PT-2015-6126 · Xen+1 · Xen+1

Donghai Zhu · Published 2015-07-16 · Updated 2024-06-15 · CVE-2015-3259

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:L/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Xen versions 4.1.x through 4.5.x

Description A stack-based buffer overflow issue exists in the xl command line utility. This allows local guest administrators to potentially gain privileges by providing a long configuration argument.

Recommendations For Xen versions 4.1.x through 4.5.x, consider restricting access to the xl command line utility until a patch is available. As a temporary workaround, avoid using long configuration arguments with the xl utility to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2015-3259

DSA-3414-1

MGASA-2016-0098

OPENSUSE-SU-2015_2003-1

OPENSUSE-SU-2024:10196-1

SUSE-SU-2015:1299-1

SUSE-SU-2015:1302-1

SUSE-SU-2015:1479-1

SUSE-SU-2015:1479-2

SUSE-SU-2015:2324-1

SUSE-SU-2015_1299-1

SUSE-SU-2015_1302-1

SUSE-SU-2015_2324-1

Affected Products

Suse

Xen

References · 291

• https://osv.dev/vulnerability/openSUSE-SU-2024:10196-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7971 · Security Note
• https://advisories.mageia.org/MGASA-2016-0098.html · Security Note
• https://security-tracker.debian.org/tracker/DSA-3414-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00042.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-10460 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7969 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2015:2324-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5307 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00041.html · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2015:1479-2 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7311 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7813 · Security Note
• https://ubuntu.com/security/CVE-2015-3259 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-11314 · Security Note