Citrix XenServer Multiple Security Updates (CTX202404)

Published: 2015-11-26 11:29:16
CVE Author: NIST National Vulnerability Database

CVSS Base Vector:

Detection Method:
Check the installed hotfixes

Apply the hotfix referenced in the advisory.

A number of security vulnerabilities have been identified in Citrix XenServer that may allow a malicious administrator of a guest VM to compromise the host and guest users to crash the host. These vulnerabilities affect all currently supported versions of Citrix XenServer up to and including Citrix XenServer 6.5 Service Pack 1. The following vulnerabilities have been addressed: CVE-2015-7835 (High): Uncontrolled creation of large page mappings by PV guests CVE-2015-7969 (Low): Leak of main per-domain vcpu pointer array/Leak of per-domain profiling-related vcpu pointer array CVE-2015-7970 (Medium): Host crash when migrating a PoD VM CVE-2015-7971 (Low): Some pmu and profiling hypercalls log without rate limiting CVE-2015-7972 (Low): Populate-on-demand balloon size inaccuracy can crash guests

Affected Versions:
Citrix XenServer up to and including Citrix XenServer 6.5 Service Pack 1

Solution Type:
Vendor Patch

Detection Type:
Linux Distribution Package

NIST (National Institute of Standards and Technology) NVD (National Vulnerability Database)

CVE Analysis


CVSS Score
Citrix Xenserver Local Security Checks

You never have to pay for a vulnerability scanning and management software again.

Tired of paying a subscription 'per asset' or 'per IP'? Well you can officially cancel your current subscription. Mageni provides a free, open source and enterprise-ready vulnerability scanning and management platform which helps you to find, prioritize, remediate and manage your vulnerabilities. It is free and always will be.