CVE-2015-3340
Fixed in a distro release EPSS <1%
Xen 4.2.x through 4.5.x does not initialize certain fields, which allows certain remote service domains to obtain sensitive information from memory via a (1) XEN_DOMCTL_gettscinfo or (2) XEN_SYSCTL_getdomaininfolist request.
Products: xen, suse_linux_enterprise_software_development_kit, suse_linux_enterprise_desktop, suse_linux_enterprise_server, fedoraproject fedora, debian_linux, opensuse, suse linux_enterprise_desktop, suse linux_enterprise_software_development_kit
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | xen | 4.6.0-1 |
| Debian 13 | xen | 4.6.0-1 |
| Debian 14 | xen | 4.6.0-1 |
| Debian 8 | xen | 4.4.1-9+deb8u3 |
| SUSE Linux Enterprise Desktop 12 | xen | 4.4.2_04-18.1 |
| SUSE Linux Enterprise Server 12 | xen | 4.4.2_04-18.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 | xen | 4.4.2_04-18.1 |
| SUSE Linux Enterprise Software Development Kit 12 | xen | 4.4.2_04-18.1 |
| Ubuntu 14.04 LTS | xen | 4.4.1-0ubuntu0.14.04.6 |
| openSUSE Tumbleweed | xen | 4.7.0_12-1.3 |