High severity7.5NVD Advisory· Published Jan 23, 2017· Updated May 13, 2026
CVE-2016-9380
CVE-2016-9380
Description
The pygrub boot loader emulator in Xen, when nul-delimited output format is requested, allows local pygrub-using guest OS administrators to read or delete arbitrary files on the host via NUL bytes in the bootloader configuration file.
Affected products
5cpe:2.3:a:citrix:xenserver:6.2.0:*:*:*:*:*:*:*+ 3 more
- cpe:2.3:a:citrix:xenserver:6.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:citrix:xenserver:6.5:*:*:*:*:*:*:*
- cpe:2.3:a:citrix:xenserver:7.0:*:*:*:*:*:*:*
- cpe:2.3:a:citrix:xenserver:6.0.2:*:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
6- xenbits.xen.org/xsa/advisory-198.htmlnvdPatchVendor Advisory
- xenbits.xen.org/xsa/xsa198.patchnvdPatchVendor Advisory
- support.citrix.com/article/CTX218775nvdPatchThird Party Advisory
- www.securityfocus.com/bid/94473nvdThird Party AdvisoryVDB Entry
- www.securitytracker.com/id/1037347nvdThird Party AdvisoryVDB Entry
- security.gentoo.org/glsa/201612-56nvd
News mentions
0No linked articles in our index yet.