[SECURITY] [DLA 1270-1] xen security update

2018-02-0612:35:00

lists.debian.org

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS3

9.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

AI Score

8.6

Confidence

High

EPSS

0.001

Percentile

51.0%

JSON

Package : xen
Version : 4.1.6.lts1-12
CVE ID : CVE-2016-9603 CVE-2016-9637 CVE-2017-2620

Multiple vulnerabilities have been discovered in the Xen hypervisor, which
could result in privilege escalation.

For Debian 7 "Wheezy", these problems have been fixed in version
4.1.6.lts1-12.

We recommend that you upgrade your xen packages.

Please note that CVE-2017-15590 (XSA-237) will not be fixed in wheezy as
the patches are too intrusive to backport.
The vulnerability can be mitigated by not passing through physical devices
to untrusted guests.
More information can be found on https://xenbits.xen.org/xsa/advisory-237.html

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

OSVersionArchitecturePackageVersionFilename
Debian7allqemu< 1.1.2+dfsg-6+deb7u20qemu_1.1.2+dfsg-6+deb7u20_all.deb
Debian8armelqemu-user< 1:2.1+dfsg-12+deb8u7qemu-user_1:2.1+dfsg-12+deb8u7_armel.deb
Debian8i386qemu-user< 1:2.1+dfsg-12+deb8u7qemu-user_1:2.1+dfsg-12+deb8u7_i386.deb
Debian7amd64xen-utils-4.1< 4.1.6.lts1-12xen-utils-4.1_4.1.6.lts1-12_amd64.deb
Debian7i386xen-hypervisor-4.1-i386< 4.1.6.lts1-12xen-hypervisor-4.1-i386_4.1.6.lts1-12_i386.deb
Debian7i386xen-utils-4.1< 4.1.6.lts1-12xen-utils-4.1_4.1.6.lts1-12_i386.deb
Debian8amd64qemu-user< 1:2.1+dfsg-12+deb8u7qemu-user_1:2.1+dfsg-12+deb8u7_amd64.deb
Debian7i386libxen-dev< 4.1.6.lts1-12libxen-dev_4.1.6.lts1-12_i386.deb
Debian8amd64qemu-system-sparc< 1:2.1+dfsg-12+deb8u7qemu-system-sparc_1:2.1+dfsg-12+deb8u7_amd64.deb
Debian7armelqemu-system< 1.1.2+dfsg-6+deb7u20qemu-system_1.1.2+dfsg-6+deb7u20_armel.deb

OS	Version	Architecture	Package	Version	Filename
Debian	7	all	qemu	< 1.1.2+dfsg-6+deb7u20	qemu_1.1.2+dfsg-6+deb7u20_all.deb
Debian	8	armel	qemu-user	< 1:2.1+dfsg-12+deb8u7	qemu-user_1:2.1+dfsg-12+deb8u7_armel.deb
Debian	8	i386	qemu-user	< 1:2.1+dfsg-12+deb8u7	qemu-user_1:2.1+dfsg-12+deb8u7_i386.deb
Debian	7	amd64	xen-utils-4.1	< 4.1.6.lts1-12	xen-utils-4.1_4.1.6.lts1-12_amd64.deb
Debian	7	i386	xen-hypervisor-4.1-i386	< 4.1.6.lts1-12	xen-hypervisor-4.1-i386_4.1.6.lts1-12_i386.deb
Debian	7	i386	xen-utils-4.1	< 4.1.6.lts1-12	xen-utils-4.1_4.1.6.lts1-12_i386.deb
Debian	8	amd64	qemu-user	< 1:2.1+dfsg-12+deb8u7	qemu-user_1:2.1+dfsg-12+deb8u7_amd64.deb
Debian	7	i386	libxen-dev	< 4.1.6.lts1-12	libxen-dev_4.1.6.lts1-12_i386.deb
Debian	8	amd64	qemu-system-sparc	< 1:2.1+dfsg-12+deb8u7	qemu-system-sparc_1:2.1+dfsg-12+deb8u7_amd64.deb
Debian	7	armel	qemu-system	< 1.1.2+dfsg-6+deb7u20	qemu-system_1.1.2+dfsg-6+deb7u20_armel.deb