OracleVM 3.3 : Unbreakable / etc (OVMSA-2017-0164)

The remote OracleVM system is missing necessary patches to address critical security updates : - mqueue: fix a use-after-free in sysmqnotify Cong Wang Orabug: 26643556 CVE-2017-11176 - ipv6: avoid overflow of offset in ip6find1stfragopt Sabrina Dubroca Orabug: 27011273 CVE-2017-7542 - packet: fix...

OracleVM 3.3 / 3.4 : ntp (OVMSA-2017-0165)

The remote OracleVM system is missing necessary patches to address critical security updates : - add disable monitor to default ntp.conf CVE-2013-5211 - fix buffer overflow in datum refclock driver CVE-2017-6462 - fix crash with invalid unpeer command CVE-2017-6463 - fix potential crash with...

OracleVM 3.4 : Unbreakable / etc (OVMSA-2017-0163)

The remote OracleVM system is missing necessary patches to address critical security updates : - ipv6: avoid overflow of offset in ip6find1stfragopt Sabrina Dubroca Orabug: 27011255 CVE-2017-7542 - udp: consistently apply ufo or fragmentation Willem de Bruijn Orabug: 26921320 CVE-2017-1000112...

OracleVM 3.2 / 3.3 / 3.4 : xen (OVMSA-2017-0162)

The remote OracleVM system is missing necessary patches to address critical security updates : - BUILDINFO: OVMF commit=173bf5c847e3ca8b42c11796ce048d8e2e916ff8 - BUILDINFO: xen commit=41067cbb7a1ecab6aa2ca0d8d40a4c9f36c5e76e - BUILDINFO: QEMU upstream...

OracleVM 3.3 : xen (OVMSA-2017-0158)

The remote OracleVM system is missing necessary patches to address critical security updates : - From: Jan Beulich Subject: gnttab: also validate PTE permissions upon destroy/replace In order for PTE handling to match up with the reference counting done by common code, presence and writability of...

OracleVM 3.2 : xen (OVMSA-2017-0159)

The remote OracleVM system is missing necessary patches to address critical security updates : - The code of OVM3.2.9 is quite old, there is no getpage/putpage pair to protect the ownership and references of page table page which is mapped in emulatemapdest. This patch fix it by adding getpage in...

OracleVM 3.4 : xen (OVMSA-2017-0157)

The remote OracleVM system is missing necessary patches to address critical security updates : - BUILDINFO: OVMF commit=173bf5c847e3ca8b42c11796ce048d8e2e916ff8 - BUILDINFO: xen commit=7590623eeb64d8a8f733c24eb80818f86eb870f0 - BUILDINFO: QEMU upstream...

OracleVM 3.4 : xen (OVMSA-2017-0153)

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2017-0153 for details. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The package checks in this plugin were extracted from OracleVM Security Advisory...

OracleVM 3.4 : dnsmasq (OVMSA-2017-0160)

The remote OracleVM system is missing necessary patches to address critical security updates : - Fix CVE-2017-14491 - Resolves: 1154953 - use both SOREUSEADDR and SOREUSEPORT - Resolves: 1288617 - add missing patch file - Resolves: 1288617 - dnsmasq: Non-interactive startup might lead to 100% cpu...

OracleVM 3.4 : nss (OVMSA-2017-0154)

The remote OracleVM system is missing necessary patches to address critical security updates : - Added nss-vendor.patch to change vendor - Temporarily disable some tests until expired PayPalEE.cert is renewed - Backport patch to simplify transcript calculation for CertificateVerify %NASLMINLEVEL...

OracleVM 3.3 : nss (OVMSA-2017-0156)

The remote OracleVM system is missing necessary patches to address critical security updates : - Added nss-vendor.patch to change vendor - Temporarily disable some tests until expired PayPalEE.cert is renewed - Backport patch to simplify transcript calculation for CertificateVerify %NASLMINLEVEL...

OracleVM 3.4 : Unbreakable / etc (OVMSA-2017-0151) (BlueBorne)

The remote OracleVM system is missing necessary patches to address critical security updates : - Bluetooth: Properly check L2CAP config option output buffer length Ben Seri Orabug: 26796363 CVE-2017-1000251 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The package checks in this plugin wer...

OracleVM 3.3 : Unbreakable / etc (OVMSA-2017-0152) (BlueBorne) (Stack Clash)

The remote OracleVM system is missing necessary patches to address critical security updates : - Bluetooth: Properly check L2CAP config option output buffer length Ben Seri Orabug: 26796364 CVE-2017-1000251 - xen: fix bio vec merging Roger Pau Monne Orabug: 26645550 CVE-2017-12134 - fs/exec.c:...

OracleVM 3.3 / 3.4 : openssh (OVMSA-2017-0150)

The remote OracleVM system is missing necessary patches to address critical security updates : - Fix for CVE-2016-6210: User enumeration via covert timing channel 1357442 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The package checks in this plugin were extracted from OracleVM Security...

OracleVM 3.3 / 3.4 : poppler (OVMSA-2017-0147)

The remote OracleVM system is missing necessary patches to address critical security updates : - Resolves: rhbz1479815 CVE-2017-9776 - Don't crash on streams without Length - Resolves: 1302365 - Use better default pixel size for printing of 0 width lines - Resolves: 1316163 - Identification of...

OracleVM 3.2 : xen (OVMSA-2017-0149)

The remote OracleVM system is missing necessary patches to address critical security updates : - From e26560a4b056dad6d85ffd9ebfad9565f210a9cc Mon Sep 17 00:00:00 2001 From: Jan Beulich Date: Wed, 30 May 2012 09:22:17 +0100 Subject: PATCH gnttab: don't use domain lock for serialization Instead us...

OracleVM 3.3 : xen (OVMSA-2017-0148)

The remote OracleVM system is missing necessary patches to address critical security updates : - From: Jan Beulich Subject: gnttab: correct pin status fixup for copy Regardless of copy operations only setting GNTPINhst, GNTPINdev also need to be taken into account when deciding whether to clear...

OracleVM 3.4 : xen (OVMSA-2017-0142)

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2017-0142 for details. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The package checks in this plugin were extracted from OracleVM Security Advisory...

OracleVM 3.4 : Unbreakable / etc (OVMSA-2017-0145) (Stack Clash)

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2017-0145 for details. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The package checks in this plugin were extracted from OracleVM Security Advisory...

OracleVM 3.3 : Unbreakable / etc (OVMSA-2017-0144)

The remote OracleVM system is missing necessary patches to address critical security updates : - l2tp: fix racy SOCKZAPPED flag check in l2tpip,6bind Guillaume Nault Orabug: 26586047 CVE-2016-10200 - xfs: fix two memory leaks in xfsattrlist.c error paths Mateusz Guzik Orabug: 26586022 CVE-2016-96...