Vulnerability Details : CVE-2015-2152
Xen 4.5.x and earlier enables certain default backends when emulating a VGA device for an x86 HVM guest qemu even when the configuration disables them, which allows local guest users to obtain access to the VGA console by (1) setting the DISPLAY environment variable, when compiled with SDL support, or connecting to the VNC server on (2) ::1 or (3) 127.0.0.1, when not compiled with SDL support.
Products affected by CVE-2015-2152
- cpe:2.3:o:xen:xen:*:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:20:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:21:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2015-2152
0.08%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 23 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2015-2152
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
1.9
|
LOW | AV:L/AC:M/Au:N/C:N/I:P/A:N |
3.4
|
2.9
|
NIST |
CWE ids for CVE-2015-2152
-
Assigned by: nvd@nist.gov (Primary)
References for CVE-2015-2152
-
http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152776.html
[SECURITY] Fedora 21 Update: xen-4.4.1-16.fc21Third Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00014.html
[security-announce] openSUSE-SU-2015:0732-1: important: Security update
-
https://security.gentoo.org/glsa/201504-04
Xen: Multiple vulnerabilities (GLSA 201504-04) — Gentoo security
-
http://www.securitytracker.com/id/1031919
Xen HVM qemu Flaw Lets Local Users Access VGA Backend on the Target Guest System - SecurityTrackerThird Party Advisory;VDB Entry
-
http://xenbits.xen.org/xsa/advisory-119.html
XSA-119 - Xen Security AdvisoriesPatch;Vendor Advisory
-
http://www.securitytracker.com/id/1031806
Xen Multiple Flaws Let Local Guest Users Deny Service or Obtain Information From Other Guest Systems - SecurityTrackerThird Party Advisory;VDB Entry
-
http://www.securityfocus.com/bid/73068
Xen CVE-2015-2152 Information Disclosure Vulnerability
-
http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152483.html
[SECURITY] Fedora 22 Update: xen-4.5.0-6.fc22Third Party Advisory
-
http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152588.html
[SECURITY] Fedora 20 Update: xen-4.3.3-12.fc20Third Party Advisory
Jump to