Read the docs
TI-2011-01402 Aliases CVE-2011-1583GHSA-4qc2-w83m-rm23

Multiple integer overflows in tools/libxc/xc_dom_bzimageloader.c in Xen 3.2, 3.3, 4.0…

Priority LOW 32CWE-189Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
Code execution
Confidentiality · integrity · availability
Complete · Complete · Complete
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-189 and the CVSS impact.

Summary

Multiple integer overflows in tools/libxc/xc_dom_bzimageloader.c in Xen 3.2, 3.3, 4.0, and 4.1 allow local users to cause a denial of service and possibly execute arbitrary code via a crafted paravirtualised guest kernel image that triggers (1) a buffer overflow during a decompression loop or (2) an out-of-bounds read in the loader involving unspecified length fields.

Why it matters now

EPSS 0.00705 53rd percentileScored 2026-11-07
Fix Fixed Red Hat: 1 advisory

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:citrix:xen:3.2.0:*:*:*:*:*:*:*3.2.0VulnerableCitrix
cpe:2.3:a:citrix:xen:3.3.0:*:*:*:*:*:*:*3.3.0VulnerableCitrix
cpe:2.3:a:citrix:xen:4.0.0:*:*:*:*:*:*:*4.0.0VulnerableCitrix
cpe:2.3:a:citrix:xen:4.1.0:*:*:*:*:*:*:*4.1.0VulnerableCitrix
  • cpe:2.3:a:citrix:xen:3.2.0:*:*:*:*:*:*:* Versions 3.2.0 Vulnerable ·Citrix
  • cpe:2.3:a:citrix:xen:3.3.0:*:*:*:*:*:*:* Versions 3.3.0 Vulnerable ·Citrix
  • cpe:2.3:a:citrix:xen:4.0.0:*:*:*:*:*:*:* Versions 4.0.0 Vulnerable ·Citrix
  • cpe:2.3:a:citrix:xen:4.1.0:*:*:*:*:*:*:* Versions 4.1.0 Vulnerable ·Citrix

Remediation

Red Hat 1 advisory

  • RHSA-2011:0496 Released 2011-05-09 · Red Hat rating Important
    xen security update
    • RHEL Virtualization (v. 5 server) xen-3.0.3-120.el5_6.2, xen-3.0.3-120.el5_6.2.i386, xen-3.0.3-120.el5_6.2.ia64 +3
    • Red Hat Enterprise Linux (v. 5.6.z server) xen-3.0.3-120.el5_6.2, xen-libs-3.0.3-120.el5_6.2, xen-libs-3.0.3-120.el5_6.2.i386 +1

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
RHEL Virtualization (v. 5 server)Fixed RHSA-2011:0496
Red Hat Enterprise Linux (v. 5.6.z server)Fixed RHSA-2011:0496

Timeline

  1. 2026-10-02 Threatist record created from CVE-2011-1583
  2. 2026-10-03 Alias added: GHSA-4qc2-w83m-rm23

References

Patch 2

Advisory 1

  • TI-2011-01674 Xen 4.1 before 4.1.1 and 4.0 before 4.0.2, when using PCI passthrough on Intel VT-d… CVSS 2.0HIGH 7.4
  • TI-2008-04202 xend in Xen 3.0.3 does not properly limit the contents of the /local/domain xenstore… CVSS 2.0HIGH 7.2
  • TI-2008-05424 xend in Xen 3.3.0 does not properly restrict a guest VM's write access within the… CVSS 2.0HIGH 7.2
  • TI-2010-04004 The fixup_page_fault function in arch/x86/traps.c in Xen 4.0.1 and earlier on 64-bit… CVSS 2.0MEDIUM 6.1
  • TI-2010-03988 The vbd_create function in Xen 3.1.2, when the Linux kernel 2.6.18 on Red Hat Enterprise… CVSS 2.0MEDIUM 5.5
  • TI-2010-03996 The do_block_io_op function in (1) drivers/xen/blkback/blkback.c and (2)… CVSS 2.0MEDIUM 5.5
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences