Unscored CVE-2015-8378 EUVD-2015-8261GHSA-h845-ghqm-6gv2

In KeePassX before 0.4.4, a cleartext copy of password data is created upon a cancel of an XML export action. This allows context-dependent…

Published Apr 10, 2017 · Updated Aug 6, 2024 · Assigned by mitre

Package: keepassx Package: keepassx Ecosystem: Debian Ecosystem: Ubuntu

Description

In KeePassX before 0.4.4, a cleartext copy of password data is created upon a cancel of an XML export action. This allows context-dependent attackers to obtain sensitive information by reading the .xml dotfile.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 13	keepassx	0.4.3+dfsg-1	—
Debian 12	keepassx	0.4.3+dfsg-1	—

Ubuntu