This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2016-7035 →

DEBIAN-CVE-2016-7035

An authorization flaw was found in Pacemaker before 1.1.16, where it did not properly guard its IPC interface. An attacker with an unprivileged accoun...

Original description

The description as published by the source.

An authorization flaw was found in Pacemaker before 1.1.16, where it did not properly guard its IPC interface. An attacker with an unprivileged account on a Pacemaker node could use this flaw to, for example, force the Local Resource Manager daemon to execute a script as root and thereby gain root access on the machine.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 pacemaker

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.15-3"}]}]

Debian:13 pacemaker

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.15-3"}]}]

Debian:14 pacemaker

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.15-3"}]}]

References

advisory security-tracker.debian.org