Published: 01/10/2015 Updated: 30/10/2018

CVSS v2 Base Score: 3.6 | Impact Score: 4.9 | Exploitability Score: 3.9

VMScore: 320

Vector: AV:L/AC:L/Au:N/C:N/I:P/A:P

libxl in Xen 4.1.x up to and including 4.6.x does not properly handle the readonly flag on disks when using the qemu-xen device model, which allows local guest users to write to a read-only disk image.

Vulnerable Product	Search on Vulmon	Subscribe to Product
xen xen 4.1.4
xen xen 4.1.5
xen xen 4.2.5
xen xen 4.3.0
xen xen 4.3.1
xen xen 4.5.0
xen xen 4.5.1
xen xen 4.1.0
xen xen 4.1.1
xen xen 4.2.1
xen xen 4.2.2
xen xen 4.3.4
xen xen 4.4.0
xen xen 4.1.6.1
xen xen 4.2.0
xen xen 4.3.2
xen xen 4.3.3
xen xen 4.1.2
xen xen 4.1.3
xen xen 4.2.3
xen xen 4.2.4
xen xen 4.4.1

Debian Bug report logs - #823620 Multiple security issues Package: src:xen; Maintainer for src:xen is Debian Xen Team <pkg-xen-devel@listsaliothdebianorg>; Reported by: Moritz Muehlenhoff <jmm@debianorg> Date: Fri, 6 May 2016 18:03:02 UTC Severity: grave Tags: security Fixed in versions xen/480~rc3-1, xen/48 ...

Multiple security issues have been found in the Xen virtualisation solution, which may result in denial of service or information disclosure For the oldstable distribution (wheezy), an update will be provided later For the stable distribution (jessie), these problems have been fixed in version 441-9+deb8u3 For the unstable distribution (sid), ...

libxl in Xen 41x through 46x does not properly handle the readonly flag on disks when using the qemu-xen device model, which allows local guest users to write to a read-only disk image ...

CWE-17 http://www.securitytracker.com/id/1033633 http://lists.fedoraproject.org/pipermail/package-announce/2015-September/167820.html https://bugzilla.redhat.com/show_bug.cgi?id=1257893 http://lists.fedoraproject.org/pipermail/package-announce/2015-September/167077.html http://lists.fedoraproject.org/pipermail/package-announce/2015-September/167792.html http://xenbits.xen.org/xsa/advisory-142.html http://www.securityfocus.com/bid/76823 http://www.debian.org/security/2015/dsa-3414 http://lists.opensuse.org/opensuse-updates/2015-12/msg00053.html https://security.gentoo.org/glsa/201604-03 https://nvd.nist.gov https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=823620 https://access.redhat.com/security/cve/cve-2015-7311 https://www.debian.org/security/./dsa-3414

CVE-2015-7311

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect