CVE-2015-3340: Debian Linux

Low severity, CVSS 2.9. EPSS: 0.8% chance of exploitation in the next 30 days.

Xen 4.2.x through 4.5.x does not initialize certain fields, which allows certain remote service domains to obtain sensitive information from memory via a (1) XEN_DOMCTL_gettscinfo or (2) XEN_SYSCTL_getdomaininfolist request.

Affected products

• Debian Debian Linux: version 7.0 only; version 8.0 only
• Fedoraproject Fedora: version 20 only; version 21 only; version 22 only
• Opensuse Opensuse: version 13.1 only
• Suse Linux Enterprise Desktop: version 12 only
• Suse Linux Enterprise Software Development Kit: version 12 only
• Suse Suse Linux Enterprise Desktop: version 11.0 only
• Suse Suse Linux Enterprise Server: version 11.0 only; version 12 only
• Suse Suse Linux Enterprise Software Development Kit: version 11.0 only
• Xen Xen: version 4.2.0 only; version 4.2.1 only; version 4.2.2 only; version 4.2.3 only; version 4.2.4 only; version 4.2.5 only; …

Published 2015-04-28. Last modified 2026-06-17.