PT-2014-4348 · Xen · Xen

Matthew Daley · Published 2014-04-01 · Updated 2017-01-07 · CVE-2014-1893

NVD

CVSS v2.0

5.2

Medium

Base vector

AV:A/AC:M/Au:S/C:N/I:N/A:C

Multiple integer overflows in the (1) FLASK GETBOOL and (2) FLASK SETBOOL suboperations in the flask hypercall in Xen 4.1.x, 3.3.x, 3.2.x, and earlier, when XSM is enabled, allow local users to cause a denial of service (processor fault) via unspecified vectors, a different vulnerability than CVE-2014-1891, CVE-2014-1892, and CVE-2014-1894.

Fix

DoS

Weakness Enumeration

CWE-189

Related Identifiers

CVE-2014-1893

Affected Products

Xen

References · 9

• http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html · Vendor Advisory
• http://xenbits.xen.org/xsa/advisory-84.html · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-201407-03.xml · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-1893 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00010.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00011.html · Vendor Advisory
• http://openwall.com/lists/oss-security/2014/02/07/4 · Note
• http://openwall.com/lists/oss-security/2014/02/07/12 · Note
• http://openwall.com/lists/oss-security/2014/02/10/8 · Note