Published: 03/06/2015 Updated: 09/09/2020

CVSS v2 Base Score: 4.6 | Impact Score: 6.4 | Exploitability Score: 3.9

VMScore: 409

Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P

QEMU does not properly restrict write access to the PCI config space for certain PCI pass-through devices, which might allow local x86 HVM guests to gain privileges, cause a denial of service (host crash), obtain sensitive information, or possibly have other unspecified impact via unknown vectors.

Vulnerable Product	Search on Vulmon	Subscribe to Product
qemu qemu
debian debian linux 7.0
debian debian linux 8.0
fedoraproject fedora 20
fedoraproject fedora 21
fedoraproject fedora 22
suse linux enterprise desktop 11
suse linux enterprise desktop 12
suse linux enterprise server 11
suse linux enterprise server 12
suse linux enterprise software development kit 11
suse linux enterprise software development kit 12
citrix xenserver 6.0
citrix xenserver 6.0.2
citrix xenserver 6.1.0
citrix xenserver 6.2.0
citrix xenserver 6.5
canonical ubuntu linux 12.04
canonical ubuntu linux 14.04
canonical ubuntu linux 14.10
canonical ubuntu linux 15.04

Several security issues were fixed in QEMU ...

Debian Bug report logs - #787547 CVE-2015-4103 CVE-2015-4104 CVE-2015-4105 CVE-2015-4106 Package: src:qemu; Maintainer for src:qemu is Debian QEMU Team <pkg-qemu-devel@listsaliothdebianorg>; Reported by: Moritz Muehlenhoff <jmm@debianorg> Date: Tue, 2 Jun 2015 17:03:01 UTC Severity: grave Tags: fixed-upstream, p ...

Debian Bug report logs - #788460 qemu: CVE-2015-3209: heap overflow in QEMU PCNET controller (allowing guest->host escape) Package: src:qemu; Maintainer for src:qemu is Debian QEMU Team <pkg-qemu-devel@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Thu, 11 Jun 2015 16:09:02 UT ...

Multiple security issues have been found in the Xen virtualisation solution: CVE-2015-3209 Matt Tait discovered a flaw in the way QEMU's AMD PCnet Ethernet emulation handles multi-TMD packets with a length above 4096 bytes A privileged guest user in a guest with an AMD PCNet ethernet card enabled can potentially use this flaw to e ...

CWE-863 http://xenbits.xen.org/xsa/advisory-131.html http://www.securityfocus.com/bid/74949 http://www.ubuntu.com/usn/USN-2630-1 http://support.citrix.com/article/CTX201145 http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160685.html http://www.securitytracker.com/id/1032467 http://www.debian.org/security/2015/dsa-3286 http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00030.html http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00029.html http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00007.html http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00004.html http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160171.html http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160154.html https://security.gentoo.org/glsa/201604-03 http://www.debian.org/security/2015/dsa-3284 https://support.citrix.com/article/CTX206006 https://usn.ubuntu.com/2630-1/https://nvd.nist.gov

CVE-2015-4106

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect