CVE-2015-3340

LOW 2.9CVE-2015-3340 · Published 28/04/2015 · updated 17/06/2026

In short

CVE-2015-3340 is a LOW (CVSS 2.9) vulnerability affecting suse linux enterprise software development kit (suse).
Chance of exploitation in the next 30 days (EPSS): 0.79%, higher than 56.4% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
suse linux enterprise software development kit suse	`= 11.0`	No fix yet

Description

Xen 4.2.x through 4.5.x does not initialize certain fields, which allows certain remote service domains to obtain sensitive information from memory via a (1) XEN_DOMCTL_gettscinfo or (2) XEN_SYSCTL_getdomaininfolist request.

References

lists.fedoraproject.org/pipermail/package-announce/2015-April/156005.html · Third Party Advisory
lists.fedoraproject.org/pipermail/package-announce/2015-May/156979.html · Third Party Advisory
lists.fedoraproject.org/pipermail/package-announce/2015-May/157006.html · Third Party Advisory
lists.opensuse.org/opensuse-security-announce/2015-05/msg00018.html · Third Party Advisory
lists.opensuse.org/opensuse-security-announce/2015-05/msg00019.html · Third Party Advisory
lists.opensuse.org/opensuse-security-announce/2015-06/msg00001.html · Third Party Advisory
debian.org/security/2015/dsa-3414 · Third Party Advisory
securityfocus.com/bid/74248 · Third Party Advisory
securitytracker.com/id/1032158 · Third Party Advisory
xenbits.xen.org/xsa/advisory-132.html · Patch

More vulnerabilities in suse linux enterprise software development kit

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free