U.S. flag   An official website of the United States government
Dot gov

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Https

Secure .gov websites use HTTPS
A lock (Dot gov) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.

Search Results (Refine Search)

Search Parameters:
  • Keyword (text search): cpe:2.3:o:xen:xen:4.2.2:*:*:*:*:x86:*:*
  • CPE Name Search: true
There are 207 matching records.
Displaying matches 201 through 207.
Vuln ID Summary CVSS Severity
CVE-2013-2078

Xen 4.0.2 through 4.0.4, 4.1.x, and 4.2.x allows local PV guest users to cause a denial of service (hypervisor crash) via certain bit combinations to the XSETBV instruction.

Published: August 14, 2013; 11:55:06 AM -0400
V3.x:(not available)
V2.0: 4.7 MEDIUM
CVE-2013-1952

Xen 4.x, when using Intel VT-d for a bus mastering capable PCI device, does not properly check the source when accessing a bridge device's interrupt remapping table entries for MSI interrupts, which allows local guest domains to cause a denial of service (interrupt injection) via unspecified vectors.

Published: May 13, 2013; 7:55:02 PM -0400
V3.x:(not available)
V2.0: 1.9 LOW
CVE-2013-1922

qemu-nbd in QEMU, as used in Xen 4.2.x, determines the format of a raw disk image based on the header, which allows local guest OS administrators to read arbitrary files on the host by modifying the header to identify a different format, which is used when the guest is restarted, a different vulnerability than CVE-2008-2004.

Published: May 13, 2013; 7:55:01 PM -0400
V3.x:(not available)
V2.0: 3.3 LOW
CVE-2013-1919

Xen 4.2.x and 4.1.x does not properly restrict access to IRQs, which allows local stub domain clients to gain access to IRQs and cause a denial of service via vectors related to "passed-through IRQs or PCI devices."

Published: May 13, 2013; 7:55:01 PM -0400
V3.x:(not available)
V2.0: 4.7 MEDIUM
CVE-2013-1918

Certain page table manipulation operations in Xen 4.1.x, 4.2.x, and earlier are not preemptible, which allows local PV kernels to cause a denial of service via vectors related to "deep page table traversal."

Published: May 13, 2013; 7:55:01 PM -0400
V3.x:(not available)
V2.0: 4.7 MEDIUM
CVE-2013-1917

Xen 3.1 through 4.x, when running 64-bit hosts on Intel CPUs, does not clear the NT flag when using an IRET after a SYSENTER instruction, which allows PV guest users to cause a denial of service (hypervisor crash) by triggering a #GP fault, which is not properly handled by another IRET instruction.

Published: May 13, 2013; 7:55:01 PM -0400
V3.x:(not available)
V2.0: 1.9 LOW
CVE-2007-5730

Heap-based buffer overflow in QEMU 0.8.2, as used in Xen and possibly other products, allows local users to execute arbitrary code via crafted data in the "net socket listen" option, aka QEMU "net socket" heap overflow. NOTE: some sources have used CVE-2007-1321 to refer to this issue as part of "NE2000 network driver and the socket code," but this is the correct identifier for the individual net socket listen vulnerability.

Published: October 30, 2007; 6:46:00 PM -0400
V3.x:(not available)
V2.0: 7.2 HIGH