Detections
Analytics
Alpine: xen: security update to 4.7.2-r1
high Tenable Cloud Security Plugin ID 407879
Description
There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:- Xen through 4.8.x on 64-bit platforms mishandles page tables after an IRET hypercall, which might allow PV
guest OS users to execute arbitrary code on the host OS, aka XSA-213. (CVE-2017-8903)
- Xen through 4.8.x mishandles the "contains segment descriptors" property during GNTTABOP_transfer (aka
guest transfer) operations, which might allow PV guest OS users to execute arbitrary code on the host OS,
aka XSA-214. (CVE-2017-8904)
- Xen through 4.6.x on 64-bit platforms mishandles a failsafe callback, which might allow PV guest OS users
to execute arbitrary code on the host OS, aka XSA-215. (CVE-2017-8905)
See Also
https://security.alpinelinux.org/vuln/CVE-2017-8903
Plugin Details
Severity: High
ID: 407879
Version: Revision 1.25
Type: Local
Published: 10/31/2023
Updated: 7/2/2026
Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 5
Percentile: 95.09
CVSS v2
Risk Factor: High
Base Score: 7.2
Temporal Score: 5.3
Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2017-8903
CVSS v3
Risk Factor: High
Base Score: 8.8
Temporal Score: 7.7
Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
CVSS Score Source: CVE-2017-8905
Vulnerability Information
Exploit Ease: No known exploits are available
Vulnerability Publication Date: 5/4/2017
Reference Information
CVE: CVE-2017-8903, CVE-2017-8904, CVE-2017-8905
IAVB: 2017-B-0050-S