PT-2016-6195 · Citrix+1 · Xen+1

Wei Liu · Published 2016-06-07 · Updated 2018-09-07 · CVE-2016-4963

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Xen versions prior to 4.7

Description The issue allows local guest OS users with access to the driver domain to cause a denial of service by manipulating information in the backend directories in xenstore. This can lead to management tool confusion.

Recommendations For versions prior to 4.7, update to version 4.7 or later to resolve the issue.

Fix

DoS

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2016-4963

DLA-1493-1

MGASA-2017-0012

OPENSUSE-SU-2016_2494-1

OPENSUSE-SU-2016_2497-1

SUSE-SU-2016:2093-1

SUSE-SU-2016:2100-1

SUSE-SU-2016:2533-1

Affected Products

Suse

Xen

References · 152

• https://ubuntu.com/security/CVE-2016-4963 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2016-4963 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-4963 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2016:2533-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2016:2093-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2017-0012.html · Security Note
• https://osv.dev/vulnerability/MGASA-2017-0012 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-4963 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-4963 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-4963 · Vendor Advisory
• http://xenbits.xen.org/xsa/advisory-178.html · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2016:2100-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-4963 · Security Note
• https://osv.dev/vulnerability/DLA-1493-1 · Vendor Advisory
• https://bugzilla.suse.com/978413 · Note