CVE-2018-19962

{"id": "CVE-2018-19962", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.9, "accessVector": "LOCAL", "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 3.4, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.1}]}, "published": "2018-12-08T04:29:00.297", "references": [{"url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00072.html", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/106182", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "https://lists.debian.org/debian-lts-announce/2019/10/msg00008.html", "source": "cve@mitre.org"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UXC6BME7SXJI2ZIATNXCAH7RGPI4UKTT/", "source": "cve@mitre.org"}, {"url": "https://support.citrix.com/article/CTX239432", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.debian.org/security/2019/dsa-4369", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://xenbits.xen.org/xsa/advisory-275.html", "tags": ["Vendor Advisory", "Patch"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Xen through 4.11.x on AMD x86 platforms, possibly allowing guest OS users to gain host OS privileges because small IOMMU mappings are unsafely combined into larger ones."}, {"lang": "es", "value": "Se ha descubierto un problema en Xen hasta las versiones 4.11.x en plataformas AMD x86, que podr\u00eda permitir que usuarios invitados del sistema operativo obtengan privilegios del host del sistema operativo. Esto se debe a que los mapeos de IOMMU peque\u00f1os se combinan de forma insegura con mapeos m\u00e1s grandes."}], "lastModified": "2023-11-07T02:55:46.397", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:xen:xen:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EA6D0834-FE53-4844-A6C7-0BB2DC64DBA3", "versionEndIncluding": "4.11.1"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:citrix:xenserver:7.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "405F950F-0772-41A3-8B72-B67151CC1376"}, {"criteria": "cpe:2.3:a:citrix:xenserver:7.1:cu1:*:*:ltsr:*:*:*", "vulnerable": true, "matchCriteriaId": "93BE83D6-26D9-46E0-B031-27A03A83537A"}, {"criteria": "cpe:2.3:a:citrix:xenserver:7.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "49D662D7-33DF-4DB3-946E-E9E410DC96CF"}, {"criteria": "cpe:2.3:a:citrix:xenserver:7.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1077F43A-22AA-436E-97ED-51CF74E92BA2"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}