CVE-2017-5715

Description

Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis.

How to fix CVE-2017-5715

To remediate CVE-2017-5715, upgrade the affected package to a fixed version below.

Alpine/xen—upgrade to 4.7.3-r4 or later
—upgrade to 3.20181128.1~deb8u1 or later
—upgrade to 3.20180515.1 or later
—upgrade to 3.20181128.1~deb9u1 or later
—upgrade to 3.20180425.1 or later
—upgrade to 4.15.11-1 or later
—upgrade to 3.16.57-1 or later
—upgrade to 384.111-1 or later
—upgrade to 1:2.12~rc3+dfsg-1 or later
—upgrade to 4.8.3+xsa262+shim4.10.0+comet3-1+deb9u6 or later
—upgrade to 4.11.1~pre+1.733450b39b-1 or later

Is CVE-2017-5715 being exploited?

Likely — EPSS is 88.5%, placing CVE-2017-5715 in the top tier of vulnerabilities by exploitation probability. Prioritise patching.

Affected packages (11)

from 0, < 4.7.3-r4
from 0, < 3.20181128.1~deb8u1
from 0, < 3.20180515.1
from 0, < 3.20181128.1~deb9u1
from 0, < 3.20180425.1
from 0, < 4.15.11-1
from 0, < 3.16.57-1
from 0, < 384.111-1
from 0, < 1:2.12~rc3+dfsg-1
from 0, < 4.8.3+xsa262+shim4.10.0+comet3-1+deb9u6

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	MEDIUM5.6	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N