{"id":"DEBIAN-CVE-2015-1851","details":"OpenStack Cinder before 2014.1.5 (icehouse), 2014.2.x before 2014.2.4 (juno), and 2015.1.x before 2015.1.1 (kilo) allows remote authenticated users to read arbitrary files via a crafted qcow2 signature in an image to the upload-to-image command.","modified":"2026-09-09T06:47:18.070501527Z","published":"2015-06-25T16:59:00.077Z","upstream":["CVE-2015-1851"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2015-1851"}],"affected":[{"package":{"name":"cinder","ecosystem":"Debian:12","purl":"pkg:deb/debian/cinder?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2015.1.0+2015.06.16.git26.9634b76ba5-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2015-1851.json"}},{"package":{"name":"cinder","ecosystem":"Debian:13","purl":"pkg:deb/debian/cinder?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2015.1.0+2015.06.16.git26.9634b76ba5-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2015-1851.json"}},{"package":{"name":"cinder","ecosystem":"Debian:14","purl":"pkg:deb/debian/cinder?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2015.1.0+2015.06.16.git26.9634b76ba5-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2015-1851.json"}}],"schema_version":"1.9.0"}