OracleVM 3.1 : kernel-uek (OVMSA-2013-0010)

The remote OracleVM system is missing necessary patches to address critical security updates : - xen-pciback: rate limit error messages from xenpcibkenablemsi,x Jan Beulich Orabug: 16243736 CVE-2013-0231 - Xen: Fix stack corruption in xenfailsafecallback for 32bit PVOPS guests. Frediano Ziglio...

OracleVM 3.2 : kernel-uek (OVMSA-2013-0015)

The remote OracleVM system is missing necessary patches to address critical security updates : - x86/xen: don't assume %ds is usable in xeniret for 32-bit PVOPS. Chuck Anderson Orabug: 16325076 CVE-2013-0228 XSA-42 CVE-2013-0190 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The package...

OracleVM 3.1 : xen (OVMSA-2013-0043)

The remote OracleVM system is missing necessary patches to address critical security updates : - x86/xsave: properly check guest input to XSETBV Other than the HVM emulation path, the PV case so far failed to check that YMM state requires SSE state to be enabled, allowing for a GP to occur upon...

OracleVM 3.2 : kernel-uek (OVMSA-2013-0008)

The remote OracleVM system is missing necessary patches to address critical security updates : - kmod: make requestmodule killable Oleg Nesterov Orabug: 16286305 CVE-2012-4398 - kmod: introduce callmodprobe helper Oleg Nesterov Orabug: 16286305 CVE-2012-4398 - usermodehelper: implement UMHKILLABL...

OracleVM 3.2 : onpenssl (OVMSA-2014-0008)

The remote OracleVM system is missing necessary patches to address critical security updates : - fix for CVE-2014-0224 - SSL/TLS MITM vulnerability - replace expired GlobalSign Root CA certificate in ca-bundle.crt - fix for CVE-2013-0169 - SSL/TLS CBC timing attack 907589 - fix for CVE-2013-0166 ...

OracleVM 2.2 : openssl (OVMSA-2014-0007)

The remote OracleVM system is missing necessary patches to address critical security updates : - fix for CVE-2014-0224 - SSL/TLS MITM vulnerability - replace expired GlobalSign Root CA certificate in ca-bundle.crt - fix for CVE-2013-0169 - SSL/TLS CBC timing attack 907589 - fix for CVE-2013-0166 ...

OracleVM 3.1 : xen (OVMSA-2013-0091)

The remote OracleVM system is missing necessary patches to address critical security updates : - x86/AMD: work around erratum 793 The recommendation is to set a bit in an MSR - do this if the firmware didn't, considering that otherwise we expose ourselves to a guest induced DoS. This is...

OracleVM 3.2 : openssl (OVMSA-2014-0039) (POODLE)

The remote OracleVM system is missing necessary patches to address critical security updates : - add support for fallback SCSV to partially mitigate CVE-2014-3566 padding attack on SSL3 - fix CVE-2014-0221 - recursion in DTLS code leading to DoS - fix CVE-2014-3505 - doublefree in DTLS packet...

OracleVM 2.2 : openssl (OVMSA-2014-0040) (POODLE)

The remote OracleVM system is missing necessary patches to address critical security updates : - add support for fallback SCSV to partially mitigate CVE-2014-3566 padding attack on SSL3 - fix CVE-2014-0221 - recursion in DTLS code leading to DoS - fix CVE-2014-3505 - doublefree in DTLS packet...

OracleVM 3.1 : xen (OVMSA-2013-0009)

The remote OracleVM system is missing necessary patches to address critical security updates : - oxenstored incorrect handling of certain Xenbus ring states Xen Security Advisory 38 CVE-2013-0215 Patch xsa38.patch The oxenstored daemon the ocaml version of the xenstore daemon does not correctly...

OracleVM 2.1 : xen (OVMSA-2008-2007)

The remote OracleVM system is missing necessary patches to address critical security updates : - CVE-2008-1945: add image format options for USB storage and removable media - CVE-2008-1952: included in fix for CVE-2008-1943 3.1.4-0.1.3.el5 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

OracleVM 3.1 : xen (OVMSA-2012-0034)

The remote OracleVM system is missing necessary patches to address critical security updates : - Xen Security Advisory CVE-2012-3433 / XSA-11 HVM guest destroy p2m teardown host DoS vulnerability An HVM guest is able to manipulate its physical address space such that tearing down the guest takes ...

OracleVM 2.1 : newt (OVMSA-2009-0026)

The remote OracleVM system is missing necessary patches to address critical security updates : - fix buffer overflow in textbox when reflowing 524618, CVE-2009-2905 - add release to -devel requires - escape macros in changelog - add support for tuples of strings in EntryWindow prompts in snack...

OracleVM 2.1 : kernel (OVMSA-2009-0004)

The remote OracleVM system is missing necessary patches to address critical security updates : CVE-2008-3528 The error-reporting functionality in 1 fs/ext2/dir.c, 2 fs/ext3/dir.c, and possibly 3 fs/ext4/dir.c in the Linux kernel 2.6.26.5 does not limit the number of printk console messages that...

OracleVM 3.1 : xen (OVMSA-2013-0037)

The remote OracleVM system is missing necessary patches to address critical security updates : - VT-d: don't permit SVTNOVERIFY entries for known device types Only in cases where we don't know what to do we should leave the IRTE blank suppressing all validation, but we should always log a warning...

OracleVM 2.1 : kernel (OVMSA-2008-2002)

The remote OracleVM system is missing necessary patches to address critical security updates : - x8664 kernel vmsplicetopipe flaw Alexander Viro 432252 CVE-2008-0600 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The package checks in this plugin were extracted from OracleVM Security Adviso...

OracleVM 3.1 : xen (OVMSA-2013-0057)

The remote OracleVM system is missing necessary patches to address critical security updates : - x86: fix page refcount handling in page table pin error path In the original patch 7 of the series addressing XSA-45 I mistakenly took the addition of the call to getpagelight in allocpagetype to cove...

OracleVM 2.1 : kernel (OVMSA-2008-2005)

The remote OracleVM system is missing necessary patches to address critical security updates : - fix utrace deadengine ops race - fix ptraceattach leak - CVE-2007-5093: kernel PWC driver DoS - CVE-2007-6282: IPSec ESP kernel panics - CVE-2007-6712: kernel: infinite loop in highres timers kernel...

OracleVM 3.2 : xen (OVMSA-2013-0004)

The remote OracleVM system is missing necessary patches to address critical security updates : - Xen Security Advisory CVE-2012-5634 / XSA-33 v3 VT-d interrupt remapping source validation flaw The patch supplied for Xen 4.1 xsa33-4.1.patch contained a build error. A corrected patch is attached. T...

OracleVM 3.3 : openssl (OVMSA-2014-0012)

The remote OracleVM system is missing necessary patches to address critical security updates : - fix CVE-2014-3505 - doublefree in DTLS packet processing - fix CVE-2014-3506 - avoid memory exhaustion in DTLS - fix CVE-2014-3507 - avoid memory leak in DTLS - fix CVE-2014-3508 - fix OID handling to...