PatchSiren

PatchSiren cyber security CVE debrief

CVE-2015-8768 Canonical CVE debrief

CVE-2015-8768 is a critical package-installation validation flaw in click/install.py. By accepting filesystem tarball entries that do not start with './', the installer could be tricked into processing crafted package contents that install an alternate security policy and elevate privileges. NVD lists click_project:click and Ubuntu 14.04/15.04 as vulnerable, and the issue is tied to Ubuntu phone security advisories and patch tracking in the supplied references.

Vendor
Canonical
Product
Unknown
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-13
Original CVE updated
2026-05-13
Advisory published
2017-02-13
Advisory updated
2026-05-13

Who should care

Administrators and maintainers who install or distribute click packages, especially on Ubuntu phone / Ubuntu Touch deployments and any legacy Ubuntu environments listed by NVD. Security teams responsible for package ingestion, mobile device management, or downstream packaging of click should treat this as high priority.

Technical summary

The vulnerable code path in click/install.py did not enforce that files inside package filesystem tarballs begin with './'. That path-validation gap weakened the expected packaging layout checks and allowed a crafted click package to carry content that could install an alternate security policy and gain privileges. The NVD record maps the issue to the click project and affected Ubuntu releases, while the linked bug, merge request, and advisory references document the remediation trail.

Defensive priority

Critical. Prioritize immediate review and patching anywhere click packages are accepted or installed from untrusted or external sources.

Recommended defensive actions

  • Check whether click is installed or used to process packages in your environment.
  • Apply the vendor or downstream fix referenced by Ubuntu USN 2771-1 or the related click revision if you maintain affected packages.
  • Restrict installation of click packages to trusted, validated sources until the fix is confirmed.
  • Review Ubuntu phone / Ubuntu 14.04 / Ubuntu 15.04 deployments and plan remediation or retirement for unsupported systems.
  • Verify that downstream tooling continues to enforce the required './' prefix rule for filesystem tarball entries.

Evidence notes

The official NVD record identifies the vulnerable component, severity, CVSS vector, and affected CPEs. The supplied references include the Launchpad bug and merge request for the fix, an oss-security patch discussion, and the Ubuntu security notice that points to remediation. The disclosure timeline in the corpus also shows an Ubuntu phone security update in 2015-10, well before the CVE record publication date.

Sources and references

Verified primary and authoritative sources

  • CVE-2015-8768 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2015-8768

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2015-8768 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2015-8768

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.