CVE-2015-4037
Debian Security Advisory 3285-1
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
The slirp_smb function in net/slirp.c in QEMU 2.3.0 and earlier creates temporary files with predictable names, which allows local users to cause a denial of service (instantiation failure) by creating /tmp/qemu-smb.*-* files before the program.
Vulnerabilidad en la función slirp_smb en net/slirp.c en QEMU 2.3.0 y en versiones anteriores, crea archivos temporales con nombres predecibles, lo que permite a usuarios locales causar una denegación de servicio (fallo en la instanciación) creando archivos /tmp/qemu-smb.*-* antes que el programa.
Matt Tait discovered that QEMU incorrectly handled the virtual PCNET driver. A malicious guest could use this issue to cause a denial of service, or possibly execute arbitrary code on the host as the user running the QEMU process. In the default installation, when QEMU is used with libvirt, attackers would be isolated by the libvirt AppArmor profile. Kurt Seifried discovered that QEMU incorrectly handled certain temporary files. A local attacker could use this issue to cause a denial of service. Various other issues were also addressed.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2015-05-19 CVE Reserved
- 2015-06-10 CVE Published
- 2024-08-06 CVE Updated
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-17: DEPRECATED: Code
CAPEC
References (14)
| URL | Tag | Source |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2015/05/13/7 | Mailing List |
|
| http://www.openwall.com/lists/oss-security/2015/05/16/5 | Mailing List |
|
| http://www.openwall.com/lists/oss-security/2015/05/23/4 | Mailing List |
|
| http://www.securityfocus.com/bid/74809 | Vdb Entry | |
| http://www.securitytracker.com/id/1032547 | Vdb Entry | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1222892 | X_refsource_confirm |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|