PT-2015-6126 · Xen+1 · Xen+1

Donghai Zhu · Publicado 2015-07-16 · Atualizado 2024-06-15 · CVE-2015-3259

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:L/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Xen versions 4.1.x through 4.5.x

Description A stack-based buffer overflow issue exists in the xl command line utility. This allows local guest administrators to potentially gain privileges by providing a long configuration argument.

Recommendations For Xen versions 4.1.x through 4.5.x, consider restricting access to the xl command line utility until a patch is available. As a temporary workaround, avoid using long configuration arguments with the xl utility to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2015-3259

DSA-3414-1

MGASA-2016-0098

OPENSUSE-SU-2015_2003-1

OPENSUSE-SU-2024:10196-1

SUSE-SU-2015:1299-1

SUSE-SU-2015:1302-1

SUSE-SU-2015:1479-1

SUSE-SU-2015:1479-2

SUSE-SU-2015:2324-1

SUSE-SU-2015_1299-1

SUSE-SU-2015_1302-1

SUSE-SU-2015_2324-1

Produtos afetados

Suse

Xen

Referências · 291

• https://osv.dev/vulnerability/openSUSE-SU-2024:10196-1 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2015-5165 · Nota
• https://suse.com/security/cve/CVE-2015-8340.html · Nota
• https://suse.com/support/update/announcement/2015/suse-su-20151299-1 · Nota
• https://lists.opensuse.org/archives/list/[e-mail]/thread/BQNNLOO42C2AJVHL72XWPCAH7YOGFT6Y · Nota
• http://xenbits.xen.org/xsa/advisory-164.html · Nota
• https://suse.com/security/cve/CVE-2016-2538 · Nota
• https://suse.com/security/cve/CVE-2015-8615 · Nota
• http://xenbits.xen.org/xsa/advisory-120.html · Nota
• https://bugzilla.suse.com/935634 · Nota
• https://suse.com/security/cve/CVE-2015-7971.html · Nota
• https://suse.com/security/cve/CVE-2016-1981 · Nota
• https://suse.com/security/cve/CVE-2015-6815.html · Nota
• https://bugzilla.suse.com/939709 · Nota
• http://xenbits.xen.org/xsa/advisory-124.html · Nota