authenticated users to cause a denial of service (memory consumption) or determine the existence of local files via the resource type in a template, as demonstrated by file:///dev/zero. Affected products include: Openstack Orchestration Api, Redhat Openstack, Fedoraproject Fedora, Oracle Solaris. Version information: before 2015.1.3.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Use memory-safe languages or bounds-checking. Enable ASLR, DEP/NX, stack canaries. Use safe string functions.