CVE-2017-7995

LowCVSS 3.8/10Last modified Jun 17, 2026

Description

Xen PV guest before Xen 4.3 checked access permissions to MMIO ranges only after accessing them, allowing host PCI device space memory reads, leading to information disclosure. This is an error in the get_user function. NOTE: the upstream Xen Project considers versions before 4.5.x to be EOL.

Metrics

CVSS 3.0 3.8/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.opensuse.org/opensuse-security-announce/2017-05/msg00005.htmlThird Party Advisory
http://www.securityfocus.com/bid/98314Third Party Advisory, VDB Entry
https://bugzilla.suse.com/show_bug.cgi?id=1033948Issue Tracking, Third Party Advisory, VDB Entry
http://lists.opensuse.org/opensuse-security-announce/2017-05/msg00005.htmlThird Party Advisory
http://www.securityfocus.com/bid/98314Third Party Advisory, VDB Entry
https://bugzilla.suse.com/show_bug.cgi?id=1033948Issue Tracking, Third Party Advisory, VDB Entry

Timeline

Published: May 3, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-79979.8Multiple SQL injection vulnerabilities in Gespage before 7.4.9 allow remote attackers to execute arbitrary SQL commands via the (1) show_prn CVE-2017-79986.1Multiple cross-site scripting (XSS) vulnerabilities in Gespage before 7.4.9 allow remote attackers to inject arbitrary web script or HTML vi CVE-2017-79996.5Atlassian Eucalyptus before 4.4.1, when in EDGE mode, allows remote authenticated users with certain privileges to cause a denial of service CVE-2017-80004.8In EMC RSA Authentication Manager 8.2 SP1 and earlier, a malicious RSA Security Console Administrator could craft a token profile and store CVE-2017-80018.4An issue was discovered in EMC ScaleIO 2.0.1.x. In a Linux environment, one of the support scripts saves the credentials of the ScaleIO MDM CVE-2017-80028.8EMC Data Protection Advisor prior to 6.4 contains multiple blind SQL injection vulnerabilities. A remote authenticated attacker may potentia CVE-2017-80034.9EMC Data Protection Advisor prior to 6.4 contains a path traversal vulnerability. A remote authenticated high privileged user may potentiall CVE-2017-80047.2The EMC RSA Identity Governance and Lifecycle, RSA Via Lifecycle and Governance and RSA IMG products (RSA Identity Governance and Lifecycle CVE-2017-80055.4The EMC RSA Identity Governance and Lifecycle, RSA Via Lifecycle and Governance, and RSA IMG products (RSA Identity Governance and Lifecycle CVE-2017-80065.9In EMC RSA Authentication Manager 8.2 SP1 Patch 1 and earlier, a malicious user logged into the Self-Service Console of RSA Authentication M CVE-2017-80078.8In EMC ViPR SRM, Storage M&R, VNX M&R, and M&R (Watch4Net) for SAS Solution Packs, the Webservice Gateway is affected by a directory travers CVE-2017-80119.8EMC ViPR SRM, EMC Storage M&R, EMC VNX M&R, EMC M&R for SAS Solution Packs (EMC ViPR SRM prior to 4.1, EMC Storage M&R prior to 4.1, EMC VNX