SB2015081206 - Permissions, Privileges, and Access Controls in Fedoraproject Fedora
Published: August 12, 2015 Updated: August 9, 2020
Security Bulletin ID
SB2015081206
Severity
High
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2015-5166)
The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
Use-after-free vulnerability in QEMU in Xen 4.5.x and earlier does not completely unplug emulated block devices, which allows local HVM guest users to gain privileges by unplugging a block device twice.
Remediation
Install update from vendor's website.
References
- http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165373.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-September/167792.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-September/167820.html
- http://www.securityfocus.com/bid/76152
- http://www.securitytracker.com/id/1033175
- http://xenbits.xen.org/xsa/advisory-139.html