Nowe podatności w produkcie firmy Citrix (P26-165)

utworzone przez | kwi 29, 2026 | Aktualizacje

ProductXenServer – versions prior to 8.4
CVECVE-2026-23556
Base score6.5/10
CVSSAV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
DetailsQuota use count leak in oxenstored. A malicious guest can exhaust system resources, leading to a Denial of Service (DoS) for management tasks.
  
CVECVE-2026-23558
Base score6.3/10
CVSSAV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
DetailsInformation leak in MSI-X interrupt handling. Allows a guest administrator to read small fragments of hypervisor memory.
  
CVECVE-2026-23559
Base score6.0/10
CVSSAV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H
DetailsUse-after-free vulnerability in PCI passthrough handling. Can be exploited by a privileged guest to crash the entire host.
  
CVECVE-2026-23560
Base score8.8/10
CVSSAV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
DetailsLogic error in the grant table mechanism. Allows unauthorized access to memory pages belonging to other domains (privilege escalation).
  
CVECVE-2026-23561
Base score8.2/10
CVSSAV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
DetailsImproper input validation in backend drivers. Enables a privileged guest to execute arbitrary code with Dom0 privileges.
  
Patch availableYES
Linkhttps://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696527&articleURL=XenServer_Security_Update_for_Multiple_Issues