What’s Vulnerable › Vulnerabilities
CVE-2015-4106
- Severity: medium (CVSS 4.6 v2.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2015-06-03 · updated 2026-06-17
- Weakness: CWE-863
Description
QEMU does not properly restrict write access to the PCI config space for certain PCI pass-through devices, which might allow local x86 HVM guests to gain privileges, cause a denial of service (host crash), obtain sensitive information, or possibly have other unspecified impact via unknown vectors.
Affected products
- Canonical Ubuntu Linux: 12.04, 14.04, 14.10, 15.04 (and their updates)
- Citrix XenServer: 6.2.0, 6.5; 6.0, 6.0.2, 6.1.0 (and their updates)
- Debian Linux: 7.0, 8.0 (and their updates)
- Fedoraproject Fedora: 20, 21, 22 (and their updates)
- QEMU: through 2.3.1
- SUSE Linux Enterprise Server 15 SP1: 11-sp3; 12
- SUSE Linux Enterprise Server: 11-sp1, 11-sp2, 11-sp3; 12
- SUSE Linux Enterprise Software Development Kit: 11-sp3; 12
References
- http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160154.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160171.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160685.html
- http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00004.html
- http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00007.html
- http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00029.html
- http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00030.html
- http://support.citrix.com/article/CTX201145
- http://www.debian.org/security/2015/dsa-3284
- http://www.debian.org/security/2015/dsa-3286
- http://www.securityfocus.com/bid/74949
- http://www.securitytracker.com/id/1032467
Get alerted when CVE-2015-4106 or the next vulnerability affects your stack