CVE-2015-3209
UnknownEPSS 9.67%
Last modified
CVE-2015-3209 is a vulnerability of currently unknown severity. Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary code by sending a packet with TXSTATUS_STARTPACKET set and then a crafted packet with TXSTATUS_DEVICEOWNS set.. EPSS estimates a 9.67% chance of exploitation in the next 30 days.
Description
Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary code by sending a packet with TXSTATUS_STARTPACKET set and then a crafted packet with TXSTATUS_DEVICEOWNS set.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Qemu | Qemu | <= 2.3.1 | — |
| Juniper | Junos Space | <= 15.1 | — |
| Canonical | Ubuntu Linux | 12.04 | — |
| Canonical | Ubuntu Linux | 14.04 | — |
| Canonical | Ubuntu Linux | 14.10 | — |
| Canonical | Ubuntu Linux | 15.04 | — |
| Debian | Debian Linux | 7.0 | — |
| Debian | Debian Linux | 8.0 | — |
| Redhat | Enterprise Linux Desktop | 6.0 | — |
| Redhat | Enterprise Linux Eus | 6.6 | — |
| Redhat | Enterprise Linux Server | 5.0 | — |
| Redhat | Enterprise Linux Server | 6.0 | — |
| Redhat | Enterprise Linux Server Aus | 6.6 | — |
| Redhat | Enterprise Linux Server Tus | 6.6 | — |
| Redhat | Enterprise Linux Workstation | 5.0 | — |
| Redhat | Enterprise Linux Workstation | 6.0 | — |
| Redhat | Openstack | 5.0 | — |
| Redhat | Virtualization | 3.0 | — |
| Fedoraproject | Fedora | 20 | — |
| Fedoraproject | Fedora | 21 | — |
| Fedoraproject | Fedora | 22 | — |
| Suse | Linux Enterprise Debuginfo | 11 | Sp2 |
| Suse | Linux Enterprise Desktop | 11 | Sp3 |
| Suse | Linux Enterprise Desktop | 12 | — |
| Suse | Linux Enterprise Server | 10 | Sp4 |
| Suse | Linux Enterprise Server | 11 | Sp1 |
| Suse | Linux Enterprise Server | 12 | — |
| Suse | Linux Enterprise Software Development Kit | 11 | Sp3 |
| Suse | Linux Enterprise Software Development Kit | 12 | — |
| Arista | Eos | 4.12 | — |
| Arista | Eos | 4.13 | — |
| Arista | Eos | 4.14 | — |
| Arista | Eos | 4.15 | — |
References
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10698Third Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160669.htmlThird Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160677.htmlThird Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160685.htmlThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00004.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00007.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00027.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00029.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00030.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00014.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00020.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00015.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00027.htmlMailing List, Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1087.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1088.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1089.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1189.htmlThird Party Advisory
- http://www.debian.org/security/2015/dsa-3284Third Party Advisory
- http://www.debian.org/security/2015/dsa-3285Third Party Advisory
- http://www.debian.org/security/2015/dsa-3286Third Party Advisory
- http://www.securityfocus.com/bid/75123Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1032545Third Party Advisory, VDB Entry
- http://www.ubuntu.com/usn/USN-2630-1Third Party Advisory
- http://xenbits.xen.org/xsa/advisory-135.htmlThird Party Advisory
- https://kb.juniper.net/JSA10783Third Party Advisory
- https://security.gentoo.org/glsa/201510-02Third Party Advisory
- https://security.gentoo.org/glsa/201604-03Third Party Advisory
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10698Third Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160669.htmlThird Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160677.htmlThird Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160685.htmlThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00004.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00007.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00027.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00029.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00030.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00014.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00020.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00015.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00027.htmlMailing List, Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1087.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1088.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1089.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1189.htmlThird Party Advisory
- http://www.debian.org/security/2015/dsa-3284Third Party Advisory
- http://www.debian.org/security/2015/dsa-3285Third Party Advisory
- http://www.debian.org/security/2015/dsa-3286Third Party Advisory
- http://www.securityfocus.com/bid/75123Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1032545Third Party Advisory, VDB Entry
- http://www.ubuntu.com/usn/USN-2630-1Third Party Advisory
- http://xenbits.xen.org/xsa/advisory-135.htmlThird Party Advisory
- https://kb.juniper.net/JSA10783Third Party Advisory
- https://security.gentoo.org/glsa/201510-02Third Party Advisory
- https://security.gentoo.org/glsa/201604-03Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2015-3209?
Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary code by sending a packet with TXSTATUS_STARTPACKET set and then a crafted packet with TXSTATUS_DEVICEOWNS set.
How severe is CVE-2015-3209?
Severity scoring for CVE-2015-3209 is pending analysis. The EPSS model estimates a 9.67% probability of exploitation in the next 30 days.
How do I fix CVE-2015-3209?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2015
- CVE-2015-3203Unrestricted file upload vulnerability in h5ai before 0.25.0…
- CVE-2015-3204libreswan 3.9 through 3.12 allows remote attackers to cause …
- CVE-2015-3205libmimedir allows remote attackers to execute arbitrary code…
- CVE-2015-3206The checkPassword function in python-kerberos does not authe…
- CVE-2015-3207In Openshift Origin 3 the cookies being set in console have …5.3
- CVE-2015-3208Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2015-3210Heap-based buffer overflow in PCRE 8.34 through 8.37 and PCR…9.8
- CVE-2015-3211php-fpm allows local users to write to or create arbitrary f…
- CVE-2015-3212Race condition in net/sctp/socket.c in the Linux kernel befo…
- CVE-2015-3213The gesture handling code in Clutter before 1.16.2 allows ph…
- CVE-2015-3214The pit_ioport_read in i8254.c in the Linux kernel before 2.…
- CVE-2015-3215The NetKVM Windows Virtio driver allows remote attackers to …
Are you affected by CVE-2015-3209?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST