CVE-2015-8568

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Memory leak in QEMU, when built with a VMWARE VMXNET3 paravirtual NIC emulator support, allows local guest users to cause a denial of service (host memory consumption) by trying to activate the vmxnet3 device repeatedly.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Weakness enumeration

CWE-772

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.debian.org/security/2016/dsa-3471Third Party Advisory
http://www.openwall.com/lists/oss-security/2015/12/15/10Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/79721Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1289816Issue Tracking, Patch, Third Party Advisory
https://lists.gnu.org/archive/html/qemu-devel/2015-12/msg02299.htmlMailing List, Patch, Third Party Advisory
https://security.gentoo.org/glsa/201602-01Third Party Advisory
http://www.debian.org/security/2016/dsa-3471Third Party Advisory
http://www.openwall.com/lists/oss-security/2015/12/15/10Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/79721Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1289816Issue Tracking, Patch, Third Party Advisory
https://lists.gnu.org/archive/html/qemu-devel/2015-12/msg02299.htmlMailing List, Patch, Third Party Advisory
https://security.gentoo.org/glsa/201602-01Third Party Advisory

Timeline

Published: Apr 11, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-85692.3The (1) pptp_bind and (2) pptp_connect functions in drivers/net/ppp/pptp.c in the Linux kernel through 4.3.3 do not verify an address length CVE-2015-85707.4The password reset functionality in Lepide Active Directory Self Service allows remote authenticated users to change arbitrary domain user p CVE-2015-85716.8Integer overflow in Autodesk Design Review (ADR) before 2013 Hotfix 2 allows remote attackers to execute arbitrary code via a crafted biClrU CVE-2015-85726.8Multiple buffer overflows in Autodesk Design Review (ADR) before 2013 Hotfix 2 allow remote attackers to execute arbitrary code via crafted CVE-2015-85754.0The sco_sock_bind function in net/bluetooth/sco.c in the Linux kernel before 4.3.4 does not verify an address length, which allows local use CVE-2015-85772.6The Buffer Overflow Protection (BOP) feature in McAfee VirusScan Enterprise before 8.8 Patch 6 allocates memory with Read, Write, Execute (R CVE-2015-85786.4AVG Internet Security 2015 allocates memory with Read, Write, Execute (RWX) permissions at predictable addresses when protecting user-mode p CVE-2015-85796.4Kaspersky Total Security 2015 15.0.2.361 allocates memory with Read, Write, Execute (RWX) permissions at predictable addresses when protecti CVE-2015-85806.8Multiple use-after-free vulnerabilities in the (1) Print method and (2) App object handling in Foxit Reader before 7.2.2 and Foxit PhantomPD CVE-2015-85929.8In all Qualcomm products with Android releases from CAF using the Linux kernel, a pointer is not validated prior to being dereferenced poten CVE-2015-85939.8In all Qualcomm products with Android releases from CAF using the Linux kernel, a buffer overflow vulnerability exists in 1x call processing CVE-2015-85949.8In all Qualcomm products with Android releases from CAF using the Linux kernel, a buffer over-read vulnerability exists in RFA-1x.