CVE-2017-15288
Summary
| CVE | CVE-2017-15288 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2017-11-15 16:29:00 UTC |
| Updated | 2023-11-07 02:39:00 UTC |
| Description | The compilation daemon in Scala before 2.10.7, 2.11.x before 2.11.12, and 2.12.x before 2.12.4 uses weak permissions for private files in /tmp/scala-devel/${USER:shared}/scalac-compile-server-port, which allows local users to write to arbitrary class files and consequently gain privileges. |
Risk And Classification
Problem Types: CWE-732
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Apache | Activemq | 5.15.9 | All | All | All |
| Application | Apache | Activemq | 5.15.9 | All | All | All |
| Application | Apache | Drill | 1.16.0 | All | All | All |
| Application | Apache | Drill | 1.16.0 | All | All | All |
| Application | Apache | Kafka | 2.7.0 | All | All | All |
| Application | Apache | Kafka | 2.7.0 | All | All | All |
| Application | Scala-lang | Scala | All | All | All | All |
| Application | Scala-lang | Scala | 2.11.0 | All | All | All |
| Application | Scala-lang | Scala | 2.11.0 | m1 | All | All |
| Application | Scala-lang | Scala | 2.11.0 | m2 | All | All |
| Application | Scala-lang | Scala | 2.11.0 | m3 | All | All |
| Application | Scala-lang | Scala | 2.11.0 | m4 | All | All |
| Application | Scala-lang | Scala | 2.11.0 | m5 | All | All |
| Application | Scala-lang | Scala | 2.11.0 | m6 | All | All |
| Application | Scala-lang | Scala | 2.11.0 | m7 | All | All |
| Application | Scala-lang | Scala | 2.11.0 | m8 | All | All |
| Application | Scala-lang | Scala | 2.11.0 | rc1 | All | All |
| Application | Scala-lang | Scala | 2.11.0 | rc2 | All | All |
| Application | Scala-lang | Scala | 2.11.0 | rc3 | All | All |
| Application | Scala-lang | Scala | 2.11.0 | rc4 | All | All |
| Application | Scala-lang | Scala | 2.11.1 | All | All | All |
| Application | Scala-lang | Scala | 2.11.10 | All | All | All |
| Application | Scala-lang | Scala | 2.11.11 | All | All | All |
| Application | Scala-lang | Scala | 2.11.2 | All | All | All |
| Application | Scala-lang | Scala | 2.11.3 | All | All | All |
| Application | Scala-lang | Scala | 2.11.4 | All | All | All |
| Application | Scala-lang | Scala | 2.11.5 | All | All | All |
| Application | Scala-lang | Scala | 2.11.6 | All | All | All |
| Application | Scala-lang | Scala | 2.11.7 | All | All | All |
| Application | Scala-lang | Scala | 2.11.8 | All | All | All |
| Application | Scala-lang | Scala | 2.11.9 | All | All | All |
| Application | Scala-lang | Scala | 2.12.0 | All | All | All |
| Application | Scala-lang | Scala | 2.12.0 | m1 | All | All |
| Application | Scala-lang | Scala | 2.12.0 | m2 | All | All |
| Application | Scala-lang | Scala | 2.12.0 | m3 | All | All |
| Application | Scala-lang | Scala | 2.12.0 | m4 | All | All |
| Application | Scala-lang | Scala | 2.12.0 | m5 | All | All |
| Application | Scala-lang | Scala | 2.12.0 | rc1 | All | All |
| Application | Scala-lang | Scala | 2.12.0 | rc2 | All | All |
| Application | Scala-lang | Scala | 2.12.1 | All | All | All |
| Application | Scala-lang | Scala | 2.12.2 | All | All | All |
| Application | Scala-lang | Scala | 2.12.3 | All | All | All |
| Application | Scala-lang | Scala | All | All | All | All |
| Application | Scala-lang | Scala | 2.11.0 | All | All | All |
| Application | Scala-lang | Scala | 2.11.0 | m1 | All | All |
| Application | Scala-lang | Scala | 2.11.0 | m2 | All | All |
| Application | Scala-lang | Scala | 2.11.0 | m3 | All | All |
| Application | Scala-lang | Scala | 2.11.0 | m4 | All | All |
| Application | Scala-lang | Scala | 2.11.0 | m5 | All | All |
| Application | Scala-lang | Scala | 2.11.0 | m6 | All | All |
| Application | Scala-lang | Scala | 2.11.0 | m7 | All | All |
| Application | Scala-lang | Scala | 2.11.0 | m8 | All | All |
| Application | Scala-lang | Scala | 2.11.0 | rc1 | All | All |
| Application | Scala-lang | Scala | 2.11.0 | rc2 | All | All |
| Application | Scala-lang | Scala | 2.11.0 | rc3 | All | All |
| Application | Scala-lang | Scala | 2.11.0 | rc4 | All | All |
| Application | Scala-lang | Scala | 2.11.1 | All | All | All |
| Application | Scala-lang | Scala | 2.11.10 | All | All | All |
| Application | Scala-lang | Scala | 2.11.11 | All | All | All |
| Application | Scala-lang | Scala | 2.11.2 | All | All | All |
| Application | Scala-lang | Scala | 2.11.3 | All | All | All |
| Application | Scala-lang | Scala | 2.11.4 | All | All | All |
| Application | Scala-lang | Scala | 2.11.5 | All | All | All |
| Application | Scala-lang | Scala | 2.11.6 | All | All | All |
| Application | Scala-lang | Scala | 2.11.7 | All | All | All |
| Application | Scala-lang | Scala | 2.11.8 | All | All | All |
| Application | Scala-lang | Scala | 2.11.9 | All | All | All |
| Application | Scala-lang | Scala | 2.12.0 | All | All | All |
| Application | Scala-lang | Scala | 2.12.0 | m1 | All | All |
| Application | Scala-lang | Scala | 2.12.0 | m2 | All | All |
| Application | Scala-lang | Scala | 2.12.0 | m3 | All | All |
| Application | Scala-lang | Scala | 2.12.0 | m4 | All | All |
| Application | Scala-lang | Scala | 2.12.0 | m5 | All | All |
| Application | Scala-lang | Scala | 2.12.0 | rc1 | All | All |
| Application | Scala-lang | Scala | 2.12.0 | rc2 | All | All |
| Application | Scala-lang | Scala | 2.12.1 | All | All | All |
| Application | Scala-lang | Scala | 2.12.2 | All | All | All |
| Application | Scala-lang | Scala | 2.12.3 | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Pony Mail! | lists.apache.org | ||
| Pony Mail! | lists.apache.org | ||
| Pony Mail! | MLIST | lists.apache.org | Mailing List, Third Party Advisory |
| Pony Mail! | lists.apache.org | ||
| Pony Mail! | lists.apache.org | ||
| Pony Mail! | lists.apache.org | ||
| Pony Mail! | lists.apache.org | ||
| Pony Mail! | lists.apache.org | ||
| Move compilation daemon portfile under `~/.scalac/` by adriaanm · Pull Request #6120 · scala/scala · GitHub | CONFIRM | github.com | Issue Tracking, Patch, Third Party Advisory |
| Pony Mail! | MLIST | lists.apache.org | Mailing List, Third Party Advisory |
| Pony Mail! | MLIST | lists.apache.org | Mailing List, Third Party Advisory |
| Security update: 2.12.4, 2.11.12, 2.10.7 (CVE-2017-15288) | The Scala Programming Language | CONFIRM | scala-lang.org | Issue Tracking, Mitigation, Vendor Advisory |
| Pony Mail! | MLIST | lists.apache.org | Mailing List, Third Party Advisory |
| Pony Mail! | MLIST | lists.apache.org | Mailing List, Third Party Advisory |
| Pony Mail! | MLIST | lists.apache.org | Mailing List, Third Party Advisory |
| Pony Mail! | lists.apache.org | ||
| Pony Mail! | lists.apache.org | ||
| Scala: Privilege escalation (GLSA 201812-08) — Gentoo security | GENTOO | security.gentoo.org | Third Party Advisory |
| Pony Mail! | MLIST | lists.apache.org | Mailing List, Third Party Advisory |
| Move compilation daemon portfile to homedir by adriaanm · Pull Request #6108 · scala/scala · GitHub | CONFIRM | github.com | Issue Tracking, Patch, Third Party Advisory |
| Pony Mail! | lists.apache.org | ||
| Pony Mail! | lists.apache.org | ||
| Pony Mail! | MLIST | lists.apache.org | Mailing List, Third Party Advisory |
| Backports for 2.10.7 by adriaanm · Pull Request #6128 · scala/scala · GitHub | CONFIRM | github.com | Issue Tracking, Patch, Third Party Advisory |
| Pony Mail! | MLIST | lists.apache.org | Mailing List, Third Party Advisory |
| Pony Mail! | MLIST | lists.apache.org | Mailing List, Third Party Advisory |
| Pony Mail! | MLIST | lists.apache.org | Mailing List, Third Party Advisory |
| Pony Mail! | MLIST | lists.apache.org | Mailing List, Third Party Advisory |
| Pony Mail! | lists.apache.org | ||
| Pony Mail! | MLIST | lists.apache.org | Mailing List, Third Party Advisory |
| Pony Mail! | MLIST | lists.apache.org | Mailing List, Third Party Advisory |
| Pony Mail! | lists.apache.org | ||
| Pony Mail! | lists.apache.org | ||
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.