Vulnerability Details : CVE-2012-5511
Stack-based buffer overflow in the dirty video RAM tracking functionality in Xen 3.4 through 4.1 allows local HVM guest OS administrators to cause a denial of service (crash) via a large bitmap image.
Vulnerability category: OverflowDenial of service
Products affected by CVE-2012-5511
- cpe:2.3:o:xen:xen:3.4.1:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:3.4.3:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:3.4.4:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.0.0:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:3.4.0:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:3.4.2:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.0.4:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.1.0:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.0.2:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.0.3:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.0.1:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2012-5511
0.07%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 29 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2012-5511
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.7
|
MEDIUM | AV:L/AC:M/Au:N/C:N/I:N/A:C |
3.4
|
6.9
|
NIST |
CWE ids for CVE-2012-5511
-
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.Assigned by: nvd@nist.gov (Primary)
References for CVE-2012-5511
-
http://lists.opensuse.org/opensuse-updates/2013-04/msg00051.html
openSUSE-SU-2013:0636-1: moderate: xen: security and bugfix update
-
http://security.gentoo.org/glsa/glsa-201309-24.xml
Xen: Multiple vulnerabilities (GLSA 201309-24) — Gentoo security
-
http://www.openwall.com/lists/oss-security/2012/12/03/10
oss-security - Xen Security Advisory 27 (CVE-2012-5511) - several HVM operations do not validate the range of their inputs
-
http://lists.opensuse.org/opensuse-security-announce/2012-12/msg00001.html
[security-announce] SUSE-SU-2012:1615-1: important: Security update for
-
http://www.debian.org/security/2013/dsa-2636
Debian -- Security Information -- DSA-2636-2 xen
-
http://support.citrix.com/article/CTX135777
Citrix XenServer Multiple Security Updates
-
http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html
[security-announce] SUSE-SU-2014:0446-1: important: Security update for
-
http://lists.opensuse.org/opensuse-updates/2013-04/msg00052.html
openSUSE-SU-2013:0637-1: moderate: xen: security and bugfix update
-
http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00011.html
[security-announce] openSUSE-SU-2013:0133-1: important: xen to fix vario
-
http://lists.opensuse.org/opensuse-security-announce/2012-12/msg00018.html
[security-announce] openSUSE-SU-2012:1685-1: important: xen to fix vario
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/80484
Xen HVM denial of service CVE-2012-6333 Vulnerability Report
-
http://lists.opensuse.org/opensuse-security-announce/2012-12/msg00019.html
[security-announce] openSUSE-SU-2012:1687-1: important: xen to fix vario
-
http://www.securityfocus.com/bid/56796
Xen Bitmap Local Denial of Service Vulnerability
Jump to