CVE-2016-7093

HighCVSS 8.2/10Last modified Jun 17, 2026

Description

Xen 4.5.3, 4.6.3, and 4.7.x allow local HVM guest OS administrators to overwrite hypervisor memory and consequently gain host OS privileges by leveraging mishandling of instruction pointer truncation during emulation.

Metrics

CVSS 3.0 8.2/10CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://support.citrix.com/article/CTX216071Third Party Advisory
http://www.securityfocus.com/bid/92865
http://www.securitytracker.com/id/1036752Third Party Advisory, VDB Entry
http://xenbits.xen.org/xsa/advisory-186.htmlPatch, Vendor Advisory
http://xenbits.xen.org/xsa/xsa186-0001-x86-emulate-Correct-boundary-interactions-of-emulate.patchPatch, Vendor Advisory
https://security.gentoo.org/glsa/201611-09
http://support.citrix.com/article/CTX216071Third Party Advisory
http://www.securityfocus.com/bid/92865
http://www.securitytracker.com/id/1036752Third Party Advisory, VDB Entry
http://xenbits.xen.org/xsa/advisory-186.htmlPatch, Vendor Advisory
http://xenbits.xen.org/xsa/xsa186-0001-x86-emulate-Correct-boundary-interactions-of-emulate.patchPatch, Vendor Advisory
https://security.gentoo.org/glsa/201611-09

Timeline

Published: Sep 21, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-70944.1Buffer overflow in Xen 4.7.x and earlier allows local x86 HVM guest OS administrators on guests running with shadow paging to cause a denial CVE-2016-70959.8Exponent CMS before 2.3.9 is vulnerable to an attacker uploading a malicious script file using redirection to place the script in an unprote CVE-2016-70974.4The filesystem implementation in the Linux kernel through 4.8.2 preserves the setgid bit during a setxattr call, which allows local users to CVE-2016-70988.1Race condition in wget 1.17 and earlier, when used in recursive or mirroring mode to download a single file, might allow remote servers to b CVE-2016-70995.9The tls.checkServerIdentity function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 does no CVE-2016-71016.5The SGI coder in ImageMagick before 7.0.2-10 allows remote attackers to cause a denial of service (out-of-bounds read) via a large row value CVE-2016-71028.4ownCloud Desktop before 2.2.3 allows local users to execute arbitrary code and possibly gain privileges via a Trojan library in a "special p CVE-2016-71036.1Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject arbitrary web script or HTML via CVE-2016-71077.5Huawei Unified Maintenance Audit (UMA) before V200R001C00SPC200 SPH206 allows remote attackers to reset arbitrary user passwords and consequ CVE-2016-71086.5Huawei Unified Maintenance Audit (UMA) before V200R001C00SPC200 SPH206 allows remote authenticated users to obtain the MD5 hashes of arbitra CVE-2016-71099.8Huawei Unified Maintenance Audit (UMA) before V200R001C00SPC200 allows remote attackers to execute arbitrary commands via "special character CVE-2016-71109.8Huawei Unified Maintenance Audit (UMA) before V200R001C00SPC200 allows remote attackers to execute arbitrary commands via "special character