CVE-2015-5165
UnknownEPSS 13.29%
Last modified
CVE-2015-5165 is a vulnerability of currently unknown severity. The C+ mode offload emulation in the RTL8139 network card device model in QEMU, as used in Xen 4.5.x and earlier, allows remote attackers to read process heap memory via unspecified vectors.. EPSS estimates a 13.29% chance of exploitation in the next 30 days.
Description
The C+ mode offload emulation in the RTL8139 network card device model in QEMU, as used in Xen 4.5.x and earlier, allows remote attackers to read process heap memory via unspecified vectors.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Xen | Xen | <= 4.5.0 | — |
| Xen | Xen | 4.5.1 | — |
| Fedoraproject | Fedora | 21 | — |
| Fedoraproject | Fedora | 22 | — |
| Suse | Linux Enterprise Debuginfo | 11 | Sp1 |
| Suse | Linux Enterprise Server | 10 | Sp4 |
| Suse | Linux Enterprise Server | 11 | Sp1 |
| Debian | Debian Linux | 7.0 | — |
| Debian | Debian Linux | 8.0 | — |
| Redhat | Openstack | 5.0 | — |
| Redhat | Openstack | 6.0 | — |
| Redhat | Virtualization | 3.0 | — |
| Redhat | Enterprise Linux Compute Node Eus | 7.1 | — |
| Redhat | Enterprise Linux Compute Node Eus | 7.2 | — |
| Redhat | Enterprise Linux Compute Node Eus | 7.3 | — |
| Redhat | Enterprise Linux Compute Node Eus | 7.4 | — |
| Redhat | Enterprise Linux Compute Node Eus | 7.5 | — |
| Redhat | Enterprise Linux Compute Node Eus | 7.6 | — |
| Redhat | Enterprise Linux Compute Node Eus | 7.7 | — |
| Redhat | Enterprise Linux Desktop | 6.0 | — |
| Redhat | Enterprise Linux Eus | 6.7 | — |
| Redhat | Enterprise Linux Eus Compute Node | 6.7 | — |
| Redhat | Enterprise Linux For Power Big Endian | 6.0 | — |
| Redhat | Enterprise Linux For Power Big Endian | 7.0 | — |
| Redhat | Enterprise Linux For Power Big Endian Eus | 6.7_ppc64 | — |
| Redhat | Enterprise Linux For Power Big Endian Eus | 7.1_ppc64 | — |
| Redhat | Enterprise Linux For Power Big Endian Eus | 7.2_ppc64 | — |
| Redhat | Enterprise Linux For Power Big Endian Eus | 7.3_ppc64 | — |
| Redhat | Enterprise Linux For Power Big Endian Eus | 7.4_ppc64 | — |
| Redhat | Enterprise Linux For Power Big Endian Eus | 7.5_ppc64 | — |
| Redhat | Enterprise Linux For Power Big Endian Eus | 7.6_ppc64 | — |
| Redhat | Enterprise Linux For Power Big Endian Eus | 7.7_ppc64 | — |
| Redhat | Enterprise Linux For Scientific Computing | 6.0 | — |
| Redhat | Enterprise Linux For Scientific Computing | 7.0 | — |
| Redhat | Enterprise Linux Server | 6.0 | — |
| Redhat | Enterprise Linux Server | 7.0 | — |
| Redhat | Enterprise Linux Server Aus | 7.3 | — |
| Redhat | Enterprise Linux Server Aus | 7.4 | — |
| Redhat | Enterprise Linux Server Aus | 7.6 | — |
| Redhat | Enterprise Linux Server Aus | 7.7 | — |
| Redhat | Enterprise Linux Server Eus | 7.1 | — |
| Redhat | Enterprise Linux Server Eus | 7.2 | — |
| Redhat | Enterprise Linux Server Eus | 7.3 | — |
| Redhat | Enterprise Linux Server Eus | 7.4 | — |
| Redhat | Enterprise Linux Server Eus | 7.5 | — |
| Redhat | Enterprise Linux Server Eus | 7.6 | — |
| Redhat | Enterprise Linux Server Eus | 7.7 | — |
| Redhat | Enterprise Linux Server Eus From Rhui | 6.7 | — |
| Redhat | Enterprise Linux Server From Rhui | 6.0 | — |
| Redhat | Enterprise Linux Server From Rhui | 7.0 | — |
Showing 50 of 65 affected configurations. See NVD for the full list.
References
- http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165373.htmlIssue Tracking, Mailing List, Third Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2015-September/167792.htmlIssue Tracking, Mailing List, Third Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2015-September/167820.htmlIssue Tracking, Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00018.htmlIssue Tracking, Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00027.htmlIssue Tracking, Mailing List, Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1674.htmlIssue Tracking, Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1683.htmlIssue Tracking, Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1739.htmlIssue Tracking, Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1740.htmlIssue Tracking, Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1793.htmlIssue Tracking, Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1833.htmlIssue Tracking, Third Party Advisory
- http://support.citrix.com/article/CTX201717Broken Link, Third Party Advisory
- http://www.debian.org/security/2015/dsa-3348Third Party Advisory
- http://www.debian.org/security/2015/dsa-3349Third Party Advisory
- http://www.securityfocus.com/bid/76153Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1033176Third Party Advisory, VDB Entry
- http://xenbits.xen.org/xsa/advisory-140.htmlPatch, Vendor Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165373.htmlIssue Tracking, Mailing List, Third Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2015-September/167792.htmlIssue Tracking, Mailing List, Third Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2015-September/167820.htmlIssue Tracking, Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00018.htmlIssue Tracking, Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00027.htmlIssue Tracking, Mailing List, Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1674.htmlIssue Tracking, Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1683.htmlIssue Tracking, Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1739.htmlIssue Tracking, Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1740.htmlIssue Tracking, Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1793.htmlIssue Tracking, Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1833.htmlIssue Tracking, Third Party Advisory
- http://support.citrix.com/article/CTX201717Broken Link, Third Party Advisory
- http://www.debian.org/security/2015/dsa-3348Third Party Advisory
- http://www.debian.org/security/2015/dsa-3349Third Party Advisory
- http://www.securityfocus.com/bid/76153Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1033176Third Party Advisory, VDB Entry
- http://xenbits.xen.org/xsa/advisory-140.htmlPatch, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2015-5165?
The C+ mode offload emulation in the RTL8139 network card device model in QEMU, as used in Xen 4.5.x and earlier, allows remote attackers to read process heap memory via unspecified vectors.
How severe is CVE-2015-5165?
Severity scoring for CVE-2015-5165 is pending analysis. The EPSS model estimates a 13.29% probability of exploitation in the next 30 days.
How do I fix CVE-2015-5165?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
Are you affected by CVE-2015-5165?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST