CVE-2016-4962 The libxl device-handling in Xen 4.6.x and earlier allows local OS guest administrators to cause a denial of service (resource consumption or management facility confusion) or gain host OS privileges....
MediumCVSS 6.7
EPSS 0.40%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The libxl device-handling in Xen 4.6.x and earlier allows local OS guest administrators to cause a denial of service (resource consumption or management facility confusion) or gain host OS privileges by manipulating information in guest controlled areas of xenstore.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/xen(Debian:12) | < 4.8.0~rc3-1 | 4.8.0~rc3-1 |
| debian/xen(Debian:13) | < 4.8.0~rc3-1 | 4.8.0~rc3-1 |
| debian/xen(Debian:14) | < 4.8.0~rc3-1 | 4.8.0~rc3-1 |
| oracle vm server | = 3.3 | No fix listed |
| oracle vm server | = 3.4 | No fix listed |
| Xen | = 4.3.0 | No fix listed |
| Xen | = 4.3.1 | No fix listed |
| Xen | = 4.3.2 | No fix listed |
| Xen | = 4.3.3 | No fix listed |
| Xen | = 4.3.4 | No fix listed |
| Xen | = 4.4.0 | No fix listed |
| Xen | = 4.4.0-rc1 | No fix listed |
| Xen | = 4.4.1 | No fix listed |
| Xen | = 4.4.2 | No fix listed |
| Xen | = 4.4.3 | No fix listed |
| Xen | = 4.4.4 | No fix listed |
| Xen | = 4.5.0 | No fix listed |
| Xen | = 4.5.1 | No fix listed |
| Xen | = 4.5.2 | No fix listed |
| Xen | = 4.5.3 | No fix listed |
| Xen | = 4.6.0 | No fix listed |
| Xen | = 4.6.1 | No fix listed |
References
- Debian Security Tracker CVE-2016-4962 vendor-advisory
- DSA-3633 vendor-advisory
- www.oracle.com vendor-advisory
- 91006 vdb-entry
- 1036023 third-party-advisory vdb-entry
- xenbits.xen.org vendor-advisory