CVE-2014-3969

HighCVSS 7.4/10Last modified Jun 17, 2026

Description

Xen 4.4.x, when running on an ARM system, does not properly check write permissions on virtual addresses, which allows local guest administrators to gain privileges via unspecified vectors.

Metrics

CVSS 2.0 7.4/10AV:A/AC:M/Au:S/C:C/I:C/A:C

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://secunia.com/advisories/58975Permissions Required
http://www.openwall.com/lists/oss-security/2014/06/04/14Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/67819Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1030333Third Party Advisory, VDB Entry
http://xenbits.xen.org/xsa/advisory-98.htmlPatch, Vendor Advisory
http://secunia.com/advisories/58975Permissions Required
http://www.openwall.com/lists/oss-security/2014/06/04/14Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/67819Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1030333Third Party Advisory, VDB Entry
http://xenbits.xen.org/xsa/advisory-98.htmlPatch, Vendor Advisory

Timeline

Published: Jun 5, 2014
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-39702.9The pa_rtp_recv function in modules/rtp/rtp.c in the module-rtp-recv module in PulseAudio 5.0 and earlier allows remote attackers to cause a CVE-2014-39715.0The CmdAuthenticate::_authenticateX509 function in db/commands/authentication_commands.cpp in mongod in MongoDB 2.6.x before 2.6.2 allows re CVE-2014-39725.3Directory traversal vulnerability in Apexis APM-J601-WS cameras with firmware before 17.35.2.49 allows remote attackers to read arbitrary fi CVE-2014-39737.5Multiple SQL injection vulnerabilities in FrontAccounting (FA) before 2.3.21 allow remote attackers to execute arbitrary SQL commands via un CVE-2014-39744.3Cross-site scripting (XSS) vulnerability in filemanager.php in AuraCMS 3.0 and earlier allows remote attackers to inject arbitrary web scrip CVE-2014-39755.0Absolute path traversal vulnerability in filemanager.php in AuraCMS 3.0 allows remote attackers to list a directory via a full pathname in t CVE-2014-39765.0Buffer overflow in A10 Networks Advanced Core Operating System (ACOS) before 2.7.0-p6 and 2.7.1 before 2.7.1-P1_55 allows remote attackers t CVE-2014-39776.9libodm.a in IBM AIX 6.1 and 7.1, and VIOS 2.2.x, allows local users to overwrite arbitrary files via a symlink attack on a temporary file. N CVE-2014-39786.5SQL injection vulnerability in TomatoCart 1.1.8.6.1 allows remote authenticated users to execute arbitrary SQL commands via the First Name a CVE-2014-39797.5Bytemark Symbiosis allows remote attackers to cause a denial of service via a crafted username, which triggers the firewall to blacklist the CVE-2014-39804.6libfep 0.0.5 before 0.1.0 does not properly use UNIX domain sockets in the abstract namespace, which allows local users to gain privileges v CVE-2014-39813.3acinclude.m4, as used in the configure script in PHP 5.5.13 and earlier, allows local users to overwrite arbitrary files via a symlink attac