{"id":"CVE-2015-3209","aliases":["DEBIAN-CVE-2015-3209","DSA-3284-1","DSA-3285-1","DSA-3286-1","EUVD-2015-3272","GHSA-f8hq-r3jp-2m27","MGASA-2015-0310","MGASA-2016-0098","RHSA-2015:1087","RHSA-2015:1088","RHSA-2015:1089","RHSA-2015:1189","SUSE-SU-2015:0870-1","SUSE-SU-2015:0889-1","SUSE-SU-2015:0929-1","SUSE-SU-2015:1042-1","SUSE-SU-2015:1045-1","SUSE-SU-2015:1152-1","SUSE-SU-2015:1156-1","SUSE-SU-2015:1157-1","SUSE-SU-2015:1426-1","SUSE-SU-2015:1519-1","UBUNTU-CVE-2015-3209","USN-2630-1"],"status":"published","title":"Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute...","description":"Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary code by sending a packet with TXSTATUS_STARTPACKET set and then a crafted packet with TXSTATUS_DEVICEOWNS set.","severity":{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.09679,"percentile":0.9553,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2012-08-31T14:36:20Z","modified":"2026-09-09T06:47:26Z","fixes":[{"ecosystem":"Debian:12","package":"qemu","fixed_in":["1:2.3+dfsg-6"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"qemu","fixed_in":["1:2.3+dfsg-6"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"qemu","fixed_in":["1:2.3+dfsg-6"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"xen","fixed_in":["4.4.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"xen","fixed_in":["4.4.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"xen","fixed_in":["4.4.0-1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"qemu-guest-agent","fixed_in":["2:0.12.1.2-2.448.el6_6.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"qemu-img","fixed_in":["2:0.12.1.2-2.448.el6_6.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"qemu-kvm","fixed_in":["2:0.12.1.2-2.448.el6_6.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"qemu-kvm-debuginfo","fixed_in":["2:0.12.1.2-2.448.el6_6.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"qemu-kvm-tools","fixed_in":["2:0.12.1.2-2.448.el6_6.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"qemu-guest-agent","fixed_in":["2:0.12.1.2-2.448.el6_6.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"qemu-img","fixed_in":["2:0.12.1.2-2.448.el6_6.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"qemu-kvm","fixed_in":["2:0.12.1.2-2.448.el6_6.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"qemu-kvm-debuginfo","fixed_in":["2:0.12.1.2-2.448.el6_6.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"qemu-kvm-tools","fixed_in":["2:0.12.1.2-2.448.el6_6.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"qemu-guest-agent","fixed_in":["2:0.12.1.2-2.448.el6_6.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"qemu-img","fixed_in":["2:0.12.1.2-2.448.el6_6.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"qemu-kvm","fixed_in":["2:0.12.1.2-2.448.el6_6.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"qemu-kvm-debuginfo","fixed_in":["2:0.12.1.2-2.448.el6_6.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"qemu-kvm-tools","fixed_in":["2:0.12.1.2-2.448.el6_6.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"qemu-guest-agent","fixed_in":["2:0.12.1.2-2.448.el6_6.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"qemu-img","fixed_in":["2:0.12.1.2-2.448.el6_6.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"qemu-kvm","fixed_in":["2:0.12.1.2-2.448.el6_6.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"qemu-kvm-debuginfo","fixed_in":["2:0.12.1.2-2.448.el6_6.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"qemu-kvm-tools","fixed_in":["2:0.12.1.2-2.448.el6_6.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::hypervisor","package":"qemu-img-rhev","fixed_in":["2:0.12.1.2-2.448.el6_6.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::hypervisor","package":"qemu-kvm-rhev","fixed_in":["2:0.12.1.2-2.448.el6_6.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::hypervisor","package":"qemu-kvm-rhev-debuginfo","fixed_in":["2:0.12.1.2-2.448.el6_6.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::hypervisor","package":"qemu-kvm-rhev-tools","fixed_in":["2:0.12.1.2-2.448.el6_6.4"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el6","package":"qemu-img-rhev","fixed_in":["2:0.12.1.2-2.448.el6_6.4"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el6","package":"qemu-kvm-rhev","fixed_in":["2:0.12.1.2-2.448.el6_6.4"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el6","package":"qemu-kvm-rhev-debuginfo","fixed_in":["2:0.12.1.2-2.448.el6_6.4"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el6","package":"qemu-kvm-rhev-tools","fixed_in":["2:0.12.1.2-2.448.el6_6.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_virtualization:5::client","package":"kmod-kvm","fixed_in":["0:83-273.el5_11"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_virtualization:5::client","package":"kmod-kvm-debug","fixed_in":["0:83-273.el5_11"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_virtualization:5::client","package":"kvm","fixed_in":["0:83-273.el5_11"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_virtualization:5::client","package":"kvm-debuginfo","fixed_in":["0:83-273.el5_11"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_virtualization:5::client","package":"kvm-qemu-img","fixed_in":["0:83-273.el5_11"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_virtualization:5::client","package":"kvm-tools","fixed_in":["0:83-273.el5_11"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_virtualization:5::server","package":"kmod-kvm","fixed_in":["0:83-273.el5_11"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_virtualization:5::server","package":"kmod-kvm-debug","fixed_in":["0:83-273.el5_11"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_virtualization:5::server","package":"kvm","fixed_in":["0:83-273.el5_11"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_virtualization:5::server","package":"kvm-debuginfo","fixed_in":["0:83-273.el5_11"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_virtualization:5::server","package":"kvm-qemu-img","fixed_in":["0:83-273.el5_11"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_virtualization:5::server","package":"kvm-tools","fixed_in":["0:83-273.el5_11"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"qemu","fixed_in":["2.0.0+dfsg-2ubuntu1.13"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"xen","fixed_in":["4.4.2-0ubuntu0.14.04.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3+dfsg-6"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3+dfsg-6"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3+dfsg-6"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.1+dfsg-12+deb8u1"}]}],"versions":["1:2.1+dfsg-11","1:2.1+dfsg-12","1:2.1+dfsg-12~bpo70+1"],"bundled":6},{"source":"osv","ecosystem":"Debian:7","package":"qemu-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2+dfsg-6+deb7u8"}]}],"versions":["1.1.2+dfsg-6","1.1.2+dfsg-6+deb7u1","1.1.2+dfsg-6+deb7u2","1.1.2+dfsg-6+deb7u3","1.1.2+dfsg-6+deb7u4","1.1.2+dfsg-6+deb7u5","1.1.2+dfsg-6+deb7u6","1.1.2+dfsg-6+deb7u7","1.1.2+dfsg-6+deb7u7~bpo60+1"],"bundled":2},{"source":"osv","ecosystem":"Debian:7","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.4-3+deb7u8"}]}],"versions":["4.1.4-3","4.1.4-3+deb7u1","4.1.4-3+deb7u2","4.1.4-3+deb7u3","4.1.4-3+deb7u4","4.1.4-3+deb7u5","4.1.4-3+deb7u6","4.1.4-3+deb7u7"],"bundled":7},{"source":"osv","ecosystem":"Debian:8","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.1-9+deb8u1"}]}],"versions":["4.4.1-9"],"bundled":7},{"source":"osv","ecosystem":"Mageia:4","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.2-1.12.mga4"}]}],"bundled":9},{"source":"osv","ecosystem":"Mageia:5","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.3-2.3.mga5"}]}],"bundled":9},{"source":"osv","ecosystem":"Mageia:5","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.2-1.5.mga5"}]}],"bundled":45},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"qemu-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.448.el6_6.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"qemu-img","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.448.el6_6.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"qemu-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.448.el6_6.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"qemu-kvm-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.448.el6_6.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"qemu-kvm-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.448.el6_6.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"qemu-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.448.el6_6.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"qemu-img","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.448.el6_6.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"qemu-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.448.el6_6.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"qemu-kvm-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.448.el6_6.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"qemu-kvm-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.448.el6_6.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"qemu-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.448.el6_6.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"qemu-img","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.448.el6_6.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"qemu-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.448.el6_6.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"qemu-kvm-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.448.el6_6.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"qemu-kvm-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.448.el6_6.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"qemu-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.448.el6_6.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"qemu-img","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.448.el6_6.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"qemu-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.448.el6_6.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"qemu-kvm-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.448.el6_6.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"qemu-kvm-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.448.el6_6.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::hypervisor","package":"qemu-img-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.448.el6_6.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::hypervisor","package":"qemu-kvm-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.448.el6_6.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::hypervisor","package":"qemu-kvm-rhev-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.448.el6_6.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::hypervisor","package":"qemu-kvm-rhev-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.448.el6_6.4"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el6","package":"qemu-img-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.448.el6_6.4"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el6","package":"qemu-kvm-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.448.el6_6.4"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el6","package":"qemu-kvm-rhev-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.448.el6_6.4"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el6","package":"qemu-kvm-rhev-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.448.el6_6.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_virtualization:5::client","package":"kmod-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:83-273.el5_11"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_virtualization:5::client","package":"kmod-kvm-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:83-273.el5_11"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_virtualization:5::client","package":"kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:83-273.el5_11"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_virtualization:5::client","package":"kvm-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:83-273.el5_11"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_virtualization:5::client","package":"kvm-qemu-img","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:83-273.el5_11"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_virtualization:5::client","package":"kvm-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:83-273.el5_11"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_virtualization:5::server","package":"kmod-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:83-273.el5_11"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_virtualization:5::server","package":"kmod-kvm-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:83-273.el5_11"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_virtualization:5::server","package":"kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:83-273.el5_11"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_virtualization:5::server","package":"kvm-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:83-273.el5_11"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_virtualization:5::server","package":"kvm-qemu-img","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:83-273.el5_11"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_virtualization:5::server","package":"kvm-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:83-273.el5_11"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.2_06-21.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.2_06-21.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.2_06-21.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.2_06-21.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP2-LTSS","package":"kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.15.1-0.32.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.2-48.4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.2-48.4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.2-48.4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0+dfsg-2ubuntu1.13"}]}],"versions":["1.5.0+dfsg-3ubuntu5","1.5.0+dfsg-3ubuntu6","1.6.0+dfsg-2ubuntu1","1.6.0+dfsg-2ubuntu2","1.6.0+dfsg-2ubuntu3","1.6.0+dfsg-2ubuntu4","1.7.0+dfsg-2ubuntu1","1.7.0+dfsg-2ubuntu2","1.7.0+dfsg-2ubuntu3","1.7.0+dfsg-2ubuntu4","1.7.0+dfsg-2ubuntu5","1.7.0+dfsg-2ubuntu7","1.7.0+dfsg-2ubuntu8","1.7.0+dfsg-2ubuntu9","1.7.0+dfsg-3ubuntu1~ppa1","1.7.0+dfsg-3ubuntu1","1.7.0+dfsg-3ubuntu2","1.7.0+dfsg-3ubuntu3","1.7.0+dfsg-3ubuntu4","1.7.0+dfsg-3ubuntu5","1.7.0+dfsg-3ubuntu6","1.7.0+dfsg-3ubuntu7","2.0.0~rc1+dfsg-0ubuntu1","2.0.0~rc1+dfsg-0ubuntu2","2.0.0~rc1+dfsg-0ubuntu3","2.0.0~rc1+dfsg-0ubuntu3.1","2.0.0+dfsg-2ubuntu1","2.0.0+dfsg-2ubuntu1.1","2.0.0+dfsg-2ubuntu1.2","2.0.0+dfsg-2ubuntu1.3","2.0.0+dfsg-2ubuntu1.5","2.0.0+dfsg-2ubuntu1.6","2.0.0+dfsg-2ubuntu1.7","2.0.0+dfsg-2ubuntu1.8","2.0.0+dfsg-2ubuntu1.9","2.0.0+dfsg-2ubuntu1.10","2.0.0+dfsg-2ubuntu1.11"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.2-0ubuntu0.14.04.2"}]}],"versions":["4.3.0-1ubuntu1","4.3.0-1ubuntu2","4.3.0-1ubuntu3","4.3.0-1ubuntu4","4.3.0-1ubuntu5","4.4.0-0ubuntu3","4.4.0-0ubuntu4","4.4.0-0ubuntu5","4.4.0-0ubuntu5.1","4.4.0-0ubuntu5.2","4.4.1-0ubuntu0.14.04.1","4.4.1-0ubuntu0.14.04.2","4.4.1-0ubuntu0.14.04.3","4.4.1-0ubuntu0.14.04.4","4.4.1-0ubuntu0.14.04.5","4.4.1-0ubuntu0.14.04.6","4.4.2-0ubuntu0.14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0+dfsg-2ubuntu1.13"}]}],"versions":["1.5.0+dfsg-3ubuntu5","1.5.0+dfsg-3ubuntu6","1.6.0+dfsg-2ubuntu1","1.6.0+dfsg-2ubuntu2","1.6.0+dfsg-2ubuntu3","1.6.0+dfsg-2ubuntu4","1.7.0+dfsg-2ubuntu1","1.7.0+dfsg-2ubuntu2","1.7.0+dfsg-2ubuntu3","1.7.0+dfsg-2ubuntu4","1.7.0+dfsg-2ubuntu5","1.7.0+dfsg-2ubuntu7","1.7.0+dfsg-2ubuntu8","1.7.0+dfsg-2ubuntu9","1.7.0+dfsg-3ubuntu1~ppa1","1.7.0+dfsg-3ubuntu1","1.7.0+dfsg-3ubuntu2","1.7.0+dfsg-3ubuntu3","1.7.0+dfsg-3ubuntu4","1.7.0+dfsg-3ubuntu5","1.7.0+dfsg-3ubuntu6","1.7.0+dfsg-3ubuntu7","2.0.0~rc1+dfsg-0ubuntu1","2.0.0~rc1+dfsg-0ubuntu2","2.0.0~rc1+dfsg-0ubuntu3","2.0.0~rc1+dfsg-0ubuntu3.1","2.0.0+dfsg-2ubuntu1","2.0.0+dfsg-2ubuntu1.1","2.0.0+dfsg-2ubuntu1.2","2.0.0+dfsg-2ubuntu1.3","2.0.0+dfsg-2ubuntu1.5","2.0.0+dfsg-2ubuntu1.6","2.0.0+dfsg-2ubuntu1.7","2.0.0+dfsg-2ubuntu1.8","2.0.0+dfsg-2ubuntu1.9","2.0.0+dfsg-2ubuntu1.10","2.0.0+dfsg-2ubuntu1.11"],"bundled":6}],"products":[{"vendor":"arista","product":"eos"},{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"juniper","product":"junos_space"},{"vendor":"qemu","product":"qemu"},{"vendor":"redhat","product":"enterprise_linux_desktop"},{"vendor":"redhat","product":"enterprise_linux_eus"},{"vendor":"redhat","product":"enterprise_linux_server"},{"vendor":"redhat","product":"enterprise_linux_server_aus"},{"vendor":"redhat","product":"enterprise_linux_server_tus"},{"vendor":"redhat","product":"enterprise_linux_workstation"},{"vendor":"redhat","product":"openstack"},{"vendor":"redhat","product":"virtualization"},{"vendor":"suse","product":"linux_enterprise_debuginfo"},{"vendor":"suse","product":"linux_enterprise_desktop"},{"vendor":"suse","product":"linux_enterprise_server"},{"vendor":"suse","product":"linux_enterprise_software_development_kit"}],"references":[{"url":"http://www.ubuntu.com/usn/USN-2630-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00027.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1087.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00015.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"https://kb.juniper.net/JSA10783","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160669.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Third Party Advisory","advisory"]},{"url":"http://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA10698","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.debian.org/security/2015/dsa-3286","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160677.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00029.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1088.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1089.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00027.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"https://security.gentoo.org/glsa/201510-02","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00014.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://www.debian.org/security/2015/dsa-3284","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.securityfocus.com/bid/75123","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00030.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://www.securitytracker.com/id/1032545","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00007.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://xenbits.xen.org/xsa/advisory-135.html","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","report"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00020.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"https://security.gentoo.org/glsa/201604-03","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1189.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00004.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160685.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.debian.org/security/2015/dsa-3285","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.arista.com/en/support/advisories-notices/security-advisories/1180-security-advisory-13","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-3209","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2015:1087","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2015:1088","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2015:1089","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2015:1189","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-3209","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1225882","tags":["report"]},{"url":"https://github.com/advisories/GHSA-f8hq-r3jp-2m27"},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-3209","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2015-0310.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=16105","tags":["report"]},{"url":"http://www.ubuntu.com/usn/usn-2630-1/","tags":["web"]},{"url":"https://rhn.redhat.com/errata/RHSA-2015-1507.html","tags":["web"]},{"url":"http://openwall.com/lists/oss-security/2015/08/06/5","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2016-0098.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=16956","tags":["report"]},{"url":"http://xenbits.xen.org/xsa/advisory-117.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-118.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-119.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-120.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-121.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-122.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-123.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-124.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-125.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-126.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-127.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-128.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-129.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-130.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-131.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-132.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-133.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-134.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-136.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-137.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-138.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-139.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-140.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-141.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-142.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-145.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-146.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-147.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-148.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-149.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-150.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-151.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-152.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-153.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-154.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-155.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-156.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-158.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-159.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-162.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-163.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-164.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-165.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-166.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-167.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-168.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-170.html","tags":["advisory"]},{"url":"http://www.xenproject.org/downloads/xen-archives/xen-45-series/xen-451.html","tags":["web"]},{"url":"http://www.xenproject.org/downloads/xen-archives/xen-45-series/xen-452.html","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1087.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-3209","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1088.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1089.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1189.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150870-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/812836","tags":["report"]},{"url":"https://bugzilla.suse.com/812983","tags":["report"]},{"url":"https://bugzilla.suse.com/817593","tags":["report"]},{"url":"https://bugzilla.suse.com/821819","tags":["report"]},{"url":"https://bugzilla.suse.com/824340","tags":["report"]},{"url":"https://bugzilla.suse.com/829800","tags":["report"]},{"url":"https://bugzilla.suse.com/841080","tags":["report"]},{"url":"https://bugzilla.suse.com/842006","tags":["report"]},{"url":"https://bugzilla.suse.com/842088","tags":["report"]},{"url":"https://bugzilla.suse.com/858858","tags":["report"]},{"url":"https://bugzilla.suse.com/864391","tags":["report"]},{"url":"https://bugzilla.suse.com/864649","tags":["report"]},{"url":"https://bugzilla.suse.com/864650","tags":["report"]},{"url":"https://bugzilla.suse.com/864653","tags":["report"]},{"url":"https://bugzilla.suse.com/864655","tags":["report"]},{"url":"https://bugzilla.suse.com/864665","tags":["report"]},{"url":"https://bugzilla.suse.com/864671","tags":["report"]},{"url":"https://bugzilla.suse.com/864673","tags":["report"]},{"url":"https://bugzilla.suse.com/864678","tags":["report"]},{"url":"https://bugzilla.suse.com/864682","tags":["report"]},{"url":"https://bugzilla.suse.com/864769","tags":["report"]},{"url":"https://bugzilla.suse.com/864796","tags":["report"]},{"url":"https://bugzilla.suse.com/864801","tags":["report"]},{"url":"https://bugzilla.suse.com/864802","tags":["report"]},{"url":"https://bugzilla.suse.com/864804","tags":["report"]},{"url":"https://bugzilla.suse.com/864805","tags":["report"]},{"url":"https://bugzilla.suse.com/864811","tags":["report"]},{"url":"https://bugzilla.suse.com/864812","tags":["report"]},{"url":"https://bugzilla.suse.com/864814","tags":["report"]},{"url":"https://bugzilla.suse.com/870439","tags":["report"]},{"url":"https://bugzilla.suse.com/873235","tags":["report"]},{"url":"https://bugzilla.suse.com/874749","tags":["report"]},{"url":"https://bugzilla.suse.com/874788","tags":["report"]},{"url":"https://bugzilla.suse.com/876842","tags":["report"]},{"url":"https://bugzilla.suse.com/877642","tags":["report"]},{"url":"https://bugzilla.suse.com/877645","tags":["report"]},{"url":"https://bugzilla.suse.com/878541","tags":["report"]},{"url":"https://bugzilla.suse.com/886535","tags":["report"]},{"url":"https://bugzilla.suse.com/920571","tags":["report"]},{"url":"https://bugzilla.suse.com/924018","tags":["report"]},{"url":"https://bugzilla.suse.com/929339","tags":["report"]},{"url":"https://bugzilla.suse.com/932267","tags":["report"]},{"url":"https://bugzilla.suse.com/932770","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2016","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4344","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4541","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0142","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0143","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0144","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0145","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0146","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0147","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0150","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0222","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0223","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-2894","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3461","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1779","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3209","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3456","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150889-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150929-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/598271","tags":["report"]},{"url":"https://bugzilla.suse.com/598298","tags":["report"]},{"url":"https://bugzilla.suse.com/599095","tags":["report"]},{"url":"https://bugzilla.suse.com/603161","tags":["report"]},{"url":"https://bugzilla.suse.com/603179","tags":["report"]},{"url":"https://bugzilla.suse.com/610682","tags":["report"]},{"url":"https://bugzilla.suse.com/619991","tags":["report"]},{"url":"https://bugzilla.suse.com/621793","tags":["report"]},{"url":"https://bugzilla.suse.com/626654","tags":["report"]},{"url":"https://bugzilla.suse.com/637297","tags":["report"]},{"url":"https://bugzilla.suse.com/689895","tags":["report"]},{"url":"https://bugzilla.suse.com/690781","tags":["report"]},{"url":"https://bugzilla.suse.com/695510","tags":["report"]},{"url":"https://bugzilla.suse.com/695766","tags":["report"]},{"url":"https://bugzilla.suse.com/698237","tags":["report"]},{"url":"https://bugzilla.suse.com/701161","tags":["report"]},{"url":"https://bugzilla.suse.com/702823","tags":["report"]},{"url":"https://bugzilla.suse.com/704933","tags":["report"]},{"url":"https://bugzilla.suse.com/705095","tags":["report"]},{"url":"https://bugzilla.suse.com/705304","tags":["report"]},{"url":"https://bugzilla.suse.com/740165","tags":["report"]},{"url":"https://bugzilla.suse.com/764526","tags":["report"]},{"url":"https://bugzilla.suse.com/777084","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2011-1750","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-1751","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-2212","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-2512","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-2527","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-0029","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-2652","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-3515","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20151042-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/906689","tags":["report"]},{"url":"https://bugzilla.suse.com/931625","tags":["report"]},{"url":"https://bugzilla.suse.com/931626","tags":["report"]},{"url":"https://bugzilla.suse.com/931627","tags":["report"]},{"url":"https://bugzilla.suse.com/931628","tags":["report"]},{"url":"https://bugzilla.suse.com/932790","tags":["report"]},{"url":"https://bugzilla.suse.com/932996","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4103","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4104","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4105","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4106","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4163","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4164","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20151045-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20151152-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20151156-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20151157-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20151426-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/938344","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5154","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20151519-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/893892","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4037","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2015-3209","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2630-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2015-4037","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-4103","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-4104","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-4105","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-4106","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2015-3209","description":"Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary code by sending a packet with TXSTATUS_STARTPACKET set and then a crafted packet with TXSTATUS_DEVICEOWNS set.","status":"published","published":"2015-06-15T15:00:00Z","modified":"2024-08-06T05:39:31.977Z","updated_at":"2026-11-02T14:35:42.331636Z"}],"euvd":[{"id":"EUVD-2015-3272","description":"Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary code by sending a packet with TXSTATUS_STARTPACKET set and then a crafted packet with TXSTATUS_DEVICEOWNS set.","status":"published","published":"2015-06-15T15:00:00Z","modified":"2024-08-06T05:39:31Z","updated_at":"2026-11-03T02:22:09.179399Z"}],"ghsa":[{"id":"GHSA-f8hq-r3jp-2m27","title":"Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute...","description":"Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary code by sending a packet with TXSTATUS_STARTPACKET set and then a crafted packet with TXSTATUS_DEVICEOWNS set.","status":"published","published":"2022-05-13T01:03:35Z","modified":"2023-02-10T05:06:08Z","cwes":["CWE-787"],"updated_at":"2026-11-02T14:54:00.716708Z"}],"nvd":[{"id":"CVE-2015-3209","description":"Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary code by sending a packet with TXSTATUS_STARTPACKET set and then a crafted packet with TXSTATUS_DEVICEOWNS set.","status":"published","published":"2015-06-15T15:59:00.07Z","modified":"2026-06-17T00:25:32.487Z","cvss":[{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:03:05.884985Z"}],"osv":[{"id":"CVE-2015-3209","description":"Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary code by sending a packet with TXSTATUS_STARTPACKET set and then a crafted packet with TXSTATUS_DEVICEOWNS set.","status":"published","published":"2015-06-15T15:59:00Z","modified":"2026-04-16T06:16:39.608608672Z","updated_at":"2026-11-02T15:44:00.594921Z"},{"id":"DEBIAN-CVE-2015-3209","description":"Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary code by sending a packet with TXSTATUS_STARTPACKET set and then a crafted packet with TXSTATUS_DEVICEOWNS set.","status":"published","published":"2015-06-15T15:59:00.07Z","modified":"2026-09-09T06:47:26.631015493Z","updated_at":"2026-11-02T15:45:26.752992Z"},{"id":"DSA-3284-1","title":"qemu - security update","status":"published","published":"2015-06-13T00:00:00Z","modified":"2026-03-09T01:20:29.522543Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"DSA-3285-1","title":"qemu-kvm - security update","status":"published","published":"2015-06-13T00:00:00Z","modified":"2026-03-09T01:19:12.03914Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"DSA-3286-1","title":"xen - security update","status":"published","published":"2015-06-13T00:00:00Z","modified":"2026-03-09T01:17:50.219926Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"MGASA-2015-0310","title":"Updated qemu package fixes security vulnerability","description":"Matt Tait discovered that QEMU incorrectly handled the virtual PCNET\ndriver. A malicious guest could use this issue to cause a denial of\nservice, or possibly execute arbitrary code on the host as the user\nrunning the QEMU process (CVE-2015-3209).\n\nKurt Seifried discovered that QEMU incorrectly handled certain temporary\nfiles. A local attacker could use this issue to cause a denial of service\n(CVE-2015-4037).\n\nJan Beulich discovered that the QEMU Xen code incorrectly restricted write\naccess to the host MSI message data field. A malicious guest could use\nthis issue to cause a denial of service (CVE-2015-4103).\n\nJan Beulich discovered that the QEMU Xen code incorrectly restricted\naccess to the PCI MSI mask bits. A malicious guest could use this issue to\ncause a denial of service (CVE-2015-4104).\n\nJan Beulich discovered that the QEMU Xen code incorrectly handled MSI-X\nerror messages. A malicious guest could use this issue to cause a denial\nof service (CVE-2015-4105).\n\nJan Beulich discovered that the QEMU Xen code incorrectly restricted write\naccess to the PCI config space. A malicious guest could use this issue to\ncause a denial of service, obtain sensitive information, or possibly\nexecute arbitrary code (CVE-2015-4106).\n\nA heap buffer overflow flaw was found in the way QEMU's IDE subsystem\nhandled I/O buffer access while processing certain ATAPI commands.\nA privileged guest user in a guest with the CDROM drive enabled could\npotentially use this flaw to execute arbitrary code on the host with the\nprivileges of the host's QEMU process corresponding to the guest\n(CVE-2015-5154).\n\nAn out-of-bounds memory access flaw, leading to memory corruption or\npossibly an information leak, was found in QEMU's pit_ioport_read()\nfunction. A privileged guest user in a QEMU guest, which had QEMU PIT\nemulation enabled, could potentially, in rare cases, use this flaw to\nexecute arbitrary code on the host with the privileges of the hosting QEMU\nprocess (CVE-2015-3214).\n\nQemu emulator built with the virtio-serial vmchannel support is vulnerable\nto a buffer overflow issue. It could occur while exchanging virtio control\nmessages between guest \u0026 the host. A malicious guest could use this flaw\nto corrupt few bytes of Qemu memory area, potentially crashing the Qemu\nprocess (CVE-2015-5745).\n","status":"published","published":"2015-08-11T20:22:53Z","modified":"2026-04-16T06:23:35.491063273Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"MGASA-2016-0098","title":"Updated xen packages fix security vulnerabilities","description":"This xen update is based on upstream 4.5.2 maintenance release, and fixes the\nfollowing security issues:\n\nThe vgic_v2_to_sgi function in arch/arm/vgic-v2.c in Xen 4.5.x, when running\non ARM hardware with general interrupt controller (GIC) version 2, allows\nlocal guest users to cause a denial of service (host crash) by writing an\ninvalid value to the GICD.SGIR register (CVE-2015-0268).\n\nThe ARM GIC distributor virtualization in Xen 4.4.x and 4.5.x allows local\nguests to cause a denial of service by causing a large number messages to\nbe logged (CVE-2015-1563).\n\nThe emulation routines for unspecified X86 devices in Xen 3.2.x through\n4.5.x does not properly initialize data, which allow local HVM guest users\nto obtain sensitive information via vectors involving an unsupported access\nsize (CVE-2015-2044).\n\nThe HYPERVISOR_xen_version hypercall in Xen 3.2.x through 4.5.x does not\nproperly initialize data structures, which allows local guest users to\nobtain sensitive information via unspecified vectors (CVE-2015-2045).\n\nXen 3.3.x through 4.5.x and the Linux kernel through 3.19.1 do not properly\nrestrict access to PCI command registers, which might allow local guest\nusers to cause a denial of service (non-maskable interrupt and host crash)\nby disabling the (1) memory or (2) I/O decoding for a PCI Express device\nand then accessing the device, which triggers an Unsupported Request (UR)\nresponse (CVE-2015-2150).\n\nThe x86 emulator in Xen 3.2.x through 4.5.x does not properly ignore segment\noverrides for instructions with register operands, which allows local guest\nusers to obtain sensitive information, cause a denial of service (memory\ncorruption), or possibly execute arbitrary code via unspecified vectors\n(CVE-2015-2151).\n\nXen 4.5.x and earlier enables certain default backends when emulating a VGA\ndevice for an x86 HVM guest qemu even when the configuration disables them,\nwhich allows local guest users to obtain access to the VGA console by (1)\nsetting the DISPLAY environment variable, when compiled with SDL support,\nor connecting to the VNC server on (2) ::1 or (3) 127.0.0.1, when not\ncompiled with SDL support (CVE-2015-2152).\n\nXen 4.3.x, 4.4.x, and 4.5.x, when using toolstack disaggregation, allows\nremote domains with partial management control to cause a denial of service\n(host lock) via unspecified domctl operations (CVE-2015-2751). \n\nThe XEN_DOMCTL_memory_mapping hypercall in Xen 3.2.x through 4.5.x, when\nusing a PCI passthrough device, is not preemptable, which allows local x86\nHVM domain users to cause a denial of service (host CPU consumption) via\na crafted request to the device model (qemu-dm) (CVE-2015-2752).\n\nQEMU, as used in Xen 3.3.x through 4.5.x, does not properly restrict access\nto PCI command registers, which might allow local HVM guest users to cause\na denial of service (non-maskable interrupt and host crash) by disabling\nthe (1) memory or (2) I/O decoding for a PCI Express device and then\naccessing the device, which triggers an Unsupported Request (UR) response\n(CVE-2015-2756).\n\nHeap-based buffer overflow in the PCNET controller in QEMU allows remote\nattackers to execute arbitrary code by sending a packet with\nTXSTATUS_STARTPACKET set and then a crafted packet with TXSTATUS_DEVICEOWNS\nset (CVE-2015-3209).\n\nStack-based buffer overflow in the xl command line utility in Xen 4.1.x\nthrough 4.5.x allows local guest administrators to gain privileges via a\nlong configuration argument (CVE-2015-3259).\n\nXen 4.2.x through 4.5.x does not initialize certain fields, which allows\ncertain remote service domains to obtain sensitive information from memory\nvia a (1) XEN_DOMCTL_gettscinfo or (2) XEN_SYSCTL_getdomaininfolist request\n(CVE-2015-3340).\n\nThe Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier\nand KVM, allows local guest users to cause a denial of service (out-of-bounds\nwrite and guest crash) or possibly execute arbitrary code via the (1)\nFD_CMD_READ_ID, (2) FD_CMD_DRIVE_SPECIFICATION_COMMAND, or other unspecified\ncommands, aka VENOM (CVE-2015-3456).\n\nXen 3.3.x through 4.5.x does not properly restrict write access to the host\nMSI message data field, which allows local x86 HVM guest administrators\ncause a denial of service (host interrupt handling confusion) via vectors\nrelated to qemu and accessing spanning multiple fields (CVE-2015-4103).\n\nXen 3.3.x through 4.5.x does not properly restrict access to PCI MSI mask\nbits, which allows local x86 HVM guest users to cause a denial of service\n(unexpected interrupt and host crash) via unspecified vectors \n(CVE-2015-4104).\n\nXen 3.3.x through 4.5.x enables logging for PCI MSI-X pass-through error\nmessages, which allows local x86 HVM guests to cause a denial of service\n(host disk consumption) via certain invalid operations (CVE-2015-4105).\n\nQEMU does not properly restrict write access to the PCI config space for\ncertain PCI pass-through devices, which mighy allow local x86 HVM guests\nto gain privileges, cause a denial of service (host crash), obtain\nsensitive information, or possibly have other unspecified impact via\nunknown vectors (CVE-2015-4106).\n\nGNTTABOP_swap_grant_ref in Xen 4.2 through 4.5 does not check the grant\ntable operation version, which allows local guest domains to cause a\ndenial of service (NULL pointer dereference) via a hypercall without a\nGNTTABOP_setup_table or GNTTABOP_set_version (CVE-2015-4163).\n\nThe compat_iret function in Xen 3.1 through 4.5 iterates the wrong way\nthrough a loop, which allows local 32-bit PV guest administrators to cause\na denial of service (large loop and system hang) via a hypercall_iret call\nwith EFLAGS.VM set (CVE-2015-4164).\n\nHeap-based buffer overflow in the IDE subsystem in QEMU, as used in Xen\n4.5.x and earlier, when the container has a CDROM drive enabled, allows\nlocal guest users to execute arbitrary code on the host via unspecified\nATAPI commands (CVE-2015-5154).\n\nThe C+ mode offload emulation in the RTL8139 network card device model in\nQEMU, as used in Xen 4.5.x and earlier, allows remote attackers to read\nprocess heap memory via unspecified vectors (CVE-2015-5165).\n\nUse-after-free vulnerability in QEMU in Xen 4.5.x and earlier does not\ncompletely unplug emulated block devices, which allows local HVM guest\nusers to gain privileges by unplugging a block device twice (CVE-2015-5166).\n\nA guest to host DoS issue was found affecting various hypervisors. In that,\na guest can DoS the host by triggering an infinite stream of \"alignment\ncheck\" (#AC) exceptions. This causes the microcode to enter an infinite loop\nwhere the core never receives another interrupt. The host kernel panics due\nto this effect (CVE-2015-5307).\n\nThe xenmem_add_to_physmap_one function in arch/arm/mm.c in Xen 4.5.x,\n4.4.x, and earlier does not limit the number of printk console messages\nwhen reporting a failure to retrieve a reference on a foreign page, which\nallows remote domains to cause a denial of service by leveraging\npermissions to map the memory of a foreign guest (CVE-2015-6654).\n\nlibxl in Xen 4.1.x through 4.6.x does not properly handle the readonly flag\non disks when using the qemu-xen device model, which allows local guest\nusers to write to a read-only disk image (CVE-2015-7311).\n\nA heap-based buffer overflow flaw was discovered in the way QEMU's AMD\nPC-Net II Ethernet Controller emulation received certain packets in\nloopback mode. A privileged user (with the CAP_SYS_RAWIO capability)\ninside a guest could use this flaw to crash the host QEMU process\n(resulting in denial of service) or, potentially, execute arbitrary\ncode with privileges of the host QEMU process (CVE-2015-7504).\n\nMulticall support for arm in xen 4.4.x and later was not correctly set\nup with correct functionality and therefore exposed to guests a code path\nwhich crashes the host. Any guest can issue a preemptable hypercall via the\nmulticall interface to exploit this vulnerability (CVE-2015-7812).\n\nXen 4.4.x, 4.5.x, and 4.6.x does not limit the number of printk console\nmessages when reporting unimplemented hypercalls, which allows local guests\nto cause a denial of service via a sequence of (1) HYPERVISOR_physdev_op\nhypercalls, which are not properly handled in the do_physdev_op function\nin arch/arm/physdev.c, or (2) HYPERVISOR_hvm_op hypercalls, which are not\nproperly handled in the do_hvm_op function in arch/arm/hvm.c (CVE-2015-7813).\n\nRace condition in the relinquish_memory function in arch/arm/domain.c in\nXen 4.6.x and earlier allows local domains with partial management control\nto cause a denial of service (host crash) via vectors involving the\ndestruction of a domain and using XENMEM_decrease_reservation to reduce\nthe memory of the domain (CVE-2015-7814).\n\nThe mod_l2_entry function in arch/x86/mm.c in Xen 3.4 through 4.6.x does\nnot properly validate level 2 page table entries, which allows local PV\nguest administrators to gain privileges via a crafted superpage mapping\n(CVE-2015-7835).\n\nMultiple memory leaks in Xen 4.0 through 4.6.x allow local guest\nadministrators or domains with certain permission to cause a denial of\nservice (memory consumption) via a large number of \"teardowns\" of domains\nwith the vcpu pointer array allocated using the (1) XEN_DOMCTL_max_vcpus\nhypercall or the xenoprofile state vcpu pointer array allocated using the\n(2) XENOPROF_get_buffer or (3) XENOPROF_set_passive hypercall\n(CVE-2015-7969).\n\nThe p2m_pod_emergency_sweep function in arch/x86/mm/p2m-pod.c in Xen 3.4.x,\n3.5.x, and 3.6.x is not preemptible, which allows local x86 HVM guest\nadministrators to cause a denial of service (CPU consumption and possibly\nreboot) via crafted memory contents that triggers a \"time-consuming linear\nscan,\" related to Populate-on-Demand (CVE-2015-7970).\n\nXen 3.2.x through 4.6.x does not limit the number of printk console messages\nwhen logging certain pmu and profiling hypercalls, which allows local guests\nto cause a denial of service via a sequence of crafted (1) \nHYPERCALL_xenoprof_op hypercalls, which are not properly handled in the \ndo_xenoprof_op function in common/xenoprof.c, or (2) HYPERVISOR_xenpmu_op\nhypercalls, which are not properly handled in the do_xenpmu_op function in\narch/x86/cpu/vpmu.c (CVE-2015-7971).\n\nThe (1) libxl_set_memory_target function in tools/libxl/libxl.c and (2) \nlibxl__build_post function in tools/libxl/libxl_dom.c in Xen 3.4.x through\n4.6.x do not properly calculate the balloon size when using the\npopulate-on-demand (PoD) system, which allows local HVM guest users to\ncause a denial of service (guest crash) via unspecified vectors related\nto \"heavy memory pressure.\" (CVE-2015-7972)\n\nA guest to host DoS issue was found affecting various hypervisors. In that,\na guest can DoS the host by triggering an infinite stream of \"debug check\"\n(#DB) exceptions. This causes the microcode to enter an infinite loop where\nthe core never receives another interrupt. The host kernel panics due to\nthis effect (CVE-2015-8104).\n\nXen 4.6.x and earlier does not properly enforce limits on page order inputs\nfor the (1) XENMEM_increase_reservation, (2) XENMEM_populate_physmap,\n(3) XENMEM_exchange, and possibly other HYPERVISOR_memory_op suboperations,\nwhich allows ARM guest OS administrators to cause a denial of service (CPU\nconsumption, guest reboot, or watchdog timeout and host reboot) and possibly\nhave unspecified other impact via unknown vectors (CVE-2015-8338).\n\nThe memory_exchange function in common/memory.c in Xen 3.2.x through 4.6.x\ndoes not properly hand back pages to a domain, which might allow guest OS\nadministrators to cause a denial of service (host crash) via unspecified\nvectors related to domain teardown (CVE-2015-8339).\n\nThe memory_exchange function in common/memory.c in Xen 3.2.x through 4.6.x\ndoes not properly release locks, which might allow guest OS administrators\nto cause a denial of service (deadlock or host crash) via unspecified\nvectors, related to XENMEM_exchange error handling (CVE-2015-8340).\n\nFelix Wilhelm discovered a race condition in the Xen paravirtualized\ndrivers which can cause double fetch vulnerabilities. An attacker in the\nparavirtualized guest could exploit this flaw to cause a denial of service\n(crash the host) or potentially execute arbitrary code on the host\n(CVE-2015-8550).\n\nInformation leak in legacy x86 FPU/XMM initialization (CVE-2015-8555).\n\nThe PV superpage functionality lacks certain validity checks on data\nbeing passed to the hypervisor by guests.  This is the case for the\npage identifier (MFN) passed to MMUEXT_MARK_SUPER and\nMMUEXT_UNMARK_SUPER sub-ops of the HYPERVISOR_mmuext_op hypercall as\nwell as for various forms of page table updates. Use of the feature,\nwhich is disabled by default, may have unknown effects, ranging from\ninformation leaks through Denial of Service to privilege escalation.\n(CVE-2016-1570)\n\nWhile INVLPG does not cause a General Protection Fault when used on a\nnon-canonical address, INVVPID in its \"individual address\" variant,\nwhich is used to back the intercepted INVLPG in certain cases, fails in\nsuch cases. Failure of INVVPID results in a hypervisor bug check.\nA malicious guest can crash the host, leading to a Denial of Service.\n(CVE-2016-1571)\n\nXen 4.6.x and earlier allows local guest administrators to cause a denial\nof service (host reboot) via vectors related to multiple mappings of MMIO\npages with different cachability settings (CVE-2016-2270).\n\nVMX in Xen 4.6.x and earlier, when using an Intel or Cyrix CPU, allows\nlocal HVM guest users to cause a denial of service (guest crash) via\nvectors related to a non-canonical RIP (CVE-2016-2271).\n\nFor other fixes in this update, see the referenced changelogs.\n","status":"published","published":"2016-03-07T11:20:30Z","modified":"2026-04-16T06:26:13.002854919Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"RHSA-2015:1087","title":"Red Hat Security Advisory: qemu-kvm security update","status":"published","published":"2024-09-15T22:36:40Z","modified":"2026-06-27T10:02:26Z","updated_at":"2026-11-02T15:53:03.182161Z"},{"id":"RHSA-2015:1088","title":"Red Hat Security Advisory: qemu-kvm-rhev security update","status":"published","published":"2024-09-15T22:36:45Z","modified":"2026-06-27T10:02:27Z","updated_at":"2026-11-02T15:53:03.182161Z"},{"id":"RHSA-2015:1089","title":"Red Hat Security Advisory: qemu-kvm-rhev security update","status":"published","published":"2024-09-15T22:36:51Z","modified":"2026-06-27T10:02:27Z","updated_at":"2026-11-02T15:53:03.182161Z"},{"id":"RHSA-2015:1189","title":"Red Hat Security Advisory: kvm security update","status":"published","published":"2024-09-15T22:36:55Z","modified":"2026-06-27T10:02:34Z","updated_at":"2026-11-02T15:53:03.182161Z"},{"id":"SUSE-SU-2015:0870-1","title":"Security update for kvm","description":"\nkvm has been updated to fix issues in the embedded qemu:\n\n    * \n\n      CVE-2014-0223: An integer overflow flaw was found in the QEMU block\n      driver for QCOW version 1 disk images. A user able to alter the QEMU\n      disk image files loaded by a guest could have used this flaw to\n      corrupt QEMU process memory on the host, which could potentially have\n      resulted in arbitrary code execution on the host with the privileges\n      of the QEMU process.\n\n    * \n\n      CVE-2014-3461: A user able to alter the savevm data (either on the\n      disk or over the wire during migration) could have used this flaw to\n      to corrupt QEMU process memory on the (destination) host, which could\n      have potentially resulted in arbitrary code execution on the host\n      with the privileges of the QEMU process.\n\n    * \n\n      CVE-2014-0222: An integer overflow flaw was found in the QEMU block\n      driver for QCOW version 1 disk images. A user able to alter the QEMU\n      disk image files loaded by a guest could have used this flaw to\n      corrupt QEMU process memory on the host, which could have potentially\n      resulted in arbitrary code execution on the host with the privileges\n      of the QEMU process.\n\nNon-security bugs fixed:\n\n    * Fix exceeding IRQ routes that could have caused freezes of guests.\n      (bnc#876842)\n    * Fix CPUID emulation bugs that may have broken Windows guests with\n      newer -cpu types (bnc#886535)\n\nSecurity Issues:\n\n    * CVE-2014-0222\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0222\u003e\n    * CVE-2014-0223\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0223\u003e\n    * CVE-2014-3461\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3461\u003e\n\n","status":"published","published":"2014-09-19T14:41:45Z","modified":"2026-02-04T02:40:36.136649Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2015:0889-1","title":"Security update for kvm","description":"\nkvm has been updated to fix issues in the embedded qemu:\n\n    * \n\n      CVE-2014-0223: An integer overflow flaw was found in the QEMU block\n      driver for QCOW version 1 disk images. A user able to alter the QEMU\n      disk image files loaded by a guest could have used this flaw to\n      corrupt QEMU process memory on the host, which could potentially have\n      resulted in arbitrary code execution on the host with the privileges\n      of the QEMU process.\n\n    * \n\n      CVE-2014-3461: A user able to alter the savevm data (either on the\n      disk or over the wire during migration) could have used this flaw to\n      to corrupt QEMU process memory on the (destination) host, which could\n      have potentially resulted in arbitrary code execution on the host\n      with the privileges of the QEMU process.\n\n    * \n\n      CVE-2014-0222: An integer overflow flaw was found in the QEMU block\n      driver for QCOW version 1 disk images. A user able to alter the QEMU\n      disk image files loaded by a guest could have used this flaw to\n      corrupt QEMU process memory on the host, which could have potentially\n      resulted in arbitrary code execution on the host with the privileges\n      of the QEMU process.\n\nNon-security bugs fixed:\n\n    * Fix exceeding IRQ routes that could have caused freezes of guests.\n      (bnc#876842)\n    * Fix CPUID emulation bugs that may have broken Windows guests with\n      newer -cpu types (bnc#886535)\n\nSecurity Issues:\n\n    * CVE-2014-0222\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0222\u003e\n    * CVE-2014-0223\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0223\u003e\n    * CVE-2014-3461\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3461\u003e\n\n","status":"published","published":"2014-09-19T14:41:45Z","modified":"2026-02-04T02:14:59.402186Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2015:0929-1","title":"Security update for kvm","description":"\nThe kvm qemu vt100 emulation was affected by a problem where specific vt100 \nsequences could have been used by guest users to affect the host. \n(CVE-2012-3515 aka XSA-17).\n\nAlso a temp file race was fixed. (CVE-2012-2652)\n\nSecurity Issue reference:\n\n    * CVE-2012-3515\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3515\u003e\n    * CVE-2012-2652\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2652\u003e\n\n","status":"published","published":"2012-08-31T14:36:20Z","modified":"2026-02-04T03:38:26.839919Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2015:1042-1","title":"Security update for xen","description":"Xen was updated to fix seven security issues and one non-security bug.\n\nThe following vulnerabilities were fixed:\n\n* CVE-2015-4103: Potential unintended writes to host MSI message data field via qemu (XSA-128) (bnc#931625)\n* CVE-2015-4104: PCI MSI mask bits inadvertently exposed to guests (XSA-129) (bnc#931626)\n* CVE-2015-4105: Guest triggerable qemu MSI-X pass-through error messages (XSA-130) (bnc#931627)\n* CVE-2015-4106: Unmediated PCI register access in qemu (XSA-131) (bnc#931628)\n* CVE-2015-4163: GNTTABOP_swap_grant_ref operation misbehavior (XSA-134) (bnc#932790)\n* CVE-2015-3209: heap overflow in qemu pcnet controller allowing guest to host escape (XSA-135) (bnc#932770)\n* CVE-2015-4164: DoS through iret hypercall handler (XSA-136) (bnc#932996)\n\nThe following non-security bug was fixed:\n\n* bnc#906689: let systemd schedule xencommons after network-online.target and remote-fs.target so that xendomains has access to remote shares\n","status":"published","published":"2015-06-03T12:47:57Z","modified":"2026-02-04T02:38:31.335401Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2015:1045-1","title":"Security update for Xen","description":"\nXen was updated to fix seven security vulnerabilities:\n\n    * CVE-2015-4103: Potential unintended writes to host MSI message data\n      field via qemu. (XSA-128, bnc#931625)\n    * CVE-2015-4104: PCI MSI mask bits inadvertently exposed to guests.\n      (XSA-129, bnc#931626)\n    * CVE-2015-4105: Guest triggerable qemu MSI-X pass-through error\n      messages. (XSA-130, bnc#931627)\n    * CVE-2015-4106: Unmediated PCI register access in qemu. (XSA-131,\n      bnc#931628)\n    * CVE-2015-4163: GNTTABOP_swap_grant_ref operation misbehavior.\n      (XSA-134, bnc#932790)\n    * CVE-2015-3209: Heap overflow in qemu pcnet controller allowing guest\n      to host escape. (XSA-135, bnc#932770)\n    * CVE-2015-4164: DoS through iret hypercall handler. (XSA-136,\n      bnc#932996)\n\nSecurity Issues:\n\n    * CVE-2015-4103\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4103\u003e\n    * CVE-2015-4104\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4104\u003e\n    * CVE-2015-4105\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4105\u003e\n    * CVE-2015-4106\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4106\u003e\n    * CVE-2015-4163\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4163\u003e\n    * CVE-2015-4164\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4164\u003e\n    * CVE-2015-3209\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3209\u003e\n\n","status":"published","published":"2015-06-05T12:53:19Z","modified":"2026-02-04T04:35:43.662637Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2015:1152-1","title":"Security update for kvm","description":"\nkvm has been updated to fix issues in the embedded qemu:\n\n    * \n\n      CVE-2014-0223: An integer overflow flaw was found in the QEMU block\n      driver for QCOW version 1 disk images. A user able to alter the QEMU\n      disk image files loaded by a guest could have used this flaw to\n      corrupt QEMU process memory on the host, which could potentially have\n      resulted in arbitrary code execution on the host with the privileges\n      of the QEMU process.\n\n    * \n\n      CVE-2014-3461: A user able to alter the savevm data (either on the\n      disk or over the wire during migration) could have used this flaw to\n      to corrupt QEMU process memory on the (destination) host, which could\n      have potentially resulted in arbitrary code execution on the host\n      with the privileges of the QEMU process.\n\n    * \n\n      CVE-2014-0222: An integer overflow flaw was found in the QEMU block\n      driver for QCOW version 1 disk images. A user able to alter the QEMU\n      disk image files loaded by a guest could have used this flaw to\n      corrupt QEMU process memory on the host, which could have potentially\n      resulted in arbitrary code execution on the host with the privileges\n      of the QEMU process.\n\nNon-security bugs fixed:\n\n    * Fix exceeding IRQ routes that could have caused freezes of guests.\n      (bnc#876842)\n    * Fix CPUID emulation bugs that may have broken Windows guests with\n      newer -cpu types (bnc#886535)\n\nSecurity Issues:\n\n    * CVE-2014-0222\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0222\u003e\n    * CVE-2014-0223\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0223\u003e\n    * CVE-2014-3461\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3461\u003e\n\n","status":"published","published":"2014-09-19T14:41:45Z","modified":"2026-02-04T03:41:35.653354Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"SUSE-SU-2015:1156-1","title":"Security update for Xen","description":"\nXen was updated to fix six security issues:\n\n    * CVE-2015-4103: Potential unintended writes to host MSI message data\n      field via qemu. (XSA-128, bsc#931625)\n    * CVE-2015-4104: PCI MSI mask bits inadvertently exposed to guests.\n      (XSA-129, bsc#931626)\n    * CVE-2015-4105: Guest triggerable qemu MSI-X pass-through error\n      messages. (XSA-130, bsc#931627)\n    * CVE-2015-4106: Unmediated PCI register access in qemu. (XSA-131,\n      bsc#931628)\n    * CVE-2015-3209: heap overflow in qemu pcnet controller allowing guest\n      to host escape. (XSA-135, bsc#932770)\n    * CVE-2015-4164: DoS through iret hypercall handler. (XSA-136,\n      bsc#932996)\n\nSecurity Issues:\n\n    * CVE-2015-4103\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4103\u003e\n    * CVE-2015-4104\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4104\u003e\n    * CVE-2015-4105\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4105\u003e\n    * CVE-2015-4106\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4106\u003e\n    * CVE-2015-4164\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4164\u003e\n    * CVE-2015-3209\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3209\u003e\n\n","status":"published","published":"2015-06-05T12:39:39Z","modified":"2026-02-04T03:24:02.982488Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"SUSE-SU-2015:1157-1","title":"Security update for Xen","description":"\nXen was updated to fix six security issues:\n\n    * CVE-2015-4103: Potential unintended writes to host MSI message data\n      field via qemu. (XSA-128, bsc#931625)\n    * CVE-2015-4104: PCI MSI mask bits inadvertently exposed to guests.\n      (XSA-129, bsc#931626)\n    * CVE-2015-4105: Guest triggerable qemu MSI-X pass-through error\n      messages. (XSA-130, bsc#931627)\n    * CVE-2015-4106: Unmediated PCI register access in qemu. (XSA-131,\n      bsc#931628)\n    * CVE-2015-3209: Heap overflow in qemu pcnet controller allowing guest\n      to host escape. (XSA-135, bsc#932770)\n    * CVE-2015-4164: DoS through iret hypercall handler. (XSA-136,\n      bsc#932996)\n\nSecurity Issues:\n\n    * CVE-2015-4103\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4103\u003e\n    * CVE-2015-4104\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4104\u003e\n    * CVE-2015-4105\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4105\u003e\n    * CVE-2015-4106\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4106\u003e\n    * CVE-2015-4163\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4163\u003e\n    * CVE-2015-4164\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4164\u003e\n    * CVE-2015-3209\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3209\u003e\n\n","status":"published","published":"2015-06-05T12:47:22Z","modified":"2026-02-04T02:40:25.116653Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"SUSE-SU-2015:1426-1","title":"Security update for kvm","description":"kvm was updated to fix two security issues.\n\nThe following vulnerabilities were fixed:\n\n- CVE-2015-5154: Host code execution via IDE subsystem CD-ROM (bsc#938344).\n- CVE-2015-3209: Fix buffer overflow in pcnet emulation (bsc#932770).\n","status":"published","published":"2015-08-07T17:46:18Z","modified":"2026-02-04T02:16:19.407523Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"SUSE-SU-2015:1519-1","title":"Security update for qemu","description":"qemu was updated to fix two security issues and augments one non-security bug fix.\n\nThe following vulnerabilities were fixed:\n\n* CVE-2015-3209: heap overflow in qemu pcnet controller allowing guest to host escape (XSA-135) (bsc#932770)\n* CVE-2015-4037: Avoid predictable directory name for smb config (bsc#932267)\n\nThe fix for the following non-security bug was improved:\n\n* bsc#893892: Use improved upstream patch for display issue affecting installs of SLES 11 VMs on SLES 12\n","status":"published","published":"2015-06-08T14:28:12Z","modified":"2026-02-04T04:36:23.556547Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"UBUNTU-CVE-2015-3209","description":"Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary code by sending a packet with TXSTATUS_STARTPACKET set and then a crafted packet with TXSTATUS_DEVICEOWNS set.","status":"published","published":"2015-06-10T14:00:00Z","modified":"2026-04-22T10:06:41.239422Z","updated_at":"2026-11-02T15:54:10.045446Z"},{"id":"USN-2630-1","title":"qemu, qemu-kvm vulnerabilities","description":"Matt Tait discovered that QEMU incorrectly handled the virtual PCNET\ndriver. A malicious guest could use this issue to cause a denial of\nservice, or possibly execute arbitrary code on the host as the user running\nthe QEMU process. In the default installation, when QEMU is used with\nlibvirt, attackers would be isolated by the libvirt AppArmor profile.\n(CVE-2015-3209)\n\nKurt Seifried discovered that QEMU incorrectly handled certain temporary\nfiles. A local attacker could use this issue to cause a denial of service.\n(CVE-2015-4037)\n\nJan Beulich discovered that the QEMU Xen code incorrectly restricted write\naccess to the host MSI message data field. A malicious guest could use this\nissue to cause a denial of service. This issue only applied to Ubuntu 14.04\nLTS, Ubuntu 14.10 and Ubuntu 15.04. (CVE-2015-4103)\n\nJan Beulich discovered that the QEMU Xen code incorrectly restricted access\nto the PCI MSI mask bits. A malicious guest could use this issue to cause a\ndenial of service. This issue only applied to Ubuntu 14.04 LTS, Ubuntu\n14.10 and Ubuntu 15.04. (CVE-2015-4104)\n\nJan Beulich discovered that the QEMU Xen code incorrectly handled MSI-X\nerror messages. A malicious guest could use this issue to cause a denial of\nservice. This issue only applied to Ubuntu 14.04 LTS, Ubuntu 14.10 and\nUbuntu 15.04. (CVE-2015-4105)\n\nJan Beulich discovered that the QEMU Xen code incorrectly restricted write\naccess to the PCI config space. A malicious guest could use this issue to\ncause a denial of service, obtain sensitive information, or possibly\nexecute arbitrary code. This issue only applied to Ubuntu 14.04 LTS,\nUbuntu 14.10 and Ubuntu 15.04. (CVE-2015-4106)\n","status":"published","published":"2015-06-10T14:30:07Z","modified":"2026-02-10T04:40:54Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}