NVD

Id
28422  
Name
CVE-2015-8080  
Description
Integer overflow in the getnum function in lua_struct.c in Redis 2.8.x before 2.8.24 and 3.0.x before 3.0.6 allows context-dependent attackers with permission to run Lua code in a Redis session to cause a denial of service (memory corruption and application crash) or possibly bypass intended sandbox restrictions via a large number, which triggers a stack-based buffer overflow.  
Reject
 
CVSS Version
2  
CVSS Score
5  
Severity
Medium  
CVSS Base Score
5  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:N/I:N/A:P)  
Pub Date
2017-01-19  
Published
2016-04-13  
Modified Date
2016-11-30  
Seq
2015-8080  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
149443 28422 CVE-2015-8080 openSUSE-SU-2016:1444  View
149444 28422 CVE-2015-8080 RHSA-2016:0095  View
149445 28422 CVE-2015-8080 RHSA-2016:0096  View
149446 28422 CVE-2015-8080 RHSA-2016:0097  View
149447 28422 CVE-2015-8080 DSA-3412  View
149448 28422 CVE-2015-8080 [oss-security] 20151106 Review+CVE request: multiple issues in redis EVAL command (lua sandbox)  View
149449 28422 CVE-2015-8080 [oss-security] 20151106 Re: Review+CVE request: multiple issues in redis EVAL command (lua sandbox)  View
149450 28422 CVE-2015-8080 77507  View
149451 28422 CVE-2015-8080 https://github.com/antirez/redis/issues/2855  View
149452 28422 CVE-2015-8080 https://raw.githubusercontent.com/antirez/redis/2.8/00-RELEASENOTES  View
149453 28422 CVE-2015-8080 https://raw.githubusercontent.com/antirez/redis/3.0/00-RELEASENOTES  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
11748 JVNDB-2015-007068 Redis の lua_struct.c の getnum 関数における整数オーバーフローの脆弱性 Redis の lua_struct.c の getnum 関数には、整数オーバーフローの脆弱性が存在します。 CVE-2015-8080 85305 CVE-2015-8080 28422 5 7.5 http://jvndb.jvn.jp/ja/contents/2015/JVNDB-2015-007068.html 2015-12-18 2016-04-21 View