Published: 18/03/2015 Updated: 30/10/2018

CVSS v2 Base Score: 1.9 | Impact Score: 2.9 | Exploitability Score: 3.4

VMScore: 169

Vector: AV:L/AC:M/Au:N/C:N/I:P/A:N

Xen 4.5.x and previous versions enables certain default backends when emulating a VGA device for an x86 HVM guest qemu even when the configuration disables them, which allows local guest users to obtain access to the VGA console by (1) setting the DISPLAY environment variable, when compiled with SDL support, or connecting to the VNC server on (2) ::1 or (3) 127.0.0.1, when not compiled with SDL support.

Vulnerable Product	Search on Vulmon	Subscribe to Product
xen xen
fedoraproject fedora 22
fedoraproject fedora 21
fedoraproject fedora 20

Debian Bug report logs - #781620 CVE-2015-2751 CVE-2015-2752 CVE-2015-2756 Package: src:xen; Maintainer for src:xen is Debian Xen Team <pkg-xen-devel@listsaliothdebianorg>; Reported by: Moritz Muehlenhoff <jmm@debianorg> Date: Tue, 31 Mar 2015 17:15:02 UTC Severity: important Tags: fixed-upstream, security, upstr ...

Debian Bug report logs - #780975 CVE-2015-2152 Package: src:xen; Maintainer for src:xen is Debian Xen Team <pkg-xen-devel@listsaliothdebianorg>; Reported by: Moritz Muehlenhoff <jmm@debianorg> Date: Sun, 22 Mar 2015 18:03:01 UTC Severity: important Tags: security Fixed in version xen/441-9 Done: Bastian Blank ...

Xen 45x and earlier enables certain default backends when emulating a VGA device for an x86 HVM guest qemu even when the configuration disables them, which allows local guest users to obtain access to the VGA console by (1) setting the DISPLAY environment variable, when compiled with SDL support, or connecting to the VNC server on (2) ::1 or (3) ...

CWE-264 http://xenbits.xen.org/xsa/advisory-119.html http://www.securitytracker.com/id/1031919 http://www.securitytracker.com/id/1031806 http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152588.html http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152776.html http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152483.html https://security.gentoo.org/glsa/201504-04 http://www.securityfocus.com/bid/73068 http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00014.html https://nvd.nist.gov https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=894847 https://access.redhat.com/security/cve/cve-2015-2152

CVE-2015-2152

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect