CVE

Id
61867  
CVE No.
CVE-2013-1920  
Status
Candidate  
Description
Xen 4.2.x, 4.1.x, and earlier, when the hypervisor is running "under memory pressure" and the Xen Security Module (XSM) is enabled, uses the wrong ordering of operations when extending the per-domain event channel tracking table, which causes a use-after-free and allows local guest kernels to inject arbitrary events and gain privileges via unspecified vectors.  
Phase
Assigned (20130219)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
619496 61867 CVE-2013-1920 MLIST:[Xen-announce] 20130404 Xen Security Advisory 47 (CVE-2013-1920) - Potential use of freed memory in event channel operations  View
619497 61867 CVE-2013-1920 URL:http://lists.xen.org/archives/html/xen-announce/2013-04/msg00000.html  View
619498 61867 CVE-2013-1920 MLIST:[oss-security] 20130404 Xen Security Advisory 47 (CVE-2013-1920) - Potential use of freed memory in event channel operations  View
619499 61867 CVE-2013-1920 URL:http://www.openwall.com/lists/oss-security/2013/04/04/7  View
619500 61867 CVE-2013-1920 GENTOO:GLSA-201309-24  View
619501 61867 CVE-2013-1920 URL:http://security.gentoo.org/glsa/glsa-201309-24.xml  View
619502 61867 CVE-2013-1920 SUSE:openSUSE-SU-2013:0912  View
619503 61867 CVE-2013-1920 URL:http://lists.opensuse.org/opensuse-updates/2013-06/msg00049.html  View
619504 61867 CVE-2013-1920 SUSE:SUSE-SU-2014:0411  View
619505 61867 CVE-2013-1920 URL:http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00015.html  View
619506 61867 CVE-2013-1920 SUSE:SUSE-SU-2014:0446  View
619507 61867 CVE-2013-1920 URL:http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html  View
619508 61867 CVE-2013-1920 SUSE:SUSE-SU-2014:0470  View
619509 61867 CVE-2013-1920 URL:http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00000.html  View
619510 61867 CVE-2013-1920 BID:58880  View
619511 61867 CVE-2013-1920 URL:http://www.securityfocus.com/bid/58880  View
619512 61867 CVE-2013-1920 OSVDB:92050  View
619513 61867 CVE-2013-1920 URL:http://osvdb.org/92050  View
619514 61867 CVE-2013-1920 SECTRACK:1028388  View
619515 61867 CVE-2013-1920 URL:http://www.securitytracker.com/id/1028388  View
619516 61867 CVE-2013-1920 SECUNIA:52857  View
619517 61867 CVE-2013-1920 URL:http://secunia.com/advisories/52857  View
619518 61867 CVE-2013-1920 SECUNIA:55082  View
619519 61867 CVE-2013-1920 URL:http://secunia.com/advisories/55082  View
619520 61867 CVE-2013-1920 XF:xen-cve20131920-code-exec(83226)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
21863 JVNDB-2013-003438 Drupal 用 Chaos Tool Suite モジュールにおける制限されたノードタイトルを読まれる脆弱性 Drupal 用 Chaos Tool Suite モジュールは、ノードアクセスを適切に制限しないため、制限されたノードタイトルを読まれる脆弱性が存在します。 CVE-2013-1925 61867 3.5 http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-003438.html  View