Description
tools/libxc/xc_dom_bzimageloader.c in Xen 3.2, 3.3, 4.0, and 4.1 allows local users to cause a denial of service (management software infinite loop and management domain resource consumption) via unspecified vectors related to "Lack of error checking in the decompression loop."
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | xen | 4.1.1-1 | — |
| Debian 13 | xen | 4.1.1-1 | — |
| Debian 12 | xen | 4.1.1-1 | — |
| Debian 6.0 | xen | 4.0.1-4 | DSA-2337-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | xen +1 | 3.0.3-120.el5_6.2 | RHSA-2011:0496 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Virtualization 5 | xen +1 | 3.0.3-120.el5_6.2 | RHSA-2011:0496 |
Advisories 2
- RHSA-2011:0496 Red Hat Security Advisory: xen security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-2337-1 xen - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- 55082 third-party-advisory
- GLSA-201309-24 vendor-advisory
- [Xen-devel] 20110509 Xen security advisory CVE-2011-1583 - pv kernel image validation mailing-list
- xen-xcdombzimageloader-dos(69381) vdb-entry
- [Xen-devel] 20110509 Re: Xen security advisory CVE-2011-1583 - pv kernel image validation mailing-list