CVE-2015-6566
high
CVSS v3
8.4
CVSS v2
7.2
VIR risk
8.4
Description
zarafa-autorespond in Zarafa Collaboration Platform (ZCP) before 7.2.1 allows local users to gain privileges via a symlink attack on /tmp/zarafa-vacation-*.
Predictions
Exploit likelihood
80%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: cve@mitre.org — https://download.zarafa.com/community/final/7.2/final-changelog-7.2.txt
OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| fedora | 21 | affected | |
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| zarafa | zarafa_collaboration_platform | {"endIncluding":"7.2.0"} | |
References
- http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172605.html
- https://download.zarafa.com/community/final/7.2/final-changelog-7.2.txt
- https://jira.zarafa.com/browse/ZCP-13533
- https://jira.zarafa.com/browse/ZCP-13572
- http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172605.html
- https://download.zarafa.com/community/final/7.2/final-changelog-7.2.txt
- https://jira.zarafa.com/browse/ZCP-13533
- https://jira.zarafa.com/browse/ZCP-13572
CWEs
CWE-59
Verify integrity in audit chain (admin only). AS-IS.