CVE-2014-3969
UnknownEPSS 0.65%
Last modified
CVE-2014-3969 is a vulnerability of currently unknown severity. Xen 4.4.x, when running on an ARM system, does not properly check write permissions on virtual addresses, which allows local guest administrators to gain privileges via unspecified vectors.. EPSS estimates a 0.65% chance of exploitation in the next 30 days.
Description
Xen 4.4.x, when running on an ARM system, does not properly check write permissions on virtual addresses, which allows local guest administrators to gain privileges via unspecified vectors.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Xen | Xen | 4.4.0 |
References
- http://secunia.com/advisories/58975Permissions Required
- http://www.openwall.com/lists/oss-security/2014/06/04/14Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/67819Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1030333Third Party Advisory, VDB Entry
- http://xenbits.xen.org/xsa/advisory-98.htmlPatch, Vendor Advisory
- http://secunia.com/advisories/58975Permissions Required
- http://www.openwall.com/lists/oss-security/2014/06/04/14Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/67819Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1030333Third Party Advisory, VDB Entry
- http://xenbits.xen.org/xsa/advisory-98.htmlPatch, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2014-3969?
Xen 4.4.x, when running on an ARM system, does not properly check write permissions on virtual addresses, which allows local guest administrators to gain privileges via unspecified vectors.
How severe is CVE-2014-3969?
Severity scoring for CVE-2014-3969 is pending analysis. The EPSS model estimates a 0.65% probability of exploitation in the next 30 days.
How do I fix CVE-2014-3969?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2014
- CVE-2014-3961SQL injection vulnerability in the Export CSV page in the Pa…
- CVE-2014-3962Multiple SQL injection vulnerabilities in Videos Tube 1.0 al…
- CVE-2014-3963ownCloud Server before 6.0.1 does not properly check permiss…
- CVE-2014-3966Cross-site scripting (XSS) vulnerability in Special:Password…
- CVE-2014-3967The HVMOP_inject_msi function in Xen 4.2.x, 4.3.x, and 4.4.x…
- CVE-2014-3968The HVMOP_inject_msi function in Xen 4.2.x, 4.3.x, and 4.4.x…
- CVE-2014-3970The pa_rtp_recv function in modules/rtp/rtp.c in the module-…
- CVE-2014-3971The CmdAuthenticate::_authenticateX509 function in db/comman…
- CVE-2014-3972Directory traversal vulnerability in Apexis APM-J601-WS came…
- CVE-2014-3973Multiple SQL injection vulnerabilities in FrontAccounting (F…
- CVE-2014-3974Cross-site scripting (XSS) vulnerability in filemanager.php …
- CVE-2014-3975Absolute path traversal vulnerability in filemanager.php in …
Are you affected by CVE-2014-3969?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST