CVE-2018-19962

EPSS 0.19%
Published 08.12.2018 04:29:00
Last modified 21.11.2024 03:58:53
Source cve@mitre.org
Teams watchlist Login
Open Login

An issue was discovered in Xen through 4.11.x on AMD x86 platforms, possibly allowing guest OS users to gain host OS privileges because small IOMMU mappings are unsafely combined into larger ones.

Affected products Warnungen 0 Metrics 3 CWE 1 References 10

Data is provided by the National Vulnerability Database (NVD)

Xen ≫ Xen Version <= 4.11.1

Debian ≫ Debian Linux Version9.0

Citrix ≫ Xenserver Version7.0

Citrix ≫ Xenserver Version7.1 Updatecu1 SwEditionltsr

Citrix ≫ Xenserver Version7.5

Citrix ≫ Xenserver Version7.6

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.19%	0.41

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	7.8	1.1	6	CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
nvd@nist.gov	6.9	3.4	10	AV:L/AC:M/Au:N/C:C/I:C/A:C

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00072.html

http://www.securityfocus.com/bid/106182

Third Party Advisory

VDB Entry

https://lists.debian.org/debian-lts-announce/2019/10/msg00008.html

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UXC6BME7SXJI2ZIATNXCAH7RGPI4UKTT/

https://support.citrix.com/article/CTX239432

Third Party Advisory

https://www.debian.org/security/2019/dsa-4369

Third Party Advisory

https://xenbits.xen.org/xsa/advisory-275.html

Patch

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2018-19962

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2018-19962

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2018-19962

EUVD