Published: 13/04/2016 Updated: 01/07/2017

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

CVSS v3 Base Score: 8.6 | Impact Score: 4 | Exploitability Score: 3.9

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

Xen 4.6.x, 4.5.x, 4.4.x, 4.3.x, and previous versions do not initialize x86 FPU stack and XMM registers when XSAVE/XRSTOR are not used to manage guest extended register state, which allows local guest domains to obtain sensitive information from other domains via unspecified vectors.

Vulnerable Product	Search on Vulmon	Subscribe to Product
citrix xenserver 6.0
xen xen 4.4.3
xen xen 4.4.2
xen xen 4.6.0
xen xen 4.3.4
xen xen 4.3.3
xen xen 4.4.1
xen xen 4.4.0
xen xen 4.3.2
xen xen 4.3.1
xen xen 4.5.3
xen xen 4.5.2
xen xen 4.3.0
xen xen 4.4.4
xen xen 4.5.1
xen xen 4.5.0
xen xen 4.6.1

Debian Bug report logs - #823620 Multiple security issues Package: src:xen; Maintainer for src:xen is Debian Xen Team <pkg-xen-devel@listsaliothdebianorg>; Reported by: Moritz Muehlenhoff <jmm@debianorg> Date: Fri, 6 May 2016 18:03:02 UTC Severity: grave Tags: security Fixed in versions xen/480~rc3-1, xen/48 ...

Multiple security issues have been found in the Xen virtualisation solution, which may result in denial of service or information disclosure The oldstable distribution (wheezy) will be updated in a separate DSA For the stable distribution (jessie), these problems have been fixed in version 441-9+deb8u4 For the unstable distribution (sid), thes ...

Xen 46x, 45x, 44x, 43x, and earlier do not initialize x86 FPU stack and XMM registers when XSAVE/XRSTOR are not used to manage guest extended register state, which allows local guest domains to obtain sensitive information from other domains via unspecified vectors ...

CWE-200 http://www.securitytracker.com/id/1034477 http://www.securityfocus.com/bid/79543 http://xenbits.xen.org/xsa/advisory-165.html http://support.citrix.com/article/CTX203879 http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html http://www.debian.org/security/2016/dsa-3519 https://security.gentoo.org/glsa/201604-03 https://nvd.nist.gov https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=823620 https://www.debian.org/security/./dsa-3519

CVE-2015-8555

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect