Vulnerability in Arista Eos
CVE-2015-5165
The C+ mode offload emulation in the RTL8139 network card device model in QEMU, as used in Xen 4.5.x and earlier, allows remote attackers to read process heap memory via unspecified vectors.
EPSS: 0.133 (96.0th percentile) — read the EPSS interpretation.
Affected products
- Arista Eos — versions 4.12, 4.13, 4.14
- Oracle Linux — versions 7
- Xen — versions 4.5.1
- Debian Debian_linux — versions 7.0, 8.0
- Fedoraproject Fedora — versions 21, 22
- Redhat Enterprise_linux_compute_node_eus — versions 7.1, 7.2, 7.3
- Redhat Enterprise_linux_desktop — versions 6.0
- Redhat Enterprise_linux_eus — versions 6.7
- Redhat Enterprise_linux_eus_compute_node — versions 6.7
- Redhat Enterprise_linux_for_power_big_endian — versions 6.0, 7.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory, Third Party Advisory, Issue Tracking)
- secalert@redhat.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_SECTRACK)
- secalert@redhat.com (vendor-advisory, Mailing List, Third Party Advisory, Issue Tracking, x_refsource_SUSE)
- secalert@redhat.com (vendor-advisory, Third Party Advisory, x_refsource_DEBIAN)
- secalert@redhat.com (x_refsource_CONFIRM, Third Party Advisory)
- secalert@redhat.com (x_refsource_CONFIRM, Third Party Advisory, Broken Link)
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory, Third Party Advisory, Issue Tracking)
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory, Third Party Advisory, Issue Tracking)
- secalert@redhat.com (vendor-advisory, Third Party Advisory, x_refsource_DEBIAN)
- secalert@redhat.com (vendor-advisory, x_refsource_FEDORA, Mailing List, Third Party Advisory, Issue Tracking)
Frequently asked questions
- What is CVE-2015-5165?
- CVE-2015-5165 is a vulnerability in Arista Eos, classified under Use of Uninitialized Resource. Published 2015-08-12.
- Is CVE-2015-5165 known to be exploited?
- 8 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.