[SECURITY] [DLA 1549-1] xen security update

2018-10-1811:07:38

lists.debian.org

151

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

6.9 Medium

CVSS2

Access Vector

LOCAL

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:M/Au:N/C:C/I:C/A:C

0.001 Low

EPSS

Percentile

31.4%

JSON

Package : xen
Version : 4.4.4lts2-0+deb8u1
CVE ID : CVE-2017-14316 CVE-2017-14317 CVE-2017-14319 CVE-2017-15588
CVE-2017-15589 CVE-2017-15590 CVE-2017-15597 CVE-2017-17046
CVE-2017-17563 CVE-2017-17564 CVE-2017-17565 CVE-2017-17566
CVE-2018-10471 CVE-2018-10982

Multiple vulnerabilities have been discovered in the Xen hypervisor, which
could result in denial of service, informations leaks or privilege
escalation.

For Debian 8 "Jessie", these problems have been fixed in version
4.4.4lts2-0+deb8u1.

We recommend that you upgrade your xen packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

OSVersionArchitecturePackageVersionFilename
Debian7i386libxen-ocaml< 4.1.6.lts1-10libxen-ocaml_4.1.6.lts1-10_i386.deb
Debian7i386xen-hypervisor-4.1-amd64< 4.1.6.lts1-10xen-hypervisor-4.1-amd64_4.1.6.lts1-10_i386.deb
Debian9i386libxen-dev< 4.8.2+xsa245-0+deb9u1libxen-dev_4.8.2+xsa245-0+deb9u1_i386.deb
Debian7amd64xen-utils-4.1< 4.1.6.lts1-10xen-utils-4.1_4.1.6.lts1-10_amd64.deb
Debian9armhflibxen-dev< 4.8.2+xsa245-0+deb9u1libxen-dev_4.8.2+xsa245-0+deb9u1_armhf.deb
Debian9i386libxen-4.8-dbgsym< 4.8.2+xsa245-0+deb9u1libxen-4.8-dbgsym_4.8.2+xsa245-0+deb9u1_i386.deb
Debian9i386xenstore-utils-dbgsym< 4.8.2+xsa245-0+deb9u1xenstore-utils-dbgsym_4.8.2+xsa245-0+deb9u1_i386.deb
Debian9arm64libxenstore3.0< 4.8.2+xsa245-0+deb9u1libxenstore3.0_4.8.2+xsa245-0+deb9u1_arm64.deb
Debian9armhfxen-hypervisor-4.8-armhf< 4.8.2+xsa245-0+deb9u1xen-hypervisor-4.8-armhf_4.8.2+xsa245-0+deb9u1_armhf.deb
Debian8amd64xenstore-utils< 4.4.4lts2-0+deb8u1xenstore-utils_4.4.4lts2-0+deb8u1_amd64.deb

OS	Version	Architecture	Package	Version	Filename
Debian	7	i386	libxen-ocaml	< 4.1.6.lts1-10	libxen-ocaml_4.1.6.lts1-10_i386.deb
Debian	7	i386	xen-hypervisor-4.1-amd64	< 4.1.6.lts1-10	xen-hypervisor-4.1-amd64_4.1.6.lts1-10_i386.deb
Debian	9	i386	libxen-dev	< 4.8.2+xsa245-0+deb9u1	libxen-dev_4.8.2+xsa245-0+deb9u1_i386.deb
Debian	7	amd64	xen-utils-4.1	< 4.1.6.lts1-10	xen-utils-4.1_4.1.6.lts1-10_amd64.deb
Debian	9	armhf	libxen-dev	< 4.8.2+xsa245-0+deb9u1	libxen-dev_4.8.2+xsa245-0+deb9u1_armhf.deb
Debian	9	i386	libxen-4.8-dbgsym	< 4.8.2+xsa245-0+deb9u1	libxen-4.8-dbgsym_4.8.2+xsa245-0+deb9u1_i386.deb
Debian	9	i386	xenstore-utils-dbgsym	< 4.8.2+xsa245-0+deb9u1	xenstore-utils-dbgsym_4.8.2+xsa245-0+deb9u1_i386.deb
Debian	9	arm64	libxenstore3.0	< 4.8.2+xsa245-0+deb9u1	libxenstore3.0_4.8.2+xsa245-0+deb9u1_arm64.deb
Debian	9	armhf	xen-hypervisor-4.8-armhf	< 4.8.2+xsa245-0+deb9u1	xen-hypervisor-4.8-armhf_4.8.2+xsa245-0+deb9u1_armhf.deb
Debian	8	amd64	xenstore-utils	< 4.4.4lts2-0+deb8u1	xenstore-utils_4.4.4lts2-0+deb8u1_amd64.deb