{"id":"CVE-2013-2211","aliases":["DEBIAN-CVE-2013-2211","DSA-3006-1","EUVD-2013-2165","GHSA-446j-5cq2-4x7c","MGASA-2013-0197"],"status":"published","title":"The libxenlight (libxl) toolstack library in Xen 4.0.x, 4.1.x, and 4.2.x uses weak permissions...","description":"The libxenlight (libxl) toolstack library in Xen 4.0.x, 4.1.x, and 4.2.x uses weak permissions for xenstore keys for paravirtualised and emulated serial console devices, which allows local guest administrators to modify the xenstore value via unspecified vectors.","severity":{"version":"2.0","score":7.4,"vector":"AV:A/AC:M/Au:S/C:C/I:C/A:C","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00562,"percentile":0.47053,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-264"],"published":"2013-07-01T19:17:22Z","modified":"2026-09-01T20:03:15Z","fixes":[{"ecosystem":"Debian:12","package":"xen","fixed_in":["4.3.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"xen","fixed_in":["4.3.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"xen","fixed_in":["4.3.0-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.4-3+deb7u2"}]}],"versions":["4.1.4-3","4.1.4-3+deb7u1"],"bundled":19},{"source":"osv","ecosystem":"Mageia:3","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1-16.2.mga3"}]}],"bundled":9}],"products":[{"vendor":"xen","product":"xen"}],"references":[{"url":"http://secunia.com/advisories/55082","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2013/06/26/4","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://security.gentoo.org/glsa/glsa-201309-24.xml","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2013/06/25/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://www.debian.org/security/2014/dsa-3006","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2211"},{"url":"https://github.com/advisories/GHSA-446j-5cq2-4x7c"},{"url":"https://security-tracker.debian.org/tracker/CVE-2013-2211","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2013-0197.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=10586","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2013-2211","description":"The libxenlight (libxl) toolstack library in Xen 4.0.x, 4.1.x, and 4.2.x uses weak permissions for xenstore keys for paravirtualised and emulated serial console devices, which allows local guest administrators to modify the xenstore value via unspecified vectors.","status":"published","published":"2013-08-28T17:00:00Z","modified":"2024-08-06T15:27:41.047Z","updated_at":"2026-11-02T14:34:56.19172Z"}],"euvd":[{"id":"EUVD-2013-2165","description":"The libxenlight (libxl) toolstack library in Xen 4.0.x, 4.1.x, and 4.2.x uses weak permissions for xenstore keys for paravirtualised and emulated serial console devices, which allows local guest administrators to modify the xenstore value via unspecified vectors.","status":"published","published":"2013-08-28T17:00:00Z","modified":"2024-08-06T15:27:41Z","updated_at":"2026-11-03T01:56:39.164386Z"}],"ghsa":[{"id":"GHSA-446j-5cq2-4x7c","title":"The libxenlight (libxl) toolstack library in Xen 4.0.x, 4.1.x, and 4.2.x uses weak permissions...","description":"The libxenlight (libxl) toolstack library in Xen 4.0.x, 4.1.x, and 4.2.x uses weak permissions for xenstore keys for paravirtualised and emulated serial console devices, which allows local guest administrators to modify the xenstore value via unspecified vectors.","status":"published","published":"2022-05-17T04:20:04Z","modified":"2023-01-28T05:01:38Z","updated_at":"2026-11-02T14:43:36.071197Z"}],"nvd":[{"id":"CVE-2013-2211","description":"The libxenlight (libxl) toolstack library in Xen 4.0.x, 4.1.x, and 4.2.x uses weak permissions for xenstore keys for paravirtualised and emulated serial console devices, which allows local guest administrators to modify the xenstore value via unspecified vectors.","status":"published","published":"2013-08-28T21:55:08.56Z","modified":"2026-06-16T23:52:57.247Z","cvss":[{"version":"2.0","score":7.4,"vector":"AV:A/AC:M/Au:S/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:02:35.248411Z"}],"osv":[{"id":"CVE-2013-2211","description":"The libxenlight (libxl) toolstack library in Xen 4.0.x, 4.1.x, and 4.2.x uses weak permissions for xenstore keys for paravirtualised and emulated serial console devices, which allows local guest administrators to modify the xenstore value via unspecified vectors.","status":"published","published":"2013-08-28T21:55:08Z","modified":"2026-04-16T06:24:42.497581592Z","updated_at":"2026-11-02T15:43:59.09154Z"},{"id":"DEBIAN-CVE-2013-2211","description":"The libxenlight (libxl) toolstack library in Xen 4.0.x, 4.1.x, and 4.2.x uses weak permissions for xenstore keys for paravirtualised and emulated serial console devices, which allows local guest administrators to modify the xenstore value via unspecified vectors.","status":"published","published":"2013-08-28T21:55:08.56Z","modified":"2026-09-01T20:03:15.662032045Z","updated_at":"2026-11-02T15:45:25.514579Z"},{"id":"DSA-3006-1","title":"xen - security update","status":"published","published":"2014-08-18T00:00:00Z","modified":"2026-03-09T01:18:46.88872Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"MGASA-2013-0197","title":"Updated xen package fixes security issues","description":"This update fixes the following security issues:\nXSA-52/CVE-2013-2076: Information leak on XSAVE/XRSTOR capable AMD CPUs\nXSA-53/CVE-2013-2077: Hypervisor crash due to missing exception recovery on XRSTOR\nXSA-54/CVE-2013-2078: Hypervisor crash due to missing exception recovery on XSETBV\nXSA-55/CVE-2013-2194: integer overflows\nXSA-55/CVE-2013-2195: pointer dereferences\nXSA-55/CVE-2013-2196: other problems\nXSA-56/CVE-2013-2072: Buffer overflow in xencontrol Python bindings affecting xend\nXSA-57/CVE-2013-2211: libxl allows guest write access to sensitive console related xenstore keys\nXSA-58/CVE-2013-1432: Page reference counting error due to XSA-45/CVE-2013-1918 fixes\n","status":"published","published":"2013-07-01T19:17:22Z","modified":"2026-04-16T06:22:48.153434415Z","updated_at":"2026-11-02T15:49:39.121227Z"}]}}