CVE-2011-1583: Citrix Xen

Medium severity, CVSS 6.9. EPSS: 0.7% chance of exploitation in the next 30 days.

Multiple integer overflows in tools/libxc/xc_dom_bzimageloader.c in Xen 3.2, 3.3, 4.0, and 4.1 allow local users to cause a denial of service and possibly execute arbitrary code via a crafted paravirtualised guest kernel image that triggers (1) a buffer overflow during a decompression loop or (2) an out-of-bounds read in the loader involving unspecified length fields.

Affected products

• Citrix Xen: version 3.2.0 only; version 3.3.0 only; version 4.0.0 only; version 4.1.0 only

Published 2011-08-12. Last modified 2026-06-16.