CVE-2016-9380
published 2017-01-23CVE-2016-9380: The pygrub boot loader emulator in Xen, when nul-delimited output format is requested, allows local pygrub-using guest OS administrators to read or delete…
PriorityP337high7.5CVSS 3.0
AVLACHPRLUINSCCHIHAN
EPSS
0.42%
35.2th percentile
The pygrub boot loader emulator in Xen, when nul-delimited output format is requested, allows local pygrub-using guest OS administrators to read or delete arbitrary files on the host via NUL bytes in the bootloader configuration file.
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| citrix | citrix_adm | — | — |
| citrix | citrix_hypervisor | — | — |
| citrix | citrix_virtual_apps_and_desktops | — | — |
| citrix | endpoint_management | — | — |
| citrix | netscaler_adc | — | — |
| citrix | netscaler_gateway | — | — |
| citrix | xenserver | — | — |
| citrix | xenserver | — | — |
| citrix | xenserver | — | — |
| citrix | xenserver | — | — |
| citrix | xenserver | — | — |
| debian | xen | < xen 4.8.0-1 (bookworm) | xen 4.8.0-1 (bookworm) |
| xen | xen | >= 0 < 4.8.0-1 | 4.8.0-1 |
| xen | xen | >= 0 < 4.8.0-1 | 4.8.0-1 |
| xen | xen | >= 0 < 4.8.0-1 | 4.8.0-1 |
| xen | xen | >= 0 < 4.8.0-1 | 4.8.0-1 |
CVSS provenance
nvdv3.07.5HIGHCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
nvdv2.04.6MEDIUMAV:L/AC:L/Au:N/C:P/I:P/A:P
osv7.5HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
xen: delimiter injection vulnerabilities in pygrub (XSA-198)
vendor_redhat·2016-11-22·CVSS 7.5
CVE-2016-9380 [HIGH] xen: delimiter injection vulnerabilities in pygrub (XSA-198)
xen: delimiter injection vulnerabilities in pygrub (XSA-198)
The pygrub boot loader emulator in Xen, when nul-delimited output format is requested, allows local pygrub-using guest OS administrators to read or delete arbitrary files on the host via NUL bytes in the bootloader configuration file.
Package: xen (Red Hat Enterprise Linux 5) - Will not fix
Debian
CVE-2016-9380: xen - The pygrub boot loader emulator in Xen, when nul-delimited output format is requ...
vendor_debian·2016·CVSS 7.5
CVE-2016-9380 [HIGH] CVE-2016-9380: xen - The pygrub boot loader emulator in Xen, when nul-delimited output format is requ...
The pygrub boot loader emulator in Xen, when nul-delimited output format is requested, allows local pygrub-using guest OS administrators to read or delete arbitrary files on the host via NUL bytes in the bootloader configuration file.
Scope: local
bookworm: resolved (fixed in 4.8.0-1)
bullseye: resolved (fixed in 4.8.0-1)
forky: resolved (fixed in 4.8.0-1)
sid: resolved (fixed in 4.8.0-1)
trixie: resolved (fixed in 4.8.0-1)
Citrix
Citrix Security Bulletin CTX218775
vendor_citrix·CVSS 7.9
CVE-2016-9379 [HIGH] Citrix Security Bulletin CTX218775
Citrix Security Bulletin CTX218775
CVE References: CVE-2016-9379, CVE-2016-9380, CVE-2016-9381, CVE-2016-9382, CVE-2016-9383, CVE-2016-9385, CVE-2016-9386, CVE-2025-12101, CVE-2025-62626, CVE-2026-23554, CVE-2026-3055, CVE-2026-4368, CVE-2026-4397
Affected Products: Citrix ADM, Citrix Hypervisor, Citrix Virtual Apps and Desktops, Endpoint Management, NetScaler ADC, NetScaler Gateway, XenServer
GHSA
GHSA-58r5-2fcj-4x5p: The pygrub boot loader emulator in Xen, when nul-delimited output format is requested, allows local pygrub-using guest OS administrators to read or de
ghsa_unreviewed·2022-05-17
CVE-2016-9380 [HIGH] CWE-20 GHSA-58r5-2fcj-4x5p: The pygrub boot loader emulator in Xen, when nul-delimited output format is requested, allows local pygrub-using guest OS administrators to read or de
The pygrub boot loader emulator in Xen, when nul-delimited output format is requested, allows local pygrub-using guest OS administrators to read or delete arbitrary files on the host via NUL bytes in the bootloader configuration file.
OSV
CVE-2016-9380: The pygrub boot loader emulator in Xen, when nul-delimited output format is requested, allows local pygrub-using guest OS administrators to read or de
osv·2017-01-23·CVSS 7.5
CVE-2016-9380 [HIGH] CVE-2016-9380: The pygrub boot loader emulator in Xen, when nul-delimited output format is requested, allows local pygrub-using guest OS administrators to read or de
The pygrub boot loader emulator in Xen, when nul-delimited output format is requested, allows local pygrub-using guest OS administrators to read or delete arbitrary files on the host via NUL bytes in the bootloader configuration file.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2016-9377 CVE-2016-9378 CVE-2016-9379 CVE-2016-9380 CVE-2016-9381 CVE-2016-9382 CVE-2016-9383 CVE-2016-9384 CVE-2016-9385 CVE-2016-9386 xen: various flaws [fedora-all]
bugzilla·2016-11-22·CVSS 5.5
CVE-2016-9377 [MEDIUM] CVE-2016-9377 CVE-2016-9378 CVE-2016-9379 CVE-2016-9380 CVE-2016-9381 CVE-2016-9382 CVE-2016-9383 CVE-2016-9384 CVE-2016-9385 CVE-2016-9386 xen: various flaws [fedora-all]
CVE-2016-9377 CVE-2016-9378 CVE-2016-9379 CVE-2016-9380 CVE-2016-9381 CVE-2016-9382 CVE-2016-9383 CVE-2016-9384 CVE-2016-9385 CVE-2016-9386 xen: various flaws [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM chan
Bugzilla
CVE-2016-9379 CVE-2016-9380 xsa198 xen: delimiter injection vulnerabilities in pygrub (XSA-198)
bugzilla·2016-11-08·CVSS 7.9
CVE-2016-9379 [HIGH] CVE-2016-9379 CVE-2016-9380 xsa198 xen: delimiter injection vulnerabilities in pygrub (XSA-198)
CVE-2016-9379 CVE-2016-9380 xsa198 xen: delimiter injection vulnerabilities in pygrub (XSA-198)
ISSUE DESCRIPTION
pygrub, the boot loader emulator, fails to quote (or sanity check) its
results when reporting them to its caller.
pygrub supports a number of output formats. When the S-expression
output format is requested, putting string quotes and S-expressions in
the bootloader configuration file can produce incorrect output.
When the nul-delimited output format is requested, nul bytes in the
bootloader configuration file can produce an ambiguous or confusing
output file, which is interpreted by libxl in a vulnerable way.
The existing bootloader config interpreters all read input in a
line-based way from their bootloaders, and none of them support any
kind of escaping. So the newline-d
http://www.securityfocus.com/bid/94473http://www.securitytracker.com/id/1037347http://xenbits.xen.org/xsa/advisory-198.htmlhttp://xenbits.xen.org/xsa/xsa198.patchhttps://security.gentoo.org/glsa/201612-56https://support.citrix.com/article/CTX218775http://www.securityfocus.com/bid/94473http://www.securitytracker.com/id/1037347http://xenbits.xen.org/xsa/advisory-198.htmlhttp://xenbits.xen.org/xsa/xsa198.patchhttps://security.gentoo.org/glsa/201612-56https://support.citrix.com/article/CTX218775
2017-01-23
Published