CVE-2015-8277

CRITICAL

Flexera FlexNet Publisher <11.13.1.2 - Buffer Overflow

Title source: llm

Description

Multiple buffer overflows in (1) lmgrd and (2) Vendor Daemon in Flexera FlexNet Publisher before 11.13.1.2 Security Update 1 allow remote attackers to execute arbitrary code via a crafted packet with opcode (a) 0x107 or (b) 0x10a.

Exploits (1)

nomisec WORKING POC 3 stars

by securifera · poc

https://github.com/securifera/CVE-2015-8277-Exploit

View Code ZIP pw:eip

References (10)

[Various Sources] https://rockwellautomation.custhelp.com/app/answers/detail/a_id/1073133

[Various Sources] https://sw.aveva.com/hubfs/assets-2018/pdf/security-bulletin/SecurityBulletin_LFSec129.pdf

[Various Sources] https://www.securifera.com/advisories/cve-2015-8277

[Various Sources] http://securitymumblings.blogspot.com/2016/02/cve-2015-8277.html

[Vendor Advisory] http://support.citrix.com/article/CTX207824

[Third Party Advisory, US Government Resource] http://www.kb.cert.org/vuls/id/485744

[Third Party Advisory, VDB Entry] http://www.securitytracker.com/id/1035266

[Various Sources] https://ics-cert.us-cert.gov/advisories/ICSA-18-102-02

[Various Sources] https://ics-cert.us-cert.gov/advisories/ICSA-18-212-05

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/83334

Scores

CVSS v3 9.8

EPSS 0.8047

EPSS Percentile 99.1%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-119

Status published

Products (1)

flexerasoftware/flexnet_publisher < 11.13.1.0

Published Feb 24, 2016

Tracked Since Feb 18, 2026