CVE-2013-4371 — Vulnetix

Try Vulnetix Request Demo

CVE-2013-4371 PUBLISHED CVSS 4.400000095367432 MEDIUM

Use-after-free vulnerability in the libxl_list_cpupool function in the libxl toolstack library in Xen 4.2.x and 4.3.x, when running "under memory pressure," returns the original pointer when the realloc function fails, which allows local users to cause a denial of service (heap corruption and crash) and possibly execute arbitrary code via unspecified vectors.

EPSS 0.08% · 24.1th percentile

Risk Scores

CVSS v2.0

4.400000095367432

EPSS Score

0.08%

24.1th percentile

Affected Products

Vendor	Product	Versions
xen	xen	4.2.0, 4.2.1, 4.2.2
n/a	n/a	n/a

Timeline

Oct 17, 2013 CVE Published
Feb 4, 2022 EPSS Score
Mar 28, 2022 EPSS Score
May 19, 2022 EPSS Score
Jul 10, 2022 EPSS Score
Sep 1, 2022 EPSS Score
Oct 23, 2022 EPSS Score
Dec 14, 2022 EPSS Score
Feb 4, 2023 EPSS Score
Mar 7, 2023 EPSS Score
Mar 28, 2023 EPSS Score
May 19, 2023 EPSS Score

References

GLSA-201407-03 vendor-advisory
[oss-security] 20131010 Xen Security Advisory 70 (CVE-2013-4371) - use-after-free in libxl_list_cpupool under memory pressure mailing-list
https://nvd.nist.gov/vuln/detail/CVE-2013-4371 advisory

Open in Interactive Console →