Description
Xen 4.5.x and earlier enables certain default backends when emulating a VGA device for an x86 HVM guest qemu even when the configuration disables them, which allows local guest users to obtain access to the VGA console by (1) setting the DISPLAY environment variable, when compiled with SDL support, or connecting to the VNC server on (2) ::1 or (3) 127.0.0.1, when not compiled with SDL support.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | xen | 4.4.1-9 | — |
| Debian 13 | xen | 4.4.1-9 | — |
| Debian 12 | xen | 4.4.1-9 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | xen | 4.4.1-0ubuntu0.14.04.4 | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 | xen | 4.4.1_10-9.1 | SUSE-SU-2015:0613-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 | xen | 4.4.1_10-9.1 | SUSE-SU-2015:0613-1 |
Advisories 1
- SUSE-SU-2015:0613-1 Security update for Xen SUSE / openSUSE Security Updates · Feb 4, 2026
References
- GLSA-201504-04 vendor-advisory
- 1031919 vdb-entry
- FEDORA-2015-3944 vendor-advisory
- FEDORA-2015-3721 vendor-advisory
- 73068 vdb-entry
- FEDORA-2015-3935 vendor-advisory
- http://xenbits.xen.org/xsa/advisory-119.html
- openSUSE-SU-2015:0732 vendor-advisory
- 1031806 vdb-entry