CVE-2015-3241

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

OpenStack Compute (nova) 2015.1 through 2015.1.1, 2014.2.3, and earlier does not stop the migration process when the instance is deleted, which allows remote authenticated users to cause a denial of service (disk, network, and other resource consumption) by resizing and then deleting an instance.

Metrics

CVSS 2.0 6.8/10AV:N/AC:L/Au:S/C:N/I:N/A:C

Weakness enumeration

CWE-399

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://rhn.redhat.com/errata/RHSA-2015-1723.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-1898.htmlThird Party Advisory
http://www.securityfocus.com/bid/75372Third Party Advisory, VDB Entry
https://github.com/openstack/ossa/blob/482576204dec96f580817b119e3166d71c757731/ossa/OSSA-2015-015.yamlThird Party Advisory
https://launchpad.net/bugs/1387543Third Party Advisory
https://security.openstack.org/ossa/OSSA-2015-015.htmlVendor Advisory
http://rhn.redhat.com/errata/RHSA-2015-1723.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-1898.htmlThird Party Advisory
http://www.securityfocus.com/bid/75372Third Party Advisory, VDB Entry
https://github.com/openstack/ossa/blob/482576204dec96f580817b119e3166d71c757731/ossa/OSSA-2015-015.yamlThird Party Advisory
https://launchpad.net/bugs/1387543Third Party Advisory
https://security.openstack.org/ossa/OSSA-2015-015.htmlVendor Advisory

Timeline

Published: Sep 8, 2015
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-32435.5rsyslog uses weak permissions for generating log files, which allows local users to obtain sensitive information by reading files in /var/lo CVE-2015-32444.9The Portlet Bridge for JavaServer Faces in Red Hat JBoss Portal 6.2.0, when used in portlets with the default resource serving for GenericPo CVE-2015-32452.1Incomplete blacklist vulnerability in the chfn function in libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper progra CVE-2015-32467.4libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd, w CVE-2015-32476.9Race condition in the worker_update_monitors_config function in SPICE 0.12.4 allows a remote authenticated guest user to cause a denial of s CVE-2015-32484.7openhpi/Makefile.am in OpenHPI before 3.6.0 uses world-writable permissions for /var/lib/openhpi directory, which allows local users, when q CVE-2015-32499.8The HTTP/2 experimental feature in Apache Traffic Server 5.3.x before 5.3.1 allows remote attackers to cause a denial of service (out-of-bou CVE-2015-32507.5Apache Directory LDAP API before 1.0.0-M31 allows attackers to conduct timing attacks via unspecified vectors.CVE-2015-32514.9Apache CloudStack before 4.5.2 might allow remote authenticated administrators to obtain sensitive password information for root accounts of CVE-2015-32529.8Apache CloudStack before 4.5.2 does not properly preserve VNC passwords when migrating KVM virtual machines, which allows remote attackers t CVE-2015-32539.8The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to execute arbitrary code CVE-2015-32546.5The client libraries in Apache Thrift before 0.9.3 might allow remote authenticated users to cause a denial of service (infinite recursion)