Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2012-2625

15
FAUCET Score

CVE-2012-2625 describes a denial-of-service vulnerability in the PyGrub boot loader within Xen versions 4.1.x, 4.2.x, and unstable builds prior to changeset 25589:60f09d1ab1fe. A local authenticated para-virtualized guest user can exploit this by providing a large bzip2 or lzma compressed kernel image, leading to excessive memory consumption. The vulnerability has a low CVSS score of 2.7 (AV:A/AC:L/Au:S/C:N/I:N/A:P), indicating an attack requires local access and authentication, with only a partial denial of service impact. There is no known active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.

Impacted Technologies

VendorProductVersion(s)CPE
4.1.0CPE matchmatch criteria
cpe:2.3:o:xen:xen:4.1.0:*:*:*:*:*:*:*
4.1.1CPE matchmatch criteria
cpe:2.3:o:xen:xen:4.1.1:*:*:*:*:*:*:*
4.1.2CPE matchmatch criteria
cpe:2.3:o:xen:xen:4.1.2:*:*:*:*:*:*:*
4.1.3CPE matchmatch criteria
cpe:2.3:o:xen:xen:4.1.3:*:*:*:*:*:*:*
4.2.0CPE matchmatch criteria
cpe:2.3:o:xen:xen:4.2.0:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 2.0

2.7LOW

AV:A/AC:L/Au:S/C:N/I:N/A:P

Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
Access Vector
ADJACENT_NETWORK
Access Complexity
LOW
Authentication
SINGLE
Exploitability Score
5.1
Impact Score
2.9
CvssVersion
2.0

Exploit Intelligence

EPSS Score
0.92%
Probability of exploitation in next 30 days
EPSS Percentile
56.7%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0092 is in the 92nd percentile among its peer group of 85 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.0 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (1)

redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 5Fixed in: xen-0:3.0.3-135.el5_8.4
View patch

Vendor Advisories (1)

redhatCVE-2012-2625Moderate

xen: pv bootloader doesn't check the size of the bzip2 or lzma compressed kernel

May 4, 2012

References

bugzilla.xensource.com / bugzilla/show_bug.cgi
Broken Link
lists.opensuse.org / opensuse-security-announce/2012-08/msg00024.html
Third Party Advisory
lists.opensuse.org / opensuse-security-announce/2012-08/msg00025.html
Third Party Advisory
lists.opensuse.org / opensuse-security-announce/2012-09/msg00005.html
Third Party Advisory
lists.opensuse.org / opensuse-security-announce/2012-09/msg00017.html
Third Party Advisory
lists.opensuse.org / opensuse-security-announce/2012-09/msg00018.html
Third Party Advisory
lists.opensuse.org / opensuse-security-announce/2012-11/msg00017.html
Third Party Advisory
lists.opensuse.org / opensuse-security-announce/2012-11/msg00018.html
Third Party Advisory
rhn.redhat.com / errata/RHSA-2012-1130.html
Third Party Advisory
secunia.com / advisories/49184
Third Party Advisory
secunia.com / advisories/51413
Third Party Advisory
openwall.com / lists/oss-security/2012/10/26/3
Mailing ListThird Party Advisory
securityfocus.com / bid/53650
Third Party AdvisoryVDB Entry
securitytracker.com / id
Third Party AdvisoryVDB Entry
xenbits.xensource.com / hg/xen-unstable.hg/rev/60f09d1ab1fe
Vendor Advisory