Detections
Analytics

Debian dla-4818 : libxen-dev - security update

critical Nessus Plugin ID 362913

Synopsis

The remote Debian host is missing one or more security-related updates.

Description

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4818 advisory.

 - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4818-1 [email protected] https://www.debian.org/lts/security/ Hans van Kranenburg October 04, 2026 https://wiki.debian.org/LTS
 - -------------------------------------------------------------------------

 Package : xen Version : 4.17.7-0+deb12u1 CVE ID : CVE-2025-10263 CVE-2025-54505 CVE-2025-54518 CVE-2025-58150 CVE-2026-23553 CVE-2026-23554 CVE-2026-23556 CVE-2026-23557 CVE-2026-23558 CVE-2026-42487 CVE-2026-42488 CVE-2026-42489 CVE-2026-42490 CVE-2026-42493 CVE-2026-42494 CVE-2026-42495 CVE-2026-62423 CVE-2026-62424 CVE-2026-62425 CVE-2026-62426 CVE-2026-62427 CVE-2026-62428 CVE-2026-62429 CVE-2026-62430 CVE-2026-62431 CVE-2026-62432 CVE-2026-62433 CVE-2026-62434 CVE-2026-62435 CVE-2026-62436

 Multiple vulnerabilities have been discovered in the Xen hypervisor, which could result in privilege escalation, information disclosure or denial of service.

 For Debian 12 bookworm, these problems have been fixed in version 4.17.7-0+deb12u1.

 We recommend that you upgrade your xen packages.

 For the detailed security status of xen please refer to its security tracker page at:
 https://security-tracker.debian.org/tracker/xen

 Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade the libxen-dev packages.

See Also

https://packages.debian.org/source/bookworm/xen

https://security-tracker.debian.org/tracker/CVE-2025-10263

https://security-tracker.debian.org/tracker/CVE-2025-54505

https://security-tracker.debian.org/tracker/CVE-2025-54518

https://security-tracker.debian.org/tracker/CVE-2025-58150

https://security-tracker.debian.org/tracker/CVE-2026-23553

https://security-tracker.debian.org/tracker/CVE-2026-23554

https://security-tracker.debian.org/tracker/CVE-2026-23556

https://security-tracker.debian.org/tracker/CVE-2026-23557

https://security-tracker.debian.org/tracker/CVE-2026-23558

https://security-tracker.debian.org/tracker/CVE-2026-42487

https://security-tracker.debian.org/tracker/CVE-2026-42488

https://security-tracker.debian.org/tracker/CVE-2026-42489

https://security-tracker.debian.org/tracker/CVE-2026-42490

https://security-tracker.debian.org/tracker/CVE-2026-42493

https://security-tracker.debian.org/tracker/CVE-2026-42494

https://security-tracker.debian.org/tracker/CVE-2026-42495

https://security-tracker.debian.org/tracker/CVE-2026-62423

https://security-tracker.debian.org/tracker/CVE-2026-62424

https://security-tracker.debian.org/tracker/CVE-2026-62425

https://security-tracker.debian.org/tracker/CVE-2026-62426

https://security-tracker.debian.org/tracker/CVE-2026-62427

https://security-tracker.debian.org/tracker/CVE-2026-62428

https://security-tracker.debian.org/tracker/CVE-2026-62429

https://security-tracker.debian.org/tracker/CVE-2026-62430

https://security-tracker.debian.org/tracker/CVE-2026-62431

https://security-tracker.debian.org/tracker/CVE-2026-62432

https://security-tracker.debian.org/tracker/CVE-2026-62433

https://security-tracker.debian.org/tracker/CVE-2026-62434

https://security-tracker.debian.org/tracker/CVE-2026-62435

https://security-tracker.debian.org/tracker/CVE-2026-62436

https://security-tracker.debian.org/tracker/source-package/xen

Plugin Details

Severity: Critical

ID: 362913

File Name: debian_DLA-4818.nasl

Version: 1.1

Type: Local

Agent: unix

Published: 10/4/2026

Updated: 10/4/2026

Supported Sensors: Continuous Assessment, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.6

Percentile: 98.37

CVSS v2

Risk Factor: High

Base Score: 9.4

Temporal Score: 7

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:N

CVSS Score Source: CVE-2025-10263

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.7

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS Score Source: CVE-2026-62427

CVSS v4

Risk Factor: Critical

Base Score: 9.4

Threat Score: 7.6

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

CVSS Score Source: CVE-2026-23556

Vulnerability Information

CPE: cpe:/o:debian:debian_linux:12.0, p-cpe:/a:debian:debian_linux:libxen-dev, p-cpe:/a:debian:debian_linux:libxencall1, p-cpe:/a:debian:debian_linux:libxendevicemodel1, p-cpe:/a:debian:debian_linux:libxenevtchn1, p-cpe:/a:debian:debian_linux:libxenforeignmemory1, p-cpe:/a:debian:debian_linux:libxengnttab1, p-cpe:/a:debian:debian_linux:libxenhypfs1, p-cpe:/a:debian:debian_linux:libxenmisc4.17, p-cpe:/a:debian:debian_linux:libxenstore4, p-cpe:/a:debian:debian_linux:libxentoolcore1, p-cpe:/a:debian:debian_linux:libxentoollog1, p-cpe:/a:debian:debian_linux:xen-doc, p-cpe:/a:debian:debian_linux:xen-hypervisor-4.17-amd64-dbg, p-cpe:/a:debian:debian_linux:xen-hypervisor-4.17-amd64, p-cpe:/a:debian:debian_linux:xen-hypervisor-4.17-arm64-dbg, p-cpe:/a:debian:debian_linux:xen-hypervisor-4.17-arm64, p-cpe:/a:debian:debian_linux:xen-hypervisor-4.17-armhf-dbg, p-cpe:/a:debian:debian_linux:xen-hypervisor-4.17-armhf, p-cpe:/a:debian:debian_linux:xen-hypervisor-common, p-cpe:/a:debian:debian_linux:xen-system-amd64, p-cpe:/a:debian:debian_linux:xen-system-arm64, p-cpe:/a:debian:debian_linux:xen-system-armhf, p-cpe:/a:debian:debian_linux:xen-utils-4.17-dbg, p-cpe:/a:debian:debian_linux:xen-utils-4.17, p-cpe:/a:debian:debian_linux:xen-utils-common, p-cpe:/a:debian:debian_linux:xenstore-utils

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Ease: No known exploits are available

Patch Publication Date: 10/4/2026

Vulnerability Publication Date: 7/10/2025

Reference Information

CVE: CVE-2025-10263, CVE-2025-54505, CVE-2025-54518, CVE-2025-58150, CVE-2026-23553, CVE-2026-23554, CVE-2026-23556, CVE-2026-23557, CVE-2026-23558, CVE-2026-42487, CVE-2026-42488, CVE-2026-42489, CVE-2026-42490, CVE-2026-42493, CVE-2026-42494, CVE-2026-42495, CVE-2026-62423, CVE-2026-62424, CVE-2026-62425, CVE-2026-62426, CVE-2026-62427, CVE-2026-62428, CVE-2026-62429, CVE-2026-62430, CVE-2026-62431, CVE-2026-62432, CVE-2026-62433, CVE-2026-62434, CVE-2026-62435, CVE-2026-62436