CVE-2015-5162

Severity: high (CVSS 7.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2016-10-07 · updated 2026-06-17
Weakness: CWE-399

Description

The image parser in OpenStack Cinder 7.0.2 and 8.0.0 through 8.1.1; Glance before 11.0.1 and 12.0.0; and Nova before 12.0.4 and 13.0.0 does not properly limit qemu-img calls, which might allow attackers to cause a denial of service (memory and disk consumption) via a crafted disk image.

Affected products

OpenStack Cinder: 7.0.2, 8.0.0, 8.1.0
OpenStack Glance: through 11.0.0; 11.0.1, 12.0.0
OpenStack Nova: through 12.0.3; 13.0.0

References

http://rhn.redhat.com/errata/RHSA-2016-2923.html
http://rhn.redhat.com/errata/RHSA-2016-2991.html
http://rhn.redhat.com/errata/RHSA-2017-0153.html
http://rhn.redhat.com/errata/RHSA-2017-0156.html
http://rhn.redhat.com/errata/RHSA-2017-0165.html
http://rhn.redhat.com/errata/RHSA-2017-0282.html
http://www.openwall.com/lists/oss-security/2016/10/06/8
http://www.securityfocus.com/bid/76849
https://launchpad.net/bugs/1449062
http://rhn.redhat.com/errata/RHSA-2016-2923.html
http://rhn.redhat.com/errata/RHSA-2016-2991.html
http://rhn.redhat.com/errata/RHSA-2017-0153.html

Get alerted when CVE-2015-5162 or the next vulnerability affects your stack