Vulnerability Details : CVE-2015-3209
Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary code by sending a packet with TXSTATUS_STARTPACKET set and then a crafted packet with TXSTATUS_DEVICEOWNS set.
Vulnerability category: OverflowMemory CorruptionExecute code
Products affected by CVE-2015-3209
- cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_eus:6.6:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_aus:6.6:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:openstack:5.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_tus:6.6:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:virtualization:3.0:*:*:*:*:*:*:*
- cpe:2.3:o:suse:linux_enterprise_desktop:11:sp3:*:*:*:*:*:*
- cpe:2.3:o:suse:linux_enterprise_desktop:12:-:*:*:*:*:*:*
- cpe:2.3:o:suse:linux_enterprise_server:10:sp4:*:*:ltss:*:*:*
- cpe:2.3:o:suse:linux_enterprise_server:11:sp1:*:*:ltss:*:*:*
- cpe:2.3:o:suse:linux_enterprise_server:11:sp2:*:*:ltss:*:*:*
- cpe:2.3:o:suse:linux_enterprise_server:11:sp3:*:*:*:-:*:*
- cpe:2.3:o:suse:linux_enterprise_server:12:-:*:*:*:*:*:*
- cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp3:*:*:*:*:*:*
- cpe:2.3:o:suse:linux_enterprise_software_development_kit:12:-:*:*:*:*:*:*
- cpe:2.3:a:suse:linux_enterprise_debuginfo:11:sp2:*:*:*:*:*:*
- cpe:2.3:a:juniper:junos_space:*:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:15.04:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:14.10:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:20:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:21:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:*
- cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:*
- cpe:2.3:o:arista:eos:4.15:*:*:*:*:*:*:*
- cpe:2.3:o:arista:eos:4.12:*:*:*:*:*:*:*
- cpe:2.3:o:arista:eos:4.13:*:*:*:*:*:*:*
- cpe:2.3:o:arista:eos:4.14:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2015-3209
21.50%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 95 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2015-3209
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.5
|
HIGH | AV:N/AC:L/Au:N/C:P/I:P/A:P |
10.0
|
6.4
|
NIST |
CWE ids for CVE-2015-3209
-
The product writes data past the end, or before the beginning, of the intended buffer.Assigned by: nvd@nist.gov (Primary)
References for CVE-2015-3209
-
http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00027.html
[security-announce] SUSE-SU-2015:1643-1: important: Security update forMailing List;Third Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00029.html
[security-announce] SUSE-SU-2015:1156-1: important: Security update forMailing List;Third Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00020.html
[security-announce] SUSE-SU-2015:1426-1: important: Security update forMailing List;Third Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00004.html
[security-announce] SUSE-SU-2015:1042-1: important: Security update forMailing List;Third Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00027.html
[security-announce] SUSE-SU-2015:1152-1: important: Security update forMailing List;Third Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00015.html
[security-announce] SUSE-SU-2015:1519-1: important: Security update forMailing List;Third Party Advisory
-
https://www.arista.com/en/support/advisories-notices/security-advisories/1180-security-advisory-13
Security Advisory 0013 - AristaThird Party Advisory
-
http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160677.html
[SECURITY] Fedora 21 Update: xen-4.4.2-6.fc21Third Party Advisory
-
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10698
Juniper Networks - 2015-10 Security Bulletin: Junos Space: Multiple Vulnerabilities in Junos SpaceThird Party Advisory
-
http://rhn.redhat.com/errata/RHSA-2015-1189.html
RHSA-2015:1189 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160685.html
[SECURITY] Fedora 20 Update: xen-4.3.4-6.fc20Third Party Advisory
-
http://www.debian.org/security/2015/dsa-3284
Debian -- Security Information -- DSA-3284-1 qemuThird Party Advisory
-
http://www.ubuntu.com/usn/USN-2630-1
USN-2630-1: QEMU vulnerabilities | Ubuntu security noticesThird Party Advisory
-
http://www.debian.org/security/2015/dsa-3285
Debian -- Security Information -- DSA-3285-1 qemu-kvmThird Party Advisory
-
http://www.securityfocus.com/bid/75123
QEMU AMD PCnet Ethernet Emulation Heap Based Buffer Overflow VulnerabilityThird Party Advisory;VDB Entry
-
http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00007.html
[security-announce] SUSE-SU-2015:1045-1: important: Security update forMailing List;Third Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00030.html
[security-announce] SUSE-SU-2015:1157-1: important: Security update forMailing List;Third Party Advisory
-
https://kb.juniper.net/JSA10783
Juniper Networks - 2017-04 Security Bulletin: Multiple Vulnerabilities in NorthStar Controller Application before version 2.1.0 Service Pack 1.Third Party Advisory
-
https://security.gentoo.org/glsa/201604-03
Xen: Multiple vulnerabilities (GLSA 201604-03) — Gentoo securityThird Party Advisory
-
http://www.securitytracker.com/id/1032545
Xen Heap Overflow in QEMU PCNET Controller Lets Local Guest Users Gain Privileges on the Host System - SecurityTrackerThird Party Advisory;VDB Entry
-
http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160669.html
[SECURITY] Fedora 22 Update: xen-4.5.0-11.fc22Third Party Advisory
-
http://xenbits.xen.org/xsa/advisory-135.html
XSA-135 - Xen Security AdvisoriesThird Party Advisory
-
http://rhn.redhat.com/errata/RHSA-2015-1088.html
RHSA-2015:1088 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
https://security.gentoo.org/glsa/201510-02
QEMU: Arbitrary code execution (GLSA 201510-02) — Gentoo securityThird Party Advisory
-
http://rhn.redhat.com/errata/RHSA-2015-1087.html
RHSA-2015:1087 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
http://rhn.redhat.com/errata/RHSA-2015-1089.html
RHSA-2015:1089 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
http://www.debian.org/security/2015/dsa-3286
Debian -- Security Information -- DSA-3286-1 xenThird Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00014.html
[security-announce] SUSE-SU-2015:1206-1: important: Security update forMailing List;Third Party Advisory
Jump to