CVE-2015-7311
published 2015-10-01CVE-2015-7311: libxl in Xen 4.1.x through 4.6.x does not properly handle the readonly flag on disks when using the qemu-xen device model, which allows local guest users to…
PriorityP412low3.6CVSS 2.0
AVLACLAuNCNIPAP
EPSS
0.42%
33.8th percentile
libxl in Xen 4.1.x through 4.6.x does not properly handle the readonly flag on disks when using the qemu-xen device model, which allows local guest users to write to a read-only disk image.
Affected
27 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | xen | < xen 4.8.0~rc3-1 (bookworm) | xen 4.8.0~rc3-1 (bookworm) |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | >= 0 < 4.8.0~rc3-1 | 4.8.0~rc3-1 |
| xen | xen | >= 0 < 4.8.0~rc3-1 | 4.8.0~rc3-1 |
CVSS provenance
nvdv2.03.6LOWAV:L/AC:L/Au:N/C:N/I:P/A:P
osv3.6LOW
vendor_debian3.6LOW
vendor_redhat3.6LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-wx4v-7h7w-4x2j: libxl in Xen 4
ghsa_unreviewed·2022-05-14
CVE-2015-7311 [LOW] GHSA-wx4v-7h7w-4x2j: libxl in Xen 4
libxl in Xen 4.1.x through 4.6.x does not properly handle the readonly flag on disks when using the qemu-xen device model, which allows local guest users to write to a read-only disk image.
OSV
CVE-2015-7311: libxl in Xen 4
osv·2015-10-01·CVSS 3.6
CVE-2015-7311 [LOW] CVE-2015-7311: libxl in Xen 4
libxl in Xen 4.1.x through 4.6.x does not properly handle the readonly flag on disks when using the qemu-xen device model, which allows local guest users to write to a read-only disk image.
Red Hat
xen: libxl fails to honour readonly flag on disks with qemu-xen (xsa-142)
vendor_redhat·2015-09-22·CVSS 3.6
CVE-2015-7311 [LOW] xen: libxl fails to honour readonly flag on disks with qemu-xen (xsa-142)
xen: libxl fails to honour readonly flag on disks with qemu-xen (xsa-142)
libxl in Xen 4.1.x through 4.6.x does not properly handle the readonly flag on disks when using the qemu-xen device model, which allows local guest users to write to a read-only disk image.
Statement: Not vulnerable.
This issue does not affect the versions of the xen package as shipped with Red Hat Enterprise Linux 5.
Package: xen (Red Hat Enterprise Linux 5) - Not affected
Debian
CVE-2015-7311: xen - libxl in Xen 4.1.x through 4.6.x does not properly handle the readonly flag on d...
vendor_debian·2015·CVSS 3.6
CVE-2015-7311 [LOW] CVE-2015-7311: xen - libxl in Xen 4.1.x through 4.6.x does not properly handle the readonly flag on d...
libxl in Xen 4.1.x through 4.6.x does not properly handle the readonly flag on disks when using the qemu-xen device model, which allows local guest users to write to a read-only disk image.
Scope: local
bookworm: resolved (fixed in 4.8.0~rc3-1)
bullseye: resolved (fixed in 4.8.0~rc3-1)
forky: resolved (fixed in 4.8.0~rc3-1)
sid: resolved (fixed in 4.8.0~rc3-1)
trixie: resolved (fixed in 4.8.0~rc3-1)
No detection rules found.
No public exploits indexed.
http://lists.fedoraproject.org/pipermail/package-announce/2015-September/167077.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-September/167792.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-September/167820.htmlhttp://lists.opensuse.org/opensuse-updates/2015-12/msg00053.htmlhttp://www.debian.org/security/2015/dsa-3414http://www.securityfocus.com/bid/76823http://www.securitytracker.com/id/1033633http://xenbits.xen.org/xsa/advisory-142.htmlhttps://bugzilla.redhat.com/show_bug.cgi?id=1257893https://security.gentoo.org/glsa/201604-03http://lists.fedoraproject.org/pipermail/package-announce/2015-September/167077.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-September/167792.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-September/167820.htmlhttp://lists.opensuse.org/opensuse-updates/2015-12/msg00053.htmlhttp://www.debian.org/security/2015/dsa-3414http://www.securityfocus.com/bid/76823http://www.securitytracker.com/id/1033633http://xenbits.xen.org/xsa/advisory-142.htmlhttps://bugzilla.redhat.com/show_bug.cgi?id=1257893https://security.gentoo.org/glsa/201604-03
2015-10-01
Published