CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 0CVE-2013-4494 – kernel: xen: Lock order reversal between page allocation and grant table locks
https://notcve.org/view.php?id=CVE-2013-4494
02 Nov 2013 — Xen before 4.1.x, 4.2.x, and 4.3.x does not take the page_alloc_lock and grant_table.lock in the same order, which allows local guest administrators with access to multiple vcpus to cause a denial of service (host deadlock) via unspecified vectors. Xen con versiones enteriores a 4.1.x, 4.2.x, 4.3.x, y no toma la page_alloc_lock grant_table.lock en el mismo orden, lo que permite a los administradores invitados locales con acceso a múltiples vcpus causar una denegación de servicio (bloqueo host) a través sin ... • http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00015.html • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 34EXPL: 0CVE-2013-4368 – xen: information leak through outs instruction emulation (XSA-67)
https://notcve.org/view.php?id=CVE-2013-4368
17 Oct 2013 — The outs instruction emulation in Xen 3.1.x, 4.2.x, 4.3.x, and earlier, when using FS: or GS: segment override, uses an uninitialized variable as a segment base, which allows local 64-bit PV guests to obtain sensitive information (hypervisor stack content) via unspecified vectors related to stale data in a segment register. La instrucción de emulación outs en Xen 3.1.x, 4.2.x, 4.3.x, y anteriores versiones, cuando se usa la anulación del segmento FS: o GS:, utiliza una variable sin inicializar como segmento... • http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00015.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.5EPSS: 0%CPEs: 23EXPL: 0CVE-2013-4361 – Debian Security Advisory 3006-1
https://notcve.org/view.php?id=CVE-2013-4361
01 Oct 2013 — The fbld instruction emulation in Xen 3.3.x through 4.3.x does not use the correct variable for the source effective address, which allows local HVM guests to obtain hypervisor stack information by reading the values used by the instruction. La emulación de la instrucción fbld en Xen 3.3.x a 4.3.x no usa la variable correcta para la dirección de origen efectiva, lo cual permite a invitados HVM locales obtener información de la pila del hypervisor mediante la lectura de valores usados por la instrucción. Mul... • http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 0%CPEs: 33EXPL: 0CVE-2013-4355 – Kernel: Xen: Xsa-63: information leak via I/O instruction emulation
https://notcve.org/view.php?id=CVE-2013-4355
01 Oct 2013 — Xen 4.3.x and earlier does not properly handle certain errors, which allows local HVM guests to obtain hypervisor stack memory via a (1) port or (2) memory mapped I/O write or (3) other unspecified operations related to addresses without associated memory. Xen v4.3.x y anterior no maneja correctamente ciertos errores, lo que permite a invitados locales HVM conseguir la memoria de la pila del hypervisor a través de un puerto o escritura de memoria mapeada de I/O u otra operación no especificada relacionada c... • http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00015.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.2EPSS: 0%CPEs: 16EXPL: 0CVE-2013-1442 – Debian Security Advisory 3006-1
https://notcve.org/view.php?id=CVE-2013-1442
30 Sep 2013 — Xen 4.0 through 4.3.x, when using AVX or LWP capable CPUs, does not properly clear previous data from registers when using an XSAVE or XRSTOR to extend the state components of a saved or restored vCPU after touching other restored extended registers, which allows local guest OSes to obtain sensitive information by reading the registers. Xen 4.0 a 4.3.x, cuando se usan CPUs con capacidad AVX o LWP, no borra apropiadamente datos anteriores de registros al usar XSAVE o XRSTOR para extender el estado de los com... • http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.8EPSS: 0%CPEs: 15EXPL: 0CVE-2013-4329 – Debian Security Advisory 3006-1
https://notcve.org/view.php?id=CVE-2013-4329
12 Sep 2013 — The xenlight library (libxl) in Xen 4.0.x through 4.2.x, when IOMMU is disabled, provides access to a busmastering-capable PCI passthrough device before the IOMMU setup is complete, which allows local HVM guest domains to gain privileges or cause a denial of service via a DMA instruction. La librería xenlight (libxl) en Xen 4.0.x a 4.2.x, cuando IOMMU está desactivado, proporciona acceso a un dispositivo de paso PCI con capacidad de control de bus antes de que la configuración IOMMU se complete, lo cual per... • http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.8EPSS: 0%CPEs: 9EXPL: 0CVE-2013-1432 – Gentoo Linux Security Advisory 201309-24
https://notcve.org/view.php?id=CVE-2013-1432
28 Aug 2013 — Xen 4.1.x and 4.2.x, when the XSA-45 patch is in place, does not properly maintain references on pages stored for deferred cleanup, which allows local PV guest kernels to cause a denial of service (premature page free and hypervisor crash) or possibly gain privileges via unspecified vectors. Xen versiones 4.1.x y 4.2.x, cuando el parche XSA-45 está en su lugar, no mantiene apropiadamente las referencias sobre las páginas almacenadas para una limpieza diferida, lo que permite a los kernels invitados PV local... • http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html • CWE-399: Resource Management Errors •
CVSS: 9.8EPSS: 0%CPEs: 14EXPL: 0CVE-2013-2211 – Gentoo Linux Security Advisory 201309-24
https://notcve.org/view.php?id=CVE-2013-2211
28 Aug 2013 — The libxenlight (libxl) toolstack library in Xen 4.0.x, 4.1.x, and 4.2.x uses weak permissions for xenstore keys for paravirtualised and emulated serial console devices, which allows local guest administrators to modify the xenstore value via unspecified vectors. La biblioteca libxenlight (libxl) toolstack ein Xen 4.0.x, 4.1.x, y 4.2.x utiliza permisos débiles para claves xenstore para dispositivos paravirtualizados y emulados de consola serie, lo que permite a administradores invitados (guest) la modificac... • http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 5.7EPSS: 0%CPEs: 23EXPL: 0CVE-2013-2212 – Gentoo Linux Security Advisory 201504-04
https://notcve.org/view.php?id=CVE-2013-2212
28 Aug 2013 — The vmx_set_uc_mode function in Xen 3.3 through 4.3, when disabling caches, allows local HVM guests with access to memory mapped I/O regions to cause a denial of service (CPU consumption and possibly hypervisor or guest kernel panic) via a crafted GFN range. La función vmx_set_uc_mode en Xen 3.3 hasta la versión 4.3, al deshabilitar cachés, permite a invitados HVM locales con a las regiones I/O asignadas a la memoria provocar una denegación de servicio (consumo de CPU y posiblemente pánico de hypervisor o d... • http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00010.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.5EPSS: 0%CPEs: 25EXPL: 0CVE-2013-3495 – Gentoo Linux Security Advisory 201504-04
https://notcve.org/view.php?id=CVE-2013-3495
28 Aug 2013 — The Intel VT-d Interrupt Remapping engine in Xen 3.3.x through 4.3.x allows local guests to cause a denial of service (kernel panic) via a malformed Message Signaled Interrupt (MSI) from a PCI device that is bus mastering capable that triggers a System Error Reporting (SERR) Non-Maskable Interrupt (NMI). El motor Intel VT-d Interrupt Remapping en Xen 3.3.x a la 4.3.x permite a invitados (guest) locales provocar una denegación de servicio (kernel panic) a través de un Message Signaled Interrupt (MSI) mal for... • http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00005.html • CWE-264: Permissions, Privileges, and Access Controls •