CVE-2015-2675

HIGH

librest - Denial of Service via OAuth Pointer Truncation

Title source: llm
STIX 2.1

Description

The OAuth implementation in librest before 0.7.93 incorrectly truncates the pointer returned by the rest_proxy_call_get_url function, which allows remote attackers to cause a denial of service (application crash) via running the EnsureCredentials method from the org.gnome.OnlineAccounts.Account interface on an object representing a Flickr account.

References (6)

Core 6
Core References
Issue Tracking, Third Party Advisory, VDB Entry x_refsource_confirm
https://bugzilla.gnome.org/show_bug.cgi?id=742644
Issue Tracking, Patch, Third Party Advisory, VDB Entry x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=1199049
Third Party Advisory, VDB Entry vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2015-2237.html
Issue Tracking, Third Party Advisory, VDB Entry x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=1183982
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2015/03/23/8

Scores

CVSS v3 7.5
EPSS 0.0305
EPSS Percentile 86.9%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Details

CWE
CWE-119
Status published
Products (1)
gnome/librest 0.7.92
Published Aug 18, 2017
Tracked Since Feb 18, 2026