(RHSA-2011:1090) Moderate: rhev-hypervisor security and bug fix update

The rhev-hypervisor package provides a Red Hat Enterprise Virtualization
Hypervisor ISO disk image. The Red Hat Enterprise Virtualization
Hypervisor is a dedicated Kernel-based Virtual Machine (KVM) hypervisor.
It includes everything necessary to run and manage virtual machines: A
subset of the Red Hat Enterprise Linux operating environment and the Red
Hat Enterprise Virtualization Agent.

Note: Red Hat Enterprise Virtualization Hypervisor is only available for
the Intel 64 and AMD64 architectures with virtualization extensions.

A flaw was found that allowed napi_reuse_skb() to be called on VLAN
(virtual LAN) packets. An attacker on the local network could trigger this
flaw by sending specially-crafted packets to a target system, possibly
causing a denial of service. (CVE-2011-1576)

Red Hat would like to thank Ryan Sweat for reporting CVE-2011-1576.

This updated package provides updated components that include fixes for
security issues; however, these issues have no security impact for Red Hat
Enterprise Virtualization Hypervisor. These fixes are for bash issue
CVE-2008-5374; curl issue CVE-2011-2192; kernel issues CVE-2010-4649,
CVE-2011-0695, CVE-2011-0711, CVE-2011-1044, CVE-2011-1182, CVE-2011-1573,
CVE-2011-1593, CVE-2011-1745, CVE-2011-1746, CVE-2011-1776, CVE-2011-1780,
CVE-2011-1936, CVE-2011-2022, CVE-2011-2213, CVE-2011-2492, CVE-2011-2525,
and CVE-2011-2689; libvirt issue CVE-2011-2511; and rsync issue
CVE-2007-6200.

This update also fixes several bugs. Documentation for these bug fixes will
be available shortly from the Technical Notes document linked to in the
References section.

As Red Hat Enterprise Virtualization Hypervisor is based on KVM, the bug
fixes from the KVM update RHBA-2011:1068 have been included in this update:

https://rhn.redhat.com/errata/RHBA-2011-1068.html

Users of Red Hat Enterprise Virtualization Hypervisor are advised to
upgrade to this updated package, which resolves this issue and fixes the
bugs noted in the Technical Notes.