GCVE - cpe:2.3:o:xen:xen:4.1.6:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:o:xen:xen:4.1.6:*:*:*:*:*:*:*

part: o version: 4.1.6 update: *

Vendor	Xen (`f270236f-a538-5294-a46e-e4b9797d2f33`)
Product	Xen (`6d9b47a4-a58a-5de1-b3a1-7ee0dccc27e6`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:deb/debian/xen`	purl2cpe	2026-06-01 10:11:08.265405
`pkg:deb/ubuntu/xen`	purl2cpe	2026-06-01 10:11:08.265406
`pkg:github/mirage/xen`	purl2cpe	2026-06-01 10:11:08.265408
`pkg:github/xen-project/xen`	purl2cpe	2026-06-01 10:11:08.265409
`pkg:gitlab/xen-project/xen`	purl2cpe	2026-06-01 10:11:08.265410
`pkg:rpm/fedora/xen`	purl2cpe	2026-06-01 10:11:08.265412
`pkg:rpm/opensuse/xen`	purl2cpe	2026-06-01 10:11:08.265413
`pkg:xen/xen`	purl2cpe	2026-06-01 10:11:08.265414

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2017-14431`	vulnerable	2026-06-08 05:08:49.940892	Details available Memory leak in Xen 3.3 through 4.8.x allows guest OS users to cause a denial of service (ARM or x86 AMD host OS memory consumption) by continually rebooting, because certain cleanup is skipped if no pass-through device was ever assigned, aka XSA-207. Published: 2017-09-13T22:00:00.000Z Updated: 2024-08-05T19:27:40.593Z Open on db.gcve.eu Reference links https://lists.debian.org/debian-lts-announce/2018/09/msg00006.html https://xenbits.xen.org/xsa/advisory-207.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-9932`	vulnerable	2026-06-08 05:08:24.990492	Details available CMPXCHG8B emulation in Xen 3.3.x through 4.7.x on x86 systems allows local HVM guest OS users to obtain sensitive information from host stack memory via a "supposedly-ignored" operand size prefix. Published: 2017-01-26T15:00:00.000Z Updated: 2024-08-06T03:07:31.379Z Open on db.gcve.eu Reference links http://xenbits.xen.org/xsa/advisory-200.html https://security.gentoo.org/glsa/201612-56 http://www.debian.org/security/2017/dsa-3847 http://www.securitytracker.com/id/1037468 http://www.securityfocus.com/bid/94863	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-4963`	vulnerable	2026-06-08 05:07:55.786851	Details available The libxl device-handling in Xen through 4.6.x allows local guest OS users with access to the driver domain to cause a denial of service (management tool confusion) by manipulating information in the backend directories in xenstore. Published: 2016-06-07T14:00:00.000Z Updated: 2024-08-06T00:46:40.035Z Open on db.gcve.eu Reference links https://lists.debian.org/debian-lts-announce/2018/09/msg00006.html http://www.securitytracker.com/id/1036024 http://xenbits.xen.org/xsa/advisory-178.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-1571`	vulnerable	2026-06-08 05:07:31.791322	Details available The paging_invlpg function in include/asm-x86/paging.h in Xen 3.3.x through 4.6.x, when using shadow mode paging or nested virtualization is enabled, allows local HVM guest users to cause a denial of service (host crash) via a non-canonical guest address in an INVVPID instruction, which triggers a hypervisor bug check. Published: 2016-01-22T15:00:00.000Z Updated: 2024-08-05T23:02:11.683Z Open on db.gcve.eu Reference links http://www.debian.org/security/2016/dsa-3519 http://www.securitytracker.com/id/1034745 http://support.citrix.com/article/CTX205496 http://xenbits.xen.org/xsa/advisory-168.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-1570`	vulnerable	2026-06-08 05:07:31.774741	Details available The PV superpage functionality in arch/x86/mm.c in Xen 3.4.0, 3.4.1, and 4.1.x through 4.6.x allows local PV guests to obtain sensitive information, cause a denial of service, gain privileges, or have unspecified other impact via a crafted page identifier (MFN) to the (1) MMUEXT_MARK_SUPER or (2) MMUEXT_UNMARK_SUPER sub-op in the HYPERVISOR_mmuext_op hypercall or (3) unknown vectors related to page table updates. Published: 2016-01-22T15:00:00.000Z Updated: 2024-08-05T23:02:11.689Z Open on db.gcve.eu Reference links http://www.debian.org/security/2016/dsa-3519 http://www.securitytracker.com/id/1034744 http://xenbits.xen.org/xsa/advisory-167.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-8552`	vulnerable	2026-06-08 05:07:04.351668	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-8341`	vulnerable	2026-06-08 05:07:03.643714	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-8340`	vulnerable	2026-06-08 05:07:03.642848	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-8339`	vulnerable	2026-06-08 05:07:03.639645	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.