Local File Write Vulnerability in libvdpau: CVE-2015-5200
Summary
DEBIAN-CVE-2015-5200: The trace functionality in libvdpau before 1.1.1, when used in a setuid or setgid application, allows local users to write to arbitrary files via unspecified vectors. Affects libvdpau versions < 1.1.1-1. Fixed in 1.1.1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libvdpau is a library that provides an interface for video decoding and processing, allowing applications to offload video processing tasks to the GPU. It is commonly used in multimedia applications to enhance performance and reduce CPU load. However, versions prior to 1.1.1 are vulnerable to a local file write issue when used in setuid or setgid applications, which could be exploited by local users.
Vulnerability Detail
The trace functionality in libvdpau before version 1.1.1 allows local users to write to arbitrary files. This vulnerability arises from insufficient validation of user input in setuid or setgid applications, potentially leading to unauthorized file modifications. Attackers could exploit this flaw to overwrite sensitive files or execute malicious scripts, posing a significant security risk.
How To Fix
Minimum fixed version
1.1.1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libvdpauTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot update the package immediately, consider removing setuid or setgid permissions from applications that utilize libvdpau until the package can be updated. This can be done using the command: 'chmod u-s /path/to/application' or 'chmod g-s /path/to/application'.
Conclusion
The vulnerability CVE-2015-5200 in libvdpau poses a significant risk to systems using versions prior to 1.1.1, particularly in setuid or setgid applications. It is crucial to update to the patched version to safeguard against potential exploitation.
See every vulnerability recorded for libvdpau →
FAQ
CVE-2015-5200 is a vulnerability in libvdpau that allows local users to write to arbitrary files due to improper handling of the trace functionality in setuid or setgid applications.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Setuid and setgid are Unix access control mechanisms that allow users to run an executable with the permissions of the executable's owner or group, respectively. This can pose security risks if not managed properly.
If you cannot update libvdpau, consider removing setuid or setgid permissions from applications that use it as a temporary measure to mitigate the risk.
More information about libvdpau can be found in the official Debian package repositories and documentation.
References
Related vulnerabilities
Recent vulnerabilities recorded for libvdpau.
