Lucene search

K
debianDebianDEBIAN:BSA-107:B7D19
HistoryMay 26, 2015 - 7:41 a.m.

[BSA-107] Security Update for horizon

2015-05-2607:41:43
lists.debian.org
8

3.5 Low

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

5.9 Medium

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

54.1%

Thomas Goirand uploaded new packages for horizon which fixed the
following security problem:

CVE-2015-3988:
Sunil Yadav from IBM Security Services reported a persistent XSS in
Horizon. An authenticated user may conduct a persistent XSS attack by
setting a malicious metadata to a Glance image, a Nova flavor or a
Host Aggregate and tricking an administrator to load the update
metadata page. Once executed in a legitimate context this attack may
result in a privilege escalation.

For the jessie-backports distribution the problems have been fixed in
2015.1.0-2~bpo8+1.

3.5 Low

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

5.9 Medium

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

54.1%