CVE-2015-5165: arista eos Use of Uninitialized Resource

Modified

AliasesRHSA-2015:1674RHSA-2015:1683RHSA-2015:1718+6 more

Published 12-08-2015Last modified 06-08-2024

Vulnerability summary

CVE-2015-5165 is a high (CVSS 9.3) Use of Uninitialized Resource vulnerability in arista eos. EPSS estimates a 13.29% chance of exploitation in the next 30 days, higher than 96.3% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 9.3, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

9.3/10

010

High · v2.0 (NVD)

EPSS score

13.29%

0%100%

Medium · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 13 · Related 7

DLA-479-1 DSA-3348-1 DSA-3349-1 MGASA-2015-0368 MGASA-2015-0369 MGASA-2016-0098+7 more

Timeline

12-08-2015
PublishedVulnerability first disclosed.
06-08-2024
Last modifiedVulnerability information updated.

Description

The C+ mode offload emulation in the RTL8139 network card device model in QEMU, as used in Xen 4.5.x and earlier, allows remote attackers to read process heap memory via unspecified vectors.

CVSS metrics

1 score · 1 source · 1 version

v2.09.3

EPSS trend

Probability

13.29%

Chance of exploitation in the next 30 days

Percentile

96%

Versus all other CVEs

30-day change

No change 0.00 pp

From 13.29% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-908Use of Uninitialized ResourceThe product uses or accesses a resource that has not been initialized.

Affected systems

Version check

Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.

Redhat35 products

enterprise_linux_compute_node_eus7.1 | 7.2 | 7.3 | 7.4 | 7.5 | 7.6 | 7.7
enterprise_linux_desktop6.0
enterprise_linux_eus6.7
enterprise_linux_eus_compute_node6.7
enterprise_linux_for_power_big_endian6.0 | 7.0

Show all 35

Debian3 products

qemu< 1:2.4+dfsg-1a
xen< 4.4.0-1
debian_linuxEOL7.0 | 8.0

Suse2 products

linux_enterprise_debuginfo11:sp1
linux_enterprise_server10:sp4 | 11:sp1

Ubuntu2 products

qemu< 2.0.0+dfsg-2ubuntu1.17
xen< 4.4.2-0ubuntu0.14.04.2

Arista1 product

eos4.12 | 4.13 | 4.14 | 4.15

Fedoraproject1 product

fedoraEOL21 | 22

Oracle1 product

linux7:0

Xen1 product

xen≤ 4.5.0 | 4.5.1

8 vendors · 46 products

References

42 links

rhn.redhat.com/errata/RHSA-2015-1674.htmlVendor AdvisoryX Refsource REDHATIssue TrackingThird Party Advisory
www.securitytracker.com/id/1033176VDB EntryX Refsource SECTRACKThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2015-09/msg00027.htmlVendor AdvisoryX Refsource SUSEIssue TrackingMailing ListThird Party Advisory
www.debian.org/security/2015/dsa-3348Vendor AdvisoryX Refsource DEBIANThird Party Advisory
www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.htmlX Refsource CONFIRMThird Party Advisory
support.citrix.com/article/CTX201717X Refsource CONFIRMBroken LinkThird Party Advisory
rhn.redhat.com/errata/RHSA-2015-1683.htmlVendor AdvisoryX Refsource REDHATIssue TrackingThird Party Advisory
rhn.redhat.com/errata/RHSA-2015-1793.htmlVendor AdvisoryX Refsource REDHATIssue TrackingThird Party Advisory
www.debian.org/security/2015/dsa-3349Vendor AdvisoryX Refsource DEBIANThird Party Advisory
lists.fedoraproject.org/pipermail/package-announce/2015-September/167820.htmlVendor AdvisoryX Refsource FEDORAIssue TrackingMailing ListThird Party Advisory

Show all 42 references

lists.fedoraproject.org/pipermail/package-announce/2015-September/165373.htmlVendor AdvisoryX Refsource FEDORAIssue TrackingMailing ListThird Party Advisory
rhn.redhat.com/errata/RHSA-2015-1833.htmlVendor AdvisoryX Refsource REDHATIssue TrackingThird Party Advisory
lists.fedoraproject.org/pipermail/package-announce/2015-September/167792.htmlVendor AdvisoryX Refsource FEDORAIssue TrackingMailing ListThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2015-08/msg00018.htmlVendor AdvisoryX Refsource SUSEIssue TrackingMailing ListThird Party Advisory
rhn.redhat.com/errata/RHSA-2015-1740.htmlVendor AdvisoryX Refsource REDHATIssue TrackingThird Party Advisory
rhn.redhat.com/errata/RHSA-2015-1739.htmlVendor AdvisoryX Refsource REDHATIssue TrackingThird Party Advisory
www.securityfocus.com/bid/76153VDB EntryX Refsource BIDThird Party Advisory
xenbits.xen.org/xsa/advisory-140.htmlX Refsource CONFIRMPatchVendor AdvisoryARTICLEREPORT
www.arista.com/en/support/advisories-notices/security-advisories/1180-security-advisory-13X Refsource MISCThird Party Advisory
access.redhat.com/errata/RHSA-2015:1674Advisory
access.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=1248760REPORT
security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1674.jsonAdvisory
access.redhat.com/security/cve/CVE-2015-5165REPORT
www.cve.org/CVERecord?id=CVE-2015-5165AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2015-5165Advisory
access.redhat.com/errata/RHSA-2015:1683Advisory
security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1683.jsonAdvisory
access.redhat.com/errata/RHSA-2015:1718Advisory
security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1718.jsonAdvisory
access.redhat.com/errata/RHSA-2015:1739Advisory
bugzilla.redhat.com/show_bug.cgi?id=1248382REPORT
security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1739.jsonAdvisory
access.redhat.com/errata/RHSA-2015:1740Advisory
security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1740.jsonAdvisory
access.redhat.com/errata/RHSA-2015:1793Advisory
security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1793.jsonAdvisory
access.redhat.com/errata/RHSA-2015:1833Advisory
security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1833.jsonAdvisory
ubuntu.com/security/CVE-2015-5165REPORT
ubuntu.com/security/notices/USN-2724-1Advisory
security-tracker.debian.org/tracker/CVE-2015-5165Advisory