OracleVM 3.1 : xen (OVMSA-2013-0073)

The remote OracleVM system is missing necessary patches to address critical security updates : - bug 17571611 CVE-2013-4368 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The package checks in this plugin were extracted from OracleVM Security Advisory OVMSA-2013-0073...

OracleVM 3.1 : xen (OVMSA-2012-0039)

The remote OracleVM system is missing necessary patches to address critical security updates : - console: bounds check whenever changing the cursor due to an escape code The device model used by fully virtualised HVM domains, qemu, does not properly handle escape VT100 sequences when emulating...

OracleVM 2.1 : kernel (OVMSA-2008-2009)

The remote OracleVM system is missing necessary patches to address critical security updates : - Update post install scripts to properly set default boot kernel. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The package checks in this plugin were extracted from OracleVM Security Advisory...

OracleVM 3.0 : xen (OVMSA-2012-0050)

The remote OracleVM system is missing necessary patches to address critical security updates : - compat/gnttab: Prevent infinite loop in compat code c/s 20281:95ea2052b41b, which introduces Grant Table version 2 hypercalls introduces a vulnerability whereby the compat hypercall handler can fall...

OracleVM 3.2 : xen (OVMSA-2013-0056)

The remote OracleVM system is missing necessary patches to address critical security updates : - x86: fix page refcount handling in page table pin error path In the original patch 7 of the series addressing XSA-45 I mistakenly took the addition of the call to getpagelight in allocpagetype to cove...

OracleVM 3.3 : rsyslog (OVMSA-2014-0030)

The remote OracleVM system is missing necessary patches to address critical security updates : - use setsid to get a controlling session and process group Orabug: 17346261 Todd Vierling - fix CVE-2014-3634 resolves: 1149148 - drop patch 5 which introduced a regression resolves: 927405 reverts:...

OracleVM 2.1 : krb5 (OVMSA-2009-0003)

The remote OracleVM system is missing necessary patches to address critical security updates : CVE-2009-0844 The getinputtoken function in the SPNEGO implementation in MIT Kerberos 5 aka krb5 1.5 through 1.6.3 allows remote attackers to cause a denial of service daemon crash and possibly obtain...

OracleVM 3.1 : xen (OVMSA-2014-0010)

The remote OracleVM system is missing necessary patches to address critical security updates : - page-alloc: scrub pages used by hypervisor upon freeing ... unless they're part of a fully separate pool and hence can't ever be used for guest allocations. This is XSA-100. %NASLMINLEVEL 70300 C...

OracleVM 3.3 : openssl (OVMSA-2014-0032) (Heartbleed) (POODLE)

The remote OracleVM system is missing necessary patches to address critical security updates : - fix CVE-2014-3567 - memory leak when handling session tickets - fix CVE-2014-3513 - memory leak in srtp support - add support for fallback SCSV to partially mitigate CVE-2014-3566 padding attack on SS...

OracleVM 2.1 : kernel (OVMSA-2009-0023)

The remote OracleVM system is missing necessary patches to address critical security updates : - backport for online resize of blockdev orabug 8585251 rh bugz 444964 - CVE-2009-2692 - net make socksendpage use kernelsendpage Jiri Pirko 517445 516955 - CVE-2009-2698 - net prevent null pointer...

OracleVM 2.1 : elinks (OVMSA-2009-0030)

The remote OracleVM system is missing necessary patches to address critical security updates : - fix 235411 - CVE-2007-2027 - elinks tries to load .po files from non-absolute path - fix 523258 - CVE-2008-7224 - entitycache static array buffer overflow %NASLMINLEVEL 70300 C Tenable Network Securit...

OracleVM 2.2 : xen (OVMSA-2012-0022)

The remote OracleVM system is missing necessary patches to address critical security updates : - CVE-2012-0217 CVE-2012-0218: guest DoS on syscall/sysenter exception generation orabug 13993157 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The package checks in this plugin were extracted fr...

OracleVM 3.3 : glibc (OVMSA-2014-0017)

The remote OracleVM system is missing necessary patches to address critical security updates : - Remove gconv transliteration loadable modules support CVE-2014-5119, - nlfindlocale: Improve handling of crafted locale names CVE-2014-0475, - Don't use alloca in addgetnetgrentX 1087789. - Adjust...

OracleVM 3.3 : krb5 (OVMSA-2014-0034)

The remote OracleVM system is missing necessary patches to address critical security updates : - actually apply that last patch - incorporate fix for MITKRB5-SA-2014-001 CVE-2014-4345, 1128157 - ksu: when evaluating .k5users, don't throw away data from .k5users when we're not passed a command to...

OracleVM 3.0 : xen (OVMSA-2013-0002)

The remote OracleVM system is missing necessary patches to address critical security updates : - VT-d: fix interrupt remapping source validation for devices behind legacy bridges Using SVTVERIFYBUS here doesn't make sense native Linux also uses SVTVERIFYSIDSQ here instead. CVE-2012-5634...

OracleVM 3.1 : xen (OVMSA-2012-0051)

The remote OracleVM system is missing necessary patches to address critical security updates : - libxc: builder: limit maximum size of kernel/ramdisk. Allowing user supplied kernels of arbitrary sizes, especially during decompression, can swallow up dom0 memory leading to either virtual address...

OracleVM 2.1 : xen (OVMSA-2009-0031)

The remote OracleVM system is missing necessary patches to address critical security updates : - Add grub.conf password protection support to pygrub rhbz 525142 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The package checks in this plugin were extracted from OracleVM Security Advisory...

OracleVM 3.2 : xen (OVMSA-2013-0085)

The remote OracleVM system is missing necessary patches to address critical security updates : - x86/HVM: only allow ring 0 guest code to make hypercalls Anything else would allow for privilege escalation. This is CVE-2013-4554 / XSA-76. CVE-2013-4554 - x86: restrict XENDOMCTLgetmemlist Coverity ...

OracleVM 2.1 : kernel (OVMSA-2009-0009)

The remote OracleVM system is missing necessary patches to address critical security updates : CVE-2008-4307 Race condition in the dosetlk function in fs/nfs/file.c in the Linux kernel before 2.6.26 allows local users to cause a denial of service crash via vectors resulting in an interrupted RPC...

OracleVM 2.1 : curl (OVMSA-2009-0019)

The remote OracleVM system is missing necessary patches to address critical security updates : - fix CVE-2009-2417 516257 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The package checks in this plugin were extracted from OracleVM Security Advisory OVMSA-2009-0019...