Description
The compilation daemon in Scala before 2.10.7, 2.11.x before 2.11.12, and 2.12.x before 2.12.4 uses weak permissions for private files in /tmp/scala-devel/${USER:shared}/scalac-compile-server-port, which allows local users to write to arbitrary class files and consequently gain privileges.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9Attack Vector: Local
Complexity: Low
Privileges: Low
User Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High
Affected Packages3 packages
🔴Vulnerability Details
3GHSAHigh severity vulnerability that affects org.scala-lang:scala-compiler↗2018-10-19 OSVHigh severity vulnerability that affects org.scala-lang:scala-compiler↗2018-10-19 OSVCVE-2017-15288: The compilation daemon in Scala before 2↗2017-11-15 📋Vendor Advisories
2Red Hatscala: Privilege escalation in Scala compilation daemon↗2017-11-13 DebianCVE-2017-15288: scala - The compilation daemon in Scala before 2.10.7, 2.11.x before 2.11.12, and 2.12.x...↗2017 💬Community
2BugzillaCVE-2017-15288 scala: Privilege escalation in Scala compilation daemon↗2017-11-23 BugzillaCVE-2017-15288 scala: Privilege escalation in Scala compilation daemon [fedora-all]↗2017-11-23