var-202004-0462
Vulnerability from variot
An issue was discovered in xenoprof in Xen through 4.13.x, allowing guest OS users (without active profiling) to obtain sensitive information about other guests. Unprivileged guests can request to map xenoprof buffers, even if profiling has not been enabled for those guests. These buffers were not scrubbed. Xen There is an information leakage vulnerability in.Information may be obtained. Xen is an open source virtual machine monitor product from the University of Cambridge. The product enables different and incompatible operating systems to run on the same computer and supports migration during runtime to ensure normal operation and avoid downtime. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 202005-08
https://security.gentoo.org/
Severity: Normal Title: Xen: Multiple vulnerabilities Date: May 14, 2020 Bugs: #717446 ID: 202005-08
Synopsis
Multiple vulnerabilities have been found in Xen, the worst of which could allow privilege escalation.
Background
Xen is a bare-metal hypervisor.
Affected packages
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 app-emulation/xen < 4.12.2-r2 >= 4.12.2-r2 2 app-emulation/xen-tools < 4.12.2-r2 >= 4.12.2-r2 ------------------------------------------------------------------- 2 affected packages
Description
Multiple vulnerabilities have been discovered in Xen. Please review the CVE identifiers referenced below for details.
Impact
Please review the referenced CVE identifiers for details.
Workaround
There is no known workaround at this time.
Resolution
All Xen users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-emulation/xen-4.12.2-r2"
References
[ 1 ] CVE-2020-11739 https://nvd.nist.gov/vuln/detail/CVE-2020-11739 [ 2 ] CVE-2020-11740 https://nvd.nist.gov/vuln/detail/CVE-2020-11740 [ 3 ] CVE-2020-11741 https://nvd.nist.gov/vuln/detail/CVE-2020-11741 [ 4 ] CVE-2020-11742 https://nvd.nist.gov/vuln/detail/CVE-2020-11742 [ 5 ] CVE-2020-11743 https://nvd.nist.gov/vuln/detail/CVE-2020-11743
Availability
This GLSA and any updates to it are available for viewing at the Gentoo Security Website:
https://security.gentoo.org/glsa/202005-08
Concerns?
Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.
License
Copyright 2020 Gentoo Foundation, Inc; referenced text belongs to its owner(s).
The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.
https://creativecommons.org/licenses/by-sa/2.5 .
For the stable distribution (buster), these problems have been fixed in version 4.11.4+24-gddaaccbbab-1~deb10u1.
We recommend that you upgrade your xen packages.
For the detailed security status of xen please refer to its security tracker page at: https://security-tracker.debian.org/tracker/xen
Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAl8Lc/AACgkQEMKTtsN8 TjaMdxAAqGcAm1NI7JRg7LQprevLCPkxPItZapx3n/q/W6HwiGQxC6KP9Ntp3ArR QiIeIPzTWVMHcaahlgkLePaFPU3MCe5TkL0GKG1JIAD8JieKBSrAWJ6tqTiZx+G+ anbksp/I9Mq9nciMlnPXeOVQgksoCB0tFYC2Ld+H7btZdD5G4KpJsz25c0S5poxW sIXLgNXIzmZcI8mVzUlt+w0FG3tnolr/kJppHBkgC46riVcy8LHRaRQiVTjwqjSn Eop4oXxLDZ/qH8k+0JAZLtBPpc9PfQcLxCJnhH8z76QdPPkcJuNFx5zRXqr1dZfG AkRuG6LZa2tRGYzKZmo7BMj5dUei4xhDHLAoWGhSHkTmYtdc1Kyy4+duGPEChSCm fCSC1FhFJFK30iq918cunWtjhRrEqrJr10HuC+YlSXfqrv1Z12fPw3UPRJmdG2Dv UPS5vT8/NwF0osNrvNE+rkhYXTEKECE756pP3jTV4+BBBgf9DLtbV0EvYq1YWlJw iT+KnzX9iW/jJg3bC32+UJlVv7IAkb8F9hcK3wKpvgSUVJIDWN352rfW7p8/xZoj 7eIlmZwDPKWsyMlbt2OsyYQFQlBvNsk0+7ycu9hG6fBaF5ATSxTO+A43Q7OxorP9 g8OhDVMgrx5GM4rXSZ60J6uxkd2eUns4Ud8pDGG8XTpnRBxD8Kk= =tfm7 -----END PGP SIGNATURE-----
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202004-0462",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "xen",
"scope": "gte",
"trust": 1.0,
"vendor": "xen",
"version": "3.2.0"
},
{
"model": "fedora",
"scope": "eq",
"trust": 1.0,
"vendor": "fedoraproject",
"version": "32"
},
{
"model": "xen",
"scope": "lte",
"trust": 1.0,
"vendor": "xen",
"version": "4.13.0"
},
{
"model": "fedora",
"scope": "eq",
"trust": 1.0,
"vendor": "fedoraproject",
"version": "30"
},
{
"model": "fedora",
"scope": "eq",
"trust": 1.0,
"vendor": "fedoraproject",
"version": "31"
},
{
"model": "leap",
"scope": "eq",
"trust": 1.0,
"vendor": "opensuse",
"version": "15.1"
},
{
"model": "xen",
"scope": "eq",
"trust": 1.0,
"vendor": "xen",
"version": "4.13.0"
},
{
"model": "linux",
"scope": "eq",
"trust": 1.0,
"vendor": "debian",
"version": "10.0"
},
{
"model": "xen",
"scope": "eq",
"trust": 0.8,
"vendor": "xen",
"version": "4.13.x"
},
{
"model": "xen",
"scope": "lte",
"trust": 0.6,
"vendor": "xen",
"version": "\u003c=4.13.x"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2020-25870"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-004342"
},
{
"db": "NVD",
"id": "CVE-2020-11740"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:xen:xen:4.13.0:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:xen:xen:4.13.0:rc2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:xen:xen:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "4.13.0",
"versionStartIncluding": "3.2.0",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2020-11740"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Gentoo",
"sources": [
{
"db": "PACKETSTORM",
"id": "157721"
},
{
"db": "CNNVD",
"id": "CNNVD-202004-654"
}
],
"trust": 0.7
},
"cve": "CVE-2020-11740",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 3.9,
"impactScore": 2.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "LOW",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Local",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 2.1,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "JVNDB-2020-004342",
"impactScore": null,
"integrityImpact": "None",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Low",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "SINGLE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 4.6,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 3.1,
"id": "CNVD-2020-25870",
"impactScore": 6.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:L/AC:L/Au:S/C:C/I:N/A:N",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "VULMON",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 3.9,
"id": "CVE-2020-11740",
"impactScore": 2.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "LOW",
"trust": 0.1,
"userInteractionRequired": null,
"vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"impactScore": 3.6,
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Local",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 5.5,
"baseSeverity": "Medium",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "JVNDB-2020-004342",
"impactScore": null,
"integrityImpact": "None",
"privilegesRequired": "Low",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2020-11740",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "JVNDB-2020-004342",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNVD",
"id": "CNVD-2020-25870",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-202004-654",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULMON",
"id": "CVE-2020-11740",
"trust": 0.1,
"value": "LOW"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2020-25870"
},
{
"db": "VULMON",
"id": "CVE-2020-11740"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-004342"
},
{
"db": "NVD",
"id": "CVE-2020-11740"
},
{
"db": "CNNVD",
"id": "CNNVD-202004-654"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "An issue was discovered in xenoprof in Xen through 4.13.x, allowing guest OS users (without active profiling) to obtain sensitive information about other guests. Unprivileged guests can request to map xenoprof buffers, even if profiling has not been enabled for those guests. These buffers were not scrubbed. Xen There is an information leakage vulnerability in.Information may be obtained. Xen is an open source virtual machine monitor product from the University of Cambridge. The product enables different and incompatible operating systems to run on the same computer and supports migration during runtime to ensure normal operation and avoid downtime. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\nGentoo Linux Security Advisory GLSA 202005-08\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n https://security.gentoo.org/\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\n Severity: Normal\n Title: Xen: Multiple vulnerabilities\n Date: May 14, 2020\n Bugs: #717446\n ID: 202005-08\n\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\nSynopsis\n========\n\nMultiple vulnerabilities have been found in Xen, the worst of which\ncould allow privilege escalation. \n\nBackground\n==========\n\nXen is a bare-metal hypervisor. \n\nAffected packages\n=================\n\n -------------------------------------------------------------------\n Package / Vulnerable / Unaffected\n -------------------------------------------------------------------\n 1 app-emulation/xen \u003c 4.12.2-r2 \u003e= 4.12.2-r2\n 2 app-emulation/xen-tools \u003c 4.12.2-r2 \u003e= 4.12.2-r2\n -------------------------------------------------------------------\n 2 affected packages\n\nDescription\n===========\n\nMultiple vulnerabilities have been discovered in Xen. Please review the\nCVE identifiers referenced below for details. \n\nImpact\n======\n\nPlease review the referenced CVE identifiers for details. \n\nWorkaround\n==========\n\nThere is no known workaround at this time. \n\nResolution\n==========\n\nAll Xen users should upgrade to the latest version:\n\n # emerge --sync\n # emerge --ask --oneshot --verbose \"\u003e=app-emulation/xen-4.12.2-r2\"\n\nReferences\n==========\n\n[ 1 ] CVE-2020-11739\n https://nvd.nist.gov/vuln/detail/CVE-2020-11739\n[ 2 ] CVE-2020-11740\n https://nvd.nist.gov/vuln/detail/CVE-2020-11740\n[ 3 ] CVE-2020-11741\n https://nvd.nist.gov/vuln/detail/CVE-2020-11741\n[ 4 ] CVE-2020-11742\n https://nvd.nist.gov/vuln/detail/CVE-2020-11742\n[ 5 ] CVE-2020-11743\n https://nvd.nist.gov/vuln/detail/CVE-2020-11743\n\nAvailability\n============\n\nThis GLSA and any updates to it are available for viewing at\nthe Gentoo Security Website:\n\n https://security.gentoo.org/glsa/202005-08\n\nConcerns?\n=========\n\nSecurity is a primary focus of Gentoo Linux and ensuring the\nconfidentiality and security of our users\u0027 machines is of utmost\nimportance to us. Any security concerns should be addressed to\nsecurity@gentoo.org or alternatively, you may file a bug at\nhttps://bugs.gentoo.org. \n\nLicense\n=======\n\nCopyright 2020 Gentoo Foundation, Inc; referenced text\nbelongs to its owner(s). \n\nThe contents of this document are licensed under the\nCreative Commons - Attribution / Share Alike license. \n\nhttps://creativecommons.org/licenses/by-sa/2.5\n. \n \nFor the stable distribution (buster), these problems have been fixed in\nversion 4.11.4+24-gddaaccbbab-1~deb10u1. \n\nWe recommend that you upgrade your xen packages. \n\nFor the detailed security status of xen please refer to\nits security tracker page at:\nhttps://security-tracker.debian.org/tracker/xen\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org\n-----BEGIN PGP SIGNATURE-----\n\niQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAl8Lc/AACgkQEMKTtsN8\nTjaMdxAAqGcAm1NI7JRg7LQprevLCPkxPItZapx3n/q/W6HwiGQxC6KP9Ntp3ArR\nQiIeIPzTWVMHcaahlgkLePaFPU3MCe5TkL0GKG1JIAD8JieKBSrAWJ6tqTiZx+G+\nanbksp/I9Mq9nciMlnPXeOVQgksoCB0tFYC2Ld+H7btZdD5G4KpJsz25c0S5poxW\nsIXLgNXIzmZcI8mVzUlt+w0FG3tnolr/kJppHBkgC46riVcy8LHRaRQiVTjwqjSn\nEop4oXxLDZ/qH8k+0JAZLtBPpc9PfQcLxCJnhH8z76QdPPkcJuNFx5zRXqr1dZfG\nAkRuG6LZa2tRGYzKZmo7BMj5dUei4xhDHLAoWGhSHkTmYtdc1Kyy4+duGPEChSCm\nfCSC1FhFJFK30iq918cunWtjhRrEqrJr10HuC+YlSXfqrv1Z12fPw3UPRJmdG2Dv\nUPS5vT8/NwF0osNrvNE+rkhYXTEKECE756pP3jTV4+BBBgf9DLtbV0EvYq1YWlJw\niT+KnzX9iW/jJg3bC32+UJlVv7IAkb8F9hcK3wKpvgSUVJIDWN352rfW7p8/xZoj\n7eIlmZwDPKWsyMlbt2OsyYQFQlBvNsk0+7ycu9hG6fBaF5ATSxTO+A43Q7OxorP9\ng8OhDVMgrx5GM4rXSZ60J6uxkd2eUns4Ud8pDGG8XTpnRBxD8Kk=\n=tfm7\n-----END PGP SIGNATURE-----\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2020-11740"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-004342"
},
{
"db": "CNVD",
"id": "CNVD-2020-25870"
},
{
"db": "VULMON",
"id": "CVE-2020-11740"
},
{
"db": "PACKETSTORM",
"id": "157721"
},
{
"db": "PACKETSTORM",
"id": "168871"
}
],
"trust": 2.43
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2020-11740",
"trust": 3.3
},
{
"db": "OPENWALL",
"id": "OSS-SECURITY/2020/04/14/1",
"trust": 2.5
},
{
"db": "JVNDB",
"id": "JVNDB-2020-004342",
"trust": 0.8
},
{
"db": "PACKETSTORM",
"id": "157721",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2020-25870",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2020.1373",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2020.2696",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2020.1463",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2020.1575",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2022.4642",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2020.2813",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2020.2364",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2020.1317",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2020.2786",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-202004-654",
"trust": 0.6
},
{
"db": "VULMON",
"id": "CVE-2020-11740",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "168871",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2020-25870"
},
{
"db": "VULMON",
"id": "CVE-2020-11740"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-004342"
},
{
"db": "PACKETSTORM",
"id": "157721"
},
{
"db": "PACKETSTORM",
"id": "168871"
},
{
"db": "NVD",
"id": "CVE-2020-11740"
},
{
"db": "CNNVD",
"id": "CNNVD-202004-654"
}
]
},
"id": "VAR-202004-0462",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2020-25870"
}
],
"trust": 0.06
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2020-25870"
}
]
},
"last_update_date": "2023-12-18T11:48:32.165000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "XSA-313",
"trust": 0.8,
"url": "https://xenbits.xen.org/xsa/advisory-313.html"
},
{
"title": "Patch for Xen Information Disclosure Vulnerability (CNVD-2020-25870)",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/216033"
},
{
"title": "Citrix Security Bulletins: Citrix Hypervisor Multiple Security Updates",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=citrix_security_bulletins\u0026qid=f370ea0c562996cebdbcb6d5adc19514"
},
{
"title": "Debian Security Advisories: DSA-4723-1 xen -- security update",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=debian_security_advisories\u0026qid=0d177f74e6265e2fdbb8df6fa6c636bf"
},
{
"title": "Ubuntu Security Notice: USN-5617-1: Xen vulnerabilities",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice\u0026qid=usn-5617-1"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2020-25870"
},
{
"db": "VULMON",
"id": "CVE-2020-11740"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-004342"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-212",
"trust": 1.0
},
{
"problemtype": "CWE-200",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2020-004342"
},
{
"db": "NVD",
"id": "CVE-2020-11740"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.4,
"url": "http://xenbits.xen.org/xsa/advisory-313.html"
},
{
"trust": 2.5,
"url": "http://www.openwall.com/lists/oss-security/2020/04/14/1"
},
{
"trust": 1.8,
"url": "https://security.gentoo.org/glsa/202005-08"
},
{
"trust": 1.8,
"url": "https://www.debian.org/security/2020/dsa-4723"
},
{
"trust": 1.7,
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00006.html"
},
{
"trust": 1.6,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-11740"
},
{
"trust": 1.0,
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5m2xrnchoggtjqbzqj7dcv6znakn3le2/"
},
{
"trust": 1.0,
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/nvtp4oyhctru3onfjofjqvndfb25kllg/"
},
{
"trust": 1.0,
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ymaw7d2mp6re4bfi5bzwobbwgy3vsofn/"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-11740"
},
{
"trust": 0.7,
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ymaw7d2mp6re4bfi5bzwobbwgy3vsofn/"
},
{
"trust": 0.7,
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5m2xrnchoggtjqbzqj7dcv6znakn3le2/"
},
{
"trust": 0.7,
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/nvtp4oyhctru3onfjofjqvndfb25kllg/"
},
{
"trust": 0.6,
"url": "https://www.suse.com/support/update/announcement/2020/suse-su-20202234-1"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2020.1317/"
},
{
"trust": 0.6,
"url": "https://vigilance.fr/vulnerability/xen-information-disclosure-via-xenoprof-32008"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2020.2364/"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2020.2696/"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2020.2786/"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2020.2813/"
},
{
"trust": 0.6,
"url": "https://access.redhat.com/security/cve/cve-2020-11740"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2022.4642"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2020.1373/"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2020.1463/"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2020.1575/"
},
{
"trust": 0.6,
"url": "https://packetstormsecurity.com/files/157721/gentoo-linux-security-advisory-202005-08.html"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-11742"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-11743"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-11741"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-11739"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/212.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "http://seclists.org/oss-sec/2020/q2/22"
},
{
"trust": 0.1,
"url": "https://ubuntu.com/security/notices/usn-5617-1"
},
{
"trust": 0.1,
"url": "https://support.citrix.com/article/ctx270837"
},
{
"trust": 0.1,
"url": "https://bugs.gentoo.org."
},
{
"trust": 0.1,
"url": "https://creativecommons.org/licenses/by-sa/2.5"
},
{
"trust": 0.1,
"url": "https://security.gentoo.org/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-15564"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-15566"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-15567"
},
{
"trust": 0.1,
"url": "https://www.debian.org/security/faq"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-15563"
},
{
"trust": 0.1,
"url": "https://security-tracker.debian.org/tracker/xen"
},
{
"trust": 0.1,
"url": "https://www.debian.org/security/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-15565"
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2020-11740"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-004342"
},
{
"db": "PACKETSTORM",
"id": "157721"
},
{
"db": "PACKETSTORM",
"id": "168871"
},
{
"db": "NVD",
"id": "CVE-2020-11740"
},
{
"db": "CNNVD",
"id": "CNNVD-202004-654"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2020-25870"
},
{
"db": "VULMON",
"id": "CVE-2020-11740"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-004342"
},
{
"db": "PACKETSTORM",
"id": "157721"
},
{
"db": "PACKETSTORM",
"id": "168871"
},
{
"db": "NVD",
"id": "CVE-2020-11740"
},
{
"db": "CNNVD",
"id": "CNNVD-202004-654"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2020-04-30T00:00:00",
"db": "CNVD",
"id": "CNVD-2020-25870"
},
{
"date": "2020-04-14T00:00:00",
"db": "VULMON",
"id": "CVE-2020-11740"
},
{
"date": "2020-05-12T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2020-004342"
},
{
"date": "2020-05-15T14:52:42",
"db": "PACKETSTORM",
"id": "157721"
},
{
"date": "2020-07-28T19:12:00",
"db": "PACKETSTORM",
"id": "168871"
},
{
"date": "2020-04-14T13:15:12.767000",
"db": "NVD",
"id": "CVE-2020-11740"
},
{
"date": "2020-04-14T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202004-654"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2020-04-30T00:00:00",
"db": "CNVD",
"id": "CNVD-2020-25870"
},
{
"date": "2022-05-03T00:00:00",
"db": "VULMON",
"id": "CVE-2020-11740"
},
{
"date": "2020-05-12T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2020-004342"
},
{
"date": "2023-11-07T03:15:04.360000",
"db": "NVD",
"id": "CVE-2020-11740"
},
{
"date": "2022-09-21T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202004-654"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "local",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202004-654"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Xen Vulnerability regarding information leakage in",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2020-004342"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "information disclosure",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202004-654"
}
],
"trust": 0.6
}
}
Loading...
Loading...
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.