CVSS: 4.9EPSS: 0%CPEs: 8EXPL: 0CVE-2015-2752
https://notcve.org/view.php?id=CVE-2015-2752
The XEN_DOMCTL_memory_mapping hypercall in Xen 3.2.x through 4.5.x, when using a PCI passthrough device, is not preemptible, which allows local x86 HVM domain users to cause a denial of service (host CPU consumption) via a crafted request to the device model (qemu-dm). La hiperllamada XEN_DOMCTL_memory_mapping en Xen 3.2.x hasta la versión 4.5.x, cuando utiliza un dispositivo de paso PCI, no es predecible, lo que podría permitir a usuarios locales del dominio HVM x86 provocar una denegación de servicio (consumo CPU del host) a través de una petición manipulada para el modelo del dispositivo (qemu-dm). • http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154574.html http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154579.html http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155198.html http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00014.html http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00018.html http://www.securityfocus.com/bid/73448 http://www.securitytracker.com/id/1031994 http://xenbits.xen.org/xsa/advisor • CWE-20: Improper Input Validation •
CVSS: 4.9EPSS: 0%CPEs: 14EXPL: 0CVE-2015-2756
https://notcve.org/view.php?id=CVE-2015-2756
QEMU, as used in Xen 3.3.x through 4.5.x, does not properly restrict access to PCI command registers, which might allow local HVM guest users to cause a denial of service (non-maskable interrupt and host crash) by disabling the (1) memory or (2) I/O decoding for a PCI Express device and then accessing the device, which triggers an Unsupported Request (UR) response. QEMU, utilizado en Xen 3.3.x hasta 4.5.x, no restringe correctamente el acceso a los registros de comandos PCI, lo que podría permitir a usuarios locales invitados de HVM causar una denegación de servicio (non-maskable interrupt (NMI) y caída de anfitrión) mediante la deshabilitación de (1) la memoria o (2) la decodificación I/O para un dispositivo PCI Express y posteriormente accediendo al dispositivo, lo que provoca una respuesta Unsupported Request (UR). • http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154574.html http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154579.html http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155198.html http://lists.nongnu.org/archive/html/qemu-devel/2015-03/msg06179.html http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00014.html http://support.citrix.com/article/CTX201145 http://www.debian.org/security/2015/dsa-3259 http://www.securityfocus.c • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.1EPSS: 1%CPEs: 9EXPL: 0CVE-2015-2751
https://notcve.org/view.php?id=CVE-2015-2751
Xen 4.3.x, 4.4.x, and 4.5.x, when using toolstack disaggregation, allows remote domains with partial management control to cause a denial of service (host lock) via unspecified domctl operations. Xen 4.3.x, 4.4.x, y 4.5.x, cuando utiliza la desagregación toolstack, opermite a dominios remotos con control de gestión parcial causar una denegación de servicio (bloqueo del anfitrión) a través de operaciones domctl no especificadas. • http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154574.html http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154579.html http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155198.html http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00018.html http://www.securityfocus.com/bid/73443 http://www.securitytracker.com/id/1031997 http://xenbits.xen.org/xsa/advisory-127.html https://security.gentoo.org/glsa/201504-04 • CWE-17: DEPRECATED: Code •
CVSS: 7.8EPSS: 0%CPEs: 5EXPL: 0CVE-2014-9114
https://notcve.org/view.php?id=CVE-2014-9114
Blkid in util-linux before 2.26rc-1 allows local users to execute arbitrary code. Blkid en util-linux en versiones anteriores a 2.26rc-1 permite a usuarios locales ejecutar código arbitrario. • http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145188.html http://lists.fedoraproject.org/pipermail/package-announce/2014-December/146229.html http://lists.opensuse.org/opensuse-updates/2015-01/msg00035.html http://www.openwall.com/lists/oss-security/2014/11/26/21 http://www.securityfocus.com/bid/71327 https://bugzilla.redhat.com/show_bug.cgi?id=1168485 https://exchange.xforce.ibmcloud.com/vulnerabilities/98993 https://github.com/karelzak/util-linux/commit/89e90ae7b2826110ea28 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 9.8EPSS: 0%CPEs: 8EXPL: 1CVE-2014-8089
https://notcve.org/view.php?id=CVE-2014-8089
SQL injection vulnerability in Zend Framework before 1.12.9, 2.2.x before 2.2.8, and 2.3.x before 2.3.3, when using the sqlsrv PHP extension, allows remote attackers to execute arbitrary SQL commands via a null byte. Una vulnerabilidad de inyección SQL en Zend Framework versiones anteriores a 1.12.9, versiones 2.2.x anteriores a 2.2.8 y versiones 2.3.x anteriores a 2.3.3, cuando se usa la extensión PHP sqlsrv, permite a atacantes remotos ejecutar comandos SQL arbitrarios por medio de un byte null. • http://framework.zend.com/security/advisory/ZF2014-06 http://seclists.org/oss-sec/2014/q4/276 http://www.securityfocus.com/bid/70011 https://bugzilla.redhat.com/show_bug.cgi?id=1151277 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •