CVE-2015-5201

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

VDSM and libvirt in Red Hat Enterprise Virtualization Hypervisor (aka RHEV-H) 7-7.x before 7-7.2-20151119.0 and 6-6.x before 6-6.7-20151117.0 as packaged in Red Hat Enterprise Virtualization before 3.5.6 when VSDM is run with -spice disable-ticketing and a VM is suspended and then restored, allows remote attackers to log in without authentication via unspecified vectors.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-306

Affected software

Vendor	Product	Versions
RedHat	Enterprise Virtualization Hypervisor (aka RHEV-H)	7-7.x before 7-7.2-20151119.0 and 6-6.x before 6-6.7-20151117.0

References

https://access.redhat.com/security/cve/cve-2015-5201Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1253882Issue Tracking, Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1273144Issue Tracking, Vendor Advisory
https://rhn.redhat.com/errata/RHEA-2015-2527.htmlVendor Advisory
https://access.redhat.com/security/cve/cve-2015-5201Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1253882Issue Tracking, Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1273144Issue Tracking, Vendor Advisory
https://rhn.redhat.com/errata/RHEA-2015-2527.htmlVendor Advisory

Timeline

Published: Feb 25, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-52035.5Double free vulnerability in the jasper_image_stop_load function in JasPer 1.900.17 allows remote attackers to cause a denial of service (cr CVE-2015-52044.3CRLF injection vulnerability in the Apache Cordova File Transfer Plugin (cordova-plugin-file-transfer) for Android before 1.3.0 allows remot CVE-2015-52069.8Unspecified vulnerability in the HTTP/2 experimental feature in Apache Traffic Server before 5.3.x before 5.3.2 has unknown impact and attac CVE-2015-52075.3Apache Cordova iOS before 4.0.0 might allow attackers to bypass a URL whitelist protection mechanism in an app and load arbitrary resources CVE-2015-52084.4Apache Cordova iOS before 4.0.0 allows remote attackers to execute arbitrary plugins via a link.CVE-2015-52097.5Apache Struts 2.x before 2.3.24.1 allows remote attackers to manipulate Struts internals, alter user sessions, or affect container settings CVE-2015-52105.8Open redirect vulnerability in Apache Ambari before 2.1.2 allows remote attackers to redirect users to arbitrary web sites and conduct phish CVE-2015-52119.6Under some situations, the Spring Framework 4.2.0 to 4.2.1, 4.0.0 to 4.1.7, 3.2.0 to 3.2.14 and older unsupported versions is vulnerable to CVE-2015-52126.8Integer underflow in LibreOffice before 4.4.5 and Apache OpenOffice before 4.1.2, when the configuration setting "Load printer settings with CVE-2015-52136.8Integer overflow in LibreOffice before 4.4.5 and Apache OpenOffice before 4.1.2 allows remote attackers to cause a denial of service (memory CVE-2015-52146.8LibreOffice before 4.4.6 and 5.x before 5.0.1 and Apache OpenOffice before 4.1.2 allows remote attackers to cause a denial of service (memor CVE-2015-52156.1The default configuration of the Jinja templating engine used in the Identity Provider (IdP) server in Ipsilon 0.1.0 before 1.0.1 does not e