Xen
Vendor:
First CVE: Sep 27, 2007 · Active for 18 years
9
Total CVEs
More Total CVEs than 64% of tracked products
3.0
Avg CVEs / Year
Higher CVE frequency than 56% of tracked products
4.8
Avg CVSS
Higher Avg CVSS than 6% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Xen over time
Volume of CVEsAvg CVSS Base Score
First CVE
Sep 27, 2007
18 years ago
Most Recent CVE
Jun 16, 2010
5,883 days ago
CVE Severity & Scoring
Xen9 CVEs
22%
67%
11%
All CVEs352,294 CVEs
45%
40%
11%
LowMediumHigh
Attack Vector
Local0 (0.0%)
Network0 (0.0%)
Unknown9 (100.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low0 (0.0%)
High0 (0.0%)
Unknown9 (100.0%)
User Interaction
None0 (0.0%)
Unknown9 (100.0%)
Required0 (0.0%)
Privileges Required
Low0 (0.0%)
High0 (0.0%)
None0 (0.0%)
Unknown9 (100.0%)
Top CVEs
Signals from CVEs in this product scope (9 CVEs).
9 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2007-4993MEDIUM pygrub (tools/pygrub/src/GrubConf.py) in Xen 3.0.3, when booting a guest domain, allows local users with elevated privileges in the guest domain to execute arbitrary commands in do | Sep 27, 2007 | 6.9 | 26 | NO | YES |
CVE-2008-1944HIGH Buffer overflow in the backend framebuffer of XenSource Xen Para-Virtualized Framebuffer (PVFB) Message 3.0 through 3.0.3 allows local users to cause a denial of service (SDL crash | May 14, 2008 | 7.2 | 18 | NO | NO |
CVE-2010-2070MEDIUM arch/ia64/xen/faults.c in Xen 3.4 and 4.0 in Linux kernel 2.6.18, and possibly other kernel versions, when running on IA-64 architectures, allows local users to cause a denial of s | Jun 16, 2010 | 4.9 | 17 | NO | NO |
CVE-2007-3919MEDIUM (1) xenbaked and (2) xenmon.py in Xen 3.1 and earlier allow local users to truncate arbitrary files via a symlink attack on /tmp/xenq-shm. | Oct 28, 2007 | 6.0 | 16 | NO | NO |
CVE-2008-1619MEDIUM The ssm_i emulation in Xen 5.1 on IA64 architectures allows attackers to cause a denial of service (dom0 panic) via certain traffic, as demonstrated using an FTP stress test tool. | Apr 2, 2008 | 4.3 | 14 | NO | NO |
CVE-2007-5906MEDIUM Xen 3.1.1 allows virtual guest system users to cause a denial of service (hypervisor crash) by using a debug register (DR7) to set certain breakpoints. | Nov 9, 2007 | 4.7 | 14 | NO | NO |
CVE-2007-5907MEDIUM Xen 3.1.1 does not prevent modification of the CR4 TSC from applications, which allows pv guests to cause a denial of service (crash). | Nov 9, 2007 | 4.7 | 14 | NO | NO |
Buffer overflow in the backend of XenSource Xen Para Virtualized Frame Buffer (PVFB) 3.0 through 3.1.2 allows local users to cause a denial of service (crash) and possibly execute | May 14, 2008 | 2.1 | 11 | NO | NO |
Xen 3.x, possibly before 3.1.2, when running on IA64 systems, does not check the RID value for mov_to_rr, which allows a VTi domain to read memory of other domains. | Dec 4, 2007 | 2.1 | 11 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (9 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
1 CVE
11.1% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (9 CVEs).
Media Mentions
Signals from CVEs in this product scope (9 CVEs).
Top CNAs Publishing CVEs For Xen
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 5.1 | 1 | 4.3 | 1.3% | 0 | 0 |
| 4.0.0 | 1 | 4.9 | 0.4% | 0 | 0 |
| 3.4.0 | 1 | 4.9 | 0.4% | 0 | 0 |
| 3.1.2 | 1 | 2.1 | 0.5% | 0 | 0 |
| 3.1.1 | 2 | 4.7 | 0.3% | 0 | 0 |
| 3.0.4 | 1 | 2.1 | 0.5% | 0 | 0 |
| 3.0.3_0_3 | 1 | 6.0 | 0.3% | 0 | 0 |
| 3.0.3_0_1 | 1 | 6.0 | 0.3% | 0 | 0 |
| 3.0.3 | 3 | 5.4 | 0.5% | 0 | 1 |
| 3.0.2 | 1 | 2.1 | 0.5% | 0 | 0 |
| 3.0 | 2 | 4.7 | 0.5% | 0 | 0 |