CVE-2015-3643

HIGH 7.8CVE-2015-3643 · Published 28/09/2017 · updated 17/06/2026

In short

CVE-2015-3643 is a HIGH (CVSS 7.8) vulnerability affecting usb-creator (usb-creator project).
Chance of exploitation in the next 30 days (EPSS): 1.5%, higher than 74.9% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
usb-creator usb-creator_project	`≤ 0.2.38.3≤ 0.2.56.3≤ 0.2.62ubuntu0.2≤ 0.2.67`	No fix yet

Description

usb-creator before 0.2.38.3ubuntu0.1 on Ubuntu 12.04 LTS, before 0.2.56.3ubuntu0.1 on Ubuntu 14.04 LTS, before 0.2.62ubuntu0.3 on Ubuntu 14.10, and before 0.2.67ubuntu0.1 on Ubuntu 15.04 allows local users to gain privileges by leveraging a missing call check_polkit for the KVMTest method.

References

openwall.com/lists/oss-security/2015/04/22/12 · Mailing List
openwall.com/lists/oss-security/2015/05/04/3 · Mailing List
securityfocus.com/bid/74304 · Third Party Advisory
bazaar.launchpad.net/~usb-creator-hackers/usb-creator/trunk/revision/470 · Third Party Advisory
usn.ubuntu.com/usn/usn-2576-1 · Third Party Advisory
usn.ubuntu.com/usn/usn-2576-2 · Third Party Advisory
exploit-db.com/exploits/36820 · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free