CVE-2015-1851: Canonical Ubuntu Linux

Medium severity, CVSS 6.8. EPSS: 2.6% chance of exploitation in the next 30 days.

OpenStack Cinder before 2014.1.5 (icehouse), 2014.2.x before 2014.2.4 (juno), and 2015.1.x before 2015.1.1 (kilo) allows remote authenticated users to read arbitrary files via a crafted qcow2 signature in an image to the upload-to-image command.

Affected products

• Canonical Ubuntu Linux: version 15.04 only
• Openstack Icehouse: up to and including 2014.1.4
• Openstack Juno: version 2014.2 only; version 2014.2.2 only; version 2014.2.3 only
• Openstack Kilo: version 2015.1.0 only

Published 2015-06-25. Last modified 2026-06-17.