Page 24 of 141 results (0.007 seconds)

CVSS: 5.2EPSS: 0%CPEs: 24EXPL: 0

CVE-2014-1893

https://notcve.org/view.php?id=CVE-2014-1893

Multiple integer overflows in the (1) FLASK_GETBOOL and (2) FLASK_SETBOOL suboperations in the flask hypercall in Xen 4.1.x, 3.3.x, 3.2.x, and earlier, when XSM is enabled, allow local users to cause a denial of service (processor fault) via unspecified vectors, a different vulnerability than CVE-2014-1891, CVE-2014-1892, and CVE-2014-1894. Múltiples desbordamientos de enteros en las suboperaciones (1) FLASK_GETBOOL y (2) FLASK_SETBOOL en la hiperllamada flask hypercall en Xen 4.1.x, 3.3.x, 3.2.x y anteriores, cuando XSM está habilitado, permiten a usuarios locales causar una denegación de servicio (fallo de procesador) a través de vectores no especificados, una vulnerabilidad diferente a CVE-2014-1891, CVE-2014-1892 y CVE-2014-1894. • http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00010.html http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00011.html http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html http://security.gentoo.org/glsa/glsa-201407-03.xml http://www.openwall.com/lists/oss-security/2014/02/07/12 http://www.openwall.com/lists/oss-security/2014/02/07/4 http://www.openwall.com/lists/oss-security/2014/02/10/8 http://xenbits.xen.org/xsa&#x • CWE-189: Numeric Errors •

CVSS: 5.2EPSS: 0%CPEs: 9EXPL: 0

CVE-2014-1894

https://notcve.org/view.php?id=CVE-2014-1894

Multiple integer overflows in unspecified suboperations in the flask hypercall in Xen 3.2.x and earlier, when XSM is enabled, allow local users to cause a denial of service (processor fault) via unspecified vectors, a different vulnerability than CVE-2014-1891, CVE-2014-1892, and CVE-2014-1893. Múltiples desbordamientos de enteros en suboperaciones no especificadas en la hiperllamada flask en Xen 3.2.x y anteriores, cuando XSM está habilitada, permiten a usuarios locales causar una denegación de servicio (fallo de procesador) a través de vectores no especificados, una vulnerabilidad diferente a CVE-2014-1891, CVE-2014-1892 y CVE-2014-1893. • http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00010.html http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00011.html http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html http://security.gentoo.org/glsa/glsa-201407-03.xml http://www.openwall.com/lists/oss-security/2014/02/07/12 http://www.openwall.com/lists/oss-security/2014/02/07/4 http://www.openwall.com/lists/oss-security/2014/02/10/8 http://xenbits.xen.org/xsa&#x • CWE-189: Numeric Errors •

CVSS: 5.2EPSS: 0%CPEs: 25EXPL: 0

CVE-2014-1891

https://notcve.org/view.php?id=CVE-2014-1891

Multiple integer overflows in the (1) FLASK_GETBOOL, (2) FLASK_SETBOOL, (3) FLASK_USER, and (4) FLASK_CONTEXT_TO_SID suboperations in the flask hypercall in Xen 4.3.x, 4.2.x, 4.1.x, 3.2.x, and earlier, when XSM is enabled, allow local users to cause a denial of service (processor fault) via unspecified vectors, a different vulnerability than CVE-2014-1892, CVE-2014-1893, and CVE-2014-1894. Múltiples desbordamiento de enteros en las suboperaciones (1) FLASK_GETBOOL, (2) FLASK_SETBOOL, (3) FLASK_USER y (4) FLASK_CONTEXT_TO_SID en la hiperllamada flask en Xen 4.3.x, 4.2.x, 4.1.x, 3.2.x y anteriores, cuando XSM está habilitado, permiten a usuarios locales causar una denegación de servicio (fallo de procesador) a través de vectores no especificados, una vulnerabilidad diferente a CVE-2014-1892, CVE-2014-1893 y CVE-2014-1894. • http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00010.html http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00011.html http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html http://security.gentoo.org/glsa/glsa-201407-03.xml http://www.openwall.com/lists/oss-security/2014/02/07/12 http://www.openwall.com/lists/oss-security/2014/02/07/4 http://www.openwall.com/lists/oss-security/2014/02/10/8 http://xenbits.xen.org/xsa&#x • CWE-189: Numeric Errors •

CVSS: 6.0EPSS: 0%CPEs: 34EXPL: 0

CVE-2013-4554 – kernel: xen: hypercalls exposed to privilege rings 1 and 2 of HVM guests

https://notcve.org/view.php?id=CVE-2013-4554

Xen 3.0.3 through 4.1.x (possibly 4.1.6.1), 4.2.x (possibly 4.2.3), and 4.3.x (possibly 4.3.1) does not properly prevent access to hypercalls, which allows local guest users to gain privileges via a crafted application running in ring 1 or 2. Xen 3.0.3 a 4.1.x (posiblemente 4.1.6.1), 4.2.x (posiblemente 4.2.3), y 4.3.x (posiblemente 4.3.1) no previene correctamente acceso a hypercalls, lo cual permite a usuarios invitados locales obtener privilegios a través de la ejecución de una aplicación manipulada en el anillo 1 o el anillo 2. • http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00010.html http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00015.html http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00000.html http://lists.opensuse.org/opensuse-updates/2013-12/msg00059.html http://rhn.redhat.com/errata/RHSA-2014-0285.html http://security.gentoo.org/glsa/glsa-201407-03.xml http://www.openwall.com/lists&# • CWE-264: Permissions, Privileges, and Access Controls •

CVSS: 2.3EPSS: 0%CPEs: 34EXPL: 0

CVE-2013-4368 – xen: information leak through outs instruction emulation (XSA-67)

https://notcve.org/view.php?id=CVE-2013-4368

The outs instruction emulation in Xen 3.1.x, 4.2.x, 4.3.x, and earlier, when using FS: or GS: segment override, uses an uninitialized variable as a segment base, which allows local 64-bit PV guests to obtain sensitive information (hypervisor stack content) via unspecified vectors related to stale data in a segment register. La instrucción de emulación outs en Xen 3.1.x, 4.2.x, 4.3.x, y anteriores versiones, cuando se usa la anulación del segmento FS: o GS:, utiliza una variable sin inicializar como segmento base, lo que permite a usuarios locales de 64-bit PV obtener información sensible (contenido de la pila de hipervisor) a través de vectores relacionados de datos obsoletos en un registro del segmento. • http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00015.html http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00000.html http://lists.opensuse.org/opensuse-updates/2013-11/msg00009.html http://rhn.redhat.com/errata/RHSA-2013-1449.html http://security.gentoo.org/glsa/glsa-201407-03.xml http://www.debian.org/security/2014/dsa-3006 http://www.openwall.com/lists/oss-security/2013/10 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •