CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 2CVE-2008-4405 – Xen 3.3 - XenStore Domain Configuration Data Unsafe Storage
https://notcve.org/view.php?id=CVE-2008-4405
xend in Xen 3.0.3 does not properly limit the contents of the /local/domain xenstore directory tree, and does not properly restrict a guest VM's write access within this tree, which allows guest OS users to cause a denial of service and possibly have unspecified other impact by writing to (1) console/tty, (2) console/limit, or (3) image/device-model-pid. NOTE: this issue was originally reported as an issue in libvirt 0.3.3 and xenstore, but CVE is considering the core issue to be related to Xen. libvirt v0.3.3 se basa en ficheros localizados bajo subdirectorios de /local/domain en xenstore a pesar de la falta de protección contra modificaciones introducida por Xen en máquinas virtuales invitado, lo cual permite a usuarios del sistema operativo (SO) huésped tener un impacto desconocido, como lo demostrado mediante la escritura en (1) consola de texto (console/tty) o (2) el puerto VNC para el gráfico framebuffer. • https://www.exploit-db.com/exploits/32446 http://lists.opensuse.org/opensuse-security-announce/2009-09/msg00001.html http://lists.xensource.com/archives/html/xen-devel/2008-09/msg00992.html http://lists.xensource.com/archives/html/xen-devel/2008-09/msg00994.html http://openwall.com/lists/oss-security/2008/09/30/6 http://secunia.com/advisories/32064 http://www.mandriva.com/security/advisories?name=MDVSA-2009:016 http://www.openwall.com/lists/oss-security/2008/10/04/3 http&# • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.8EPSS: 0%CPEs: 2EXPL: 0CVE-2008-3687
https://notcve.org/view.php?id=CVE-2008-3687
Heap-based buffer overflow in the flask_security_label function in Xen 3.3, when compiled with the XSM:FLASK module, allows unprivileged domain users (domU) to execute arbitrary code via the flask_op hypercall. Un desbordamiento de búfer basado en pila en la función flask_security_label en Xen 3.3, cuando se compila con el modulo XSM:FLASK, permite que usuarios del dominio (domU) sin privilegios puedan ejecutar código arbitrario a través de la hiperllamada flask_op. • http://invisiblethingslab.com/bh08/part2.pdf http://secunia.com/advisories/31561 http://theinvisiblethings.blogspot.com/2008/08/our-xen-0wning-trilogy-highlights.html http://www.nabble.com/-PATCH--XSM--FLASK--Argument-handling-bugs-in-XSM:FLASK-to18536032.html http://www.securityfocus.com/bid/30834 http://www.securitytracker.com/id?1020731 http://www.vupen.com/english/advisories/2008/2426 http://xenbits.xensource.com/xen-3.3-testing.hg?rev/fa66b33f975a https://exchange.xforce.ibmcloud • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.2EPSS: 0%CPEs: 6EXPL: 0CVE-2008-1944 – PVFB SDL backend chokes on bogus screen updates
https://notcve.org/view.php?id=CVE-2008-1944
Buffer overflow in the backend framebuffer of XenSource Xen Para-Virtualized Framebuffer (PVFB) Message 3.0 through 3.0.3 allows local users to cause a denial of service (SDL crash) and possibly execute arbitrary code via "bogus screen updates," related to missing validation of the "format of messages." Un desbordamiento de búfer en el backend del búfer de XenSource Xen Para-Virtualized Framebuffer (PVFB) Message versiones 3.0 hasta 3.0.3, permite a usuarios locales causar una denegación de servicio (bloqueo de SDL) y posiblemente ejecutar código arbitrario por medio de "bogus screen updates," relacionadas con la falta de comprobación del "format of messages." • http://secunia.com/advisories/29963 http://www.redhat.com/support/errata/RHSA-2008-0194.html http://www.securityfocus.com/bid/29186 http://www.securitytracker.com/id?1020009 https://bugzilla.redhat.com/show_bug.cgi?id=443390 https://exchange.xforce.ibmcloud.com/vulnerabilities/42388 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10868 https://access.redhat.com/security/cve/CVE-2008-1944 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 2.1EPSS: 0%CPEs: 9EXPL: 0CVE-2008-1943 – PVFB backend fails to validate frontend's framebuffer description
https://notcve.org/view.php?id=CVE-2008-1943
Buffer overflow in the backend of XenSource Xen Para Virtualized Frame Buffer (PVFB) 3.0 through 3.1.2 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a crafted description of a shared framebuffer. Un desbordamiento de búfer en el backend de XenSource Xen Para Virtualized Frame Buffer (PVFB) versiones 3.0 hasta 3.1.2, permite a usuarios locales causar una denegación de servicio (bloqueo de aplicación) y posiblemente ejecutar código arbitrario por medio de una descripción diseñada de una framebuffer compartida. • http://secunia.com/advisories/29963 http://secunia.com/advisories/30781 http://www.redhat.com/support/errata/RHSA-2008-0194.html http://www.securityfocus.com/bid/29183 http://www.securitytracker.com/id?1020008 http://www.vupen.com/english/advisories/2008/1900/references https://bugzilla.redhat.com/show_bug.cgi?id=443078 https://exchange.xforce.ibmcloud.com/vulnerabilities/42387 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10338 https://access.r • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 4.6EPSS: 0%CPEs: 1EXPL: 1CVE-2007-6416 – Security: vulnerability of copy_to_user in PAL emulation
https://notcve.org/view.php?id=CVE-2007-6416
The copy_to_user function in the PAL emulation functionality for Xen 3.1.2 and earlier, when running on ia64 systems, allows HVM guest users to access arbitrary physical memory by triggering certain mapping operations. La función copy_to_user en la funcionalidad del emulador PAL para Xen 3.1.2 y anteriores, cuando funciona sobre sistemas ia64, permite a un usuario invitado HVM acceder a la memoria física de su elección a través de un disparo de ciertas operaciones de mapeo. • http://osvdb.org/41344 http://secunia.com/advisories/28146 http://secunia.com/advisories/28643 http://www.redhat.com/support/errata/RHSA-2008-0089.html http://www.securityfocus.com/bid/26954 http://xenbits.xensource.com/ext/ia64/xen-unstable.hg?rev/e6069a715fd7 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9840 https://access.redhat.com/security/cve/CVE-2007-6416 https://bugzilla.redhat.com/show_bug.cgi?id=425381 • CWE-264: Permissions, Privileges, and Access Controls •