CVE-2017-17564

An issue was discovered in Xen through 4.9.x allowing guest OS users to cause a denial of service host OS crash or gain host OS privileges by leveraging incorrect error handling for reference counting in shadow mode...

CVE-2017-17563

An issue was discovered in Xen through 4.9.x allowing guest OS users to cause a denial of service host OS crash or gain host OS privileges by leveraging an incorrect mask for reference-count overflow checking in shadow mode...

CVE-2017-17565

An issue was discovered in Xen through 4.9.x allowing PV guest OS users to cause a denial of service host OS crash if shadow mode and log-dirty mode are in place, because of an incorrect assertion related to M2P...

CVE-2017-17563

CVE-2017-17563 affects the Xen hypervisor (through 4.9.x) where a bug in the reference-count overflow check in shadow mode allows a guest OS user to cause a host-OS denial of service (host crash) or gain host privileges. The issue comes from an incorrect mask in reference-count overflow checking....

improper x86 shadow mode refcount error handling

ISSUE DESCRIPTION Pages being used to run x86 guests in shadow mode are reference counted to track their uses. When another reference cannot be acquired, the corresponding page table entry must not be inserted. Due to incorrect error handling, this constraint could be violated. IMPACT A malicious...

broken x86 shadow mode refcount overflow check

ISSUE DESCRIPTION Pages being used to run x86 guests in shadow mode are reference counted to track their uses. Unfortunately the overflow check when trying to obtain a new reference used a mask one bit wider than the reference count actually is, rendering the entire check ineffective. IMPACT A...

x86 PV guests may gain access to internally used pages

ISSUE DESCRIPTION Memory management for PV guests builds on page ownership and page attributes. A domain can always map, at least r/o, pages of which it is the owner. Certain fields in the control structure of a page are used for different purposes in the main PV memory management code and in cod...

CVE-2017-17565: Improper Input Validation

An issue was discovered in Xen through 4.9.x allowing PV guest OS users to cause a denial of service host OS crash if shadow mode and log-dirty mode are in place, because of an incorrect assertion related to M2P...

CVE-2017-17563: Improper Restriction of Operations within the Bounds of a Memory Buffer

An issue was discovered in Xen through 4.9.x allowing guest OS users to cause a denial of service host OS crash or gain host OS privileges by leveraging an incorrect mask for reference-count overflow checking in shadow mode...

PT-2017-14859

Name of the Vulnerable Software and Affected Versions Xen versions prior to 4.10 Description An issue in Xen allows PV guest OS users to cause a denial of service, resulting in a host OS crash, when shadow mode and log-dirty mode are enabled. This is due to an incorrect assertion related to M2P...

PT-2017-14858

Name of the Vulnerable Software and Affected Versions Xen versions prior to 4.10 Description An issue in Xen allows guest OS users to cause a denial of service, resulting in a host OS crash, or gain host OS privileges. This is achieved by leveraging incorrect error handling for reference counting...

CVE-2017-17566: Undefined Security Weakness

An issue was discovered in Xen through 4.9.x allowing PV guest OS users to cause a denial of service host OS crash or gain host OS privileges in shadow mode by mapping a certain auxiliary page...

PT-2017-14857

Name of the Vulnerable Software and Affected Versions Xen versions prior to 4.10 Description An issue in Xen allows guest OS users to cause a denial of service, potentially leading to a host OS crash, or gain host OS privileges. This is achieved by leveraging an incorrect mask for reference-count...

PT-2017-14860

Name of the Vulnerable Software and Affected Versions Xen versions prior to 4.10 Description An issue in Xen allows PV guest OS users to cause a denial of service or gain host OS privileges in shadow mode by mapping a certain auxiliary page. Recommendations For versions prior to 4.10, update to...

CVE-2017-17564: Undefined Security Weakness

An issue was discovered in Xen through 4.9.x allowing guest OS users to cause a denial of service host OS crash or gain host OS privileges by leveraging incorrect error handling for reference counting in shadow mode...

Former NSA Employee Pleads Guilty to Taking Classified Data

A former employee for the National Security Agency pleaded guilty on Friday to taking classified data to his home computer in Maryland. According to published reports, U.S. intelligence officials believe the data was then stolen from his computer by hackers working for the Russian government. Ngh...

WAGO PFC 200 SERIES Multiple Vulnerabilities

Exploit for hardware platform in category local exploits VENDOR DESCRIPTION “The WAGO-I/O-SYSTEM is a flexible fieldbus-independent solution for decentralized automation tasks. With the relay, function and interface modules, as well as overvoltage protection, WAGO provides a suitable interface fo...

CVE-2017-17087

fileio.c in Vim prior to 8.0.1263 sets the group ownership of a .swp file to the editor's primary group which may be different from the group ownership of the original file, which allows local users to obtain sensitive information by leveraging an applicable group membership, as demonstrated by...

CVE-2017-17087

fileio.c in Vim prior to 8.0.1263 sets the group ownership of a .swp file to the editor's primary group which may be different from the group ownership of the original file, which allows local users to obtain sensitive information by leveraging an applicable group membership, as demonstrated by...

CVE-2017-16566

On Jooan IP Camera A5 2.3.36 devices, an insecure FTP server does not require authentication, which allows remote attackers to read or replace core system files including those used for authentication such as passwd and shadow. This can be abused to take full root level control of the device...