CVE-2018-19962

EPSS 0.19%
Veröffentlicht 08.12.2018 04:29:00
Zuletzt bearbeitet 21.11.2024 03:58:53
Quelle cve@mitre.org
Teams Watchlist Login
Unerledigt Login

An issue was discovered in Xen through 4.11.x on AMD x86 platforms, possibly allowing guest OS users to gain host OS privileges because small IOMMU mappings are unsafely combined into larger ones.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 10

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Xen ≫ Xen Version <= 4.11.1

Debian ≫ Debian Linux Version9.0

Citrix ≫ Xenserver Version7.0

Citrix ≫ Xenserver Version7.1 Updatecu1 SwEditionltsr

Citrix ≫ Xenserver Version7.5

Citrix ≫ Xenserver Version7.6

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.19%	0.41

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	7.8	1.1	6	CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
nvd@nist.gov	6.9	3.4	10	AV:L/AC:M/Au:N/C:C/I:C/A:C

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00072.html

http://www.securityfocus.com/bid/106182

Third Party Advisory

VDB Entry

https://lists.debian.org/debian-lts-announce/2019/10/msg00008.html

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UXC6BME7SXJI2ZIATNXCAH7RGPI4UKTT/

https://support.citrix.com/article/CTX239432

Third Party Advisory

https://www.debian.org/security/2019/dsa-4369

Third Party Advisory

https://xenbits.xen.org/xsa/advisory-275.html

Patch

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2018-19962

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2018-19962

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2018-19962

EUVD