High severity · published Nov 15, 2017
CVE-2017-15288
The compilation daemon in Scala before 2.10.7, 2.11.x before 2.11.12, and 2.12.x before 2.12.4 uses weak permissions for private files in…
7.8
CVSS
0.3%
EPSS
No
On KEV
Description
The compilation daemon in Scala before 2.10.7, 2.11.x before 2.11.12, and 2.12.x before 2.12.4 uses weak permissions for private files in /tmp/scala-devel/${USER:shared}/scalac-compile-server-port, which allows local users to write to arbitrary class files and consequently gain privileges.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SC
Scala · Scala-lang
before 2.10.7; 2.11.0 before 2.11.12; 2.12.0 before 2.12.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-15288
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-15288
Issue Tracking
http://scala-lang.org/news/security-update-nov17.html
Issue Tracking
https://github.com/scala/scala/pull/6108
Issue Tracking
https://github.com/scala/scala/pull/6120
Issue Tracking
https://github.com/scala/scala/pull/6128
lists.apache.org
https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272%40%3Cissues.activemq.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E
More from Scala
9.8
CVE-2022-36944
Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file