SB2015031206 - Fedora 22 update for xen 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2015031206

SB2015031206 - Fedora 22 update for xen

Published: March 12, 2015 Updated: April 24, 2025

Security Bulletin ID SB2015031206
Severity
Low
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2015-2152)

The vulnerability allows a remote non-authenticated attacker to manipulate data.

Xen 4.5.x and earlier enables certain default backends when emulating a VGA device for an x86 HVM guest qemu even when the configuration disables them, which allows local guest users to obtain access to the VGA console by (1) setting the DISPLAY environment variable, when compiled with SDL support, or connecting to the VNC server on (2) ::1 or (3) 127.0.0.1, when not compiled with SDL support.


2) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2015-2151)

The vulnerability allows a local non-authenticated attacker to execute arbitrary code.

The x86 emulator in Xen 3.2.x through 4.5.x does not properly ignore segment overrides for instructions with register operands, which allows local guest users to obtain sensitive information, cause a denial of service (memory corruption), or possibly execute arbitrary code via unspecified vectors.


Remediation

Install update from vendor's website.

References