CVSS: 4.9EPSS: 0%CPEs: 30EXPL: 0CVE-2015-4103
https://notcve.org/view.php?id=CVE-2015-4103
Xen 3.3.x through 4.5.x does not properly restrict write access to the host MSI message data field, which allows local x86 HVM guest administrators to cause a denial of service (host interrupt handling confusion) via vectors related to qemu and accessing spanning multiple fields. Xen 3.3.x hasta la versión 4.5.x no restringe correctamente el acceso a escritura al campo de datos del mensaje MSI del host, lo que permite a administradores invitados x86 HVM locales causar una denegación de servicio (confusión en el manejo de interrupción de host) a través de vectores relacionados con qemu y accediendo a múltiples campos de expansión. • http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160154.html http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160171.html http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160685.html http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00004.html http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00007.html http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00029.html http://lists.opensuse.org/opensuse-security-announce&#x • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.8EPSS: 2%CPEs: 31EXPL: 0CVE-2015-4104
https://notcve.org/view.php?id=CVE-2015-4104
Xen 3.3.x through 4.5.x does not properly restrict access to PCI MSI mask bits, which allows local x86 HVM guest users to cause a denial of service (unexpected interrupt and host crash) via unspecified vectors. Xen 3.3.x hasta 4.5.x no restringe correctamente el acceso a los bits de máscara PCI MSI, lo que permite a usuarios locales invitados de x86 HVM causar una denegación de servicio (interrupción no esperado y caída de anfitrión) a través de vectores no especificados. • http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160154.html http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160171.html http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160685.html http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00004.html http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00007.html http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00029.html http://lists.opensuse.org/opensuse-security-announce&#x • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.9EPSS: 0%CPEs: 31EXPL: 0CVE-2015-4105
https://notcve.org/view.php?id=CVE-2015-4105
Xen 3.3.x through 4.5.x enables logging for PCI MSI-X pass-through error messages, which allows local x86 HVM guests to cause a denial of service (host disk consumption) via certain invalid operations. Xen 3.3.x hasta 4.5.x habilita el registro para mensajes de error 'pass-through' de PCI MSI-X, lo que permite a invitados locales de x86 HVM causar una denegación de servicio (consumo de disco de anfitrión) a través de ciertas operaciones inválidas. • http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160154.html http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160171.html http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160685.html http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00004.html http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00007.html http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00029.html http://lists.opensuse.org/opensuse-security-announce&#x • CWE-399: Resource Management Errors •
CVSS: 2.9EPSS: 0%CPEs: 27EXPL: 0CVE-2015-3340
https://notcve.org/view.php?id=CVE-2015-3340
Xen 4.2.x through 4.5.x does not initialize certain fields, which allows certain remote service domains to obtain sensitive information from memory via a (1) XEN_DOMCTL_gettscinfo or (2) XEN_SYSCTL_getdomaininfolist request. Xen 4.2.x hasta 4.5.x no inicializa ciertos campos, lo que permite a ciertos dominios de servicio remotos obtener información sensible de la memoria a través de una solicitud (1) XEN_DOMCTL_gettscinfo o (2) XEN_SYSCTL_getdomaininfolist. • http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156005.html http://lists.fedoraproject.org/pipermail/package-announce/2015-May/156979.html http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157006.html http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00018.html http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00019.html http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00001.html http://www.debian.org/security/2015/dsa-3414 h • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 2.1EPSS: 0%CPEs: 6EXPL: 0CVE-2015-0777
https://notcve.org/view.php?id=CVE-2015-0777
drivers/xen/usbback/usbback.c in linux-2.6.18-xen-3.4.0 (aka the Xen 3.4.x support patches for the Linux kernel 2.6.18), as used in the Linux kernel 2.6.x and 3.x in SUSE Linux distributions, allows guest OS users to obtain sensitive information from uninitialized locations in host OS kernel memory via unspecified vectors. drivers/xen/usbback/usbback.c en linux-2.6.18-xen-3.4.0 (también conocido como los parches de soporte Xen 3.4.x para el kernel de Linux 2.6.18), utilizado en el kernel de Linux 2.6.x y 3.x en SUSE Linux distributions, permite a usuarios del sistema operativo invitado obtener información sensible de localizaciones no inicializadas en la memoria del kernel del sistema operativo anfitrión a través de vectores no especificados. • http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00004.html http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00018.html http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00021.html http://www.securityfocus.com/bid/73921 https://bugzilla.novell.com/show_bug.cgi?id=917830 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •