CVE-2015-3340

Advisory lineage Upstream: 0 Downstream: 6
Modified
Published: 28 Apr 2015, 14:00
Last modified:06 Aug 2024, 05:47

Vulnerability Summary

Overall Risk (default)
low
12/100
CVSS Score
2.9 LOW
v2.0 (nvd)
EPSS Score
0.63% LOW
1% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

28 Apr 2015, 14:00
Published
Vulnerability first disclosed
06 Aug 2024, 05:47
Last Modified
Vulnerability information updated

Description

Xen 4.2.x through 4.5.x does not initialize certain fields, which allows certain remote service domains to obtain sensitive information from memory via a (1) XEN_DOMCTL_gettscinfo or (2) XEN_SYSCTL_getdomaininfolist request.

CVSS Metrics

  • v2.0•LOW•Score: 2.9AV:A/AC:M/Au:N/C:P/I:N/A:N

EPSS Trends

Current EPSS score: 0.63%• Percentile: 71%

Techniques & Countermeasures

  • CWE-200•Exposure of Sensitive Information to an Unauthorized Actor

    The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Affected Systems

  • debian•debian_linux

    7.0 | 8.0

  • fedoraproject•fedora

    20 | 21 | 22

  • opensuse•opensuse

    13.1

  • suse•linux_enterprise_desktop

    12

  • suse•linux_enterprise_software_development_kit

    12

  • suse•suse_linux_enterprise_desktop

    11.0:sp3

  • suse•suse_linux_enterprise_server

    11.0:sp3 | 12

  • suse•suse_linux_enterprise_software_development_kit

    11.0:sp3

  • xen•xen

    4.2.0 | 4.2.1 | 4.2.2 | 4.2.3 | 4.2.4 | 4.2.5 | 4.3.0 | 4.3.1 | 4.3.2 | 4.3.3 | 4.3.4 | 4.4.0 | 4.4.1 | 4.4.2 | 4.5.0

References (11)