Unrated severityNVD Advisory· Published Aug 12, 2015· Updated May 6, 2026
CVE-2015-5154
CVE-2015-5154
Description
Heap-based buffer overflow in the IDE subsystem in QEMU, as used in Xen 4.5.x and earlier, when the container has a CDROM drive enabled, allows local guest users to execute arbitrary code on the host via unspecified ATAPI commands.
Affected products
46- cpe:2.3:a:suse:linux_enterprise_debuginfo:11:sp4:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:21:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:o:fedoraproject:fedora:21:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:23:*:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_desktop:11:sp4:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:suse:linux_enterprise_desktop:11:sp4:*:*:*:*:*:*
- cpe:2.3:o:suse:linux_enterprise_desktop:12:*:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_server:11:sp4:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:suse:linux_enterprise_server:11:sp4:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:12:*:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp4:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp4:*:*:*:*:*:*
- cpe:2.3:o:suse:linux_enterprise_software_development_kit:12:*:*:*:*:*:*:*
- osv-coords33 versionspkg:rpm/opensuse/xen&distro=openSUSE%20Tumbleweedpkg:rpm/suse/kvm&distro=SUSE%20Linux%20Enterprise%20Desktop%2011%20SP3pkg:rpm/suse/kvm&distro=SUSE%20Linux%20Enterprise%20Desktop%2011%20SP4pkg:rpm/suse/kvm&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP1-LTSSpkg:rpm/suse/kvm&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP1-TERADATApkg:rpm/suse/kvm&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP2-LTSSpkg:rpm/suse/kvm&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP3pkg:rpm/suse/kvm&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP3-TERADATApkg:rpm/suse/kvm&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4pkg:rpm/suse/kvm&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2011%20SP3pkg:rpm/suse/kvm&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2011%20SP4pkg:rpm/suse/qemu&distro=SUSE%20Linux%20Enterprise%20Desktop%2012pkg:rpm/suse/qemu&distro=SUSE%20Linux%20Enterprise%20Server%2012pkg:rpm/suse/qemu&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012pkg:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Desktop%2011%20SP3pkg:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Desktop%2011%20SP4pkg:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Desktop%2012pkg:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP1pkg:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP1-LTSSpkg:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP2-LTSSpkg:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP3pkg:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP3-TERADATApkg:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4pkg:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Server%2012pkg:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP1pkg:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2011%20SP3pkg:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2011%20SP4pkg:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012pkg:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP1pkg:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2011%20SP3pkg:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2011%20SP4pkg:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012pkg:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP1
< 4.7.0_12-1.3+ 32 more
- (no CPE)range: < 4.7.0_12-1.3
- (no CPE)range: < 1.4.2-0.22.34.3
- (no CPE)range: < 1.4.2-32.1
- (no CPE)range: < 0.12.5-1.30.2
- (no CPE)range: < 0.12.5-1.30.2
- (no CPE)range: < 0.15.1-0.32.2
- (no CPE)range: < 1.4.2-0.22.34.3
- (no CPE)range: < 1.4.2-0.22.34.3
- (no CPE)range: < 1.4.2-32.1
- (no CPE)range: < 1.4.2-0.22.34.3
- (no CPE)range: < 1.4.2-32.1
- (no CPE)range: < 2.0.2-48.9.1
- (no CPE)range: < 2.0.2-48.9.1
- (no CPE)range: < 2.0.2-48.9.1
- (no CPE)range: < 4.2.5_12-15.1
- (no CPE)range: < 4.4.2_10-5.1
- (no CPE)range: < 4.4.2_08-22.5.1
- (no CPE)range: < 4.5.2_02-4.1
- (no CPE)range: < 4.0.3_21548_18-29.1
- (no CPE)range: < 4.1.6_08-17.1
- (no CPE)range: < 4.2.5_12-15.1
- (no CPE)range: < 4.2.5_12-15.1
- (no CPE)range: < 4.4.2_10-5.1
- (no CPE)range: < 4.4.2_08-22.5.1
- (no CPE)range: < 4.5.2_02-4.1
- (no CPE)range: < 4.2.5_12-15.1
- (no CPE)range: < 4.4.2_10-5.1
- (no CPE)range: < 4.4.2_08-22.5.1
- (no CPE)range: < 4.5.2_02-4.1
- (no CPE)range: < 4.2.5_12-15.1
- (no CPE)range: < 4.4.2_10-5.1
- (no CPE)range: < 4.4.2_08-22.5.1
- (no CPE)range: < 4.5.2_02-4.1
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
21- xenbits.xen.org/xsa/advisory-138.htmlnvdPatchVendor Advisory
- lists.fedoraproject.org/pipermail/package-announce/2015-August/163472.htmlnvdThird Party Advisory
- lists.fedoraproject.org/pipermail/package-announce/2015-August/163658.htmlnvdThird Party Advisory
- lists.fedoraproject.org/pipermail/package-announce/2015-August/163681.htmlnvdThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2015-07/msg00041.htmlnvdThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2015-07/msg00042.htmlnvdThird Party Advisory
- support.citrix.com/article/CTX201593nvdThird Party Advisory
- security.gentoo.org/glsa/201510-02nvdThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2015-08/msg00017.htmlnvd
- lists.opensuse.org/opensuse-security-announce/2015-08/msg00018.htmlnvd
- lists.opensuse.org/opensuse-security-announce/2015-08/msg00020.htmlnvd
- lists.opensuse.org/opensuse-security-announce/2015-08/msg00022.htmlnvd
- lists.opensuse.org/opensuse-security-announce/2015-09/msg00027.htmlnvd
- lists.opensuse.org/opensuse-security-announce/2015-10/msg00019.htmlnvd
- rhn.redhat.com/errata/RHSA-2015-1507.htmlnvd
- rhn.redhat.com/errata/RHSA-2015-1508.htmlnvd
- rhn.redhat.com/errata/RHSA-2015-1512.htmlnvd
- www.debian.org/security/2015/dsa-3348nvd
- www.securityfocus.com/bid/76048nvd
- www.securitytracker.com/id/1033074nvd
- security.gentoo.org/glsa/201604-03nvd
News mentions
0No linked articles in our index yet.