Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2015-7937 State: PUBLISHED Published: 2015-12-21T11:00:00 Last Updated: 2024-08-06T08:06:30.903Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in the GoAhead Web Server on Schneider Electric Modicon M340 PLC BMXNOx and BMXPx devices allows remote attackers to execute arbitrary code via a long password in HTTP Basic Authentication data. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-15-351-01 - http://www.securityfocus.com/bid/79622 - http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2015-344-01
CVE ID: CVE-2015-7938 State: PUBLISHED Published: 2016-01-09T02:00:00 Last Updated: 2024-08-06T08:06:31.282Z Vendors: n/a Products: n/a Problem Types: n/a Description: Advantech EKI-132x devices with firmware before 2015-12-31 allow remote attackers to bypass authentication via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-15-344-01
CVE ID: CVE-2015-7939 State: PUBLISHED Published: 2016-01-09T02:00:00 Last Updated: 2024-08-06T08:06:30.882Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in Unitronics VisiLogic OPLC IDE before 9.8.09 allows remote attackers to execute arbitrary code via a long vlp filename. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-15-274-02A - http://www.zerodayinitiative.com/advisories/ZDI-16-001
CVE ID: CVE-2015-7940 State: PUBLISHED Published: 2015-11-09T16:00:00 Last Updated: 2024-08-06T08:06:30.850Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Bouncy Castle Java library before 1.51 does not validate a point is withing the elliptic curve, which makes it easier for remote attackers to obtain private keys via a series of crafted elliptic curve Diffie Hellman (ECDH) key exchanges, aka an "invalid curve attack." Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2016-2035.html - http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html - http://www.oracle.com/technetwork/security-advisory/cpujan2018-32
echnetwork/security-advisory/cpujul2018-4258247.html - http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html - https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html - http://www.securityfocus.com/bid/79091 - http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00012.html - http://lists.fedoraproject.org/pipermail/package-announce/2016-January/174915.html - http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html - http://rhn.redhat.com/errata/RHSA-2016-2036.html - http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html - https://usn.ubuntu.com/3727-1/ - http://www.openwall.com/lists/oss-security/20
curity-advisory/cpuoct2017-3236626.html - https://usn.ubuntu.com/3727-1/ - http://www.openwall.com/lists/oss-security/2015/10/22/9 - http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html - http://www.securitytracker.com/id/1037036 - http://www.openwall.com/lists/oss-security/2015/10/22/7 - http://www.debian.org/security/2015/dsa-3417 - http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html - http://web-in-security.blogspot.ca/2015/09/practical-invalid-curve-attacks.html - http://www.securitytracker.com/id/1037046 - http://www.securitytracker.com/id/1037053 - https://www.oracle.com/security-alerts/cpuapr2020.html
CVE ID: CVE-2015-7941 State: PUBLISHED Published: 2015-11-18T16:00:00 Last Updated: 2024-08-06T08:06:31.043Z Vendors: n/a Products: n/a Problem Types: n/a Description: libxml2 2.9.2 does not properly stop parsing invalid input, which allows context-dependent attackers to cause a denial of service (out-of-bounds read and libxml2 crash) via crafted XML data to the (1) xmlParseEntityDecl or (2) xmlParseConditionalSections function in parser.c, as demonstrated by non-terminated entities. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2015-2550.html - http://www.securityfocus.com/bid/74241 - http://lists.opensuse.org/opensuse-updates/2016-01/msg
ta/RHSA-2015-2550.html - http://www.securityfocus.com/bid/74241 - http://lists.opensuse.org/opensuse-updates/2016-01/msg00031.html - http://www.openwall.com/lists/oss-security/2015/10/22/5 - https://git.gnome.org/browse/libxml2/commit/?id=9b8512337d14c8ddf662fcb98b0135f225a1c489 - http://www.debian.org/security/2015/dsa-3430 - http://xmlsoft.org/news.html - http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177381.html - https://bugzilla.gnome.org/show_bug.cgi?id=744980 - http://rhn.redhat.com/errata/RHSA-2016-1089.html - http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html - http://www.securitytracker.com/id/1034243 - http://rhn.redhat.com
rk/topics/security/linuxbulletinoct2015-2719645.html - http://www.securitytracker.com/id/1034243 - http://rhn.redhat.com/errata/RHSA-2015-2549.html - http://www.ubuntu.com/usn/USN-2812-1 - http://marc.info/?l=bugtraq&m=145382616617563&w=2 - http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177341.html - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04944172 - http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html - https://security.gentoo.org/glsa/201701-37 - http://lists.opensuse.org/opensuse-updates/2015-12/msg00120.html - http://www.openwall.com/lists/oss-security/2015/10/22/8 - https://git.gnome.org/browse/li
pdates/2015-12/msg00120.html - http://www.openwall.com/lists/oss-security/2015/10/22/8 - https://git.gnome.org/browse/libxml2/commit/?id=a7dfab7411cbf545f359dd3157e5df1eb0e7ce31
CVE ID: CVE-2015-7942 State: PUBLISHED Published: 2015-11-18T16:00:00 Last Updated: 2024-08-06T08:06:30.993Z Vendors: n/a Products: n/a Problem Types: n/a Description: The xmlParseConditionalSections function in parser.c in libxml2 does not properly skip intermediary entities when it stops parsing invalid input, which allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via crafted XML data, a different vulnerability than CVE-2015-7941. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2015-2550.html - http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html - http://lists.opensuse.org/
A-2015-2550.html - http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html - http://lists.opensuse.org/opensuse-updates/2016-01/msg00031.html - https://support.apple.com/HT206167 - https://support.apple.com/HT206168 - https://bugzilla.gnome.org/show_bug.cgi?id=744980#c8 - http://www.openwall.com/lists/oss-security/2015/10/22/5 - http://www.debian.org/security/2015/dsa-3430 - http://www.securityfocus.com/bid/79507 - http://lists.apple.com/archives/security-announce/2016/Mar/msg00000.html - http://xmlsoft.org/news.html - http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177381.html - http://rhn.redhat.com/errata/RHSA-2016-1089.html - http://www.oracle.com
il/package-announce/2016-February/177381.html - http://rhn.redhat.com/errata/RHSA-2016-1089.html - http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html - http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html - http://lists.apple.com/archives/security-announce/2016/Mar/msg00001.html - http://www.securitytracker.com/id/1034243 - http://rhn.redhat.com/errata/RHSA-2015-2549.html - http://www.ubuntu.com/usn/USN-2812-1 - http://marc.info/?l=bugtraq&m=145382616617563&w=2 - http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177341.html - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c0494417
unce/2016-February/177341.html - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04944172 - https://security.gentoo.org/glsa/201701-37 - http://lists.opensuse.org/opensuse-updates/2015-12/msg00120.html - https://bugzilla.gnome.org/show_bug.cgi?id=756456 - http://www.openwall.com/lists/oss-security/2015/10/22/8 - http://lists.apple.com/archives/security-announce/2016/Mar/msg00002.html - https://support.apple.com/HT206169 - https://support.apple.com/HT206166
CVE ID: CVE-2015-7943 State: PUBLISHED Published: 2017-10-18T18:00:00 Last Updated: 2024-08-06T08:06:31.133Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.41, the jQuery Update module 7.x-2.x before 7.x-2.7 for Drupal, and the LABjs module 7.x-1.x before 7.x-1.8 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-3233. Additional Analyst Notes: - CVE Program Container: References: - https://www.drupal.org/node/2598434 - http://www.securityfocus.com/bid/77293 - https://
Program Container: References: - https://www.drupal.org/node/2598434 - http://www.securityfocus.com/bid/77293 - https://www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2015-10-21/drupal-core-overlay-less-critical - https://www.drupal.org/node/2598426 - http://www.debian.org/security/2017/dsa-3897
CVE ID: CVE-2015-7944 State: PUBLISHED Published: 2017-08-18T17:00:00 Last Updated: 2024-08-06T08:06:31.017Z Vendors: n/a Products: n/a Problem Types: n/a Description: The RESTful control interface (aka RAPI or ganeti-rapi) in Ganeti before 2.9.7, 2.10.x before 2.10.8, 2.11.x before 2.11.8, 2.12.x before 2.12.6, 2.13.x before 2.13.3, 2.14.x before 2.14.2, and 2.15.x before 2.15.2, when used in SSL mode, allows remote attackers to cause a denial of service (resource consumption) via SSL parameter renegotiation. Additional Analyst Notes: - CVE Program Container: References: - http://docs.ganeti.org/ganeti/2.11/html/news.html#version-2-11-8 - http://docs.ganeti.org/ganeti/2.12/html/news.html#ve
http://docs.ganeti.org/ganeti/2.11/html/news.html#version-2-11-8 - http://docs.ganeti.org/ganeti/2.12/html/news.html#version-2-12.6 - http://www.debian.org/security/2016/dsa-3431 - http://docs.ganeti.org/ganeti/2.13/html/news.html#version-2-13-3 - http://docs.ganeti.org/ganeti/2.15/html/news.html#version-2-15-2 - http://packetstormsecurity.com/files/135101/Ganeti-Leaked-Secret-Denial-Of-Service.html - https://www.exploit-db.com/exploits/39169/ - http://docs.ganeti.org/ganeti/2.9/html/news.html#version-2-9-7 - http://www.ocert.org/advisories/ocert-2015-012.html - http://docs.ganeti.org/ganeti/2.10/html/news.html#version-2-10-8 - http://docs.ganeti.org/ganeti/2.14/html/news.html#version-2-14-
s.ganeti.org/ganeti/2.10/html/news.html#version-2-10-8 - http://docs.ganeti.org/ganeti/2.14/html/news.html#version-2-14-2
CVE ID: CVE-2015-7945 State: PUBLISHED Published: 2017-08-18T17:00:00 Last Updated: 2024-08-06T08:06:31.127Z Vendors: n/a Products: n/a Problem Types: n/a Description: The RESTful control interface (aka RAPI or ganeti-rapi) in Ganeti before 2.9.7, 2.10.x before 2.10.8, 2.11.x before 2.11.8, 2.12.x before 2.12.6, 2.13.x before 2.13.3, 2.14.x before 2.14.2, and 2.15.x before 2.15.2 allows remote attackers to obtain the DRBD secret via instance information job results. Additional Analyst Notes: - CVE Program Container: References: - http://docs.ganeti.org/ganeti/2.11/html/news.html#version-2-11-8 - http://docs.ganeti.org/ganeti/2.12/html/news.html#version-2-12.6 - http://www.debian.org/security
.html#version-2-11-8 - http://docs.ganeti.org/ganeti/2.12/html/news.html#version-2-12.6 - http://www.debian.org/security/2016/dsa-3431 - http://docs.ganeti.org/ganeti/2.13/html/news.html#version-2-13-3 - http://docs.ganeti.org/ganeti/2.15/html/news.html#version-2-15-2 - http://packetstormsecurity.com/files/135101/Ganeti-Leaked-Secret-Denial-Of-Service.html - https://www.exploit-db.com/exploits/39169/ - http://docs.ganeti.org/ganeti/2.9/html/news.html#version-2-9-7 - http://www.ocert.org/advisories/ocert-2015-012.html - http://docs.ganeti.org/ganeti/2.10/html/news.html#version-2-10-8 - http://docs.ganeti.org/ganeti/2.14/html/news.html#version-2-14-2
CVE ID: CVE-2015-7946 State: PUBLISHED Published: 2020-05-07T22:15:13.142257Z Last Updated: 2024-09-16T22:34:53.134Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N) Vendors: Canonical Products: unity8 (Ubuntu) Problem Types: CWE-200 Description: Information Exposure vulnerability in Unity8 as used on the Ubuntu phone and possibly also in Unity8 shipped elsewhere. This allows an attacker to enable the MTP service by opening the emergency dialer. Fixed in 8.11+16.04.20160111.1-0ubuntu1 and 8.11+15.04.20160122-0ubuntu1. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.net/bugs/1525981
CVE ID: CVE-2015-7947 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2015-7948 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2015-7949 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2015-7950 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2015-7951 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2015-7952 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2015-7953 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2015-7954 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2015-7955 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2015-7956 State: REJECTED Published: 2017-03-06T02:00:00 Last Updated: 2017-03-06T01:57:01 Description: No description available.
CVE ID: CVE-2015-7957 State: REJECTED Published: 2017-03-06T02:00:00 Last Updated: 2017-03-06T01:57:01 Description: No description available.
CVE ID: CVE-2015-7958 State: REJECTED Published: 2017-03-06T02:00:00 Last Updated: 2017-03-06T01:57:01 Description: No description available.
CVE ID: CVE-2015-7959 State: REJECTED Published: 2017-03-06T02:00:00 Last Updated: 2017-03-06T01:57:01 Description: No description available.
CVE ID: CVE-2015-7960 State: REJECTED Published: 2017-03-06T02:00:00 Last Updated: 2017-03-06T01:57:01 Description: No description available.
CVE ID: CVE-2015-7961 State: PUBLISHED Published: 2018-03-02T22:00:00 Last Updated: 2024-08-06T08:06:31.016Z Vendors: n/a Products: n/a Problem Types: n/a Description: SafeNet Authentication Service Remote Web Workplace Agent uses a weak ACL for unspecified installation directories and executable modules, which allows local users to gain privileges by modifying an executable module. Additional Analyst Notes: - CVE Program Container: References: - https://safenet.gemalto.com/technical-support/security-updates/ - https://labs.nettitude.com/blog/cve-2015-7596-through-cve-2015-7598-cve-2015-7961-through-cve-2015-7967-safenet-authentication-service-agent-vulnerabilities/ - https://labs.nettitude.
CVE ID: CVE-2015-7962 State: PUBLISHED Published: 2018-03-02T22:00:00 Last Updated: 2024-08-06T08:06:31.059Z Vendors: n/a Products: n/a Problem Types: n/a Description: SafeNet Authentication Service for Outlook Web App Agent uses a weak ACL for unspecified installation directories and executable modules, which allows local users to gain privileges by modifying an executable module. Additional Analyst Notes: - CVE Program Container: References: - https://safenet.gemalto.com/technical-support/security-updates/ - https://labs.nettitude.com/blog/cve-2015-7596-through-cve-2015-7598-cve-2015-7961-through-cve-2015-7967-safenet-authentication-service-agent-vulnerabilities/ - https://labs.nettitude.c
598-cve-2015-7961-through-cve-2015-7967-safenet-authentication-service-agent-vulnerabilities/ - https://labs.nettitude.com/wp-content/uploads/2016/03/160125-1-Gemalto-IDSS-Security-Bulletin-SAS-Agents-Privilege-Escalation.pdf
CVE ID: CVE-2015-7963 State: PUBLISHED Published: 2018-03-02T22:00:00 Last Updated: 2024-08-06T08:06:31.166Z Vendors: n/a Products: n/a Problem Types: n/a Description: SafeNet Authentication Service for AD FS Agent uses a weak ACL for unspecified installation directories and executable modules, which allows local users to gain privileges by modifying an executable module. Additional Analyst Notes: - CVE Program Container: References: - https://safenet.gemalto.com/technical-support/security-updates/ - https://labs.nettitude.com/blog/cve-2015-7596-through-cve-2015-7598-cve-2015-7961-through-cve-2015-7967-safenet-authentication-service-agent-vulnerabilities/ - https://labs.nettitude.com/wp-cont
15-7961-through-cve-2015-7967-safenet-authentication-service-agent-vulnerabilities/ - https://labs.nettitude.com/wp-content/uploads/2016/03/160125-1-Gemalto-IDSS-Security-Bulletin-SAS-Agents-Privilege-Escalation.pdf
CVE ID: CVE-2015-7964 State: PUBLISHED Published: 2018-03-02T22:00:00 Last Updated: 2024-08-06T08:06:31.127Z Vendors: n/a Products: n/a Problem Types: n/a Description: SafeNet Authentication Service for NPS Agent uses a weak ACL for unspecified installation directories and executable modules, which allows local users to gain privileges by modifying an executable module. Additional Analyst Notes: - CVE Program Container: References: - https://safenet.gemalto.com/technical-support/security-updates/ - https://labs.nettitude.com/blog/cve-2015-7596-through-cve-2015-7598-cve-2015-7961-through-cve-2015-7967-safenet-authentication-service-agent-vulnerabilities/ - https://labs.nettitude.com/wp-conten
-7961-through-cve-2015-7967-safenet-authentication-service-agent-vulnerabilities/ - https://labs.nettitude.com/wp-content/uploads/2016/03/160125-1-Gemalto-IDSS-Security-Bulletin-SAS-Agents-Privilege-Escalation.pdf
CVE ID: CVE-2015-7965 State: PUBLISHED Published: 2018-03-02T22:00:00 Last Updated: 2024-08-06T08:06:31.457Z Vendors: n/a Products: n/a Problem Types: n/a Description: SafeNet Authentication Service Windows Logon Agent uses a weak ACL for unspecified installation directories and executable modules, which allows local users to gain privileges by modifying an executable module, a different vulnerability than CVE-2015-7966. Additional Analyst Notes: - CVE Program Container: References: - https://safenet.gemalto.com/technical-support/security-updates/ - https://labs.nettitude.com/blog/cve-2015-7596-through-cve-2015-7598-cve-2015-7961-through-cve-2015-7967-safenet-authentication-service-agent-vul
om/blog/cve-2015-7596-through-cve-2015-7598-cve-2015-7961-through-cve-2015-7967-safenet-authentication-service-agent-vulnerabilities/ - https://labs.nettitude.com/wp-content/uploads/2016/03/160125-1-Gemalto-IDSS-Security-Bulletin-SAS-Agents-Privilege-Escalation.pdf
CVE ID: CVE-2015-7966 State: PUBLISHED Published: 2018-03-02T22:00:00 Last Updated: 2024-08-06T08:06:30.989Z Vendors: n/a Products: n/a Problem Types: n/a Description: SafeNet Authentication Service Windows Logon Agent uses a weak ACL for unspecified installation directories and executable modules, which allows local users to gain privileges by modifying an executable module, a different vulnerability than CVE-2015-7965. Additional Analyst Notes: - CVE Program Container: References: - https://safenet.gemalto.com/technical-support/security-updates/ - https://labs.nettitude.com/blog/cve-2015-7596-through-cve-2015-7598-cve-2015-7961-through-cve-2015-7967-safenet-authentication-service-agent-vul
CVE ID: CVE-2015-7967 State: PUBLISHED Published: 2018-03-02T22:00:00 Last Updated: 2024-08-06T08:06:31.427Z Vendors: n/a Products: n/a Problem Types: n/a Description: SafeNet Authentication Service for Citrix Web Interface Agent uses a weak ACL for unspecified installation directories and executable modules, which allows local users to gain privileges by modifying an executable module. Additional Analyst Notes: - CVE Program Container: References: - https://safenet.gemalto.com/technical-support/security-updates/ - https://labs.nettitude.com/blog/cve-2015-7596-through-cve-2015-7598-cve-2015-7961-through-cve-2015-7967-safenet-authentication-service-agent-vulnerabilities/ - https://labs.nettit
015-7598-cve-2015-7961-through-cve-2015-7967-safenet-authentication-service-agent-vulnerabilities/ - https://labs.nettitude.com/wp-content/uploads/2016/03/160125-1-Gemalto-IDSS-Security-Bulletin-SAS-Agents-Privilege-Escalation.pdf
CVE ID: CVE-2015-7968 State: PUBLISHED Published: 2020-03-09T13:34:18 Last Updated: 2024-08-06T08:06:31.323Z Severity: MEDIUM (CVSS 6.4 CVSS:3.0/AC:L/AV:N/A:L/C:L/I:N/PR:L/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: nwbc_ext2int in SAP NetWeaver Application Server before Security Note 2183189 allows XXE attacks for local file inclusion via the sap/bc/ui2/nwbc/nwbc_ext2int/ URI. Additional Analyst Notes: - CVE Program Container: References: - https://labs.integrity.pt/advisories/cve-2015-7968/
CVE ID: CVE-2015-7969 State: PUBLISHED Published: 2015-10-30T15:00:00 Last Updated: 2024-08-06T08:06:31.433Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple memory leaks in Xen 4.0 through 4.6.x allow local guest administrators or domains with certain permission to cause a denial of service (memory consumption) via a large number of "teardowns" of domains with the vcpu pointer array allocated using the (1) XEN_DOMCTL_max_vcpus hypercall or the xenoprofile state vcpu pointer array allocated using the (2) XENOPROF_get_buffer or (3) XENOPROF_set_passive hypercall. Additional Analyst Notes: - CVE Program Container: References: - http://support.citrix.com/article/CTX202404 - h
ercall. Additional Analyst Notes: - CVE Program Container: References: - http://support.citrix.com/article/CTX202404 - http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171249.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171082.html - http://www.securitytracker.com/id/1034033 - http://xenbits.xen.org/xsa/advisory-149.html - http://lists.opensuse.org/opensuse-updates/2015-11/msg00063.html - http://www.debian.org/security/2015/dsa-3414 - http://xenbits.xen.org/xsa/advisory-151.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171185.html - https://security.gentoo.org/glsa/201604-03 - http://www.securityfocus.c
ail/package-announce/2015-November/171185.html - https://security.gentoo.org/glsa/201604-03 - http://www.securityfocus.com/bid/77364
CVE ID: CVE-2015-7970 State: PUBLISHED Published: 2015-10-30T15:00:00 Last Updated: 2024-08-06T08:06:31.452Z Vendors: n/a Products: n/a Problem Types: n/a Description: The p2m_pod_emergency_sweep function in arch/x86/mm/p2m-pod.c in Xen 3.4.x, 3.5.x, and 3.6.x is not preemptible, which allows local x86 HVM guest administrators to cause a denial of service (CPU consumption and possibly reboot) via crafted memory contents that triggers a "time-consuming linear scan," related to Populate-on-Demand. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/77362 - http://support.citrix.com/article/CTX202404 - http://lists.fedoraproject.org/pipermail/packag
urityfocus.com/bid/77362 - http://support.citrix.com/article/CTX202404 - http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171249.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171082.html - http://lists.opensuse.org/opensuse-updates/2015-12/msg00053.html - http://www.securitytracker.com/id/1034034 - http://xenbits.xen.org/xsa/advisory-150.html - http://www.debian.org/security/2015/dsa-3414 - http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171185.html - https://security.gentoo.org/glsa/201604-03