Xen: Mehrere Schwachstellen
WID-SEC-2025-2007 · first 10.09.2025 · updated 10.07.2026 · CVSS 8,8
What it is about
Xen ist ein Virtueller-Maschinen-Monitor (VMM), der Hardware (x86, IA-64, PowerPC) für die darauf laufenden Systeme (Domains) paravirtualisiert. Ein Angreifer kann mehrere Schwachstellen in Xen ausnutzenEin Angreifer kann mehrere Schwachstellen in Xen ausnutzen, um einen Denial-of-Service-Angriff durchzuführen, Informationen offenzulegen oder Berechtigungen zu erweitern.
Under what conditions?
The BSI does not name any particular preconditions. Exploitable remotely according to the BSI.
What can happen in the worst case
An attacker could use the vulnerability to
- einen Denial-of-Service-Angriff durchzuführen
- Informationen offenzulegen oder Berechtigungen zu erweitern
Am I affected?
Affected according to the BSI:
- Debian Linux
- Fedora Linux
- SUSE Linux
- SUSE openSUSE
- Open Source Xen Server 8.4
- Open Source Xen >=4.13
- Open Source Xen XAPI
- Open Source Xen >=4.12
- Dell NetWorker vProxy <19.14
The installed version is usually shown under “Help → About” or in the device’s admin interface.
What helps?
Update to at least:
- Open Source Xen >=4.13
- Open Source Xen >=4.12
- Dell NetWorker vProxy 19.14
Is the vulnerability already being exploited?
None of the CVEs is in the CISA catalogue of exploited vulnerabilities. That does not mean there are no attacks, only that none are documented.
Information and sources
- Original BSI advisory (WID)
- Citrix Security Advisory CTX695195 vom 2025-09-09 support.citrix.com
- Xen Security Advisory XSA-472 vom 2025-09-09 xenbits.xen.org
- Xen Security Advisory XSA-474 vom 2025-09-09 xenbits.xen.org
- Xen Security Advisory XSA-473 vom 2025-09-09 xenbits.xen.org
- SUSE Security Update SUSE-SU-2025:03172-1 vom 2025-09-11 lists.suse.com
- openSUSE Security Update OPENSUSE-SU-2025:15547-1 vom 2025-09-12 lists.opensuse.org
- Fedora Security Advisory FEDORA-2025-643CC72C6F vom 2025-09-15 bodhi.fedoraproject.org
- Fedora Security Advisory FEDORA-2025-7A1F93F58A vom 2025-09-15 bodhi.fedoraproject.org
- Fedora Security Advisory FEDORA-2025-92EFB95906 vom 2025-09-16 bodhi.fedoraproject.org
- Fedora Security Advisory FEDORA-2025-873AD6DF70 vom 2025-09-22 bodhi.fedoraproject.org
- SUSE Security Update SUSE-SU-2025:3797-1 vom 2025-10-27 lists.suse.com
- SUSE Security Update SUSE-SU-2025:3798-1 vom 2025-10-27 lists.opensuse.org
- SUSE Security Update SUSE-SU-2025:3843-1 vom 2025-10-28 lists.suse.com
- Debian Security Advisory DSA-6068 vom 2025-12-03 lists.debian.org
- SUSE Security Update SUSE-SU-2026:0012-1 vom 2026-01-05 lists.suse.com
- SUSE Security Update SUSE-SU-2026:0303-1 vom 2026-01-28 lists.suse.com
- Dell Security Advisory DSA-2026-030 vom 2026-01-30 www.dell.com
CVE: CVE-2025-27466, CVE-2025-58142, CVE-2025-58143, CVE-2025-58146, CVE-2025-58144, CVE-2025-58145
Source: BSI warning and information service (CERT-Bund); CISA. The assessment of the conditions is my reading of the BSI text; the external pages are in their original language.