OracleVM 2.2 : xen (OVMSA-2013-0092)

The remote OracleVM system is missing necessary patches to address critical security updates : - x86/AMD: work around erratum 793 XSA-82 Jan Beulich 17884839 CVE-2013-6885 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The package checks in this plugin were extracted from OracleVM Security...

OracleVM 3.1 : xen (OVMSA-2013-0091)

The remote OracleVM system is missing necessary patches to address critical security updates : - x86/AMD: work around erratum 793 The recommendation is to set a bit in an MSR - do this if the firmware didn't, considering that otherwise we expose ourselves to a guest induced DoS. This is...

OracleVM 3.1 : xen (OVMSA-2012-0021)

The remote OracleVM system is missing necessary patches to address critical security updates : - x86-64: detect processors subject to AMD erratum 121 and refuse to bootCVE-2006-0744 - guest denial of service on syscall/sysenter exception generation CVE-2012-0217,CVE-2012-0218 - Remove unnecessary...

firefox security update

CentOS Errata and Security Advisory CESA-2014:0310 Updated firefox packages that fix several security issues are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having Critical security impact. Common Vulnerability Scoring System CVS...

hw: AMD CPU erratum may cause core hang

The microcode on AMD 16h 00h through 0Fh processors does not properly handle the interaction between locked instructions and write-combined memory types, which allows local users to cause a denial of service system hang via a crafted application, aka the errata 793 issue...

Fedora 18 : xen-4.2.3-11.fc18 (2013-22866)

HVM guest triggerable AMD CPU erratum may cause host hang XSA-82, CVE-2013-6885 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without...

Guest triggerable AMD CPU erratum may cause host hang

ISSUE DESCRIPTION AMD CPU erratum 793 "Specific Combination of Writes to Write Combined Memory Types and Locked Instructions May Cause Core Hang" describes a situation under which a CPU core may hang. IMPACT A malicious guest administrator can mount a denial of service attack affecting the whole...

firefox, xulrunner security update

CentOS Errata and Security Advisory CESA-2013:1140 Updated firefox packages that fix several security issues are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System CVS...

Oracle Linux 3 : krb5 (ELSA-2007-0384)

From Red Hat Security Advisory 2007:0384 : Updated krb5 packages that fix several security flaws are now available for Red Hat Enterprise Linux 2.1 and 3. This update has been rated as having critical security impact by the Red Hat Security Response Team. Kerberos is a network authentication syst...

Oracle Linux 4 : squirrelmail (ELSA-2006-0668)

From Red Hat Security Advisory 2006:0668 : A new squirrelmail package that fixes a security issue as well as several bugs is now available for Red Hat Enterprise Linux 3 and 4. This update has been rated as having moderate security impact by the Red Hat Security Response Team. SquirrelMail is a...

Oracle Linux 3 : kernel (ELSA-2007-0436)

From Red Hat Security Advisory 2007:0436 : Updated kernel packages are now available as part of ongoing support and maintenance of Red Hat Enterprise Linux version 3. This is the ninth regular update. This security advisory has been rated as having important security impact by the Red Hat Securit...

Oracle Linux 3 / 4 : seamonkey (ELSA-2007-0722)

From Red Hat Security Advisory 2007:0722 : Updated SeaMonkey packages that fix several security bugs are now available for Red Hat Enterprise Linux 2.1, 3, and 4. This update has been rated as having critical security impact by the Red Hat Security Response Team. SeaMonkey is an open source Web...

Oracle Linux 5 : kernel (ELSA-2012-1061)

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2012-1061 advisory. - xen x8664: check address on trap handlers or guest callbacks Paolo Bonzini 813430 813431 CVE-2012-0217 - xen x8664: Do not execute sysret with a non-canonical...

Oracle Linux 4 : file (ELSA-2007-0124)

From Red Hat Security Advisory 2007:0124 : An updated file package that fixes a security flaw is now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The file command is used to identify a particul...

PV guest host Denial of Service

ISSUE DESCRIPTION A Xen user has discovered that some older AMD CPUs can be made to lock up due to AMD processor erratum 121. This issue was discovered during testing of the fix for XSA-7 CVE-2012-0217. Although the two issues are unrelated the situations which can trigger them may overlap...

Fedora 7 : yelp-2.18.1-4.fc7 (2007-0009)

Updated firefox packages that fix several security bugs are now available for Fedora Core 7. Users of yelp are advised to upgrade to these erratum packages which contain a version of yelp built against a firefox version not vulnerable to these flaws. Note that Tenable Network Security has extract...

Scientific Linux Security Update : python on SL5.x i386/x86_64 (20120618)

Python is an interpreted, interactive, object-oriented programming language. A denial of service flaw was found in the implementation of associative arrays dictionaries in Python. An attacker able to supply a large number of inputs to a Python application such as HTTP POST request parameters sent...

Scientific Linux Security Update : seamonkey on SL4.x i386/x86_64

This erratum blacklists a small number of HTTPS certificates. BZ689430 After installing the update, SeaMonkey must be restarted for the changes to take effect. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'deprecatednasllevel.inc';...

Debian DSA-2501-1 : xen - several vulnerabilities

Several vulnerabilities were discovered in Xen, a hypervisor. - CVE-2012-0217 Xen does not properly handle uncanonical return addresses on Intel amd64 CPUs, allowing amd64 PV guests to elevate to hypervisor privileges. AMD processors, HVM and i386 guests are not affected. - CVE-2012-0218 Xen does...

SuSE 10 Security Update : Xen (ZYPP Patch Number 8180)

Three security issues were found in XEN. Two security issues are fixed by this update : - Due to incorrect fault handling in the XEN hypervisor it was possible for a XEN guest domain administrator to execute code in the XEN host environment. CVE-2012-0217 - Also a guest user could crash the guest...