OracleVM 3.3 : openssl (OVMSA-2015-0005) (FREAK)

The remote OracleVM system is missing necessary patches to address critical security updates : - fix CVE-2014-3570 - incorrect computation in BNsqr - fix CVE-2014-3571 - possible crash in dtls1getrecord - fix CVE-2014-3572 - possible downgrade of ECDH ciphersuite to non-PFS state - fix...

OracleVM 3.3 : glibc (OVMSA-2015-0003)

The remote OracleVM system is missing necessary patches to address critical security updates : - Fix recursive dlopen 1173469. - Fix typo in ressend and resquery rh1172023. - Fix crashes on invalid input in IBM gconv modules CVE-2014-6040, 1139571. - Fix wordexp to honour WRDENOCMD CVE-2014-7817,...

OracleVM 3.2 : ntp (OVMSA-2015-0001)

The remote OracleVM system is missing necessary patches to address critical security updates : - Remove default ntp servers in ntp.conf bug 14342986 - don't generate weak control key for resolver CVE-2014-9293 - don't generate weak MD5 keys in ntp-keygen CVE-2014-9294 - fix buffer overflows via...

OracleVM 2.2 : ntp (OVMSA-2015-0002)

The remote OracleVM system is missing necessary patches to address critical security updates : - don't generate weak control key for resolver CVE-2014-9293 - don't generate weak MD5 keys in ntp-keygen CVE-2014-9294 - fix buffer overflows via specially-crafted packets CVE-2014-9295 - increase...

OracleVM 3.3 : jasper (OVMSA-2014-0087)

The remote OracleVM system is missing necessary patches to address critical security updates : - CVE-2014-8137 - double-free in in jasiccattrvaldestroy 1173566 - CVE-2014-8138 - heap overflow in jp2decode 1173566 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The package checks in this plug...

OracleVM 3.3 : mailx (OVMSA-2014-0086)

The remote OracleVM system is missing necessary patches to address critical security updates : - CVE-2004-2771 mailx: command execution flaw resolves: 1171175 - resolves: 857120 fixed incorrect return code when TMPDIR points to invalid path - resolves: 845098 added support for alternatives...

OracleVM 3.3 : bind (OVMSA-2014-0084)

The remote OracleVM system is missing necessary patches to address critical security updates : - Fix CVE-2014-8500 1171973 - Use /dev/urandom when generating rndc.key file 951255 - Remove bogus file from /usr/share/doc, introduced by fix for bug 1092035 - Add support for TLSA resource records...

OracleVM 3.3 : ntp (OVMSA-2014-0085)

The remote OracleVM system is missing necessary patches to address critical security updates : - don't generate weak control key for resolver CVE-2014-9293 - don't generate weak MD5 keys in ntp-keygen CVE-2014-9294 - fix buffer overflows via specially-crafted packets CVE-2014-9295 - don't mobiliz...

OracleVM 3.3 : rpm (OVMSA-2014-0083)

The remote OracleVM system is missing necessary patches to address critical security updates : - Fix race condidition where unchecked data is exposed in the file system CVE-2013-64351163059 - Fix thinko in the non-root python byte-compilation fix - Byte-compile versioned python libdirs in non-roo...

OracleVM 3.3 : nss (OVMSA-2014-0082)

The remote OracleVM system is missing necessary patches to address critical security updates : nss - Added nss-vendor.patch to change vendor - Resolves: Bug 1158160 - Upgrade to NSS 3.16.2.3 for Firefox 31.3 - Remove unused indentation pseudo patch - require nss util 3.16.2.3 - Restore patch for...

OracleVM 2.2 : xen (OVMSA-2012-0058)

The remote OracleVM system is missing necessary patches to address critical security updates : XSA-27: hvm: Limit the size of large HVM op batches orabug 15907978 CVE-2012-5511 XSA-29: add missing guest address range checks to XENMEMexchange handlers orabug 15907996 CVE-2012-5513 XSA-30: xen: fix...

OracleVM 2.1 : xen (OVMSA-2008-2003)

The remote OracleVM system is missing necessary patches to address critical security updates : - Disable QEMU image format auto-detection CVE-2008-2004 - Fix PVFB to validate frame buffer description - Fix PVFB to cope with bogus update requests - Fix QEMU buffer overflow CVE-2007-5730 - Fix QEMU...

OracleVM 2.1 : kernel (OVMSA-2009-0017)

The remote OracleVM system is missing necessary patches to address critical security updates : CVE-2009-1895 The personality subsystem in the Linux kernel before 2.6.31-rc3 has a PERCLEARONSETID setting that does not clear the ADDRCOMPATLAYOUT and MMAPPAGEZERO flags when executing a setuid or...

OracleVM 3.2 : xen (OVMSA-2013-0040)

The remote OracleVM system is missing necessary patches to address critical security updates : - libxc: limit cpu values when setting vcpu affinity When support for pinning more than 64 cpus was added, check for cpu out-of-range values was removed. This can lead to subsequent out-of-bounds cpumap...

OracleVM 3.1 : xen (OVMSA-2013-0032)

The remote OracleVM system is missing necessary patches to address critical security updates : - defer event channel bucket pointer store until after XSM checks Otherwise a dangling pointer can be left, which would cause subsequent memory corruption as soon as the space got re-allocated for some...

OracleVM 3.2 : xen (OVMSA-2013-0070)

The remote OracleVM system is missing necessary patches to address critical security updates : - x86: properly set up fbld emulation operand address This is XSA-66. CVE-2013-4361 - x86: properly handle hvmcopyfromguestphys,virt errors Ignoring them generally implies using uninitialized data and, ...

OracleVM 3.0 : xen (OVMSA-2012-0056)

The remote OracleVM system is missing necessary patches to address critical security updates : - xen: fix error handling of guestphysmapmarkpopulateondemand The only user of the 'out' label bypasses a necessary unlock, thus enabling the caller to lock up Xen. Also, the function was never meant to...

OracleVM 3.2 : xen (OVMSA-2013-0042)

The remote OracleVM system is missing necessary patches to address critical security updates : - Other than the HVM emulation path, the PV case so far failed to check that YMM state requires SSE state to be enabled, allowing for a GP to occur upon passing the inputs to XSETBV inside the hyperviso...

OracleVM 2.2 : xen (OVMSA-2014-0028)

The remote OracleVM system is missing necessary patches to address critical security updates : - Backport xend: disable sslv3 due to CVE-2014-356 19831405 - libxc: Support set affinity for more than 64 CPUs 18938789 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The package checks in this...

OracleVM 2.2 : xen (OVMSA-2013-0074)

The remote OracleVM system is missing necessary patches to address critical security updates : - x86: check segment descriptor read result in 64-bit OUTS emulation XSA-67 Matthew Daley orabug 17571640 CVE-2013-4368 - x86: properly set up fbld emulation operand address XSA-66 Jan Beulich orabug...