CVE-2015-7236: Canonical Ubuntu Linux

High severity, CVSS 7.5. EPSS: 6.4% chance of exploitation in the next 30 days.

Use-after-free vulnerability in xprt_set_caller in rpcb_svc_com.c in rpcbind 0.2.1 and earlier allows remote attackers to cause a denial of service (daemon crash) via crafted packets, involving a PMAP_CALLIT code.

Affected products

• Canonical Ubuntu Linux: version 12.04 only; version 14.04 only; version 15.04 only
• Debian Debian Linux: version 7.0 only
• Oracle Solaris: version 10 only; version 11.3 only
• Rpcbind Project Rpcbind: up to and including 0.2.1

Published 2015-10-01. Last modified 2026-06-17.