Xen Denial of Service Vulnerability (CNVD-2015-01674)

Xen is an open source virtual machine monitor product developed at the University of Cambridge, UK. The product enables different and incompatible operating systems to run on the same computer and supports runtime migration to ensure uptime and avoid downtime. A security vulnerability exists in X...

Unbreakable Enterprise kernel security update

2.6.39-400.248.3 - kvm: fix excessive pages un-pinning in kvmiommumap error path. Quentin Casasnovas Orabug: 20687314 CVE-2014-3601 CVE-2014-8369 CVE-2014-3601 - Revert 'mm: Fix NULL pointer dereference in madviseMADVWILLNEED support' Guangyu Sun Orabug: 20673281 CVE-2014-8173 2.6.39-400.248.2 -...

CVE-2015-2150

Xen 3.3.x through 4.5.x and the Linux kernel through 3.19.1 do not properly restrict access to PCI command registers, which might allow local guest OS users to cause a denial of service non-maskable interrupt and host crash by disabling the 1 memory or 2 I/O decoding for a PCI Express device and...

CVE-2015-2150

Xen 3.3.x through 4.5.x and the Linux kernel through 3.19.1 do not properly restrict access to PCI command registers, which might allow local guest OS users to cause a denial of service non-maskable interrupt and host crash by disabling the 1 memory or 2 I/O decoding for a PCI Express device and...

Command injection

Xen 3.3.x through 4.5.x and the Linux kernel through 3.19.1 do not properly restrict access to PCI command registers, which might allow local guest OS users to cause a denial of service non-maskable interrupt and host crash by disabling the 1 memory or 2 I/O decoding for a PCI Express device and...

CVE-2015-2150

Xen 3.3.x through 4.5.x and the Linux kernel through 3.19.1 do not properly restrict access to PCI command registers, which might allow local guest OS users to cause a denial of service non-maskable interrupt and host crash by disabling the 1 memory or 2 I/O decoding for a PCI Express device and...

CVE-2015-2150

CVE-2015-2150 affects Xen 3.3.x–4.5.x and the Linux kernel up to 3.19.1, where access to PCI command registers is not properly restricted. This can allow a local guest OS user to cause a denial of service (unexpected NMI, host crash) by disabling memory or I/O decoding for a PCI Express device an...

CVE-2015-2150

Xen 3.3.x through 4.5.x and the Linux kernel through 3.19.1 do not properly restrict access to PCI command registers, which might allow local guest OS users to cause a denial of service non-maskable interrupt and host crash by disabling the 1 memory or 2 I/O decoding for a PCI Express device and...

CVE-2015-2150

Xen 3.3.x through 4.5.x and the Linux kernel through 3.19.1 do not properly restrict access to PCI command registers, which might allow local guest OS users to cause a denial of service non-maskable interrupt and host crash by disabling the 1 memory or 2 I/O decoding for a PCI Express device and...

UBUNTU-CVE-2015-2150

Xen 3.3.x through 4.5.x and the Linux kernel through 3.19.1 do not properly restrict access to PCI command registers, which might allow local guest OS users to cause a denial of service non-maskable interrupt and host crash by disabling the 1 memory or 2 I/O decoding for a PCI Express device and...

Debian DSA-3181-1 : xen - security update

Multiple security issues have been found in the Xen virtualisation solution : - CVE-2015-2044 Information leak via x86 system device emulation. - CVE-2015-2045 Information leak in the HYPERVISORxenversion hypercall. - CVE-2015-2151 Missing input sanitising in the x86 emulator could result in...

qemu-kvm security, bug fix, and enhancement update

1.5.3-86.el7 - kvm-vfio-pci-Fix-interrupt-disabling.patch bz1180942 - kvm-cirrus-fix-blit-region-check.patch bz1169456 - kvm-cirrus-don-t-overflow-CirrusVGAState-cirrusbltbuf.patch bz1169456 - Resolves: bz1169456 CVE-2014-8106 qemu-kvm: qemu: cirrus: insufficient blit region checks rhel-7.1 -...

[SECURITY] [DSA 3181-1] xen security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3181-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff March 10, 2015 http://www.debian.org/security/faq -...

Non-standard PCI device functionality may render pass-through insecure

ISSUE DESCRIPTION Devices with capabilities or defects that are undocumented or that virtualization software is unaware of may allow guests to control parts of the host that they shouldn't be in control of. Here are some examples of the kind of problem: While XSA-120 deals with standard PCI confi...

Non-maskable interrupts triggerable by guests

ISSUE DESCRIPTION Guests are currently permitted to modify all of the writable bits in the PCI command register of devices passed through to them. This in particular allows them to disable memory and I/O decoding on the device unless the device is an SR-IOV virtual function, in which case...

DSA-3181-1 xen - security update

Bulletin has no description...

Debian Security Advisory DSA 3181-1 (xen - security update)

Multiple security issues have been found in the Xen virtualisation solution: CVE-2015-2044 Information leak via x86 system device emulation. CVE-2015-2045 Information leak in the HYPERVISORxenversion hypercall. CVE-2015-2151 Missing input sanitising in the x86 emulator could result in information...

Moderate: Red Hat Security Advisory: ppc64-diag security, bug fix, and enhancement update

Updated ppc64-diag packages that fix two security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which giv...

RHEL 7 : libvirt (RHSA-2015:0323)

Updated libvirt packages that fix two security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Low security impact. Common Vulnerability Scoring System CVSS base scores, which give detail...

What does PCI DSS 3.1 and PA-DSS 3.1 mean for you and your organization

In the wake of the POODLE vulnerability identified by NIST and subsequent attacks, the PCI SSC has announced its intent to release the first revision of the PCI DSS 3.0 and PA-DSS 3.0 standards. The PCI DSS 3.1 and PA-DSS 3.1 standards will indicate that the SSL v3.0 protocol no longer meets the...