CVE-2016-7094

MediumCVSS 4.1/10Last modified Jun 17, 2026

Description

Buffer overflow in Xen 4.7.x and earlier allows local x86 HVM guest OS administrators on guests running with shadow paging to cause a denial of service via a pagetable update.

Metrics

CVSS 3.0 4.1/10CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-119

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://support.citrix.com/article/CTX216071Third Party Advisory
http://www.debian.org/security/2016/dsa-3663
http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
http://www.securityfocus.com/bid/92864Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1036753Third Party Advisory, VDB Entry
http://xenbits.xen.org/xsa/advisory-187.htmlPatch, Vendor Advisory
http://xenbits.xen.org/xsa/xsa187-0001-x86-shadow-Avoid-overflowing-sh_ctxt-seg_reg.patchPatch, Vendor Advisory
https://security.gentoo.org/glsa/201611-09
http://support.citrix.com/article/CTX216071Third Party Advisory
http://www.debian.org/security/2016/dsa-3663
http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
http://www.securityfocus.com/bid/92864Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1036753Third Party Advisory, VDB Entry
http://xenbits.xen.org/xsa/advisory-187.htmlPatch, Vendor Advisory
http://xenbits.xen.org/xsa/xsa187-0001-x86-shadow-Avoid-overflowing-sh_ctxt-seg_reg.patchPatch, Vendor Advisory
https://security.gentoo.org/glsa/201611-09

Timeline

Published: Sep 21, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-70959.8Exponent CMS before 2.3.9 is vulnerable to an attacker uploading a malicious script file using redirection to place the script in an unprote CVE-2016-70974.4The filesystem implementation in the Linux kernel through 4.8.2 preserves the setgid bit during a setxattr call, which allows local users to CVE-2016-70988.1Race condition in wget 1.17 and earlier, when used in recursive or mirroring mode to download a single file, might allow remote servers to b CVE-2016-70995.9The tls.checkServerIdentity function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 does no CVE-2016-71016.5The SGI coder in ImageMagick before 7.0.2-10 allows remote attackers to cause a denial of service (out-of-bounds read) via a large row value CVE-2016-71028.4ownCloud Desktop before 2.2.3 allows local users to execute arbitrary code and possibly gain privileges via a Trojan library in a "special p CVE-2016-71036.1Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject arbitrary web script or HTML via CVE-2016-71077.5Huawei Unified Maintenance Audit (UMA) before V200R001C00SPC200 SPH206 allows remote attackers to reset arbitrary user passwords and consequ CVE-2016-71086.5Huawei Unified Maintenance Audit (UMA) before V200R001C00SPC200 SPH206 allows remote authenticated users to obtain the MD5 hashes of arbitra CVE-2016-71099.8Huawei Unified Maintenance Audit (UMA) before V200R001C00SPC200 allows remote attackers to execute arbitrary commands via "special character CVE-2016-71109.8Huawei Unified Maintenance Audit (UMA) before V200R001C00SPC200 allows remote attackers to execute arbitrary commands via "special character CVE-2016-71114.7MantisBT before 1.3.1 and 2.x before 2.0.0-beta.2 uses a weak Content Security Policy when using the Gravatar plugin, which allows remote at