SB2016090901 - Denial of service in Oracle VM Server for x86
Published: September 9, 2016 Updated: January 9, 2017
Security Bulletin ID
SB2016090901
CSH Severity
High
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 vulnerability.
1) Denial of service (CVE-ID: CVE-2016-7154)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:H/E:A/U:Amber
The vulnerability allows local administrative user to gain elevated privileges and cause denial of service on the host system.
The vulnerability exists due to supplying of specially crafted frame number to the EVTCHNOP_init_control() function and allows attacker to cause use-after-free and denil of service.
Successful exploitation of this vulnerability may allow a lcal user to get privileges on the host system and trigger a target service deny.
Remediation
Install update from vendor's website.