CVE-2015-2285

Severity: high (CVSS 7.2 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2015-03-12 · updated 2026-06-17
Weakness: CWE-19

Description

The logrotation script (/etc/cron.daily/upstart) in the Ubuntu Upstart package before 1.13.2-0ubuntu9, as used in Ubuntu Vivid 15.04, allows local users to execute arbitrary commands and gain privileges via a crafted file in /run/user/*/upstart/sessions/.

Affected products

Ubuntu Upstart: through 1.13.2-0ubuntu7
Ubuntu Vivid: 15.04

References

http://packetstormsecurity.com/files/130587/Ubuntu-Vivid-Upstart-Privilege-Escalation.html
http://seclists.org/fulldisclosure/2015/Mar/7
http://www.halfdog.net/Security/2015/UpstartLogrotationPrivilegeEscalation/
https://bugs.launchpad.net/ubuntu/+source/upstart/+bug/1425685
http://packetstormsecurity.com/files/130587/Ubuntu-Vivid-Upstart-Privilege-Escalation.html
http://seclists.org/fulldisclosure/2015/Mar/7
http://www.halfdog.net/Security/2015/UpstartLogrotationPrivilegeEscalation/
https://bugs.launchpad.net/ubuntu/+source/upstart/+bug/1425685

Get alerted when CVE-2015-2285 or the next vulnerability affects your stack