You are here
Home > Preporuke > Sigurnosni nedostaci programskog paketa xen

Sigurnosni nedostaci programskog paketa xen

by ncert - 0

openSUSE Security Update: Security update for xen
______________________________________________________________________________

Announcement ID: openSUSE-SU-2015:1092-1
Rating: important
References: #861318 #882089 #895528 #901488 #903680 #906689
#910254 #912011 #918995 #918998 #919098 #919464
#919663 #921842 #922705 #922706 #922709 #923758
#927967 #929339 #931625 #931626 #931627 #931628
#932770 #932790 #932996
Cross-References: CVE-2014-3615 CVE-2015-2044 CVE-2015-2045
CVE-2015-2151 CVE-2015-2152 CVE-2015-2751
CVE-2015-2752 CVE-2015-2756 CVE-2015-3209
CVE-2015-3340 CVE-2015-3456 CVE-2015-4103
CVE-2015-4104 CVE-2015-4105 CVE-2015-4106
CVE-2015-4163 CVE-2015-4164
Affected Products:
openSUSE 13.2
______________________________________________________________________________

An update that solves 17 vulnerabilities and has 10 fixes
is now available.

Description:

Xen was updated to 4.4.2 to fix multiple vulnerabilities and non-security
bugs.

The following vulnerabilities were fixed:

* CVE-2015-4103: Potential unintended writes to host MSI message data
field via qemu (XSA-128) (boo#931625)
* CVE-2015-4104: PCI MSI mask bits inadvertently exposed to guests
(XSA-129) (boo#931626)
* CVE-2015-4105: Guest triggerable qemu MSI-X pass-through error messages
(XSA-130) (boo#931627)
* CVE-2015-4106: Unmediated PCI register access in qemu (XSA-131)
(boo#931628)
* CVE-2015-4164: DoS through iret hypercall handler (XSA-136) (boo#932996)
* CVE-2015-4163: GNTTABOP_swap_grant_ref operation misbehavior (XSA-134)
(boo#932790)
* CVE-2015-3209: heap overflow in qemu pcnet controller allowing guest to
host escape (XSA-135) (boo#932770)
* CVE-2015-3456: Fixed a buffer overflow in the floppy drive emulation,
which could be used to denial of service attacks or potential code
execution against the host. ()
* CVE-2015-3340: Xen did not initialize certain fields, which allowed
certain remote service domains to obtain sensitive information from
memory via a (1) XEN_DOMCTL_gettscinfo or (2)
XEN_SYSCTL_getdomaininfolist request. ()
* CVE-2015-2752: Long latency MMIO mapping operations are not preemptible
(XSA-125 boo#922705)
* CVE-2015-2756: Unmediated PCI command register access in qemu (XSA-126
boo#922706)
* CVE-2015-2751: Certain domctl operations may be abused to lock up the
host (XSA-127 boo#922709)
* CVE-2015-2151: Hypervisor memory corruption due to x86 emulator flaw
(boo#919464 XSA-123)
* CVE-2015-2045: Information leak through version information hypercall
(boo#918998 XSA-122)
* CVE-2015-2044: Information leak via internal x86 system device emulation
(boo#918995 (XSA-121)
* CVE-2015-2152: HVM qemu unexpectedly enabling emulated VGA graphics
backends (boo#919663 XSA-119)
* CVE-2014-3615: information leakage when guest sets high resolution
(boo#895528)

The following non-security bugs were fixed:

* xentop: Fix memory leak on read failure
* boo#923758: xen dmesg contains bogus output in early boot
* boo#921842: Xentop doesn’t display disk statistics for VMs using qdisks
* boo#919098: L3: XEN blktap device intermittently fails to connect
* boo#882089: Windows 2012 R2 fails to boot up with greater than 60 vcpus
* boo#903680: Problems with detecting free loop devices on Xen guest
startup
* boo#861318: xentop reports “Found interface vif101.0 but domain 101 does
not exist.”
* boo#901488: Intel ixgbe driver assigns rx/tx queues per core resulting
in irq problems on servers with a large amount of CPU cores
* boo#910254: SLES11 SP3 Xen VT-d igb NIC doesn’t work
* boo#912011: high ping latency after upgrade to latest SLES11SP3 on xen
Dom0
* boo#906689: let systemd schedule xencommons after network-online.target
and remote-fs.target so that xendomains has access to remote shares

The following functionality was enabled or enhanced:

* Enable spice support in qemu for x86_64
* Add Qxl vga support
* Enhancement to virsh/libvirtd “send-key” command (FATE#317240)
* Add domain_migrate_constraints_set API to Xend’s http interface
(FATE#317239)

Patch Instructions:

To install this openSUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:

– openSUSE 13.2:

zypper in -t patch openSUSE-2015-434=1

To bring your system up-to-date, use “zypper patch”.

Package List:

– openSUSE 13.2 (i586 x86_64):

xen-debugsource-4.4.2_06-23.1
xen-devel-4.4.2_06-23.1
xen-libs-4.4.2_06-23.1
xen-libs-debuginfo-4.4.2_06-23.1
xen-tools-domU-4.4.2_06-23.1
xen-tools-domU-debuginfo-4.4.2_06-23.1

– openSUSE 13.2 (x86_64):

xen-4.4.2_06-23.1
xen-doc-html-4.4.2_06-23.1
xen-kmp-default-4.4.2_06_k3.16.7_21-23.1
xen-kmp-default-debuginfo-4.4.2_06_k3.16.7_21-23.1
xen-kmp-desktop-4.4.2_06_k3.16.7_21-23.1
xen-kmp-desktop-debuginfo-4.4.2_06_k3.16.7_21-23.1
xen-libs-32bit-4.4.2_06-23.1
xen-libs-debuginfo-32bit-4.4.2_06-23.1
xen-tools-4.4.2_06-23.1
xen-tools-debuginfo-4.4.2_06-23.1

References:

https://www.suse.com/security/cve/CVE-2014-3615.html
https://www.suse.com/security/cve/CVE-2015-2044.html
https://www.suse.com/security/cve/CVE-2015-2045.html
https://www.suse.com/security/cve/CVE-2015-2151.html
https://www.suse.com/security/cve/CVE-2015-2152.html
https://www.suse.com/security/cve/CVE-2015-2751.html
https://www.suse.com/security/cve/CVE-2015-2752.html
https://www.suse.com/security/cve/CVE-2015-2756.html
https://www.suse.com/security/cve/CVE-2015-3209.html
https://www.suse.com/security/cve/CVE-2015-3340.html
https://www.suse.com/security/cve/CVE-2015-3456.html
https://www.suse.com/security/cve/CVE-2015-4103.html
https://www.suse.com/security/cve/CVE-2015-4104.html
https://www.suse.com/security/cve/CVE-2015-4105.html
https://www.suse.com/security/cve/CVE-2015-4106.html
https://www.suse.com/security/cve/CVE-2015-4163.html
https://www.suse.com/security/cve/CVE-2015-4164.html
https://bugzilla.suse.com/861318
https://bugzilla.suse.com/882089
https://bugzilla.suse.com/895528
https://bugzilla.suse.com/901488
https://bugzilla.suse.com/903680
https://bugzilla.suse.com/906689
https://bugzilla.suse.com/910254
https://bugzilla.suse.com/912011
https://bugzilla.suse.com/918995
https://bugzilla.suse.com/918998
https://bugzilla.suse.com/919098
https://bugzilla.suse.com/919464
https://bugzilla.suse.com/919663
https://bugzilla.suse.com/921842
https://bugzilla.suse.com/922705
https://bugzilla.suse.com/922706
https://bugzilla.suse.com/922709
https://bugzilla.suse.com/923758
https://bugzilla.suse.com/927967
https://bugzilla.suse.com/929339
https://bugzilla.suse.com/931625
https://bugzilla.suse.com/931626
https://bugzilla.suse.com/931627
https://bugzilla.suse.com/931628
https://bugzilla.suse.com/932770
https://bugzilla.suse.com/932790
https://bugzilla.suse.com/932996

—
To unsubscribe, e-mail: opensuse-security-announce+unsubscribe@opensuse.org
For additional commands, e-mail: opensuse-security-announce+help@opensuse.org

openSUSE Security Update: Security update for xen
______________________________________________________________________________

Announcement ID: openSUSE-SU-2015:1094-1
Rating: important
References: #922709 #931625 #931626 #931627 #931628 #932770
#932790 #932996
Cross-References: CVE-2015-2751 CVE-2015-3209 CVE-2015-4103
CVE-2015-4104 CVE-2015-4105 CVE-2015-4106
CVE-2015-4163 CVE-2015-4164
Affected Products:
openSUSE 13.1
______________________________________________________________________________

An update that fixes 8 vulnerabilities is now available.

Description:

Xen was updated to fix eight vulnerabilities.

The following vulnerabilities were fixed:

* CVE-2015-2751: Certain domctl operations may be abused to lock up the
host (XSA-127 boo#922709)
* CVE-2015-4103: Potential unintended writes to host MSI message data
field via qemu (XSA-128) (boo#931625)
* CVE-2015-4104: PCI MSI mask bits inadvertently exposed to guests
(XSA-129) (boo#931626)
* CVE-2015-4105: Guest triggerable qemu MSI-X pass-through error messages
(XSA-130) (boo#931627)
* CVE-2015-4106: Unmediated PCI register access in qemu (XSA-131)
(boo#931628)
* CVE-2015-4163: GNTTABOP_swap_grant_ref operation misbehavior (XSA-134)
(boo#932790)
* CVE-2015-3209: heap overflow in qemu pcnet controller allowing guest to
host escape (XSA-135) (boo#932770)
* CVE-2015-4164: DoS through iret hypercall handler (XSA-136) (boo#932996)

Patch Instructions:

To install this openSUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:

– openSUSE 13.1:

zypper in -t patch openSUSE-2015-435=1

To bring your system up-to-date, use “zypper patch”.

Package List:

– openSUSE 13.1 (i586 x86_64):

xen-debugsource-4.3.4_05-47.1
xen-devel-4.3.4_05-47.1
xen-kmp-default-4.3.4_05_k3.11.10_29-47.1
xen-kmp-default-debuginfo-4.3.4_05_k3.11.10_29-47.1
xen-kmp-desktop-4.3.4_05_k3.11.10_29-47.1
xen-kmp-desktop-debuginfo-4.3.4_05_k3.11.10_29-47.1
xen-libs-4.3.4_05-47.1
xen-libs-debuginfo-4.3.4_05-47.1
xen-tools-domU-4.3.4_05-47.1
xen-tools-domU-debuginfo-4.3.4_05-47.1

– openSUSE 13.1 (x86_64):

xen-4.3.4_05-47.1
xen-doc-html-4.3.4_05-47.1
xen-libs-32bit-4.3.4_05-47.1
xen-libs-debuginfo-32bit-4.3.4_05-47.1
xen-tools-4.3.4_05-47.1
xen-tools-debuginfo-4.3.4_05-47.1
xen-xend-tools-4.3.4_05-47.1
xen-xend-tools-debuginfo-4.3.4_05-47.1

– openSUSE 13.1 (i586):

xen-kmp-pae-4.3.4_05_k3.11.10_29-47.1
xen-kmp-pae-debuginfo-4.3.4_05_k3.11.10_29-47.1

References:

https://www.suse.com/security/cve/CVE-2015-2751.html
https://www.suse.com/security/cve/CVE-2015-3209.html
https://www.suse.com/security/cve/CVE-2015-4103.html
https://www.suse.com/security/cve/CVE-2015-4104.html
https://www.suse.com/security/cve/CVE-2015-4105.html
https://www.suse.com/security/cve/CVE-2015-4106.html
https://www.suse.com/security/cve/CVE-2015-4163.html
https://www.suse.com/security/cve/CVE-2015-4164.html
https://bugzilla.suse.com/922709
https://bugzilla.suse.com/931625
https://bugzilla.suse.com/931626
https://bugzilla.suse.com/931627
https://bugzilla.suse.com/931628
https://bugzilla.suse.com/932770
https://bugzilla.suse.com/932790
https://bugzilla.suse.com/932996

—
To unsubscribe, e-mail: opensuse-security-announce+unsubscribe@opensuse.org
For additional commands, e-mail: opensuse-security-announce+help@opensuse.org

ncert
Top
More in Preporuke
Sigurnosni nedostaci programskog paketa qt5

Otkriveni su sigurnosni nedostaci u komponentama programskog paketa qt5 za operacijski sustav Fedora. Otkrivena Logjam ranjivost (CVE-2015-4000) potencijalnim napadačima izvođenjem...

Close