Information disclosure in Piriform Ccleaner

CVE-2015-3999

Piriform CCleaner 3.26.0.1988 through 5.02.5101 writes the filenames to disk when overwriting files, which allows local users to obtain sensitive information by searching unallocated disk space.

Vulnerability class: Information Disclosure

EPSS: 0.005 (41.4th percentile) — read the EPSS interpretation.

Affected products

Piriform Ccleaner — versions 3.26.1888, 3.27.1900, 3.28.1913
N/a — versions n/a

Weakness classification (CWE)

CWE-200 — Information Disclosure

References

cve@mitre.org (mailing-list, x_refsource_FULLDISC)
cve@mitre.org (vdb-entry, x_refsource_BID)