Local File Write Vulnerability in libvdpau: CVE-2015-5200
Summary
CVE-2015-5200: The trace functionality in libvdpau before 1.1.1, when used in a setuid or setgid application, allows local users to write to arbitrary files via unspecified vectors. Affects libvdpau versions < 1.1.1-1. Fixed in 1.1.1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libvdpau is a library that provides an interface for video decoding and rendering using the Video Decode and Presentation API for Unix (VDPAU). It is commonly used in multimedia applications to offload video processing tasks to the GPU, enhancing performance and efficiency. However, prior to version 1.1.1, libvdpau was found to have a vulnerability that could be exploited in setuid or setgid applications, allowing local users to write to arbitrary files.
Vulnerability Detail
The vulnerability, identified as CVE-2015-5200, arises from the trace functionality in libvdpau versions before 1.1.1. When this functionality is used in applications with elevated privileges (setuid or setgid), it allows local users to manipulate the system in a way that they can write to arbitrary files. This could lead to unauthorized data modification or system compromise, making it critical for users of affected versions to address this issue promptly.
How To Fix
Minimum fixed version
1.1.1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libvdpauTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, consider removing setuid or setgid permissions from applications that utilize libvdpau until the library can be updated. This can be done using the following command:
chmod u-s /path/to/application
chmod g-s /path/to/application
Conclusion
CVE-2015-5200 presents a significant risk for users of libvdpau prior to version 1.1.1, particularly in applications with elevated privileges. It is crucial to upgrade to the latest version to mitigate this vulnerability and protect your system from potential exploitation.
See every vulnerability recorded for libvdpau →
FAQ
CVE-2015-5200 is a vulnerability in libvdpau that allows local users to write to arbitrary files when the library is used in setuid or setgid applications.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by CVE-2015-5200 without requiring any signup.
Setuid and setgid are Unix/Linux permissions that allow users to run an executable with the permissions of the executable's owner or group, respectively, which can pose security risks if not managed properly.
As a temporary measure, you can remove the setuid or setgid permissions from applications that use libvdpau until you can perform the upgrade.
Yes, if exploited, this vulnerability could allow unauthorized users to modify or overwrite files, potentially leading to data loss or corruption.
Related vulnerabilities
Recent vulnerabilities recorded for libvdpau.
