CVE-2015-8555

HIGH

Citrix XenServer - Information Disclosure via Uninitialized FPU Stack and XMM Registers

Title source: llm
STIX 2.1

Description

Xen 4.6.x, 4.5.x, 4.4.x, 4.3.x, and earlier do not initialize x86 FPU stack and XMM registers when XSAVE/XRSTOR are not used to manage guest extended register state, which allows local guest domains to obtain sensitive information from other domains via unspecified vectors.

References (7)

Core 7
Core References
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2016/dsa-3519
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1034477
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/79543
Patch, Vendor Advisory x_refsource_confirm
http://xenbits.xen.org/xsa/advisory-165.html
Third Party Advisory vendor-advisory x_refsource_gentoo
https://security.gentoo.org/glsa/201604-03
Vendor Advisory x_refsource_confirm
http://support.citrix.com/article/CTX203879

Scores

CVSS v3 8.6
EPSS 0.0055
EPSS Percentile 68.2%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Details

CWE
CWE-200
Status published
Products (17)
citrix/xenserver 6.0
xen/xen 4.3.0
xen/xen 4.3.1
xen/xen 4.3.2
xen/xen 4.3.3
xen/xen 4.3.4
xen/xen 4.4.0
xen/xen 4.4.1
xen/xen 4.4.2
xen/xen 4.4.3
... and 7 more
Published Apr 13, 2016
Tracked Since Feb 18, 2026