[SECURITY] [DSA 3390-1] xen security update

2015-11-0218:24:14

lists.debian.org

7.2 High

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

JSON

Debian Security Advisory DSA-3390-1 [email protected]
https://www.debian.org/security/ Salvatore Bonaccorso
November 02, 2015 https://www.debian.org/security/faq

Package : xen
CVE ID : CVE-2015-7835

It was discovered that the code to validate level 2 page table entries
is bypassed when certain conditions are satisfied. A malicious PV guest
administrator can take advantage of this flaw to gain privileges via a
crafted superpage mapping.

For the oldstable distribution (wheezy), this problem has been fixed
in version 4.1.4-3+deb7u9.

For the stable distribution (jessie), this problem has been fixed in
version 4.4.1-9+deb8u2.

We recommend that you upgrade your xen packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: [email protected]

OSVersionArchitecturePackageVersionFilename
Debian8armhfxen-system-armhf< 4.4.1-9+deb8u2xen-system-armhf_4.4.1-9+deb8u2_armhf.deb
Debian7i386libxen-dev< 4.1.4-3+deb7u9libxen-dev_4.1.4-3+deb7u9_i386.deb
Debian8amd64libxen-4.4< 4.4.1-9+deb8u2libxen-4.4_4.4.1-9+deb8u2_amd64.deb
Debian8amd64xen-hypervisor-4.4-amd64< 4.4.1-9+deb8u2xen-hypervisor-4.4-amd64_4.4.1-9+deb8u2_amd64.deb
Debian7allxen-utils-common< 4.1.4-3+deb7u9xen-utils-common_4.1.4-3+deb7u9_all.deb
Debian7amd64libxen-4.1< 4.1.4-3+deb7u9libxen-4.1_4.1.4-3+deb7u9_amd64.deb
Debian7allxen< 4.1.4-3+deb7u9xen_4.1.4-3+deb7u9_all.deb
Debian8amd64libxen-dev< 4.4.1-9+deb8u2libxen-dev_4.4.1-9+deb8u2_amd64.deb
Debian8armhflibxenstore3.0< 4.4.1-9+deb8u2libxenstore3.0_4.4.1-9+deb8u2_armhf.deb
Debian8allxen-utils-common< 4.4.1-9+deb8u2xen-utils-common_4.4.1-9+deb8u2_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	8	armhf	xen-system-armhf	< 4.4.1-9+deb8u2	xen-system-armhf_4.4.1-9+deb8u2_armhf.deb
Debian	7	i386	libxen-dev	< 4.1.4-3+deb7u9	libxen-dev_4.1.4-3+deb7u9_i386.deb
Debian	8	amd64	libxen-4.4	< 4.4.1-9+deb8u2	libxen-4.4_4.4.1-9+deb8u2_amd64.deb
Debian	8	amd64	xen-hypervisor-4.4-amd64	< 4.4.1-9+deb8u2	xen-hypervisor-4.4-amd64_4.4.1-9+deb8u2_amd64.deb
Debian	7	all	xen-utils-common	< 4.1.4-3+deb7u9	xen-utils-common_4.1.4-3+deb7u9_all.deb
Debian	7	amd64	libxen-4.1	< 4.1.4-3+deb7u9	libxen-4.1_4.1.4-3+deb7u9_amd64.deb
Debian	7	all	xen	< 4.1.4-3+deb7u9	xen_4.1.4-3+deb7u9_all.deb
Debian	8	amd64	libxen-dev	< 4.4.1-9+deb8u2	libxen-dev_4.4.1-9+deb8u2_amd64.deb
Debian	8	armhf	libxenstore3.0	< 4.4.1-9+deb8u2	libxenstore3.0_4.4.1-9+deb8u2_armhf.deb
Debian	8	all	xen-utils-common	< 4.4.1-9+deb8u2	xen-utils-common_4.4.1-9+deb8u2_all.deb