CVE-2012-3515

Опубликовано: 23 нояб. 2012

Источник: nvd

CVSS2: 7.2

EPSS Низкий

Описание

Qemu, as used in Xen 4.0, 4.1 and possibly other products, when emulating certain devices with a virtual console backend, allows local OS guest users to gain privileges via a crafted escape VT100 sequence that triggers the overwrite of a "device model's address space."

Ссылки

http://git.qemu.org/?p=qemu-stable-0.15.git%3Ba=log
http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00001.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00003.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00004.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00005.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00012.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00016.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00017.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00018.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00024.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00026.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00027.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00002.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00017.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00018.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2012-09/msg00051.html
Mailing List
Third Party Advisory
http://lists.xen.org/archives/html/xen-announce/2012-09/msg00003.html
Mailing List
Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2012-1233.html
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2012-1234.html
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2012-1235.html
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:*

Версия до 1.2.0 (исключая)

cpe:2.3:o:xen:xen:4.0.0:*:*:*:*:*:*:*

cpe:2.3:o:xen:xen:4.1.0:*:*:*:*:*:*:*

Конфигурация 2

Одно из

cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*

cpe:2.3:o:opensuse:opensuse:12.1:*:*:*:*:*:*:*

cpe:2.3:o:opensuse:opensuse:12.2:*:*:*:*:*:*:*

cpe:2.3:o:suse:linux_enterprise_desktop:10:sp4:*:*:*:*:*:*

cpe:2.3:o:suse:linux_enterprise_desktop:11:sp2:*:*:*:*:*:*

cpe:2.3:o:suse:linux_enterprise_server:10:sp2:*:*:*:*:*:*

cpe:2.3:o:suse:linux_enterprise_server:10:sp3:*:*:ltss:*:*:*

cpe:2.3:o:suse:linux_enterprise_server:10:sp4:*:*:*:*:*:*

cpe:2.3:o:suse:linux_enterprise_server:11:sp1:*:*:ltss:*:*:*

cpe:2.3:o:suse:linux_enterprise_server:11:sp2:*:*:*:-:*:*

cpe:2.3:o:suse:linux_enterprise_server:11:sp2:*:*:*:vmware:*:*

cpe:2.3:o:suse:linux_enterprise_software_development_kit:10:sp4:*:*:*:*:*:*

cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp2:*:*:*:*:*:*

Конфигурация 3

Одновременно

cpe:2.3:a:redhat:virtualization:3.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*

Конфигурация 4

Одно из

cpe:2.3:a:redhat:virtualization:5.0:*:*:*:*:*:*:*

cpe:2.3:a:redhat:virtualization:6.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_eus:6.3:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*

Конфигурация 5

Одно из

cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*

Конфигурация 6

Одно из

cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:-:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:11.04:*:*:*:*:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:11.10:*:*:*:*:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*

EPSS

Процентиль: 17%

0.00056

Низкий

7.2 High

CVSS2

Дефекты

CWE-20

Связанные уязвимости

CVE-2012-3515

ubuntu

больше 12 лет назад

CVE-2012-3515

redhat

почти 13 лет назад

CVE-2012-3515

debian

больше 12 лет назад

Qemu, as used in Xen 4.0, 4.1 and possibly other products, when emulat ...

GHSA-rwhm-5hjg-54j9

github

больше 3 лет назад

ELSA-2012-1236

oracle-oval

почти 13 лет назад

ELSA-2012-1236: xen security update (IMPORTANT)

EPSS

Процентиль: 17%

0.00056

Низкий

7.2 High

CVSS2

Дефекты

CWE-20