CVE-2015-3289

MediumCVSS 4.0/10Last modified Jun 17, 2026

Description

OpenStack Glance before 2015.1.1 (kilo) allows remote authenticated users to cause a denial of service (disk consumption) by repeatedly using the import task flow API to create images and then deleting them.

Metrics

CVSS 2.0 4.0/10AV:N/AC:L/Au:S/C:N/I:N/A:P

Weakness enumeration

CWE-399

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.openstack.org/pipermail/openstack-announce/2015-July/000481.htmlPatch, Vendor Advisory
http://www.securityfocus.com/bid/76068
https://bugs.launchpad.net/glance/+bug/1454087Patch
http://lists.openstack.org/pipermail/openstack-announce/2015-July/000481.htmlPatch, Vendor Advisory
http://www.securityfocus.com/bid/76068
https://bugs.launchpad.net/glance/+bug/1454087Patch

Timeline

Published: Aug 14, 2015
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-32907.2arch/x86/entry/entry_64.S in the Linux kernel before 4.1.6 on the x86_64 platform improperly relies on espfix64 during nested NMI processing CVE-2015-32912.1arch/x86/entry/entry_64.S in the Linux kernel before 4.1.6 on the x86_64 platform does not properly determine when nested NMI processing is CVE-2015-329210.0The installer in NetApp OnCommand Workflow Automation before 2.2.1P1 and 3.x before 3.0P1 sets up the Java Debugging Wire Protocol (JDWP) se CVE-2015-32934.0FortiMail 5.0.3 through 5.2.3 allows remote administrators to obtain credentials via the "diag debug application httpd" command.CVE-2015-32946.4The tcp_request function in Dnsmasq before 2.73rc4 does not properly handle the return value of the setup_reply function, which allows remot CVE-2015-32955.3markdown-it before 4.1.0 does not block data: URLs.CVE-2015-32966.1Multiple cross-site scripting (XSS) vulnerabilities in NodeBB before 0.7 allow remote attackers to inject arbitrary web script or HTML via v CVE-2015-32977.5Directory traversal vulnerability in node/utils/Minify.js in Etherpad 1.1.1 through 1.5.2 allows remote attackers to read arbitrary files by CVE-2015-32988.8Yubico ykneo-openpgp before 1.0.10 has a typo in which an invalid PIN can be used. When first powered up, a signature will be issued even th CVE-2015-32996.1Cross-site scripting (XSS) vulnerability in the Floating Social Bar plugin before 1.1.7 for WordPress allows remote attackers to inject arbi CVE-2015-33004.3Multiple cross-site scripting (XSS) vulnerabilities in the TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Pl CVE-2015-33014.0Directory traversal vulnerability in the TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for W