Xen 4.5.x and earlier enables certain default backends when emulating a VGA device for an x86 HVM guest qemu even when the configuration disables them, which allows local guest users to obtain access to the VGA console by (1) setting the DISPLAY environment variable, when compiled with SDL support, or connecting to the VNC server on (2) ::1 or (3) 127.0.0.1, when not compiled with SDL support.
CVSS Details
- CVSS 3.1 Base Score: 7.1
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade xen | Jul 30, 2024 | Mar 18, 2015 |
| Freebsd | — | Upgrade xen-tools | Dec 10, 2025 | Jul 11, 2015 |
| Gentoo Linux | — | Upgrade app-emulation/xen. | Oct 30, 2017 | Mar 18, 2015 |
| Suse | — | Upgrade xenUpgrade xen-tools-domUUpgrade xen-doc-htmlUpgrade xen-toolsUpgrade xen-kmp-defaultUpgrade xen-libs-32bitUpgrade xen-develUpgrade xen-libs | Dec 18, 2015 | Mar 18, 2015 |
| Ubuntu | — | Upgrade xen | Nov 19, 2024 | Mar 18, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub