CVE-2017-10923

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Xen through 4.8.x does not validate a vCPU array index upon the sending of an SGI, which allows guest OS users to cause a denial of service (hypervisor crash), aka XSA-225.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.securityfocus.com/bid/99160Tool Signature, VDB Entry
http://www.securitytracker.com/id/1038735Third Party Advisory, VDB Entry
https://security.gentoo.org/glsa/201708-03
https://xenbits.xen.org/xsa/advisory-225.htmlMailing List, Mitigation, Vendor Advisory
http://www.securityfocus.com/bid/99160Tool Signature, VDB Entry
http://www.securitytracker.com/id/1038735Third Party Advisory, VDB Entry
https://security.gentoo.org/glsa/201708-03
https://xenbits.xen.org/xsa/advisory-225.htmlMailing List, Mitigation, Vendor Advisory

Timeline

Published: Jul 5, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-109247.8IrfanView 4.44 (32bit) with FPX Plugin 4.47 allows attackers to execute arbitrary code or cause a denial of service via a crafted .fpx file,CVE-2017-109257.8IrfanView 4.44 (32bit) with FPX Plugin 4.47 might allow attackers to cause a denial of service or possibly have unspecified other impact via CVE-2017-109267.8IrfanView 4.44 (32bit) with FPX Plugin 4.47 might allow attackers to cause a denial of service or possibly have unspecified other impact via CVE-2017-109288.8In ImageMagick 7.0.6-0, a heap-based buffer over-read in the GetNextToken function in token.c allows remote attackers to obtain sensitive in CVE-2017-109297.8The grub_memmove function in shlr/grub/kern/misc.c in radare2 1.5.0 allows remote attackers to cause a denial of service (heap-based buffer CVE-2017-10937.8IBM AIX 6.1, 7.1, and 7.2 could allow a local user to exploit a vulnerability in the bellmail binary to gain root privileges.CVE-2017-109309.8The ZXR10 1800-2S before v3.00.40 incorrectly restricts access to a resource from an unauthorized actor, resulting in ordinary users being a CVE-2017-109317.5The ZXR10 1800-2S before v3.00.40 incorrectly restricts the download of the file directory range for WEB users, resulting in the ability to CVE-2017-109329.8All versions prior to V12.17.20 of the ZTE Microwave NR8000 series products - NR8120, NR8120A, NR8120, NR8150, NR8250, NR8000 TR and NR8950 CVE-2017-109337.5All versions prior to V2.06.00.00 of ZTE ZXDT22 SF01, an monitoring system of ZTE energy product, are impacted by directory traversal vulner CVE-2017-109349.8All versions prior to V5.09.02.02T4 of the ZTE ZXIPTV-EPG product use the Java RMI service in which the servers use the Apache Commons Colle CVE-2017-109357.2All versions prior to ZSRV2 V3.00.40 of the ZTE ZXR10 1800-2S products allow remote authenticated users to bypass the original password auth