CVE-2015-2152

Xen 4.5.x and earlier enables certain default backends when emulating a VGA device for an x86 HVM guest qemu even when the configuration disables them, which allows local guest users to obtain access to the VGA console by (1) setting the DISPLAY environment variable, when compiled with SDL support, or connecting to the VNC server on (2) ::1 or (3) 127.0.0.1, when not compiled with SDL support.

• CWE-264

• http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152483.htmlThird Party Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152588.htmlThird Party Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152776.htmlThird Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00014.html
• http://www.securityfocus.com/bid/73068
• http://www.securitytracker.com/id/1031806Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1031919Third Party Advisory, VDB Entry
• http://xenbits.xen.org/xsa/advisory-119.htmlPatch, Vendor Advisory
• https://security.gentoo.org/glsa/201504-04
• http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152483.htmlThird Party Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152588.htmlThird Party Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152776.htmlThird Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00014.html
• http://www.securityfocus.com/bid/73068
• http://www.securitytracker.com/id/1031806Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1031919Third Party Advisory, VDB Entry
• http://xenbits.xen.org/xsa/advisory-119.htmlPatch, Vendor Advisory
• https://security.gentoo.org/glsa/201504-04

Published

Mar 18, 2015

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-2146Multiple SQL injection vulnerabilities in Issuetracker phpBu…
• CVE-2015-2147Multiple SQL injection vulnerabilities in Issuetracker phpBu…
• CVE-2015-2148Multiple cross-site scripting (XSS) vulnerabilities in Issue…
• CVE-2015-2149Multiple cross-site scripting (XSS) vulnerabilities in the a…
• CVE-2015-2150Xen 3.3.x through 4.5.x and the Linux kernel through 3.19.1 …
• CVE-2015-2151The x86 emulator in Xen 3.2.x through 4.5.x does not properl…
• CVE-2015-2153The rpki_rtr_pdu_print function in print-rpki-rtr.c in the T…
• CVE-2015-2154The osi_print_cksum function in print-isoclns.c in the ether…
• CVE-2015-2155The force printer in tcpdump before 4.7.2 allows remote atta…
• CVE-2015-2156Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x …
• CVE-2015-2157The (1) ssh2_load_userkey and (2) ssh2_save_userkey function…
• CVE-2015-2158Off-by-one error in the pngcrush_measure_idat function in pn…