Search Results (Refine Search)

Search Parameters:
  • Results Type: Overview
  • Keyword (text search): cpe:2.3:o:xen:xen:4.6.0:*:*:*:*:x86:*:*
There are 148 matching records.
Displaying matches 121 through 140.
Vuln ID Summary CVSS Severity
CVE-2016-7094

Buffer overflow in Xen 4.7.x and earlier allows local x86 HVM guest OS administrators on guests running with shadow paging to cause a denial of service via a pagetable update.

Published: September 21, 2016; 10:25:25 AM -0400
V3.0: 4.1 MEDIUM
V2.0: 1.5 LOW
CVE-2016-6259

Xen 4.5.x through 4.7.x do not implement Supervisor Mode Access Prevention (SMAP) whitelisting in 32-bit exception and event delivery, which allows local 32-bit PV guest OS kernels to cause a denial of service (hypervisor and VM crash) by triggering a safety check.

Published: August 02, 2016; 12:59:09 PM -0400
V3.0: 6.2 MEDIUM
V2.0: 4.9 MEDIUM
CVE-2016-6258

The PV pagetable code in arch/x86/mm.c in Xen 4.7.x and earlier allows local 32-bit PV guest OS administrators to gain host OS privileges by leveraging fast-paths for updating pagetable entries.

Published: August 02, 2016; 12:59:08 PM -0400
V3.0: 8.8 HIGH
V2.0: 7.2 HIGH
CVE-2016-5242

The p2m_teardown function in arch/arm/p2m.c in Xen 4.4.x through 4.6.x allows local guest OS users with access to the driver domain to cause a denial of service (NULL pointer dereference and host OS crash) by creating concurrent domains and holding references to them, related to VMID exhaustion.

Published: June 07, 2016; 10:06:17 AM -0400
V3.0: 5.6 MEDIUM
V2.0: 4.7 MEDIUM
CVE-2016-4963

The libxl device-handling in Xen through 4.6.x allows local guest OS users with access to the driver domain to cause a denial of service (management tool confusion) by manipulating information in the backend directories in xenstore.

Published: June 07, 2016; 10:06:16 AM -0400
V3.0: 4.7 MEDIUM
V2.0: 1.9 LOW
CVE-2016-4962

The libxl device-handling in Xen 4.6.x and earlier allows local OS guest administrators to cause a denial of service (resource consumption or management facility confusion) or gain host OS privileges by manipulating information in guest controlled areas of xenstore.

Published: June 07, 2016; 10:06:15 AM -0400
V3.0: 6.7 MEDIUM
V2.0: 6.8 MEDIUM
CVE-2016-4480

The guest_walk_tables function in arch/x86/mm/guest_walk.c in Xen 4.6.x and earlier does not properly handle the Page Size (PS) page table entry bit at the L4 and L3 page table levels, which might allow local guest OS users to gain privileges via a crafted mapping of memory.

Published: May 18, 2016; 10:59:05 AM -0400
V3.0: 8.4 HIGH
V2.0: 7.2 HIGH
CVE-2015-8554

Buffer overflow in hw/pt-msi.c in Xen 4.6.x and earlier, when using the qemu-xen-traditional (aka qemu-dm) device model, allows local x86 HVM guest administrators to gain privileges by leveraging a system with access to a passed-through MSI-X capable physical PCI device and MSI-X table entries, related to a "write path."

Published: April 14, 2016; 10:59:05 AM -0400
V3.0: 7.5 HIGH
V2.0: 6.6 MEDIUM
CVE-2016-3159

The fpu_fxrstor function in arch/x86/i387.c in Xen 4.x does not properly handle writes to the hardware FSW.ES bit when running on AMD64 processors, which allows local guest OS users to obtain sensitive register content information from another guest by leveraging pending exception and mask bits. NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-2076.

Published: April 13, 2016; 12:59:19 PM -0400
V3.0: 3.8 LOW
V2.0: 1.7 LOW
CVE-2015-8555

Xen 4.6.x, 4.5.x, 4.4.x, 4.3.x, and earlier do not initialize x86 FPU stack and XMM registers when XSAVE/XRSTOR are not used to manage guest extended register state, which allows local guest domains to obtain sensitive information from other domains via unspecified vectors.

Published: April 13, 2016; 11:59:08 AM -0400
V3.0: 8.6 HIGH
V2.0: 5.0 MEDIUM
CVE-2016-2271

VMX in Xen 4.6.x and earlier, when using an Intel or Cyrix CPU, allows local HVM guest users to cause a denial of service (guest crash) via vectors related to a non-canonical RIP.

Published: February 19, 2016; 11:59:01 AM -0500
V3.0: 5.5 MEDIUM
V2.0: 2.1 LOW
CVE-2016-2270

Xen 4.6.x and earlier allows local guest administrators to cause a denial of service (host reboot) via vectors related to multiple mappings of MMIO pages with different cachability settings.

Published: February 19, 2016; 11:59:00 AM -0500
V3.0: 6.8 MEDIUM
V2.0: 4.6 MEDIUM
CVE-2016-1571

The paging_invlpg function in include/asm-x86/paging.h in Xen 3.3.x through 4.6.x, when using shadow mode paging or nested virtualization is enabled, allows local HVM guest users to cause a denial of service (host crash) via a non-canonical guest address in an INVVPID instruction, which triggers a hypervisor bug check.

Published: January 22, 2016; 10:59:06 AM -0500
V3.0: 6.3 MEDIUM
V2.0: 4.7 MEDIUM
CVE-2016-1570

The PV superpage functionality in arch/x86/mm.c in Xen 3.4.0, 3.4.1, and 4.1.x through 4.6.x allows local PV guests to obtain sensitive information, cause a denial of service, gain privileges, or have unspecified other impact via a crafted page identifier (MFN) to the (1) MMUEXT_MARK_SUPER or (2) MMUEXT_UNMARK_SUPER sub-op in the HYPERVISOR_mmuext_op hypercall or (3) unknown vectors related to page table updates.

Published: January 22, 2016; 10:59:05 AM -0500
V3.0: 8.5 HIGH
V2.0: 6.9 MEDIUM
CVE-2015-8615

The hvm_set_callback_via function in arch/x86/hvm/irq.c in Xen 4.6 does not limit the number of printk console messages when logging the new callback method, which allows local HVM guest OS users to cause a denial of service via a large number of changes to the callback method (HVM_PARAM_CALLBACK_IRQ).

Published: January 08, 2016; 2:59:17 PM -0500
V3.0: 5.0 MEDIUM
V2.0: 2.1 LOW
CVE-2015-8341

The libxl toolstack library in Xen 4.1.x through 4.6.x does not properly release mappings of files used as kernels and initial ramdisks when managing multiple domains in the same process, which allows attackers to cause a denial of service (memory and disk consumption) by starting domains.

Published: December 17, 2015; 2:59:09 PM -0500
V3.x:(not available)
V2.0: 7.8 HIGH
CVE-2015-8340

The memory_exchange function in common/memory.c in Xen 3.2.x through 4.6.x does not properly release locks, which might allow guest OS administrators to cause a denial of service (deadlock or host crash) via unspecified vectors, related to XENMEM_exchange error handling.

Published: December 17, 2015; 2:59:08 PM -0500
V3.x:(not available)
V2.0: 4.7 MEDIUM
CVE-2015-8339

The memory_exchange function in common/memory.c in Xen 3.2.x through 4.6.x does not properly hand back pages to a domain, which might allow guest OS administrators to cause a denial of service (host crash) via unspecified vectors related to domain teardown.

Published: December 17, 2015; 2:59:07 PM -0500
V3.x:(not available)
V2.0: 4.7 MEDIUM
CVE-2015-8338

Xen 4.6.x and earlier does not properly enforce limits on page order inputs for the (1) XENMEM_increase_reservation, (2) XENMEM_populate_physmap, (3) XENMEM_exchange, and possibly other HYPERVISOR_memory_op suboperations, which allows ARM guest OS administrators to cause a denial of service (CPU consumption, guest reboot, or watchdog timeout and host reboot) and possibly have unspecified other impact via unknown vectors.

Published: December 17, 2015; 2:59:06 PM -0500
V3.x:(not available)
V2.0: 7.2 HIGH
CVE-2015-7812

The hypercall_create_continuation function in arch/arm/domain.c in Xen 4.4.x through 4.6.x allows local guest users to cause a denial of service (host crash) via a preemptible hypercall to the multicall interface.

Published: November 17, 2015; 10:59:14 AM -0500
V3.x:(not available)
V2.0: 4.9 MEDIUM