Multiple integer overflows in tools/libxc/xc_dom_bzimageloader.c in Xen 3.2, 3.3, 4.0, and 4.1 allow local users to cause a denial of service and possibly execute arbitrary code via a crafted paravirtualised guest kernel image that triggers (1) a buffer overflow during a decompression loop or (2) an out-of-bounds read in the loader involving unspecified length fields.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Xen | Citrix | 3.2.0 (including) | 3.2.0 (including) |
| Xen | Citrix | 3.3.0 (including) | 3.3.0 (including) |
| Xen | Citrix | 4.0.0 (including) | 4.0.0 (including) |
| Xen | Citrix | 4.1.0 (including) | 4.1.0 (including) |