PatchTheCVECVE-2015-8277: Multiple buffer overflows in (1) lmgrd and (2) Vendor Daemon in Flexera FlexNet Publisher before 11.13.1.2 Sec
CVE-2015-8277 is a critical-severity flaw (CVSS 9.8) affecting flexnet publisher. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Multiple buffer overflows in (1) lmgrd and (2) Vendor Daemon in Flexera FlexNet Publisher before 11.13.1.2 Security Update 1 allow remote attackers to execute arbitrary code via a crafted packet with opcode (a) 0x107 or (b) 0x10a.
Why this priority
- Critical severity
- EPSS top 2%: very likely to be exploited
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 9.8 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 28.7% (top 2%) |
| CISA exploited list | No |
| Weakness | CWE-119 |
| Published | 2016-02-24 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2015-8277?
flexnet publisher: upgrade to newer than 11.13.1.0. Exact commands for each OS are on this page.
Is CVE-2015-8277 being exploited?
CVE-2015-8277 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2015-8277 affect?
CVE-2015-8277 affects flexnet publisher. Severity is critical (CVSS 9.8). Multiple buffer overflows in (1) lmgrd and (2) Vendor Daemon in Flexera FlexNet Publisher before 11.13.1.2 Security Update 1 allow remote attackers to execute arbitrary code via a crafted packet with opcode (a) 0x107 or (b) 0x10a.
How urgent is CVE-2015-8277?
Priority 64/100. Critical severity; EPSS top 2%: very likely to be exploited; Remotely exploitable, no login, no user action
Related CVEs
- CVE-2020-12081 HIGH 7.5 DOWNGRADE An information disclosure vulnerability has been identified in FlexNet Publisher lmadmin.exe 11.14.0.2
- CVE-2020-12080 HIGH 7.5 DOWNGRADE A Denial of Service vulnerability has been identified in FlexNet Publisher's lmadmin.exe version 11.16.6
- CVE-2019-8963 HIGH 7.5 DOWNGRADE A Denial of Service (DoS) vulnerability was discovered in FlexNet Publisher's lmadmin 11.16.5, when doing a cr
- CVE-2019-8961 HIGH 7.5 DOWNGRADE A Denial of Service vulnerability related to stack exhaustion has been identified in FlexNet Publisher lmadmin
- CVE-2019-8960 HIGH 7.5 DOWNGRADE A Denial of Service vulnerability related to command handling has been identified in FlexNet Publisher lmadmin