Vulnerabilities (CVE)

Join the Common Vulnerabilities and Exposures (CVE) community and start to get notified about new vulnerabilities.

Filtered by vendor Xen Subscribe
Filtered by product Xen
Total 443 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2015-4105 1 Xen 1 Xen 2017-11-14 4.9 MEDIUM N/A
Xen 3.3.x through 4.5.x enables logging for PCI MSI-X pass-through error messages, which allows local x86 HVM guests to cause a denial of service (host disk consumption) via certain invalid operations.
CVE-2015-4103 1 Xen 1 Xen 2017-11-14 4.9 MEDIUM N/A
Xen 3.3.x through 4.5.x does not properly restrict write access to the host MSI message data field, which allows local x86 HVM guest administrators to cause a denial of service (host interrupt handling confusion) via vectors related to qemu and accessing spanning multiple fields.
CVE-2015-4104 1 Xen 1 Xen 2017-11-14 7.8 HIGH N/A
Xen 3.3.x through 4.5.x does not properly restrict access to PCI MSI mask bits, which allows local x86 HVM guest users to cause a denial of service (unexpected interrupt and host crash) via unspecified vectors.
CVE-2015-8550 2 Novell, Xen 2 Suse Linux Enterprise Real Time Extension, Xen 2017-11-03 5.7 MEDIUM 8.2 HIGH
Xen, when used on a system providing PV backends, allows local guest OS administrators to cause a denial of service (host OS crash) or gain privileges by writing to memory shared between the frontend and backend, aka a double fetch vulnerability.
CVE-2016-9932 1 Xen 1 Xen 2017-11-03 2.1 LOW 3.3 LOW
CMPXCHG8B emulation in Xen 3.3.x through 4.7.x on x86 systems allows local HVM guest OS users to obtain sensitive information from host stack memory via a "supposedly-ignored" operand size prefix.
CVE-2017-10914 1 Xen 1 Xen 2017-11-03 6.8 MEDIUM 8.1 HIGH
The grant-table feature in Xen through 4.8.x has a race condition leading to a double free, which allows guest OS users to cause a denial of service (memory consumption), or possibly obtain sensitive information or gain privileges, aka XSA-218 bug 2.
CVE-2017-10915 1 Xen 1 Xen 2017-11-03 6.8 MEDIUM 9.0 CRITICAL
The shadow-paging feature in Xen through 4.8.x mismanages page references and consequently introduces a race condition, which allows guest OS users to obtain Xen privileges, aka XSA-219.
CVE-2017-10918 1 Xen 1 Xen 2017-11-03 10.0 HIGH 10.0 CRITICAL
Xen through 4.8.x does not validate memory allocations during certain P2M operations, which allows guest OS users to obtain privileged host OS access, aka XSA-222.
CVE-2017-10917 1 Xen 1 Xen 2017-11-03 9.4 HIGH 9.1 CRITICAL
Xen through 4.8.x does not validate the port numbers of polled event channel ports, which allows guest OS users to cause a denial of service (NULL pointer dereference and host OS crash) or possibly obtain sensitive information, aka XSA-221.
CVE-2017-15596 1 Xen 1 Xen 2017-11-03 4.9 MEDIUM 6.0 MEDIUM
An issue was discovered in Xen 4.4.x through 4.9.x allowing ARM guest OS users to cause a denial of service (prevent physical CPU usage) because of lock mishandling upon detection of an add-to-physmap error.
CVE-2017-10922 1 Xen 1 Xen 2017-11-03 5.0 MEDIUM 7.5 HIGH
The grant-table feature in Xen through 4.8.x mishandles MMIO region grant references, which allows guest OS users to cause a denial of service (loss of grant trackability), aka XSA-224 bug 3.
CVE-2016-10024 2 Citrix, Xen 2 Xenserver, Xen 2017-11-03 4.9 MEDIUM 6.0 MEDIUM
Xen through 4.8.x allows local x86 PV guest OS kernel administrators to cause a denial of service (host hang or crash) by modifying the instruction stream asynchronously while performing certain kernel operations.
CVE-2016-10013 1 Xen 1 Xen 2017-11-03 4.6 MEDIUM 7.8 HIGH
Xen through 4.8.x allows local 64-bit x86 HVM guest OS users to gain privileges by leveraging mishandling of SYSCALL singlestep during emulation.
CVE-2017-10916 1 Xen 1 Xen 2017-11-03 5.0 MEDIUM 7.5 HIGH
The vCPU context-switch implementation in Xen through 4.8.x improperly interacts with the Memory Protection Extensions (MPX) and Protection Key (PKU) features, which makes it easier for guest OS users to defeat ASLR and other protection mechanisms, aka XSA-220.
CVE-2015-8552 4 Canonical, Debian, Novell and 1 more 5 Ubuntu Linux, Debian Linux, Suse Linux Enterprise Debuginfo and 2 more 2017-11-03 1.7 LOW 4.4 MEDIUM
The PCI backend driver in Xen, when running on an x86 system and using Linux 3.1.x through 4.3.x as the driver domain, allows local guest administrators to generate a continuous stream of WARN messages and cause a denial of service (disk consumption) by leveraging a system with access to a passed-through MSI or MSI-X capable physical PCI device and XEN_PCI_OP_enable_msi operations, aka "Linux pciback missing sanity checks."
CVE-2009-1758 2 Linux, Xen 2 Linux Kernel, Xen 2017-09-28 5.0 MEDIUM N/A
The hypervisor_callback function in Xen, possibly before 3.4.0, as applied to the Linux kernel 2.6.30-rc4, 2.6.18, and probably other versions allows guest user applications to cause a denial of service (kernel oops) of the guest OS by triggering a segmentation fault in "certain address ranges."
CVE-2008-4993 1 Xen 1 Xen 2017-09-28 6.9 MEDIUM N/A
qemu-dm.debug in Xen 3.2.1 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/args temporary file.
CVE-2007-6416 1 Xen 1 Xen 2017-09-28 4.6 MEDIUM N/A
The copy_to_user function in the PAL emulation functionality for Xen 3.1.2 and earlier, when running on ia64 systems, allows HVM guest users to access arbitrary physical memory by triggering certain mapping operations.
CVE-2009-3525 1 Xen 1 Xen 2017-09-18 7.2 HIGH N/A
The pyGrub boot loader in Xen 3.0.3, 3.3.0, and Xen-3.3.1 does not support the password option in grub.conf for para-virtualized guests, which allows attackers with access to the para-virtualized guest console to boot the guest or modify the guest's kernel boot parameters without providing the expected password.
CVE-2014-6268 1 Xen 1 Xen 2017-09-07 4.9 MEDIUM N/A
The evtchn_fifo_set_pending function in Xen 4.4.x allows local guest users to cause a denial of service (host crash) via vectors involving an uninitialized FIFO-based event channel control block when (1) binding or (2) moving an event to a different VCPU.