CVE-2015-5154: Fedoraproject Fedora

High severity, CVSS 7.2. EPSS: 0.6% chance of exploitation in the next 30 days.

Heap-based buffer overflow in the IDE subsystem in QEMU, as used in Xen 4.5.x and earlier, when the container has a CDROM drive enabled, allows local guest users to execute arbitrary code on the host via unspecified ATAPI commands.

Affected products

• Fedoraproject Fedora: version 21 only; version 22 only; version 23 only
• Qemu Qemu: up to and including 2.3.0
• Suse Linux Enterprise Debuginfo: version 11 only
• Suse Linux Enterprise Desktop: version 11 only; version 12 only
• Suse Linux Enterprise Server: version 11 only
• Suse Linux Enterprise Software Development Kit: version 11 only; version 12 only
• Suse Suse Linux Enterprise Server: version 12 only
• Xen Xen: up to and including 4.5.0; version 4.5.1 only

Published 2015-08-12. Last modified 2026-06-17.