CVE-2015-2285

Ubuntu Upstart <1.13.2-0ubuntu9 - Command Injection

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2015-2285. PoCs published by halfdog.

AI-analyzed exploit summary This exploit leverages an insecure upstart logrotation script in Ubuntu Vivid 15.04 that executes user-supplied data from /run/user/[uid]/upstart/sessions without sanitization, allowing arbitrary command execution with root privileges during the daily cron job.

Description

The logrotation script (/etc/cron.daily/upstart) in the Ubuntu Upstart package before 1.13.2-0ubuntu9, as used in Ubuntu Vivid 15.04, allows local users to execute arbitrary commands and gain privileges via a crafted file in /run/user/*/upstart/sessions/.

Exploits (1)

exploitdb WORKING POC
by halfdog · textlocallinux
https://www.exploit-db.com/exploits/41765

This exploit leverages an insecure upstart logrotation script in Ubuntu Vivid 15.04 that executes user-supplied data from /run/user/[uid]/upstart/sessions without sanitization, allowing arbitrary command execution with root privileges during the daily cron job.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Trivial
Reliability
Reliable
Target: Ubuntu Vivid 15.04 (upstart logrotation script)
Auth required
Prerequisites: User access to a system with Ubuntu Vivid 15.04 · libpam-systemd installed (creates user-writable /run/user/[uid] directory)
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (4)

Core 4

Scores

EPSS 0.0101
EPSS Percentile 58.7%

Details

CWE
CWE-19
Status published
Products (2)
ubuntu/upstart < 1.13.2-0ubuntu7
ubuntu/vivid 15.04
Published Mar 12, 2015
Tracked Since Feb 18, 2026