CVSS: 4.7EPSS: 0%CPEs: 25EXPL: 0CVE-2013-3495
https://notcve.org/view.php?id=CVE-2013-3495
The Intel VT-d Interrupt Remapping engine in Xen 3.3.x through 4.3.x allows local guests to cause a denial of service (kernel panic) via a malformed Message Signaled Interrupt (MSI) from a PCI device that is bus mastering capable that triggers a System Error Reporting (SERR) Non-Maskable Interrupt (NMI). El motor Intel VT-d Interrupt Remapping en Xen 3.3.x a la 4.3.x permite a invitados (guest) locales provocar una denegación de servicio (kernel panic) a través de un Message Signaled Interrupt (MSI) mal formado desde un dispositivo PCI que es capaz de provocar un System Error Reporting (SERR) Non-Maskable Interrupt (NMI). • http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00005.html http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00010.html http://osvdb.org/96438 http://secunia.com/advisories/54341 http://www.openwall.com/lists/oss-security/2013/08/20/8 http://www.securityfocus.com/bid/61854 http://www.securitytracker.com/id/1028931 https://security.gentoo.org/glsa/201504-04 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.4EPSS: 0%CPEs: 9EXPL: 0CVE-2013-1432
https://notcve.org/view.php?id=CVE-2013-1432
Xen 4.1.x and 4.2.x, when the XSA-45 patch is in place, does not properly maintain references on pages stored for deferred cleanup, which allows local PV guest kernels to cause a denial of service (premature page free and hypervisor crash) or possibly gain privileges via unspecified vectors. Xen versiones 4.1.x y 4.2.x, cuando el parche XSA-45 está en su lugar, no mantiene apropiadamente las referencias sobre las páginas almacenadas para una limpieza diferida, lo que permite a los kernels invitados PV locales causar una denegación de servicio (liberación de página prematura y bloqueo del hipervisor) o posiblemente conseguir privilegios por medio de vectores no especificados. • http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html http://secunia.com/advisories/55082 http://security.gentoo.org/glsa/glsa-201309-24.xml http://support.citrix.com/article/CTX138134 http://www.debian.org/security/2014/dsa-3006 http://www.openwall.com/lists/oss-security/2013/06/26/5 • CWE-399: Resource Management Errors •
CVSS: 4.3EPSS: 0%CPEs: 14EXPL: 0CVE-2013-2076
https://notcve.org/view.php?id=CVE-2013-2076
Xen 4.0.x, 4.1.x, and 4.2.x, when running on AMD64 processors, only save/restore the FOP, FIP, and FDP x87 registers in FXSAVE/FXRSTOR when an exception is pending, which allows one domain to determine portions of the state of floating point instructions of other domains, which can be leveraged to obtain sensitive information such as cryptographic keys, a similar vulnerability to CVE-2006-1056. NOTE: this is the documented behavior of AMD64 processors, but it is inconsistent with Intel processors in a security-relevant fashion that was not addressed by the kernels. Xen v4.0.x, v4.1.x, y v4.2.x, cuando se ejecuta en procesadores AMD64, sólo guarda/restaura los registros FOP, FIP, y FDP x87 en FXSAVE/FXRSTOR cuando una excepción se encuentra pendiente, lo que permite un dominio para determinar las porciones del estado de las instrucciones de punto flotante de otros dominios, por lo que pueden ser aprovechados para obtener información confidencial, como claves criptográficas, una vulnerabilidad similar a CVE-2006-1056. NOTA: este es el comportamiento documentado de procesadores AMD64, pero no es consistente con procesadores Intel de modo relevante para la seguridad que no ha sido resuelto por los kernel. • http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html http://secunia.com/advisories/55082 http://security.gentoo.org/glsa/glsa-201309-24.xml http://www.debian.org/security/2014/dsa-3006 http://www.openwall.com/lists/oss-security/2013/06/03/1 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.9EPSS: 0%CPEs: 3EXPL: 0CVE-2013-2195
https://notcve.org/view.php?id=CVE-2013-2195
The Elf parser (libelf) in Xen 4.2.x and earlier allow local guest administrators with certain permissions to have an unspecified impact via a crafted kernel, related to "pointer dereferences" involving unexpected calculations. El analizador ELF (libelf) in Xen v4.2.x y anteriores permite a los administradores invitados locales con ciertos permisos, tener un impacto no especificado a través de un kernel hecho manipulado, en relación con "desreferencia de puntero" que involucran cálculos inesperados. • http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00015.html http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00000.html http://secunia.com/advisories/55082 http://security.gentoo.org/glsa/glsa-201309-24.xml http://support.citrix.com/article/CTX138058 http://www.debian.org/security/2014/dsa-3006 http://www.openwall.com/lists/oss-security/2013/06/20/2 http://www.openwall.com/ • CWE-189: Numeric Errors •
CVSS: 6.9EPSS: 0%CPEs: 3EXPL: 0CVE-2013-2194
https://notcve.org/view.php?id=CVE-2013-2194
Multiple integer overflows in the Elf parser (libelf) in Xen 4.2.x and earlier allow local guest administrators with certain permissions to have an unspecified impact via a crafted kernel. Múltiples desbordamientos de enteros en el analizador ELF (libelf) en Xen v4.2.x y anteriores permite a los administradores invitados locales con ciertos permisos, tener un impacto no especificado a través de un kernel hecho manipulado. • http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00015.html http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00000.html http://secunia.com/advisories/55082 http://security.gentoo.org/glsa/glsa-201309-24.xml http://support.citrix.com/article/CTX138058 http://www.debian.org/security/2014/dsa-3006 http://www.openwall.com/lists/oss-security/2013/06/20/2 http://www.openwall.com/ • CWE-189: Numeric Errors •