CVE-2015-2687

MediumCVSS 4.7/10Last modified Jun 17, 2026

Description

OpenStack Compute (nova) Icehouse, Juno and Havana when live migration fails allows local users to access VM volumes that they would normally not have permissions for.

Metrics

CVSS 3.0 4.7/10CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-284

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.openwall.com/lists/oss-security/2015/03/24/10Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2015/03/25/3Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/77505Third Party Advisory, VDB Entry
https://bugs.launchpad.net/nova/+bug/1419577Issue Tracking, Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1205313Issue Tracking, Third Party Advisory, VDB Entry
https://review.openstack.org/#/c/338929/Third Party Advisory
http://www.openwall.com/lists/oss-security/2015/03/24/10Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2015/03/25/3Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/77505Third Party Advisory, VDB Entry
https://bugs.launchpad.net/nova/+bug/1419577Issue Tracking, Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1205313Issue Tracking, Third Party Advisory, VDB Entry
https://review.openstack.org/#/c/338929/Third Party Advisory

Timeline

Published: Aug 9, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-26887.5buf_pullup in Tor before 0.2.4.26 and 0.2.5.x before 0.2.5.11 does not properly handle unexpected arrival times of buffers with invalid layo CVE-2015-26897.5Tor before 0.2.4.26 and 0.2.5.x before 0.2.5.11 does not properly handle pending-connection resolve states during periods of high DNS load, CVE-2015-26906.1Multiple cross-site scripting (XSS) vulnerabilities in views/add-license-form.php in the Digium Addons module (digiumaddoninstaller) before CVE-2015-269210.0AdBlock before 2.21 allows remote attackers to block arbitrary resources on arbitrary websites and to disable arbitrary blocking filters.CVE-2015-26945.8The kdcpreauth modules in MIT Kerberos 5 (aka krb5) 1.12.x and 1.13.x before 1.13.2 do not properly track whether a client's request has bee CVE-2015-26955.0lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) before 1.14 relies on an inappropriate context handle, which allows remote atta CVE-2015-26967.1lib/gssapi/krb5/iakerb.c in MIT Kerberos 5 (aka krb5) before 1.14 relies on an inappropriate context handle, which allows remote attackers t CVE-2015-26974.0The build_principal_va function in lib/krb5/krb/bld_princ.c in MIT Kerberos 5 (aka krb5) before 1.14 allows remote authenticated users to ca CVE-2015-26988.5The iakerb_gss_export_sec_context function in lib/gssapi/krb5/iakerb.c in MIT Kerberos 5 (aka krb5) 1.14 pre-release 2015-09-14 improperly a CVE-2015-27016.8Cross-site request forgery (CSRF) vulnerability in CS-Cart 4.2.4 allows remote attackers to hijack the authentication of users for requests CVE-2015-27024.3Cross-site scripting (XSS) vulnerability in the Message Log in the Email Security Gateway in Websense TRITON AP-EMAIL before 8.0.0 and V-Ser CVE-2015-27034.3Multiple cross-site scripting (XSS) vulnerabilities in Websense TRITON AP-WEB before 8.0.0 and V-Series 7.7 appliances allow remote attacker