CVSS: 2.9EPSS: 0%CPEs: 27EXPL: 0CVE-2015-3340
https://notcve.org/view.php?id=CVE-2015-3340
Xen 4.2.x through 4.5.x does not initialize certain fields, which allows certain remote service domains to obtain sensitive information from memory via a (1) XEN_DOMCTL_gettscinfo or (2) XEN_SYSCTL_getdomaininfolist request. Xen 4.2.x hasta 4.5.x no inicializa ciertos campos, lo que permite a ciertos dominios de servicio remotos obtener información sensible de la memoria a través de una solicitud (1) XEN_DOMCTL_gettscinfo o (2) XEN_SYSCTL_getdomaininfolist. • http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156005.html http://lists.fedoraproject.org/pipermail/package-announce/2015-May/156979.html http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157006.html http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00018.html http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00019.html http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00001.html http://www.debian.org/security/2015/dsa-3414 h • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 2.1EPSS: 0%CPEs: 6EXPL: 0CVE-2015-0777
https://notcve.org/view.php?id=CVE-2015-0777
drivers/xen/usbback/usbback.c in linux-2.6.18-xen-3.4.0 (aka the Xen 3.4.x support patches for the Linux kernel 2.6.18), as used in the Linux kernel 2.6.x and 3.x in SUSE Linux distributions, allows guest OS users to obtain sensitive information from uninitialized locations in host OS kernel memory via unspecified vectors. drivers/xen/usbback/usbback.c en linux-2.6.18-xen-3.4.0 (también conocido como los parches de soporte Xen 3.4.x para el kernel de Linux 2.6.18), utilizado en el kernel de Linux 2.6.x y 3.x en SUSE Linux distributions, permite a usuarios del sistema operativo invitado obtener información sensible de localizaciones no inicializadas en la memoria del kernel del sistema operativo anfitrión a través de vectores no especificados. • http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00004.html http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00018.html http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00021.html http://www.securityfocus.com/bid/73921 https://bugzilla.novell.com/show_bug.cgi?id=917830 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.9EPSS: 0%CPEs: 8EXPL: 0CVE-2015-2752
https://notcve.org/view.php?id=CVE-2015-2752
The XEN_DOMCTL_memory_mapping hypercall in Xen 3.2.x through 4.5.x, when using a PCI passthrough device, is not preemptible, which allows local x86 HVM domain users to cause a denial of service (host CPU consumption) via a crafted request to the device model (qemu-dm). La hiperllamada XEN_DOMCTL_memory_mapping en Xen 3.2.x hasta la versión 4.5.x, cuando utiliza un dispositivo de paso PCI, no es predecible, lo que podría permitir a usuarios locales del dominio HVM x86 provocar una denegación de servicio (consumo CPU del host) a través de una petición manipulada para el modelo del dispositivo (qemu-dm). • http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154574.html http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154579.html http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155198.html http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00014.html http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00018.html http://www.securityfocus.com/bid/73448 http://www.securitytracker.com/id/1031994 http://xenbits.xen.org/xsa/advisor • CWE-20: Improper Input Validation •
CVSS: 4.9EPSS: 0%CPEs: 14EXPL: 0CVE-2015-2756
https://notcve.org/view.php?id=CVE-2015-2756
QEMU, as used in Xen 3.3.x through 4.5.x, does not properly restrict access to PCI command registers, which might allow local HVM guest users to cause a denial of service (non-maskable interrupt and host crash) by disabling the (1) memory or (2) I/O decoding for a PCI Express device and then accessing the device, which triggers an Unsupported Request (UR) response. QEMU, utilizado en Xen 3.3.x hasta 4.5.x, no restringe correctamente el acceso a los registros de comandos PCI, lo que podría permitir a usuarios locales invitados de HVM causar una denegación de servicio (non-maskable interrupt (NMI) y caída de anfitrión) mediante la deshabilitación de (1) la memoria o (2) la decodificación I/O para un dispositivo PCI Express y posteriormente accediendo al dispositivo, lo que provoca una respuesta Unsupported Request (UR). • http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154574.html http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154579.html http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155198.html http://lists.nongnu.org/archive/html/qemu-devel/2015-03/msg06179.html http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00014.html http://support.citrix.com/article/CTX201145 http://www.debian.org/security/2015/dsa-3259 http://www.securityfocus.c • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.1EPSS: 1%CPEs: 9EXPL: 0CVE-2015-2751
https://notcve.org/view.php?id=CVE-2015-2751
Xen 4.3.x, 4.4.x, and 4.5.x, when using toolstack disaggregation, allows remote domains with partial management control to cause a denial of service (host lock) via unspecified domctl operations. Xen 4.3.x, 4.4.x, y 4.5.x, cuando utiliza la desagregación toolstack, opermite a dominios remotos con control de gestión parcial causar una denegación de servicio (bloqueo del anfitrión) a través de operaciones domctl no especificadas. • http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154574.html http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154579.html http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155198.html http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00018.html http://www.securityfocus.com/bid/73443 http://www.securitytracker.com/id/1031997 http://xenbits.xen.org/xsa/advisory-127.html https://security.gentoo.org/glsa/201504-04 • CWE-17: DEPRECATED: Code •