Servers and applications
CVE-2015-2152
Xen 4.5.x and earlier enables certain default backends when emulating a VGA device for an x86 HVM guest qemu even when the configuration disables them, which allows local guest users to obtain access to the VGA console by (1) setting the DISPLAY environment variable, when compiled with SDL support, or connecting to the VNC server on (2) ::1 or (3) 127.0.0.1, when not compiled with SDL support.
- Severity
- Low 1.9
- Published
- 18 Mar 2015
- Last changed
- 17 Jun 2026
- Added to UpHeron
- 1 Nov 2026
- Exploit chance
- 0.4% in the next 30 daysHigher than 36% of CVEs. EPSS by FIRST, 11 Nov 2026
- Weakness
- CWE-264
- Attack
- Needs local access · No login needed
- Attacker can
- Change some data
- CVSS vector
AV:L/AC:M/Au:N/C:N/I:P/A:N- Sources
- NVD
Affected software
| Software | Affected versions |
|---|---|
XenServers and applications · cpe:o:xen:xen |
|