low2.9
CVE-2015-3340
Xen 4.2.x through 4.5.x does not initialize certain fields, which allows certain remote service domains to obtain sensitive information from memory via a (1) X…
Impact
Xen 4.2.x through 4.5.x does not initialize certain fields, which allows certain remote service domains to obtain sensitive information from memory via a (1) XEN_DOMCTL_gettscinfo or (2) XEN_SYSCTL_getdomaininfolist request.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Xen | Xen | Versions 4.2.0, 4.2.1, 4.2.2, 4.2.3, 4.2.4, 4.2.5 |
| Suse | Suse Linux Enterprise Software Development Kit | Version 11.0 |
| Suse | Suse Linux Enterprise Desktop | Version 11.0 |
| Suse | Suse Linux Enterprise Server | Versions 11.0, 12 |
| Fedoraproject | Fedora | Versions 20, 21, 22 |
| Debian | Debian Linux | Versions 7.0, 8.0 |
| Opensuse | Opensuse | Version 13.1 |
| Suse | Linux Enterprise Desktop | Version 12 |
| Suse | Linux Enterprise Software Development Kit | Version 12 |
Weakness classification
References
- NVD record
- CVE.org record
- http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156005.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-May/156979.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157006.html
- http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00018.html
- http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00019.html
- http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00001.html
- http://www.debian.org/security/2015/dsa-3414
- http://www.securityfocus.com/bid/74248
- http://www.securitytracker.com/id/1032158
- http://xenbits.xen.org/xsa/advisory-132.html
- https://security.gentoo.org/glsa/201604-03
- http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156005.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-May/156979.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157006.html
- http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00018.html
- http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00019.html
- http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00001.html
- http://www.debian.org/security/2015/dsa-3414
- http://www.securityfocus.com/bid/74248
- http://www.securitytracker.com/id/1032158
- http://xenbits.xen.org/xsa/advisory-132.html
- https://security.gentoo.org/glsa/201604-03