Published: 28/04/2015 Updated: 30/10/2018

CVSS v2 Base Score: 2.9 | Impact Score: 2.9 | Exploitability Score: 5.5

VMScore: 258

Vector: AV:A/AC:M/Au:N/C:P/I:N/A:N

Xen 4.2.x up to and including 4.5.x does not initialize certain fields, which allows certain remote service domains to obtain sensitive information from memory via a (1) XEN_DOMCTL_gettscinfo or (2) XEN_SYSCTL_getdomaininfolist request.

Vulnerable Product	Search on Vulmon	Subscribe to Product
xen xen 4.2.1
xen xen 4.2.2
xen xen 4.3.3
xen xen 4.3.4
xen xen 4.5.0
xen xen 4.2.3
xen xen 4.2.4
xen xen 4.4.0
xen xen 4.2.0
xen xen 4.3.1
xen xen 4.3.2
xen xen 4.4.2
xen xen 4.4.1
xen xen 4.2.5
xen xen 4.3.0
suse suse linux enterprise server 11.0
suse suse linux enterprise software development kit 11.0
suse suse linux enterprise desktop 11.0
fedoraproject fedora 22
fedoraproject fedora 20
fedoraproject fedora 21
debian debian linux 8.0
debian debian linux 7.0
suse suse linux enterprise server 12
suse linux enterprise desktop 12
opensuse opensuse 13.1
suse linux enterprise software development kit 12

Debian Bug report logs - #784011 xen: CVE-2015-3340: Information leak through XEN_DOMCTL_gettscinfo (XSA-132) Package: src:xen; Maintainer for src:xen is Debian Xen Team <pkg-xen-devel@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Sat, 2 May 2015 05:09:02 UTC Severity: normal ...

Debian Bug report logs - #795721 CVE-2015-3259 CVE-2015-3340 CVE-2015-4163 CVE-2015-4164 Package: src:xen; Maintainer for src:xen is Debian Xen Team <pkg-xen-devel@listsaliothdebianorg>; Reported by: Moritz Muehlenhoff <jmm@debianorg> Date: Sun, 16 Aug 2015 12:45:02 UTC Severity: important Tags: security Fixed i ...

Multiple security issues have been found in the Xen virtualisation solution, which may result in denial of service or information disclosure For the oldstable distribution (wheezy), an update will be provided later For the stable distribution (jessie), these problems have been fixed in version 441-9+deb8u3 For the unstable distribution (sid), ...

Xen 42x through 45x does not initialize certain fields, which allows certain remote service domains to obtain sensitive information from memory via a (1) XEN_DOMCTL_gettscinfo or (2) XEN_SYSCTL_getdomaininfolist request ...

CWE-200 http://www.securitytracker.com/id/1032158 http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156005.html http://xenbits.xen.org/xsa/advisory-132.html http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157006.html http://lists.fedoraproject.org/pipermail/package-announce/2015-May/156979.html http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00019.html http://www.debian.org/security/2015/dsa-3414 http://www.securityfocus.com/bid/74248 http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00018.html https://security.gentoo.org/glsa/201604-03 https://nvd.nist.gov https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=784011 https://access.redhat.com/security/cve/cve-2015-3340 https://www.debian.org/security/./dsa-3414

CVE-2015-3340

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect