CVE-2015-4035

Name: CVE-2015-4035
Creator: NVD / NIST
Published: 2017-07-25T18:29:00.557+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 0.99%

Last modified Jun 17, 2026

CVE-2015-4035 is a vulnerability of currently unknown severity. scripts/xzgrep.in in xzgrep 5.2.x before 5.2.0, before 5.0.0 does not properly process file names containing semicolons, which allows remote attackers to execute arbitrary code by having a user run xzgrep on a crafted file name.. EPSS estimates a 0.99% chance of exploitation in the next 30 days.

Description

scripts/xzgrep.in in xzgrep 5.2.x before 5.2.0, before 5.0.0 does not properly process file names containing semicolons, which allows remote attackers to execute arbitrary code by having a user run xzgrep on a crafted file name.

Metrics

EPSS Probability

0.99%

58.0th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-20

Affected Software

Vendor	Product	Versions	Update
Tukaani	Xz	<= 4.999.9	Beta

References

http://seclists.org/oss-sec/2015/q2/484Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2015/05/19/13Mailing List, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1223341Issue Tracking, Vendor Advisory
https://git.tukaani.org/?p=xz.git%3Ba=commitdiff%3Bh=f4b2b52624b802c786e4e2a8eb6895794dd93b24
http://seclists.org/oss-sec/2015/q2/484Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2015/05/19/13Mailing List, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1223341Issue Tracking, Vendor Advisory
https://git.tukaani.org/?p=xz.git%3Ba=commitdiff%3Bh=f4b2b52624b802c786e4e2a8eb6895794dd93b24

Timeline

Published: Jul 25, 2017
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2015-4035?

How severe is CVE-2015-4035?

Severity scoring for CVE-2015-4035 is pending analysis. The EPSS model estimates a 0.99% probability of exploitation in the next 30 days.

How do I fix CVE-2015-4035?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2015-4035?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST