CVSS: 4.9EPSS: 0%CPEs: 7EXPL: 0CVE-2014-1896
https://notcve.org/view.php?id=CVE-2014-1896
The (1) do_send and (2) do_recv functions in io.c in libvchan in Xen 4.2.x, 4.3.x, and 4.4-RC series allows local guests to cause a denial of service or possibly gain privileges via crafted xenstore ring indexes, which triggers a "read or write past the end of the ring." Las funciones (1) do_send y (2) do_recv en io.c in libvchan en Xen 4.2.x, 4.3.x y series 4.4-RC permiten a invitados locales causar una denegación de servicio o posiblemente ganar privilegios a través de indices de anillo xenstore manipulados, lo que provoca un "leer o escribir pasado el final del anillo". • http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00011.html http://security.gentoo.org/glsa/glsa-201407-03.xml http://www.openwall.com/lists/oss-security/2014/02/07/12 http://www.openwall.com/lists/oss-security/2014/02/10/7 http://xenbits.xen.org/xsa/advisory-86.html http://xenbits.xen.org/xsa/xsa86.patch • CWE-20: Improper Input Validation •
CVSS: 4.9EPSS: 0%CPEs: 22EXPL: 0CVE-2014-2599
https://notcve.org/view.php?id=CVE-2014-2599
The HVMOP_set_mem_access HVM control operations in Xen 4.1.x for 32-bit and 4.1.x through 4.4.x for 64-bit allow local guest administrators to cause a denial of service (CPU consumption) by leveraging access to certain service domains for HVM guests and a large input. Las operaciones de control de HVM HVMOP_set_mem_access en Xen 4.1.x para 32 bits y 4.1.x hasta 4.4.x para 64 bits permiten a administradores locales invitados causar una denegación de servicio (consumo de CPU) mediante el aprovechamiento del acceso a ciertos dominios de servicio para invitados de HVM y una entrada grande. • http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00002.html http://security.gentoo.org/glsa/glsa-201407-03.xml http://www.debian.org/security/2014/dsa-3006 http://www.openwall.com/lists/oss-security/2014/03/25/1 http://www.openwall.com/lists/oss-security/2014/03/25/2 http://www.securityfocus.com/bid/66407 http://www.securitytracker.com/id/1029956 http://xenbits.xen.org/xsa/advisory-89.html • CWE-20: Improper Input Validation •