What is CVE-2015-8567?

CVE-2015-8567 is a high-severity software vulnerability (CWE-401) with a CVSS score of 7.7. Memory leak in net/vmxnet3.c in QEMU allows remote attackers to cause a denial of service (memory consumption).

Is CVE-2015-8567 being actively exploited?

It is not currently in CISA's KEV catalog. Its EPSS exploitation probability is 6%.

How do I fix CVE-2015-8567?

Apply the vendor fix promptly. Upgrade affected products to a fixed version.

← All products

CVE-2015-8567

Q: What products does CVE-2015-8567 affect?

Tracked products affected include Ubuntu, Debian, SUSE Linux Enterprise, SUSE Linux Enterprise Server, QEMU, Fedora. Check the version you run to see whether it is affected.

HIGH severity · CVSS 7.7 · CWE-401

7.7CVSS HIGH

Summary

Memory leak in net/vmxnet3.c in QEMU allows remote attackers to cause a denial of service (memory consumption).

Impact & exploitability

Attack vectorNetwork

Attack complexityLow

Privileges requiredLow

User interactionNone

Confidentiality impactNone

Integrity impactNone

Availability impactHigh

Exploit probability (EPSS)6%

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Affected products we track (6)

Ubuntu Debian SUSE Linux Enterprise SUSE Linux Enterprise Server QEMU Fedora

Recommendation

Apply the vendor fix promptly. Open any affected product above for its exact safe version.

Additional information

NVD record
http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176503.htmlAdvisory
http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176558.htmlAdvisory
http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175967.htmlAdvisory
http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176300.htmlAdvisory
http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00010.htmlAdvisory
http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00012.htmlAdvisory
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00087.htmlAdvisory
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00002.htmlAdvisory