csaf_suse - suse-su-2016:3067-1

suse-su-2016:3067-1

Vulnerability from csaf_suse

Published

2016-12-09 13:13

Modified

2016-12-09 13:13

Summary

Security update for xen

Notes

Title of the patch

Security update for xen

Description of the patch

xen was updated to version 4.7.1 to fix 17 security issues. These security issues were fixed: - CVE-2016-9637: ioport array overflow allowing a malicious guest administrator can escalate their privilege to that of the host (bsc#1011652). - CVE-2016-9386: x86 null segments were not always treated as unusable allowing an unprivileged guest user program to elevate its privilege to that of the guest operating system. Exploit of this vulnerability is easy on Intel and more complicated on AMD (bsc#1009100). - CVE-2016-9382: x86 task switch to VM86 mode was mis-handled, allowing a unprivileged guest process to escalate its privilege to that of the guest operating system on AMD hardware. On Intel hardware a malicious unprivileged guest process can crash the guest (bsc#1009103). - CVE-2016-9385: x86 segment base write emulation lacked canonical address checks, allowing a malicious guest administrator to crash the host (bsc#1009104). - CVE-2016-9384: Guest 32-bit ELF symbol table load leaking host data to unprivileged guest users (bsc#1009105). - CVE-2016-9383: The x86 64-bit bit test instruction emulation was broken, allowing a guest to modify arbitrary memory leading to arbitray code execution (bsc#1009107). - CVE-2016-9377: x86 software interrupt injection was mis-handled, allowing an unprivileged guest user to crash the guest (bsc#1009108). - CVE-2016-9378: x86 software interrupt injection was mis-handled, allowing an unprivileged guest user to crash the guest (bsc#1009108) - CVE-2016-9381: Improper processing of shared rings allowing guest administrators take over the qemu process, elevating their privilege to that of the qemu process (bsc#1009109). - CVE-2016-9379: Delimiter injection vulnerabilities in pygrub allowed guest administrators to obtain the contents of sensitive host files or delete the files (bsc#1009111). - CVE-2016-9380: Delimiter injection vulnerabilities in pygrub allowed guest administrators to obtain the contents of sensitive host files or delete the files (bsc#1009111). - CVE-2016-7777: Xen did not properly honor CR0.TS and CR0.EM, which allowed local x86 HVM guest OS users to read or modify FPU, MMX, or XMM register state information belonging to arbitrary tasks on the guest by modifying an instruction while the hypervisor is preparing to emulate it (bsc#1000106). - CVE-2016-8910: The rtl8139_cplus_transmit function in hw/net/rtl8139.c allowed local guest OS administrators to cause a denial of service (infinite loop and CPU consumption) by leveraging failure to limit the ring descriptor count (bsc#1007157). - CVE-2016-8667: The rc4030_write function in hw/dma/rc4030.c in allowed local guest OS administrators to cause a denial of service (divide-by-zero error and QEMU process crash) via a large interval timer reload value (bsc#1005004). - CVE-2016-8669: The serial_update_parameters function in hw/char/serial.c allowed local guest OS administrators to cause a denial of service (divide-by-zero error and QEMU process crash) via vectors involving a value of divider greater than baud base (bsc#1005005). - CVE-2016-7908: The mcf_fec_do_tx function in hw/net/mcf_fec.c did not properly limit the buffer descriptor count when transmitting packets, which allowed local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via vectors involving a buffer descriptor with a length of 0 and crafted values in bd.flags (bsc#1003030). - CVE-2016-7909: The pcnet_rdra_addr function in hw/net/pcnet.c allowed local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) by setting the (1) receive or (2) transmit descriptor ring length to 0 (bsc#1003032). These non-security issues were fixed: - bsc#1004981: Xen RPM didn't contain debug hypervisor for EFI systems - bsc#1007941: Xen tools limited the number of vcpus to 256

Patchnames

SUSE-SLE-DESKTOP-12-SP2-2016-1785,SUSE-SLE-SDK-12-SP2-2016-1785,SUSE-SLE-SERVER-12-SP2-2016-1785

CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for xen",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "\nxen was updated to version 4.7.1 to fix 17 security issues.\n\nThese security issues were fixed:\n\n- CVE-2016-9637: ioport array overflow allowing a malicious guest administrator can escalate their privilege to that of the host (bsc#1011652).\n- CVE-2016-9386: x86 null segments were not always treated as unusable allowing an unprivileged guest user program to elevate its privilege to that of the guest operating system. Exploit of this vulnerability is easy on Intel and more complicated on AMD (bsc#1009100).\n- CVE-2016-9382: x86 task switch to VM86 mode was mis-handled, allowing a unprivileged guest process to escalate its privilege to that of the guest operating system on AMD hardware. On Intel hardware a malicious unprivileged guest process can crash the guest (bsc#1009103).\n- CVE-2016-9385: x86 segment base write emulation lacked canonical address checks, allowing a malicious guest administrator to crash the host (bsc#1009104).\n- CVE-2016-9384: Guest 32-bit ELF symbol table load leaking host data to unprivileged guest users (bsc#1009105).\n- CVE-2016-9383: The x86 64-bit bit test instruction emulation was broken, allowing a guest to modify arbitrary memory leading to arbitray code execution (bsc#1009107).\n- CVE-2016-9377: x86 software interrupt injection was mis-handled, allowing an unprivileged guest user to crash the guest (bsc#1009108).\n- CVE-2016-9378: x86 software interrupt injection was mis-handled, allowing an unprivileged guest user to crash the guest (bsc#1009108)\n- CVE-2016-9381: Improper processing of shared rings allowing guest administrators take over the qemu process, elevating their privilege to that of the qemu process (bsc#1009109).\n- CVE-2016-9379: Delimiter injection vulnerabilities in pygrub allowed guest administrators to obtain the contents of sensitive host files or delete the files (bsc#1009111).\n- CVE-2016-9380: Delimiter injection vulnerabilities in pygrub allowed  guest administrators to obtain the contents of sensitive host files or delete the files  (bsc#1009111).\n- CVE-2016-7777: Xen did not properly honor CR0.TS and CR0.EM, which allowed local x86 HVM guest OS users to read or modify FPU, MMX, or XMM register state information belonging to arbitrary tasks on the guest by modifying an instruction while the hypervisor is preparing to emulate it (bsc#1000106).\n- CVE-2016-8910: The rtl8139_cplus_transmit function in hw/net/rtl8139.c allowed local guest OS administrators to cause a denial of service (infinite loop and CPU consumption) by leveraging failure to limit the ring descriptor count (bsc#1007157).\n- CVE-2016-8667: The rc4030_write function in hw/dma/rc4030.c in allowed local guest OS administrators to cause a denial of service (divide-by-zero error and QEMU process crash) via a large interval timer reload value (bsc#1005004).\n- CVE-2016-8669: The serial_update_parameters function in hw/char/serial.c allowed local guest OS administrators to cause a denial of service (divide-by-zero error and QEMU process crash) via vectors involving a value of divider greater than baud base (bsc#1005005).\n- CVE-2016-7908: The mcf_fec_do_tx function in hw/net/mcf_fec.c did not properly limit the buffer descriptor count when transmitting packets, which allowed local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via vectors involving a buffer descriptor with a length of 0 and crafted values in bd.flags (bsc#1003030).\n- CVE-2016-7909: The pcnet_rdra_addr function in hw/net/pcnet.c allowed local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) by setting the (1) receive or (2) transmit descriptor ring length to 0 (bsc#1003032).\n\nThese non-security issues were fixed:\n\n- bsc#1004981: Xen RPM didn\u0027t contain debug hypervisor for EFI systems\n- bsc#1007941: Xen tools limited the number of vcpus to 256 \n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-SLE-DESKTOP-12-SP2-2016-1785,SUSE-SLE-SDK-12-SP2-2016-1785,SUSE-SLE-SERVER-12-SP2-2016-1785",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2016_3067-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2016:3067-1",
        "url": "https://www.suse.com/support/update/announcement/2016/suse-su-20163067-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2016:3067-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2016-December/002459.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1000106",
        "url": "https://bugzilla.suse.com/1000106"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1003030",
        "url": "https://bugzilla.suse.com/1003030"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1003032",
        "url": "https://bugzilla.suse.com/1003032"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1004981",
        "url": "https://bugzilla.suse.com/1004981"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1005004",
        "url": "https://bugzilla.suse.com/1005004"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1005005",
        "url": "https://bugzilla.suse.com/1005005"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1007157",
        "url": "https://bugzilla.suse.com/1007157"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1007941",
        "url": "https://bugzilla.suse.com/1007941"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1009100",
        "url": "https://bugzilla.suse.com/1009100"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1009103",
        "url": "https://bugzilla.suse.com/1009103"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1009104",
        "url": "https://bugzilla.suse.com/1009104"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1009105",
        "url": "https://bugzilla.suse.com/1009105"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1009107",
        "url": "https://bugzilla.suse.com/1009107"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1009108",
        "url": "https://bugzilla.suse.com/1009108"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1009109",
        "url": "https://bugzilla.suse.com/1009109"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1009111",
        "url": "https://bugzilla.suse.com/1009111"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1011652",
        "url": "https://bugzilla.suse.com/1011652"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2016-7777 page",
        "url": "https://www.suse.com/security/cve/CVE-2016-7777/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2016-7908 page",
        "url": "https://www.suse.com/security/cve/CVE-2016-7908/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2016-7909 page",
        "url": "https://www.suse.com/security/cve/CVE-2016-7909/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2016-8667 page",
        "url": "https://www.suse.com/security/cve/CVE-2016-8667/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2016-8669 page",
        "url": "https://www.suse.com/security/cve/CVE-2016-8669/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2016-8910 page",
        "url": "https://www.suse.com/security/cve/CVE-2016-8910/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2016-9377 page",
        "url": "https://www.suse.com/security/cve/CVE-2016-9377/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2016-9378 page",
        "url": "https://www.suse.com/security/cve/CVE-2016-9378/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2016-9379 page",
        "url": "https://www.suse.com/security/cve/CVE-2016-9379/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2016-9380 page",
        "url": "https://www.suse.com/security/cve/CVE-2016-9380/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2016-9381 page",
        "url": "https://www.suse.com/security/cve/CVE-2016-9381/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2016-9382 page",
        "url": "https://www.suse.com/security/cve/CVE-2016-9382/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2016-9383 page",
        "url": "https://www.suse.com/security/cve/CVE-2016-9383/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2016-9384 page",
        "url": "https://www.suse.com/security/cve/CVE-2016-9384/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2016-9385 page",
        "url": "https://www.suse.com/security/cve/CVE-2016-9385/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2016-9386 page",
        "url": "https://www.suse.com/security/cve/CVE-2016-9386/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2016-9637 page",
        "url": "https://www.suse.com/security/cve/CVE-2016-9637/"
      }
    ],
    "title": "Security update for xen",
    "tracking": {
      "current_release_date": "2016-12-09T13:13:04Z",
      "generator": {
        "date": "2016-12-09T13:13:04Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2016:3067-1",
      "initial_release_date": "2016-12-09T13:13:04Z",
      "revision_history": [
        {
          "date": "2016-12-09T13:13:04Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "xen-devel-4.7.1_02-25.1.aarch64",
                "product": {
                  "name": "xen-devel-4.7.1_02-25.1.aarch64",
                  "product_id": "xen-devel-4.7.1_02-25.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "xen-4.7.1_02-25.1.x86_64",
                "product": {
                  "name": "xen-4.7.1_02-25.1.x86_64",
                  "product_id": "xen-4.7.1_02-25.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "xen-libs-4.7.1_02-25.1.x86_64",
                "product": {
                  "name": "xen-libs-4.7.1_02-25.1.x86_64",
                  "product_id": "xen-libs-4.7.1_02-25.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "xen-libs-32bit-4.7.1_02-25.1.x86_64",
                "product": {
                  "name": "xen-libs-32bit-4.7.1_02-25.1.x86_64",
                  "product_id": "xen-libs-32bit-4.7.1_02-25.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "xen-devel-4.7.1_02-25.1.x86_64",
                "product": {
                  "name": "xen-devel-4.7.1_02-25.1.x86_64",
                  "product_id": "xen-devel-4.7.1_02-25.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "xen-doc-html-4.7.1_02-25.1.x86_64",
                "product": {
                  "name": "xen-doc-html-4.7.1_02-25.1.x86_64",
                  "product_id": "xen-doc-html-4.7.1_02-25.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "xen-tools-4.7.1_02-25.1.x86_64",
                "product": {
                  "name": "xen-tools-4.7.1_02-25.1.x86_64",
                  "product_id": "xen-tools-4.7.1_02-25.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "xen-tools-domU-4.7.1_02-25.1.x86_64",
                "product": {
                  "name": "xen-tools-domU-4.7.1_02-25.1.x86_64",
                  "product_id": "xen-tools-domU-4.7.1_02-25.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Desktop 12 SP2",
                "product": {
                  "name": "SUSE Linux Enterprise Desktop 12 SP2",
                  "product_id": "SUSE Linux Enterprise Desktop 12 SP2",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sled:12:sp2"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Software Development Kit 12 SP2",
                "product": {
                  "name": "SUSE Linux Enterprise Software Development Kit 12 SP2",
                  "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP2",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-sdk:12:sp2"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 12 SP2",
                "product": {
                  "name": "SUSE Linux Enterprise Server 12 SP2",
                  "product_id": "SUSE Linux Enterprise Server 12 SP2",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles:12:sp2"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP2",
                "product": {
                  "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP2",
                  "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP2",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles_sap:12:sp2"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-4.7.1_02-25.1.x86_64 as component of SUSE Linux Enterprise Desktop 12 SP2",
          "product_id": "SUSE Linux Enterprise Desktop 12 SP2:xen-4.7.1_02-25.1.x86_64"
        },
        "product_reference": "xen-4.7.1_02-25.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Desktop 12 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-libs-4.7.1_02-25.1.x86_64 as component of SUSE Linux Enterprise Desktop 12 SP2",
          "product_id": "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-4.7.1_02-25.1.x86_64"
        },
        "product_reference": "xen-libs-4.7.1_02-25.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Desktop 12 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-libs-32bit-4.7.1_02-25.1.x86_64 as component of SUSE Linux Enterprise Desktop 12 SP2",
          "product_id": "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64"
        },
        "product_reference": "xen-libs-32bit-4.7.1_02-25.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Desktop 12 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-devel-4.7.1_02-25.1.aarch64 as component of SUSE Linux Enterprise Software Development Kit 12 SP2",
          "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.aarch64"
        },
        "product_reference": "xen-devel-4.7.1_02-25.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-devel-4.7.1_02-25.1.x86_64 as component of SUSE Linux Enterprise Software Development Kit 12 SP2",
          "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.x86_64"
        },
        "product_reference": "xen-devel-4.7.1_02-25.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-4.7.1_02-25.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP2",
          "product_id": "SUSE Linux Enterprise Server 12 SP2:xen-4.7.1_02-25.1.x86_64"
        },
        "product_reference": "xen-4.7.1_02-25.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-doc-html-4.7.1_02-25.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP2",
          "product_id": "SUSE Linux Enterprise Server 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64"
        },
        "product_reference": "xen-doc-html-4.7.1_02-25.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-libs-4.7.1_02-25.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP2",
          "product_id": "SUSE Linux Enterprise Server 12 SP2:xen-libs-4.7.1_02-25.1.x86_64"
        },
        "product_reference": "xen-libs-4.7.1_02-25.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-libs-32bit-4.7.1_02-25.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP2",
          "product_id": "SUSE Linux Enterprise Server 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64"
        },
        "product_reference": "xen-libs-32bit-4.7.1_02-25.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-tools-4.7.1_02-25.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP2",
          "product_id": "SUSE Linux Enterprise Server 12 SP2:xen-tools-4.7.1_02-25.1.x86_64"
        },
        "product_reference": "xen-tools-4.7.1_02-25.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-tools-domU-4.7.1_02-25.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP2",
          "product_id": "SUSE Linux Enterprise Server 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64"
        },
        "product_reference": "xen-tools-domU-4.7.1_02-25.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-4.7.1_02-25.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP2",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-4.7.1_02-25.1.x86_64"
        },
        "product_reference": "xen-4.7.1_02-25.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-doc-html-4.7.1_02-25.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP2",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64"
        },
        "product_reference": "xen-doc-html-4.7.1_02-25.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-libs-4.7.1_02-25.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP2",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-4.7.1_02-25.1.x86_64"
        },
        "product_reference": "xen-libs-4.7.1_02-25.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-libs-32bit-4.7.1_02-25.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP2",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64"
        },
        "product_reference": "xen-libs-32bit-4.7.1_02-25.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-tools-4.7.1_02-25.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP2",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-4.7.1_02-25.1.x86_64"
        },
        "product_reference": "xen-tools-4.7.1_02-25.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-tools-domU-4.7.1_02-25.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP2",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64"
        },
        "product_reference": "xen-tools-domU-4.7.1_02-25.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2016-7777",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2016-7777"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Xen 4.7.x and earlier does not properly honor CR0.TS and CR0.EM, which allows local x86 HVM guest OS users to read or modify FPU, MMX, or XMM register state information belonging to arbitrary tasks on the guest by modifying an instruction while the hypervisor is preparing to emulate it.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12 SP2:xen-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.aarch64",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2016-7777",
          "url": "https://www.suse.com/security/cve/CVE-2016-7777"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1000106 for CVE-2016-7777",
          "url": "https://bugzilla.suse.com/1000106"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Desktop 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2016-12-09T13:13:04Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2016-7777"
    },
    {
      "cve": "CVE-2016-7908",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2016-7908"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The mcf_fec_do_tx function in hw/net/mcf_fec.c in QEMU (aka Quick Emulator) does not properly limit the buffer descriptor count when transmitting packets, which allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via vectors involving a buffer descriptor with a length of 0 and crafted values in bd.flags.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12 SP2:xen-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.aarch64",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2016-7908",
          "url": "https://www.suse.com/security/cve/CVE-2016-7908"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1002550 for CVE-2016-7908",
          "url": "https://bugzilla.suse.com/1002550"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1003030 for CVE-2016-7908",
          "url": "https://bugzilla.suse.com/1003030"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Desktop 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2016-12-09T13:13:04Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2016-7908"
    },
    {
      "cve": "CVE-2016-7909",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2016-7909"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The pcnet_rdra_addr function in hw/net/pcnet.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) by setting the (1) receive or (2) transmit descriptor ring length to 0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12 SP2:xen-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.aarch64",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2016-7909",
          "url": "https://www.suse.com/security/cve/CVE-2016-7909"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1002557 for CVE-2016-7909",
          "url": "https://bugzilla.suse.com/1002557"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1003032 for CVE-2016-7909",
          "url": "https://bugzilla.suse.com/1003032"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Desktop 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2016-12-09T13:13:04Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2016-7909"
    },
    {
      "cve": "CVE-2016-8667",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2016-8667"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The rc4030_write function in hw/dma/rc4030.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (divide-by-zero error and QEMU process crash) via a large interval timer reload value.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12 SP2:xen-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.aarch64",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2016-8667",
          "url": "https://www.suse.com/security/cve/CVE-2016-8667"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1004702 for CVE-2016-8667",
          "url": "https://bugzilla.suse.com/1004702"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1005004 for CVE-2016-8667",
          "url": "https://bugzilla.suse.com/1005004"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Desktop 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2016-12-09T13:13:04Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2016-8667"
    },
    {
      "cve": "CVE-2016-8669",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2016-8669"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The serial_update_parameters function in hw/char/serial.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (divide-by-zero error and QEMU process crash) via vectors involving a value of divider greater than baud base.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12 SP2:xen-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.aarch64",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2016-8669",
          "url": "https://www.suse.com/security/cve/CVE-2016-8669"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1004707 for CVE-2016-8669",
          "url": "https://bugzilla.suse.com/1004707"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1005005 for CVE-2016-8669",
          "url": "https://bugzilla.suse.com/1005005"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Desktop 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2016-12-09T13:13:04Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2016-8669"
    },
    {
      "cve": "CVE-2016-8910",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2016-8910"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The rtl8139_cplus_transmit function in hw/net/rtl8139.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and CPU consumption) by leveraging failure to limit the ring descriptor count.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12 SP2:xen-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.aarch64",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2016-8910",
          "url": "https://www.suse.com/security/cve/CVE-2016-8910"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1006538 for CVE-2016-8910",
          "url": "https://bugzilla.suse.com/1006538"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1007157 for CVE-2016-8910",
          "url": "https://bugzilla.suse.com/1007157"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1024178 for CVE-2016-8910",
          "url": "https://bugzilla.suse.com/1024178"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Desktop 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2016-12-09T13:13:04Z",
          "details": "low"
        }
      ],
      "title": "CVE-2016-8910"
    },
    {
      "cve": "CVE-2016-9377",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2016-9377"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Xen 4.5.x through 4.7.x on AMD systems without the NRip feature, when emulating instructions that generate software interrupts, allows local HVM guest OS users to cause a denial of service (guest crash) by leveraging IDT entry miscalculation.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12 SP2:xen-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.aarch64",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2016-9377",
          "url": "https://www.suse.com/security/cve/CVE-2016-9377"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1009108 for CVE-2016-9377",
          "url": "https://bugzilla.suse.com/1009108"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Desktop 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2016-12-09T13:13:04Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2016-9377"
    },
    {
      "cve": "CVE-2016-9378",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2016-9378"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Xen 4.5.x through 4.7.x on AMD systems without the NRip feature, when emulating instructions that generate software interrupts, allows local HVM guest OS users to cause a denial of service (guest crash) by leveraging an incorrect choice for software interrupt delivery.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12 SP2:xen-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.aarch64",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2016-9378",
          "url": "https://www.suse.com/security/cve/CVE-2016-9378"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1009108 for CVE-2016-9378",
          "url": "https://bugzilla.suse.com/1009108"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Desktop 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2016-12-09T13:13:04Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2016-9378"
    },
    {
      "cve": "CVE-2016-9379",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2016-9379"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The pygrub boot loader emulator in Xen, when S-expression output format is requested, allows local pygrub-using guest OS administrators to read or delete arbitrary files on the host via string quotes and S-expressions in the bootloader configuration file.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12 SP2:xen-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.aarch64",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2016-9379",
          "url": "https://www.suse.com/security/cve/CVE-2016-9379"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1009111 for CVE-2016-9379",
          "url": "https://bugzilla.suse.com/1009111"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.9,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Desktop 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2016-12-09T13:13:04Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2016-9379"
    },
    {
      "cve": "CVE-2016-9380",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2016-9380"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The pygrub boot loader emulator in Xen, when nul-delimited output format is requested, allows local pygrub-using guest OS administrators to read or delete arbitrary files on the host via NUL bytes in the bootloader configuration file.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12 SP2:xen-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.aarch64",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2016-9380",
          "url": "https://www.suse.com/security/cve/CVE-2016-9380"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1009111 for CVE-2016-9380",
          "url": "https://bugzilla.suse.com/1009111"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Desktop 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2016-12-09T13:13:04Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2016-9380"
    },
    {
      "cve": "CVE-2016-9381",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2016-9381"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Race condition in QEMU in Xen allows local x86 HVM guest OS administrators to gain privileges by changing certain data on shared rings, aka a \"double fetch\" vulnerability.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12 SP2:xen-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.aarch64",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2016-9381",
          "url": "https://www.suse.com/security/cve/CVE-2016-9381"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1009109 for CVE-2016-9381",
          "url": "https://bugzilla.suse.com/1009109"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Desktop 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2016-12-09T13:13:04Z",
          "details": "important"
        }
      ],
      "title": "CVE-2016-9381"
    },
    {
      "cve": "CVE-2016-9382",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2016-9382"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Xen 4.0.x through 4.7.x mishandle x86 task switches to VM86 mode, which allows local 32-bit x86 HVM guest OS users to gain privileges or cause a denial of service (guest OS crash) by leveraging a guest operating system that uses hardware task switching and allows a new task to start in VM86 mode.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12 SP2:xen-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.aarch64",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2016-9382",
          "url": "https://www.suse.com/security/cve/CVE-2016-9382"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1009103 for CVE-2016-9382",
          "url": "https://bugzilla.suse.com/1009103"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Desktop 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2016-12-09T13:13:04Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2016-9382"
    },
    {
      "cve": "CVE-2016-9383",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2016-9383"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Xen, when running on a 64-bit hypervisor, allows local x86 guest OS users to modify arbitrary memory and consequently obtain sensitive information, cause a denial of service (host crash), or execute arbitrary code on the host by leveraging broken emulation of bit test instructions.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12 SP2:xen-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.aarch64",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2016-9383",
          "url": "https://www.suse.com/security/cve/CVE-2016-9383"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1009107 for CVE-2016-9383",
          "url": "https://bugzilla.suse.com/1009107"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Desktop 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2016-12-09T13:13:04Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2016-9383"
    },
    {
      "cve": "CVE-2016-9384",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2016-9384"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Xen 4.7 allows local guest OS users to obtain sensitive host information by loading a 32-bit ELF symbol table.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12 SP2:xen-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.aarch64",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2016-9384",
          "url": "https://www.suse.com/security/cve/CVE-2016-9384"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1009105 for CVE-2016-9384",
          "url": "https://bugzilla.suse.com/1009105"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Desktop 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2016-12-09T13:13:04Z",
          "details": "low"
        }
      ],
      "title": "CVE-2016-9384"
    },
    {
      "cve": "CVE-2016-9385",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2016-9385"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The x86 segment base write emulation functionality in Xen 4.4.x through 4.7.x allows local x86 PV guest OS administrators to cause a denial of service (host crash) by leveraging lack of canonical address checks.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12 SP2:xen-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.aarch64",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2016-9385",
          "url": "https://www.suse.com/security/cve/CVE-2016-9385"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1009104 for CVE-2016-9385",
          "url": "https://bugzilla.suse.com/1009104"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Desktop 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2016-12-09T13:13:04Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2016-9385"
    },
    {
      "cve": "CVE-2016-9386",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2016-9386"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The x86 emulator in Xen does not properly treat x86 NULL segments as unusable when accessing memory, which might allow local HVM guest users to gain privileges via vectors involving \"unexpected\" base/limit values.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12 SP2:xen-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.aarch64",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2016-9386",
          "url": "https://www.suse.com/security/cve/CVE-2016-9386"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1009100 for CVE-2016-9386",
          "url": "https://bugzilla.suse.com/1009100"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Desktop 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2016-12-09T13:13:04Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2016-9386"
    },
    {
      "cve": "CVE-2016-9637",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2016-9637"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The (1) ioport_read and (2) ioport_write functions in Xen, when qemu is used as a device model within Xen, might allow local x86 HVM guest OS administrators to gain qemu process privileges via vectors involving an out-of-range ioport access.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12 SP2:xen-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.aarch64",
          "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2016-9637",
          "url": "https://www.suse.com/security/cve/CVE-2016-9637"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1011652 for CVE-2016-9637",
          "url": "https://bugzilla.suse.com/1011652"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Desktop 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-doc-html-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-32bit-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-domU-4.7.1_02-25.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP2:xen-devel-4.7.1_02-25.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2016-12-09T13:13:04Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2016-9637"
    }
  ]
}

CVE-2016-8910 (GCVE-0-2016-8910)

Vulnerability from cvelistv5

Published

2016-11-04 21:00

Modified

2024-08-06 02:35

Severity ?

CWE

Summary

The rtl8139_cplus_transmit function in hw/net/rtl8139.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and CPU consumption) by leveraging failure to limit the ring descriptor count.

References

►

URL

Tags

	https://security.gentoo.org/glsa/201611-11	vendor-advisory, x_refsource_GENTOO
	http://www.openwall.com/lists/oss-security/2016/10/24/5	mailing-list, x_refsource_MLIST
	https://access.redhat.com/errata/RHSA-2017:2392	vendor-advisory, x_refsource_REDHAT
	http://lists.opensuse.org/opensuse-updates/2016-12/msg00140.html	vendor-advisory, x_refsource_SUSE
	http://www.securityfocus.com/bid/93844	vdb-entry, x_refsource_BID
	https://lists.gnu.org/archive/html/qemu-devel/2016-10/msg05495.html	mailing-list, x_refsource_MLIST
	http://www.openwall.com/lists/oss-security/2016/10/24/2	mailing-list, x_refsource_MLIST
	https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html	mailing-list, x_refsource_MLIST
	https://access.redhat.com/errata/RHSA-2017:2408	vendor-advisory, x_refsource_REDHAT

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T02:35:02.328Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "GLSA-201611-11",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201611-11"
          },
          {
            "name": "[oss-security] 20161024 Re: CVE request Qemu: net: rtl8139: infinite loop while transmit in C+ mode",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2016/10/24/5"
          },
          {
            "name": "RHSA-2017:2392",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:2392"
          },
          {
            "name": "openSUSE-SU-2016:3237",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-updates/2016-12/msg00140.html"
          },
          {
            "name": "93844",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/93844"
          },
          {
            "name": "[qemu-devel] 20161024 [PATCH] net: rtl8139: limit processing of ring descript",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.gnu.org/archive/html/qemu-devel/2016-10/msg05495.html"
          },
          {
            "name": "[oss-security] 20161024 CVE request Qemu: net: rtl8139: infinite loop while transmit in C+ mode",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2016/10/24/2"
          },
          {
            "name": "[debian-lts-announce] 20181130 [SECURITY] [DLA 1599-1] qemu security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html"
          },
          {
            "name": "RHSA-2017:2408",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:2408"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2016-10-24T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The rtl8139_cplus_transmit function in hw/net/rtl8139.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and CPU consumption) by leveraging failure to limit the ring descriptor count."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-12-01T10:57:01",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "GLSA-201611-11",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201611-11"
        },
        {
          "name": "[oss-security] 20161024 Re: CVE request Qemu: net: rtl8139: infinite loop while transmit in C+ mode",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2016/10/24/5"
        },
        {
          "name": "RHSA-2017:2392",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:2392"
        },
        {
          "name": "openSUSE-SU-2016:3237",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-updates/2016-12/msg00140.html"
        },
        {
          "name": "93844",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/93844"
        },
        {
          "name": "[qemu-devel] 20161024 [PATCH] net: rtl8139: limit processing of ring descript",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.gnu.org/archive/html/qemu-devel/2016-10/msg05495.html"
        },
        {
          "name": "[oss-security] 20161024 CVE request Qemu: net: rtl8139: infinite loop while transmit in C+ mode",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2016/10/24/2"
        },
        {
          "name": "[debian-lts-announce] 20181130 [SECURITY] [DLA 1599-1] qemu security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html"
        },
        {
          "name": "RHSA-2017:2408",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:2408"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2016-8910",
    "datePublished": "2016-11-04T21:00:00",
    "dateReserved": "2016-10-24T00:00:00",
    "dateUpdated": "2024-08-06T02:35:02.328Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2016-7908 (GCVE-0-2016-7908)

Vulnerability from cvelistv5

Published

2016-10-05 16:00

Modified

2024-08-06 02:13

Severity ?

CWE

Summary

The mcf_fec_do_tx function in hw/net/mcf_fec.c in QEMU (aka Quick Emulator) does not properly limit the buffer descriptor count when transmitting packets, which allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via vectors involving a buffer descriptor with a length of 0 and crafted values in bd.flags.

References

►

URL

Tags

	http://www.openwall.com/lists/oss-security/2016/10/03/2	mailing-list, x_refsource_MLIST
	https://lists.gnu.org/archive/html/qemu-devel/2016-09/msg05557.html	mailing-list, x_refsource_MLIST
	https://security.gentoo.org/glsa/201611-11	vendor-advisory, x_refsource_GENTOO
	http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=070c4b92b8cd5390889716677a0b92444d6e087a	x_refsource_CONFIRM
	http://lists.opensuse.org/opensuse-updates/2016-12/msg00140.html	vendor-advisory, x_refsource_SUSE
	http://www.securityfocus.com/bid/93273	vdb-entry, x_refsource_BID
	https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html	mailing-list, x_refsource_MLIST
	http://www.openwall.com/lists/oss-security/2016/10/03/5	mailing-list, x_refsource_MLIST

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T02:13:20.875Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "[oss-security] 20161003 CVE request Qemu: net: Infinite loop in mcf_fec_do_tx",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2016/10/03/2"
          },
          {
            "name": "[qemu-devel] 20160922 [PATCH v2] net: mcf: limit buffer descriptor count",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.gnu.org/archive/html/qemu-devel/2016-09/msg05557.html"
          },
          {
            "name": "GLSA-201611-11",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201611-11"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=070c4b92b8cd5390889716677a0b92444d6e087a"
          },
          {
            "name": "openSUSE-SU-2016:3237",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-updates/2016-12/msg00140.html"
          },
          {
            "name": "93273",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/93273"
          },
          {
            "name": "[debian-lts-announce] 20181130 [SECURITY] [DLA 1599-1] qemu security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html"
          },
          {
            "name": "[oss-security] 20161003 Re: CVE request Qemu: net: Infinite loop in mcf_fec_do_tx",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2016/10/03/5"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2016-09-22T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The mcf_fec_do_tx function in hw/net/mcf_fec.c in QEMU (aka Quick Emulator) does not properly limit the buffer descriptor count when transmitting packets, which allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via vectors involving a buffer descriptor with a length of 0 and crafted values in bd.flags."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-12-01T10:57:01",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "[oss-security] 20161003 CVE request Qemu: net: Infinite loop in mcf_fec_do_tx",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2016/10/03/2"
        },
        {
          "name": "[qemu-devel] 20160922 [PATCH v2] net: mcf: limit buffer descriptor count",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.gnu.org/archive/html/qemu-devel/2016-09/msg05557.html"
        },
        {
          "name": "GLSA-201611-11",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201611-11"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=070c4b92b8cd5390889716677a0b92444d6e087a"
        },
        {
          "name": "openSUSE-SU-2016:3237",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-updates/2016-12/msg00140.html"
        },
        {
          "name": "93273",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/93273"
        },
        {
          "name": "[debian-lts-announce] 20181130 [SECURITY] [DLA 1599-1] qemu security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html"
        },
        {
          "name": "[oss-security] 20161003 Re: CVE request Qemu: net: Infinite loop in mcf_fec_do_tx",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2016/10/03/5"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2016-7908",
    "datePublished": "2016-10-05T16:00:00",
    "dateReserved": "2016-09-09T00:00:00",
    "dateUpdated": "2024-08-06T02:13:20.875Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2016-9382 (GCVE-0-2016-9382)

Vulnerability from cvelistv5

Published

2017-01-23 21:00

Modified

2024-08-06 02:50

Severity ?

CWE

Summary

Xen 4.0.x through 4.7.x mishandle x86 task switches to VM86 mode, which allows local 32-bit x86 HVM guest OS users to gain privileges or cause a denial of service (guest OS crash) by leveraging a guest operating system that uses hardware task switching and allows a new task to start in VM86 mode.

References

►

URL

Tags

	http://www.securityfocus.com/bid/94470	vdb-entry, x_refsource_BID
	https://security.gentoo.org/glsa/201612-56	vendor-advisory, x_refsource_GENTOO
	http://xenbits.xen.org/xsa/advisory-192.html	x_refsource_CONFIRM
	http://www.securitytracker.com/id/1037341	vdb-entry, x_refsource_SECTRACK
	https://support.citrix.com/article/CTX218775	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T02:50:36.977Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "94470",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/94470"
          },
          {
            "name": "GLSA-201612-56",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201612-56"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://xenbits.xen.org/xsa/advisory-192.html"
          },
          {
            "name": "1037341",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1037341"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://support.citrix.com/article/CTX218775"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2016-11-22T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Xen 4.0.x through 4.7.x mishandle x86 task switches to VM86 mode, which allows local 32-bit x86 HVM guest OS users to gain privileges or cause a denial of service (guest OS crash) by leveraging a guest operating system that uses hardware task switching and allows a new task to start in VM86 mode."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-06-30T16:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "94470",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/94470"
        },
        {
          "name": "GLSA-201612-56",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201612-56"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://xenbits.xen.org/xsa/advisory-192.html"
        },
        {
          "name": "1037341",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1037341"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://support.citrix.com/article/CTX218775"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2016-9382",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Xen 4.0.x through 4.7.x mishandle x86 task switches to VM86 mode, which allows local 32-bit x86 HVM guest OS users to gain privileges or cause a denial of service (guest OS crash) by leveraging a guest operating system that uses hardware task switching and allows a new task to start in VM86 mode."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "94470",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/94470"
            },
            {
              "name": "GLSA-201612-56",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201612-56"
            },
            {
              "name": "http://xenbits.xen.org/xsa/advisory-192.html",
              "refsource": "CONFIRM",
              "url": "http://xenbits.xen.org/xsa/advisory-192.html"
            },
            {
              "name": "1037341",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1037341"
            },
            {
              "name": "https://support.citrix.com/article/CTX218775",
              "refsource": "CONFIRM",
              "url": "https://support.citrix.com/article/CTX218775"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2016-9382",
    "datePublished": "2017-01-23T21:00:00",
    "dateReserved": "2016-11-17T00:00:00",
    "dateUpdated": "2024-08-06T02:50:36.977Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2016-9383 (GCVE-0-2016-9383)

Vulnerability from cvelistv5

Published

2017-01-23 21:00

Modified

2024-08-06 02:50

Severity ?

CWE

Summary

Xen, when running on a 64-bit hypervisor, allows local x86 guest OS users to modify arbitrary memory and consequently obtain sensitive information, cause a denial of service (host crash), or execute arbitrary code on the host by leveraging broken emulation of bit test instructions.

References

►

URL

Tags

	http://www.securityfocus.com/bid/94474	vdb-entry, x_refsource_BID
	https://security.gentoo.org/glsa/201612-56	vendor-advisory, x_refsource_GENTOO
	http://xenbits.xen.org/xsa/advisory-195.html	x_refsource_CONFIRM
	http://www.securitytracker.com/id/1037346	vdb-entry, x_refsource_SECTRACK
	https://support.citrix.com/article/CTX218775	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T02:50:37.786Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "94474",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/94474"
          },
          {
            "name": "GLSA-201612-56",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201612-56"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://xenbits.xen.org/xsa/advisory-195.html"
          },
          {
            "name": "1037346",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1037346"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://support.citrix.com/article/CTX218775"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2016-11-22T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Xen, when running on a 64-bit hypervisor, allows local x86 guest OS users to modify arbitrary memory and consequently obtain sensitive information, cause a denial of service (host crash), or execute arbitrary code on the host by leveraging broken emulation of bit test instructions."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-06-30T16:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "94474",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/94474"
        },
        {
          "name": "GLSA-201612-56",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201612-56"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://xenbits.xen.org/xsa/advisory-195.html"
        },
        {
          "name": "1037346",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1037346"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://support.citrix.com/article/CTX218775"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2016-9383",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Xen, when running on a 64-bit hypervisor, allows local x86 guest OS users to modify arbitrary memory and consequently obtain sensitive information, cause a denial of service (host crash), or execute arbitrary code on the host by leveraging broken emulation of bit test instructions."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "94474",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/94474"
            },
            {
              "name": "GLSA-201612-56",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201612-56"
            },
            {
              "name": "http://xenbits.xen.org/xsa/advisory-195.html",
              "refsource": "CONFIRM",
              "url": "http://xenbits.xen.org/xsa/advisory-195.html"
            },
            {
              "name": "1037346",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1037346"
            },
            {
              "name": "https://support.citrix.com/article/CTX218775",
              "refsource": "CONFIRM",
              "url": "https://support.citrix.com/article/CTX218775"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2016-9383",
    "datePublished": "2017-01-23T21:00:00",
    "dateReserved": "2016-11-17T00:00:00",
    "dateUpdated": "2024-08-06T02:50:37.786Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2016-7909 (GCVE-0-2016-7909)

Vulnerability from cvelistv5

Published

2016-10-05 16:00

Modified

2024-08-06 02:13

Severity ?

CWE

Summary

The pcnet_rdra_addr function in hw/net/pcnet.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) by setting the (1) receive or (2) transmit descriptor ring length to 0.

References

►

URL

Tags

	http://www.securityfocus.com/bid/93275	vdb-entry, x_refsource_BID
	https://security.gentoo.org/glsa/201611-11	vendor-advisory, x_refsource_GENTOO
	http://www.openwall.com/lists/oss-security/2016/10/03/6	mailing-list, x_refsource_MLIST
	http://www.openwall.com/lists/oss-security/2016/10/03/3	mailing-list, x_refsource_MLIST
	http://lists.opensuse.org/opensuse-updates/2016-12/msg00140.html	vendor-advisory, x_refsource_SUSE
	https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html	mailing-list, x_refsource_MLIST
	https://lists.gnu.org/archive/html/qemu-devel/2016-09/msg07942.html	mailing-list, x_refsource_MLIST

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T02:13:20.944Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "93275",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/93275"
          },
          {
            "name": "GLSA-201611-11",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201611-11"
          },
          {
            "name": "[oss-security] 20161003 Re: CVE Request Qemu: net: pcnet: infinite loop in pcnet_rdra_addr",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2016/10/03/6"
          },
          {
            "name": "[oss-security] 20161003 CVE Request Qemu: net: pcnet: infinite loop in pcnet_rdra_addr",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2016/10/03/3"
          },
          {
            "name": "openSUSE-SU-2016:3237",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-updates/2016-12/msg00140.html"
          },
          {
            "name": "[debian-lts-announce] 20181130 [SECURITY] [DLA 1599-1] qemu security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html"
          },
          {
            "name": "[qemu-devel] 20160930 [PATCH 1/2] net: pcnet: check rx/tx descriptor ring length",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.gnu.org/archive/html/qemu-devel/2016-09/msg07942.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2016-09-30T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The pcnet_rdra_addr function in hw/net/pcnet.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) by setting the (1) receive or (2) transmit descriptor ring length to 0."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-12-01T10:57:01",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "93275",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/93275"
        },
        {
          "name": "GLSA-201611-11",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201611-11"
        },
        {
          "name": "[oss-security] 20161003 Re: CVE Request Qemu: net: pcnet: infinite loop in pcnet_rdra_addr",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2016/10/03/6"
        },
        {
          "name": "[oss-security] 20161003 CVE Request Qemu: net: pcnet: infinite loop in pcnet_rdra_addr",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2016/10/03/3"
        },
        {
          "name": "openSUSE-SU-2016:3237",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-updates/2016-12/msg00140.html"
        },
        {
          "name": "[debian-lts-announce] 20181130 [SECURITY] [DLA 1599-1] qemu security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html"
        },
        {
          "name": "[qemu-devel] 20160930 [PATCH 1/2] net: pcnet: check rx/tx descriptor ring length",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.gnu.org/archive/html/qemu-devel/2016-09/msg07942.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2016-7909",
    "datePublished": "2016-10-05T16:00:00",
    "dateReserved": "2016-09-09T00:00:00",
    "dateUpdated": "2024-08-06T02:13:20.944Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2016-9386 (GCVE-0-2016-9386)

Vulnerability from cvelistv5

Published

2017-01-23 21:00

Modified

2024-08-06 02:50

Severity ?

CWE

Summary

The x86 emulator in Xen does not properly treat x86 NULL segments as unusable when accessing memory, which might allow local HVM guest users to gain privileges via vectors involving "unexpected" base/limit values.

References

►

URL

Tags

	http://www.securityfocus.com/bid/94471	vdb-entry, x_refsource_BID
	https://security.gentoo.org/glsa/201612-56	vendor-advisory, x_refsource_GENTOO
	https://support.citrix.com/article/CTX218775	x_refsource_CONFIRM
	http://xenbits.xen.org/xsa/advisory-191.html	x_refsource_CONFIRM
	http://www.securitytracker.com/id/1037340	vdb-entry, x_refsource_SECTRACK

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T02:50:37.602Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "94471",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/94471"
          },
          {
            "name": "GLSA-201612-56",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201612-56"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://support.citrix.com/article/CTX218775"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://xenbits.xen.org/xsa/advisory-191.html"
          },
          {
            "name": "1037340",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1037340"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2016-11-22T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The x86 emulator in Xen does not properly treat x86 NULL segments as unusable when accessing memory, which might allow local HVM guest users to gain privileges via vectors involving \"unexpected\" base/limit values."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-06-30T16:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "94471",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/94471"
        },
        {
          "name": "GLSA-201612-56",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201612-56"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://support.citrix.com/article/CTX218775"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://xenbits.xen.org/xsa/advisory-191.html"
        },
        {
          "name": "1037340",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1037340"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2016-9386",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The x86 emulator in Xen does not properly treat x86 NULL segments as unusable when accessing memory, which might allow local HVM guest users to gain privileges via vectors involving \"unexpected\" base/limit values."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "94471",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/94471"
            },
            {
              "name": "GLSA-201612-56",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201612-56"
            },
            {
              "name": "https://support.citrix.com/article/CTX218775",
              "refsource": "CONFIRM",
              "url": "https://support.citrix.com/article/CTX218775"
            },
            {
              "name": "http://xenbits.xen.org/xsa/advisory-191.html",
              "refsource": "CONFIRM",
              "url": "http://xenbits.xen.org/xsa/advisory-191.html"
            },
            {
              "name": "1037340",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1037340"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2016-9386",
    "datePublished": "2017-01-23T21:00:00",
    "dateReserved": "2016-11-17T00:00:00",
    "dateUpdated": "2024-08-06T02:50:37.602Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2016-9378 (GCVE-0-2016-9378)

Vulnerability from cvelistv5

Published

2017-02-22 16:00

Modified

2024-08-06 02:50

Severity ?

CWE

Summary

Xen 4.5.x through 4.7.x on AMD systems without the NRip feature, when emulating instructions that generate software interrupts, allows local HVM guest OS users to cause a denial of service (guest crash) by leveraging an incorrect choice for software interrupt delivery.

References

►

URL

Tags

	https://security.gentoo.org/glsa/201612-56	vendor-advisory, x_refsource_GENTOO
	http://www.securityfocus.com/bid/94475	vdb-entry, x_refsource_BID
	http://xenbits.xen.org/xsa/advisory-196.html	x_refsource_CONFIRM
	http://www.securitytracker.com/id/1037345	vdb-entry, x_refsource_SECTRACK

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T02:50:37.522Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "GLSA-201612-56",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201612-56"
          },
          {
            "name": "94475",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/94475"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://xenbits.xen.org/xsa/advisory-196.html"
          },
          {
            "name": "1037345",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1037345"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2016-11-22T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Xen 4.5.x through 4.7.x on AMD systems without the NRip feature, when emulating instructions that generate software interrupts, allows local HVM guest OS users to cause a denial of service (guest crash) by leveraging an incorrect choice for software interrupt delivery."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-07-27T09:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "GLSA-201612-56",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201612-56"
        },
        {
          "name": "94475",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/94475"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://xenbits.xen.org/xsa/advisory-196.html"
        },
        {
          "name": "1037345",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1037345"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2016-9378",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Xen 4.5.x through 4.7.x on AMD systems without the NRip feature, when emulating instructions that generate software interrupts, allows local HVM guest OS users to cause a denial of service (guest crash) by leveraging an incorrect choice for software interrupt delivery."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "GLSA-201612-56",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201612-56"
            },
            {
              "name": "94475",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/94475"
            },
            {
              "name": "http://xenbits.xen.org/xsa/advisory-196.html",
              "refsource": "CONFIRM",
              "url": "http://xenbits.xen.org/xsa/advisory-196.html"
            },
            {
              "name": "1037345",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1037345"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2016-9378",
    "datePublished": "2017-02-22T16:00:00",
    "dateReserved": "2016-11-17T00:00:00",
    "dateUpdated": "2024-08-06T02:50:37.522Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2016-9384 (GCVE-0-2016-9384)

Vulnerability from cvelistv5

Published

2017-02-22 16:00

Modified

2024-08-06 02:50

Severity ?

CWE

Summary

Xen 4.7 allows local guest OS users to obtain sensitive host information by loading a 32-bit ELF symbol table.

References

►

URL

Tags

	http://xenbits.xen.org/xsa/advisory-194.html	x_refsource_CONFIRM
	https://security.gentoo.org/glsa/201612-56	vendor-advisory, x_refsource_GENTOO
	http://www.securityfocus.com/bid/94468	vdb-entry, x_refsource_BID
	http://www.securitytracker.com/id/1037343	vdb-entry, x_refsource_SECTRACK
	http://xenbits.xen.org/xsa/xsa194.patch	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T02:50:37.647Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://xenbits.xen.org/xsa/advisory-194.html"
          },
          {
            "name": "GLSA-201612-56",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201612-56"
          },
          {
            "name": "94468",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/94468"
          },
          {
            "name": "1037343",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1037343"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://xenbits.xen.org/xsa/xsa194.patch"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2016-11-22T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Xen 4.7 allows local guest OS users to obtain sensitive host information by loading a 32-bit ELF symbol table."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-07-27T09:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://xenbits.xen.org/xsa/advisory-194.html"
        },
        {
          "name": "GLSA-201612-56",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201612-56"
        },
        {
          "name": "94468",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/94468"
        },
        {
          "name": "1037343",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1037343"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://xenbits.xen.org/xsa/xsa194.patch"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2016-9384",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Xen 4.7 allows local guest OS users to obtain sensitive host information by loading a 32-bit ELF symbol table."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://xenbits.xen.org/xsa/advisory-194.html",
              "refsource": "CONFIRM",
              "url": "http://xenbits.xen.org/xsa/advisory-194.html"
            },
            {
              "name": "GLSA-201612-56",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201612-56"
            },
            {
              "name": "94468",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/94468"
            },
            {
              "name": "1037343",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1037343"
            },
            {
              "name": "http://xenbits.xen.org/xsa/xsa194.patch",
              "refsource": "CONFIRM",
              "url": "http://xenbits.xen.org/xsa/xsa194.patch"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2016-9384",
    "datePublished": "2017-02-22T16:00:00",
    "dateReserved": "2016-11-17T00:00:00",
    "dateUpdated": "2024-08-06T02:50:37.647Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2016-9385 (GCVE-0-2016-9385)

Vulnerability from cvelistv5

Published

2017-01-23 21:00

Modified

2024-08-06 02:50

Severity ?

CWE

Summary

The x86 segment base write emulation functionality in Xen 4.4.x through 4.7.x allows local x86 PV guest OS administrators to cause a denial of service (host crash) by leveraging lack of canonical address checks.

References

►

URL

Tags

	https://security.gentoo.org/glsa/201612-56	vendor-advisory, x_refsource_GENTOO
	http://www.securityfocus.com/bid/94472	vdb-entry, x_refsource_BID
	http://www.securitytracker.com/id/1037342	vdb-entry, x_refsource_SECTRACK
	https://support.citrix.com/article/CTX218775	x_refsource_CONFIRM
	http://xenbits.xen.org/xsa/advisory-193.html	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T02:50:37.058Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "GLSA-201612-56",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201612-56"
          },
          {
            "name": "94472",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/94472"
          },
          {
            "name": "1037342",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1037342"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://support.citrix.com/article/CTX218775"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://xenbits.xen.org/xsa/advisory-193.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2016-11-22T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The x86 segment base write emulation functionality in Xen 4.4.x through 4.7.x allows local x86 PV guest OS administrators to cause a denial of service (host crash) by leveraging lack of canonical address checks."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-06-30T16:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "GLSA-201612-56",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201612-56"
        },
        {
          "name": "94472",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/94472"
        },
        {
          "name": "1037342",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1037342"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://support.citrix.com/article/CTX218775"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://xenbits.xen.org/xsa/advisory-193.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2016-9385",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The x86 segment base write emulation functionality in Xen 4.4.x through 4.7.x allows local x86 PV guest OS administrators to cause a denial of service (host crash) by leveraging lack of canonical address checks."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "GLSA-201612-56",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201612-56"
            },
            {
              "name": "94472",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/94472"
            },
            {
              "name": "1037342",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1037342"
            },
            {
              "name": "https://support.citrix.com/article/CTX218775",
              "refsource": "CONFIRM",
              "url": "https://support.citrix.com/article/CTX218775"
            },
            {
              "name": "http://xenbits.xen.org/xsa/advisory-193.html",
              "refsource": "CONFIRM",
              "url": "http://xenbits.xen.org/xsa/advisory-193.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2016-9385",
    "datePublished": "2017-01-23T21:00:00",
    "dateReserved": "2016-11-17T00:00:00",
    "dateUpdated": "2024-08-06T02:50:37.058Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2016-7777 (GCVE-0-2016-7777)

Vulnerability from cvelistv5

Published

2016-10-07 14:00

Modified

2024-08-06 02:04

Severity ?

CWE

Summary

Xen 4.7.x and earlier does not properly honor CR0.TS and CR0.EM, which allows local x86 HVM guest OS users to read or modify FPU, MMX, or XMM register state information belonging to arbitrary tasks on the guest by modifying an instruction while the hypervisor is preparing to emulate it.

References

►

URL

Tags

	https://support.citrix.com/article/CTX217363	x_refsource_CONFIRM
	http://xenbits.xen.org/xsa/advisory-190.html	x_refsource_CONFIRM
	http://www.securityfocus.com/bid/93344	vdb-entry, x_refsource_BID
	https://security.gentoo.org/glsa/201611-09	vendor-advisory, x_refsource_GENTOO
	http://www.securitytracker.com/id/1036942	vdb-entry, x_refsource_SECTRACK

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T02:04:55.996Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://support.citrix.com/article/CTX217363"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://xenbits.xen.org/xsa/advisory-190.html"
          },
          {
            "name": "93344",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/93344"
          },
          {
            "name": "GLSA-201611-09",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201611-09"
          },
          {
            "name": "1036942",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1036942"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2016-10-04T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Xen 4.7.x and earlier does not properly honor CR0.TS and CR0.EM, which allows local x86 HVM guest OS users to read or modify FPU, MMX, or XMM register state information belonging to arbitrary tasks on the guest by modifying an instruction while the hypervisor is preparing to emulate it."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-06-30T16:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://support.citrix.com/article/CTX217363"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://xenbits.xen.org/xsa/advisory-190.html"
        },
        {
          "name": "93344",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/93344"
        },
        {
          "name": "GLSA-201611-09",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201611-09"
        },
        {
          "name": "1036942",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1036942"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2016-7777",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Xen 4.7.x and earlier does not properly honor CR0.TS and CR0.EM, which allows local x86 HVM guest OS users to read or modify FPU, MMX, or XMM register state information belonging to arbitrary tasks on the guest by modifying an instruction while the hypervisor is preparing to emulate it."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://support.citrix.com/article/CTX217363",
              "refsource": "CONFIRM",
              "url": "https://support.citrix.com/article/CTX217363"
            },
            {
              "name": "http://xenbits.xen.org/xsa/advisory-190.html",
              "refsource": "CONFIRM",
              "url": "http://xenbits.xen.org/xsa/advisory-190.html"
            },
            {
              "name": "93344",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/93344"
            },
            {
              "name": "GLSA-201611-09",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201611-09"
            },
            {
              "name": "1036942",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1036942"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2016-7777",
    "datePublished": "2016-10-07T14:00:00",
    "dateReserved": "2016-09-09T00:00:00",
    "dateUpdated": "2024-08-06T02:04:55.996Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2016-8669 (GCVE-0-2016-8669)

Vulnerability from cvelistv5

Published

2016-11-04 21:00

Modified

2024-08-06 02:27

Severity ?

CWE

Summary

The serial_update_parameters function in hw/char/serial.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (divide-by-zero error and QEMU process crash) via vectors involving a value of divider greater than baud base.

References

►

URL

Tags

	https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html	mailing-list, x_refsource_MLIST
	https://security.gentoo.org/glsa/201611-11	vendor-advisory, x_refsource_GENTOO
	http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=3592fe0c919cf27a81d8e9f9b4f269553418bb01	x_refsource_CONFIRM
	http://www.openwall.com/lists/oss-security/2016/10/14/9	mailing-list, x_refsource_MLIST
	https://access.redhat.com/errata/RHSA-2017:2392	vendor-advisory, x_refsource_REDHAT
	http://lists.opensuse.org/opensuse-updates/2016-12/msg00140.html	vendor-advisory, x_refsource_SUSE
	http://www.securityfocus.com/bid/93563	vdb-entry, x_refsource_BID
	http://www.openwall.com/lists/oss-security/2016/10/15/5	mailing-list, x_refsource_MLIST
	https://access.redhat.com/errata/RHSA-2017:2408	vendor-advisory, x_refsource_REDHAT

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T02:27:41.271Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "[debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html"
          },
          {
            "name": "GLSA-201611-11",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201611-11"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=3592fe0c919cf27a81d8e9f9b4f269553418bb01"
          },
          {
            "name": "[oss-security] 20161014 CVE request Qemu: char: divide by zero error in serial_update_parameters",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2016/10/14/9"
          },
          {
            "name": "RHSA-2017:2392",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:2392"
          },
          {
            "name": "openSUSE-SU-2016:3237",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-updates/2016-12/msg00140.html"
          },
          {
            "name": "93563",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/93563"
          },
          {
            "name": "[oss-security] 20161015 Re: CVE request Qemu: char: divide by zero error in serial_update_parameters",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2016/10/15/5"
          },
          {
            "name": "RHSA-2017:2408",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:2408"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2016-10-12T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The serial_update_parameters function in hw/char/serial.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (divide-by-zero error and QEMU process crash) via vectors involving a value of divider greater than baud base."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-09-07T09:57:01",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "[debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html"
        },
        {
          "name": "GLSA-201611-11",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201611-11"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=3592fe0c919cf27a81d8e9f9b4f269553418bb01"
        },
        {
          "name": "[oss-security] 20161014 CVE request Qemu: char: divide by zero error in serial_update_parameters",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2016/10/14/9"
        },
        {
          "name": "RHSA-2017:2392",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:2392"
        },
        {
          "name": "openSUSE-SU-2016:3237",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-updates/2016-12/msg00140.html"
        },
        {
          "name": "93563",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/93563"
        },
        {
          "name": "[oss-security] 20161015 Re: CVE request Qemu: char: divide by zero error in serial_update_parameters",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2016/10/15/5"
        },
        {
          "name": "RHSA-2017:2408",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:2408"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2016-8669",
    "datePublished": "2016-11-04T21:00:00",
    "dateReserved": "2016-10-15T00:00:00",
    "dateUpdated": "2024-08-06T02:27:41.271Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2016-8667 (GCVE-0-2016-8667)

Vulnerability from cvelistv5

Published

2016-11-04 21:00

Modified

2024-08-06 02:27

Severity ?

CWE

Summary

The rc4030_write function in hw/dma/rc4030.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (divide-by-zero error and QEMU process crash) via a large interval timer reload value.

References

►

URL

Tags

	http://www.openwall.com/lists/oss-security/2016/10/15/4	mailing-list, x_refsource_MLIST
	https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html	mailing-list, x_refsource_MLIST
	http://www.securityfocus.com/bid/93567	vdb-entry, x_refsource_BID
	https://lists.gnu.org/archive/html/qemu-devel/2016-10/msg02577.html	mailing-list, x_refsource_MLIST
	http://lists.opensuse.org/opensuse-updates/2016-12/msg00140.html	vendor-advisory, x_refsource_SUSE
	http://www.openwall.com/lists/oss-security/2016/10/14/6	mailing-list, x_refsource_MLIST

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T02:27:41.205Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "[oss-security] 20161015 Re: CVE request Qemu: dma: rc4030 divide by zero error in set_next_tick",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2016/10/15/4"
          },
          {
            "name": "[debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html"
          },
          {
            "name": "93567",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/93567"
          },
          {
            "name": "[qemu-devel] 20161012 [PATCH] dma: rc4030: limit interval timer reload value",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.gnu.org/archive/html/qemu-devel/2016-10/msg02577.html"
          },
          {
            "name": "openSUSE-SU-2016:3237",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-updates/2016-12/msg00140.html"
          },
          {
            "name": "[oss-security] 20161014 CVE request Qemu: dma: rc4030 divide by zero error in set_next_tick",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2016/10/14/6"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2016-10-12T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The rc4030_write function in hw/dma/rc4030.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (divide-by-zero error and QEMU process crash) via a large interval timer reload value."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-09-07T09:57:01",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "[oss-security] 20161015 Re: CVE request Qemu: dma: rc4030 divide by zero error in set_next_tick",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2016/10/15/4"
        },
        {
          "name": "[debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html"
        },
        {
          "name": "93567",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/93567"
        },
        {
          "name": "[qemu-devel] 20161012 [PATCH] dma: rc4030: limit interval timer reload value",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.gnu.org/archive/html/qemu-devel/2016-10/msg02577.html"
        },
        {
          "name": "openSUSE-SU-2016:3237",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-updates/2016-12/msg00140.html"
        },
        {
          "name": "[oss-security] 20161014 CVE request Qemu: dma: rc4030 divide by zero error in set_next_tick",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2016/10/14/6"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2016-8667",
    "datePublished": "2016-11-04T21:00:00",
    "dateReserved": "2016-10-15T00:00:00",
    "dateUpdated": "2024-08-06T02:27:41.205Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2016-9377 (GCVE-0-2016-9377)

Vulnerability from cvelistv5

Published

2017-02-22 16:00

Modified

2024-08-06 02:50

Severity ?

CWE

Summary

References

►

URL

Tags

	https://security.gentoo.org/glsa/201612-56	vendor-advisory, x_refsource_GENTOO
	http://www.securityfocus.com/bid/94475	vdb-entry, x_refsource_BID
	http://xenbits.xen.org/xsa/advisory-196.html	x_refsource_CONFIRM
	http://www.securitytracker.com/id/1037345	vdb-entry, x_refsource_SECTRACK

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T02:50:37.048Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "GLSA-201612-56",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201612-56"
          },
          {
            "name": "94475",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/94475"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://xenbits.xen.org/xsa/advisory-196.html"
          },
          {
            "name": "1037345",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1037345"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2016-11-22T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Xen 4.5.x through 4.7.x on AMD systems without the NRip feature, when emulating instructions that generate software interrupts, allows local HVM guest OS users to cause a denial of service (guest crash) by leveraging IDT entry miscalculation."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-07-27T09:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "GLSA-201612-56",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201612-56"
        },
        {
          "name": "94475",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/94475"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://xenbits.xen.org/xsa/advisory-196.html"
        },
        {
          "name": "1037345",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1037345"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2016-9377",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Xen 4.5.x through 4.7.x on AMD systems without the NRip feature, when emulating instructions that generate software interrupts, allows local HVM guest OS users to cause a denial of service (guest crash) by leveraging IDT entry miscalculation."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "GLSA-201612-56",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201612-56"
            },
            {
              "name": "94475",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/94475"
            },
            {
              "name": "http://xenbits.xen.org/xsa/advisory-196.html",
              "refsource": "CONFIRM",
              "url": "http://xenbits.xen.org/xsa/advisory-196.html"
            },
            {
              "name": "1037345",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1037345"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2016-9377",
    "datePublished": "2017-02-22T16:00:00",
    "dateReserved": "2016-11-17T00:00:00",
    "dateUpdated": "2024-08-06T02:50:37.048Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2016-9379 (GCVE-0-2016-9379)

Vulnerability from cvelistv5

Published

2017-01-23 21:00

Modified

2024-08-06 02:50

Severity ?

CWE

Summary

The pygrub boot loader emulator in Xen, when S-expression output format is requested, allows local pygrub-using guest OS administrators to read or delete arbitrary files on the host via string quotes and S-expressions in the bootloader configuration file.

References

►

URL

Tags

	http://xenbits.xen.org/xsa/xsa198.patch	x_refsource_CONFIRM
	http://www.securityfocus.com/bid/94473	vdb-entry, x_refsource_BID
	https://security.gentoo.org/glsa/201612-56	vendor-advisory, x_refsource_GENTOO
	http://xenbits.xen.org/xsa/advisory-198.html	x_refsource_CONFIRM
	http://www.securitytracker.com/id/1037347	vdb-entry, x_refsource_SECTRACK
	https://support.citrix.com/article/CTX218775	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T02:50:37.614Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://xenbits.xen.org/xsa/xsa198.patch"
          },
          {
            "name": "94473",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/94473"
          },
          {
            "name": "GLSA-201612-56",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201612-56"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://xenbits.xen.org/xsa/advisory-198.html"
          },
          {
            "name": "1037347",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1037347"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://support.citrix.com/article/CTX218775"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2016-11-22T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The pygrub boot loader emulator in Xen, when S-expression output format is requested, allows local pygrub-using guest OS administrators to read or delete arbitrary files on the host via string quotes and S-expressions in the bootloader configuration file."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-06-30T16:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://xenbits.xen.org/xsa/xsa198.patch"
        },
        {
          "name": "94473",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/94473"
        },
        {
          "name": "GLSA-201612-56",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201612-56"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://xenbits.xen.org/xsa/advisory-198.html"
        },
        {
          "name": "1037347",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1037347"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://support.citrix.com/article/CTX218775"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2016-9379",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The pygrub boot loader emulator in Xen, when S-expression output format is requested, allows local pygrub-using guest OS administrators to read or delete arbitrary files on the host via string quotes and S-expressions in the bootloader configuration file."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://xenbits.xen.org/xsa/xsa198.patch",
              "refsource": "CONFIRM",
              "url": "http://xenbits.xen.org/xsa/xsa198.patch"
            },
            {
              "name": "94473",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/94473"
            },
            {
              "name": "GLSA-201612-56",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201612-56"
            },
            {
              "name": "http://xenbits.xen.org/xsa/advisory-198.html",
              "refsource": "CONFIRM",
              "url": "http://xenbits.xen.org/xsa/advisory-198.html"
            },
            {
              "name": "1037347",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1037347"
            },
            {
              "name": "https://support.citrix.com/article/CTX218775",
              "refsource": "CONFIRM",
              "url": "https://support.citrix.com/article/CTX218775"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2016-9379",
    "datePublished": "2017-01-23T21:00:00",
    "dateReserved": "2016-11-17T00:00:00",
    "dateUpdated": "2024-08-06T02:50:37.614Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2016-9380 (GCVE-0-2016-9380)

Vulnerability from cvelistv5

Published

2017-01-23 21:00

Modified

2024-08-06 02:50

Severity ?

CWE

Summary

The pygrub boot loader emulator in Xen, when nul-delimited output format is requested, allows local pygrub-using guest OS administrators to read or delete arbitrary files on the host via NUL bytes in the bootloader configuration file.

References

►

URL

Tags

	http://xenbits.xen.org/xsa/xsa198.patch	x_refsource_CONFIRM
	http://www.securityfocus.com/bid/94473	vdb-entry, x_refsource_BID
	https://security.gentoo.org/glsa/201612-56	vendor-advisory, x_refsource_GENTOO
	http://xenbits.xen.org/xsa/advisory-198.html	x_refsource_CONFIRM
	http://www.securitytracker.com/id/1037347	vdb-entry, x_refsource_SECTRACK
	https://support.citrix.com/article/CTX218775	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T02:50:37.415Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://xenbits.xen.org/xsa/xsa198.patch"
          },
          {
            "name": "94473",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/94473"
          },
          {
            "name": "GLSA-201612-56",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201612-56"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://xenbits.xen.org/xsa/advisory-198.html"
          },
          {
            "name": "1037347",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1037347"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://support.citrix.com/article/CTX218775"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2016-11-22T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The pygrub boot loader emulator in Xen, when nul-delimited output format is requested, allows local pygrub-using guest OS administrators to read or delete arbitrary files on the host via NUL bytes in the bootloader configuration file."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-06-30T16:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://xenbits.xen.org/xsa/xsa198.patch"
        },
        {
          "name": "94473",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/94473"
        },
        {
          "name": "GLSA-201612-56",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201612-56"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://xenbits.xen.org/xsa/advisory-198.html"
        },
        {
          "name": "1037347",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1037347"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://support.citrix.com/article/CTX218775"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2016-9380",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The pygrub boot loader emulator in Xen, when nul-delimited output format is requested, allows local pygrub-using guest OS administrators to read or delete arbitrary files on the host via NUL bytes in the bootloader configuration file."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://xenbits.xen.org/xsa/xsa198.patch",
              "refsource": "CONFIRM",
              "url": "http://xenbits.xen.org/xsa/xsa198.patch"
            },
            {
              "name": "94473",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/94473"
            },
            {
              "name": "GLSA-201612-56",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201612-56"
            },
            {
              "name": "http://xenbits.xen.org/xsa/advisory-198.html",
              "refsource": "CONFIRM",
              "url": "http://xenbits.xen.org/xsa/advisory-198.html"
            },
            {
              "name": "1037347",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1037347"
            },
            {
              "name": "https://support.citrix.com/article/CTX218775",
              "refsource": "CONFIRM",
              "url": "https://support.citrix.com/article/CTX218775"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2016-9380",
    "datePublished": "2017-01-23T21:00:00",
    "dateReserved": "2016-11-17T00:00:00",
    "dateUpdated": "2024-08-06T02:50:37.415Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2016-9637 (GCVE-0-2016-9637)

Vulnerability from cvelistv5

Published

2017-02-16 18:00

Modified

2024-08-06 02:59

Severity ?

CWE

Summary

The (1) ioport_read and (2) ioport_write functions in Xen, when qemu is used as a device model within Xen, might allow local x86 HVM guest OS administrators to gain qemu process privileges via vectors involving an out-of-range ioport access.

References

►

URL

Tags

	http://www.securityfocus.com/bid/94699	vdb-entry, x_refsource_BID
	https://security.gentoo.org/glsa/201612-56	vendor-advisory, x_refsource_GENTOO
	https://support.citrix.com/article/CTX219136	x_refsource_CONFIRM
	https://lists.debian.org/debian-lts-announce/2018/02/msg00005.html	mailing-list, x_refsource_MLIST
	http://xenbits.xen.org/xsa/advisory-199.html	x_refsource_CONFIRM
	http://www.securitytracker.com/id/1037397	vdb-entry, x_refsource_SECTRACK
	http://rhn.redhat.com/errata/RHSA-2016-2963.html	vendor-advisory, x_refsource_REDHAT

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T02:59:03.139Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "94699",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/94699"
          },
          {
            "name": "GLSA-201612-56",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201612-56"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://support.citrix.com/article/CTX219136"
          },
          {
            "name": "[debian-lts-announce] 20180206 [SECURITY] [DLA 1270-1] xen security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/02/msg00005.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://xenbits.xen.org/xsa/advisory-199.html"
          },
          {
            "name": "1037397",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1037397"
          },
          {
            "name": "RHSA-2016:2963",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2016-2963.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2016-12-06T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The (1) ioport_read and (2) ioport_write functions in Xen, when qemu is used as a device model within Xen, might allow local x86 HVM guest OS administrators to gain qemu process privileges via vectors involving an out-of-range ioport access."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-02-07T10:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "94699",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/94699"
        },
        {
          "name": "GLSA-201612-56",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201612-56"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://support.citrix.com/article/CTX219136"
        },
        {
          "name": "[debian-lts-announce] 20180206 [SECURITY] [DLA 1270-1] xen security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/02/msg00005.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://xenbits.xen.org/xsa/advisory-199.html"
        },
        {
          "name": "1037397",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1037397"
        },
        {
          "name": "RHSA-2016:2963",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2016-2963.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2016-9637",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The (1) ioport_read and (2) ioport_write functions in Xen, when qemu is used as a device model within Xen, might allow local x86 HVM guest OS administrators to gain qemu process privileges via vectors involving an out-of-range ioport access."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "94699",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/94699"
            },
            {
              "name": "GLSA-201612-56",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201612-56"
            },
            {
              "name": "https://support.citrix.com/article/CTX219136",
              "refsource": "CONFIRM",
              "url": "https://support.citrix.com/article/CTX219136"
            },
            {
              "name": "[debian-lts-announce] 20180206 [SECURITY] [DLA 1270-1] xen security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/02/msg00005.html"
            },
            {
              "name": "http://xenbits.xen.org/xsa/advisory-199.html",
              "refsource": "CONFIRM",
              "url": "http://xenbits.xen.org/xsa/advisory-199.html"
            },
            {
              "name": "1037397",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1037397"
            },
            {
              "name": "RHSA-2016:2963",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2016-2963.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2016-9637",
    "datePublished": "2017-02-16T18:00:00",
    "dateReserved": "2016-11-23T00:00:00",
    "dateUpdated": "2024-08-06T02:59:03.139Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2016-9381 (GCVE-0-2016-9381)

Vulnerability from cvelistv5

Published

2017-01-23 21:00

Modified

2024-08-06 02:50

Severity ?

CWE

Summary

Race condition in QEMU in Xen allows local x86 HVM guest OS administrators to gain privileges by changing certain data on shared rings, aka a "double fetch" vulnerability.

References

►

URL

Tags

	http://xenbits.xen.org/xsa/advisory-197.html	x_refsource_CONFIRM
	https://security.gentoo.org/glsa/201612-56	vendor-advisory, x_refsource_GENTOO
	http://www.securityfocus.com/bid/94476	vdb-entry, x_refsource_BID
	https://support.citrix.com/article/CTX218775	x_refsource_CONFIRM
	http://www.securitytracker.com/id/1037344	vdb-entry, x_refsource_SECTRACK

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T02:50:37.693Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://xenbits.xen.org/xsa/advisory-197.html"
          },
          {
            "name": "GLSA-201612-56",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201612-56"
          },
          {
            "name": "94476",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/94476"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://support.citrix.com/article/CTX218775"
          },
          {
            "name": "1037344",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1037344"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2016-11-22T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Race condition in QEMU in Xen allows local x86 HVM guest OS administrators to gain privileges by changing certain data on shared rings, aka a \"double fetch\" vulnerability."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-06-30T16:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://xenbits.xen.org/xsa/advisory-197.html"
        },
        {
          "name": "GLSA-201612-56",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201612-56"
        },
        {
          "name": "94476",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/94476"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://support.citrix.com/article/CTX218775"
        },
        {
          "name": "1037344",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1037344"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2016-9381",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Race condition in QEMU in Xen allows local x86 HVM guest OS administrators to gain privileges by changing certain data on shared rings, aka a \"double fetch\" vulnerability."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://xenbits.xen.org/xsa/advisory-197.html",
              "refsource": "CONFIRM",
              "url": "http://xenbits.xen.org/xsa/advisory-197.html"
            },
            {
              "name": "GLSA-201612-56",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201612-56"
            },
            {
              "name": "94476",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/94476"
            },
            {
              "name": "https://support.citrix.com/article/CTX218775",
              "refsource": "CONFIRM",
              "url": "https://support.citrix.com/article/CTX218775"
            },
            {
              "name": "1037344",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1037344"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2016-9381",
    "datePublished": "2017-01-23T21:00:00",
    "dateReserved": "2016-11-17T00:00:00",
    "dateUpdated": "2024-08-06T02:50:37.693Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

suse-su-2016:3067-1

Vulnerability from csaf_suse

CVE-2016-8910 (GCVE-0-2016-8910)

Vulnerability from cvelistv5

CVE-2016-7908 (GCVE-0-2016-7908)

Vulnerability from cvelistv5

CVE-2016-9382 (GCVE-0-2016-9382)

Vulnerability from cvelistv5

CVE-2016-9383 (GCVE-0-2016-9383)

Vulnerability from cvelistv5

CVE-2016-7909 (GCVE-0-2016-7909)

Vulnerability from cvelistv5

CVE-2016-9386 (GCVE-0-2016-9386)

Vulnerability from cvelistv5

CVE-2016-9378 (GCVE-0-2016-9378)

Vulnerability from cvelistv5

CVE-2016-9384 (GCVE-0-2016-9384)

Vulnerability from cvelistv5

CVE-2016-9385 (GCVE-0-2016-9385)

Vulnerability from cvelistv5

CVE-2016-7777 (GCVE-0-2016-7777)

Vulnerability from cvelistv5

CVE-2016-8669 (GCVE-0-2016-8669)

Vulnerability from cvelistv5

CVE-2016-8667 (GCVE-0-2016-8667)

Vulnerability from cvelistv5

CVE-2016-9377 (GCVE-0-2016-9377)

Vulnerability from cvelistv5

CVE-2016-9379 (GCVE-0-2016-9379)

Vulnerability from cvelistv5

CVE-2016-9380 (GCVE-0-2016-9380)

Vulnerability from cvelistv5

CVE-2016-9637 (GCVE-0-2016-9637)

Vulnerability from cvelistv5

CVE-2016-9381 (GCVE-0-2016-9381)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature