CVE-2016-15045
Published: 23 July 2025
Summary
CVE-2016-15045 is a high-severity Improper Privilege Management (CWE-269) vulnerability. Its CVSS base score is 8.5 (High).
Operationally, ranked in the top 13.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2016-10789
Vulnerability details
A local privilege escalation vulnerability exists in lastore-daemon, the system package manager daemon used in Deepin Linux (developed by Wuhan Deepin Technology Co., Ltd.). In versions 0.9.53-1 (Deepin 15.5) and 0.9.66-1 (Deepin 15.7), the D-Bus configuration permits any user in…
more
the sudo group to invoke the InstallPackage method without password authentication. By default, the first user created on Deepin is in the sudo group. An attacker with shell access can craft a .deb package containing a malicious post-install script and use dbus-send to install it via lastore-daemon, resulting in arbitrary code execution as root.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Guarantees critical functions are protected by mandatory invocation of the access control mechanism.
Certification assesses that critical functions have required authentication controls in place.
Baseline tailoring enforces organization-specific privilege-management decisions rather than accepting generic high-water-mark settings.
Documented procedures for role definition, privilege assignment, and removal provide the management framework that prevents improper privilege management.
By determining which components are critical, the analysis drives proper privilege assignment and management for those components, limiting attacker escalation paths.
Developer training on implemented privilege management controls prevents improper assignment or escalation through correct configuration and operation.
Least-privilege and separation-of-duties principles prevent improper privilege management.
Usage restrictions and implementation guidelines limit how privileges may be exercised with the specified components.