CVSS: 7.8EPSS: 0%CPEs: 5EXPL: 0CVE-2016-9386 – Gentoo Linux Security Advisory 201612-56
https://notcve.org/view.php?id=CVE-2016-9386
02 Jan 2017 — The x86 emulator in Xen does not properly treat x86 NULL segments as unusable when accessing memory, which might allow local HVM guest users to gain privileges via vectors involving "unexpected" base/limit values. El emulador x86 en Xen no trata adecuadamente los segmentos NULL de x86 como inutilizable el acceso a memoria, lo que podría permitir a usuarios locales del HVM invitado obtener privilegios a través de vectores que implican valores de base/límite "inesperados". Multiple vulnerabilities have been f... • http://www.securityfocus.com/bid/94471 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.6EPSS: 0%CPEs: 4EXPL: 0CVE-2016-9637 – Xen: qemu ioport out-of-bounds array access (XSA-199)
https://notcve.org/view.php?id=CVE-2016-9637
20 Dec 2016 — The (1) ioport_read and (2) ioport_write functions in Xen, when qemu is used as a device model within Xen, might allow local x86 HVM guest OS administrators to gain qemu process privileges via vectors involving an out-of-range ioport access. Las funciones (1) ioport_read y (2) ioport_write en Xen, cuando qemu es utilizado como un modelo de dispositivo dentro de Xen, podría permitir a administradores locales del SO invitado x86 HVM obtener privilegios del proceso qemu a través de vectores que involucran un a... • http://rhn.redhat.com/errata/RHSA-2016-2963.html • CWE-125: Out-of-bounds Read CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.2EPSS: 0%CPEs: 14EXPL: 0CVE-2016-6259
https://notcve.org/view.php?id=CVE-2016-6259
02 Aug 2016 — Xen 4.5.x through 4.7.x do not implement Supervisor Mode Access Prevention (SMAP) whitelisting in 32-bit exception and event delivery, which allows local 32-bit PV guest OS kernels to cause a denial of service (hypervisor and VM crash) by triggering a safety check. Xen 4.5.x hasta la version 4.7.x no implementa listas blancas Supervisor Mode Access Prevencion (SMAP) en excepción 32 bits y entrega de eventos, lo que permite a kernels 32-bit PV locales del SO invitado provocar una denegación de servicio (hipe... • http://support.citrix.com/article/CTX214954 • CWE-20: Improper Input Validation •
CVSS: 8.8EPSS: 0%CPEs: 33EXPL: 0CVE-2016-6258 – Debian Security Advisory 3633-1
https://notcve.org/view.php?id=CVE-2016-6258
28 Jul 2016 — The PV pagetable code in arch/x86/mm.c in Xen 4.7.x and earlier allows local 32-bit PV guest OS administrators to gain host OS privileges by leveraging fast-paths for updating pagetable entries. El código de tabla de página PV en arch/x86/mm.c en Xen 4.7.x y versiones anteriores permite a administradores 32-bit PV locales del SO invitado obtener privilegios de administrador del SO mediante el aprovechamiento de fast_paths para la actualización de las entradas de la tabla de página. Multiple vulnerabilities ... • http://support.citrix.com/article/CTX214954 • CWE-284: Improper Access Control •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 0CVE-2016-5302
https://notcve.org/view.php?id=CVE-2016-5302
13 Jun 2016 — Citrix XenServer 7.0 before Hotfix XS70E003, when a deployment has been upgraded from an earlier release, might allow remote attackers on the management network to "compromise" a host by leveraging credentials for an Active Directory account. Citrix XenServer 7.0 en versiones anteriores a Hotfix XS70E003, cuando un despliegue se ha actualizado desde una versión anterior, podría permitir a atacantes remotos en la red de gestión "comprometer" un host aprovechando las credenciales para una cuenta Active Direct... • http://support.citrix.com/article/CTX213549 • CWE-284: Improper Access Control •
CVSS: 5.5EPSS: 0%CPEs: 32EXPL: 0CVE-2016-3712 – qemu-kvm: Out-of-bounds read when creating weird vga screen surface
https://notcve.org/view.php?id=CVE-2016-3712
10 May 2016 — Integer overflow in the VGA module in QEMU allows local guest OS users to cause a denial of service (out-of-bounds read and QEMU process crash) by editing VGA registers in VBE mode. Desbordamiento de entero en el módulo VGA en QEMU permite a usuarios de SO invitado locales provocar una denegación de servicio (lectura fuera de límites y caída de proceso QEMU) editando registros VGA en modo VBE. An integer overflow flaw and an out-of-bounds read flaw were found in the way QEMU's VGA emulator set certain VGA r... • http://rhn.redhat.com/errata/RHSA-2016-2585.html • CWE-125: Out-of-bounds Read CWE-190: Integer Overflow or Wraparound •
CVSS: 8.8EPSS: 0%CPEs: 47EXPL: 0CVE-2016-3710 – qemu: incorrect banked access bounds checking in vga module
https://notcve.org/view.php?id=CVE-2016-3710
09 May 2016 — The VGA module in QEMU improperly performs bounds checking on banked access to video memory, which allows local guest OS administrators to execute arbitrary code on the host by changing access modes after setting the bank register, aka the "Dark Portal" issue. El módulo VGA en QEMU lleva a cabo incorrectamente comprobaciones de límites sobre acceso almacenado a la memoria de vídeo, lo que permite a administradores locales de SO invitado ejecutar código arbitrario sobre el anfitrión cambiando los modos de ac... • http://rhn.redhat.com/errata/RHSA-2016-0724.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 6.3EPSS: 0%CPEs: 37EXPL: 0CVE-2016-1571 – Debian Security Advisory 3519-1
https://notcve.org/view.php?id=CVE-2016-1571
22 Jan 2016 — The paging_invlpg function in include/asm-x86/paging.h in Xen 3.3.x through 4.6.x, when using shadow mode paging or nested virtualization is enabled, allows local HVM guest users to cause a denial of service (host crash) via a non-canonical guest address in an INVVPID instruction, which triggers a hypervisor bug check. La función paging_invlpg en include/asm-x86/paging.h en Xen 3.3.x hasta la versión 4.6.x, cuando se utiliza paginación en modo shadow o la virtualización anidada está habilitada, permite a us... • http://support.citrix.com/article/CTX205496 • CWE-17: DEPRECATED: Code •
CVSS: 7.5EPSS: 52%CPEs: 58EXPL: 0CVE-2015-7704 – ntp: disabling synchronization via crafted KoD packet
https://notcve.org/view.php?id=CVE-2015-7704
21 Oct 2015 — The ntpd client in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service via a number of crafted "KOD" messages. El cliente ntpd en NTP 4.x en versiones anteriores a 4.2.8p4, y 4.3.x en versiones anteriores a 4.3.77 permite que atacantes remotos provoquen una denegación de servicio empleando una serie de mensajes "KOD" manipulados. It was discovered that ntpd as a client did not correctly check timestamps in Kiss-of-Death packets. A remote attacker could use thi... • http://bugs.ntp.org/show_bug.cgi?id=2901 • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 36%CPEs: 31EXPL: 0CVE-2015-7705 – Slackware Security Advisory - ntp Updates
https://notcve.org/view.php?id=CVE-2015-7705
21 Oct 2015 — The rate limiting feature in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to have unspecified impact via a large number of crafted requests. La funcionalidad de limitación de velocidad en NTP 4.x en versiones anteriores a la 4.2.8p4 y 4.3.x en versiones anteriores a la 4.3.77 permite que atacantes remotos provoquen errores sin especificar empleando un gran número de peticiones manipuladas. Multiple Cisco products incorporate a version of the ntpd package. Versions of this package a... • http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00020.html • CWE-20: Improper Input Validation •