OracleVM 3.3 : nss (OVMSA-2014-0023)

The remote OracleVM system is missing necessary patches to address critical security updates : nss - Added nss-vendor.patch to change vendor - Replace expired PayPal test certificate that breaks the build - Resolves: Bug 1145431 - CVE-2014-1568 - Resolves: Bug 1145431 - CVE-2014-1568 - Removed...

OracleVM 2.2 : xen (OVMSA-2013-0075)

The remote OracleVM system is missing necessary patches to address critical security updates : - x86: check segment descriptor read result in 64-bit OUTS emulation XSA-67 Matthew Daley orabug 17571623 CVE-2013-4368 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The package checks in this...

OracleVM 2.2 : xen (OVMSA-2012-0036)

The remote OracleVM system is missing necessary patches to address critical security updates : - CVE-2012-3432 / XSA-10: HVM guest user mode MMIO emulation DoS vulnerability orabug 14463558 CVE-2012-3432 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The package checks in this plugin were...

OracleVM 3.1 : xen (OVMSA-2013-0032)

The remote OracleVM system is missing necessary patches to address critical security updates : - defer event channel bucket pointer store until after XSM checks Otherwise a dangling pointer can be left, which would cause subsequent memory corruption as soon as the space got re-allocated for some...

OracleVM 3.3 : nss (OVMSA-2014-0014)

The remote OracleVM system is missing necessary patches to address critical security updates : - Added nss-vendor.patch to change vendor - Update some patches on account of the rebase - Resolves: Bug 1099619 - Backport nss-3.12.6 upstream fix required by Firefox 31 - Resolves: Bug 1099619 - Remov...

OracleVM 2.2 : xen (OVMSA-2013-0092)

The remote OracleVM system is missing necessary patches to address critical security updates : - x86/AMD: work around erratum 793 XSA-82 Jan Beulich 17884839 CVE-2013-6885 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The package checks in this plugin were extracted from OracleVM Security...

OracleVM 3.2 : xen (OVMSA-2013-0070)

The remote OracleVM system is missing necessary patches to address critical security updates : - x86: properly set up fbld emulation operand address This is XSA-66. CVE-2013-4361 - x86: properly handle hvmcopyfromguestphys,virt errors Ignoring them generally implies using uninitialized data and, ...

OracleVM 2.1 : kernel (OVMSA-2009-0017)

The remote OracleVM system is missing necessary patches to address critical security updates : CVE-2009-1895 The personality subsystem in the Linux kernel before 2.6.31-rc3 has a PERCLEARONSETID setting that does not clear the ADDRCOMPATLAYOUT and MMAPPAGEZERO flags when executing a setuid or...

OracleVM 2.2 : xen (OVMSA-2014-0028)

The remote OracleVM system is missing necessary patches to address critical security updates : - Backport xend: disable sslv3 due to CVE-2014-356 19831405 - libxc: Support set affinity for more than 64 CPUs 18938789 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The package checks in this...

OracleVM 2.2 : xen (OVMSA-2013-0074)

The remote OracleVM system is missing necessary patches to address critical security updates : - x86: check segment descriptor read result in 64-bit OUTS emulation XSA-67 Matthew Daley orabug 17571640 CVE-2013-4368 - x86: properly set up fbld emulation operand address XSA-66 Jan Beulich orabug...

OracleVM 2.1 : xen (OVMSA-2008-2003)

The remote OracleVM system is missing necessary patches to address critical security updates : - Disable QEMU image format auto-detection CVE-2008-2004 - Fix PVFB to validate frame buffer description - Fix PVFB to cope with bogus update requests - Fix QEMU buffer overflow CVE-2007-5730 - Fix QEMU...

OracleVM 3.2 : kernel-uek (OVMSA-2013-0003)

The remote OracleVM system is missing necessary patches to address critical security updates : - bonding: fixup typo in rlb mode of bond and bridge fix Guru Anbalagane Orabug: 16069448 - bonding: rlb mode of bond should not alter ARP originating via bridge zheng.li Orabug: 14650975 - compilation...

OracleVM 3.1 : xen (OVMSA-2012-0046)

The remote OracleVM system is missing necessary patches to address critical security updates : - Xen Security Advisory CVE-2012-4411 / XSA-19 version 2 guest administrator can access qemu monitor console Disable qemu monitor by default. The qemu monitor is an overly powerful feature which must be...

OracleVM 2.2 : xen (OVMSA-2011-0007)

The remote OracleVM system is missing necessary patches to address critical security updates : - Integer overflows and lack of checking of length fields CVE-2011-1583 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The package checks in this plugin were extracted from OracleVM Security...

OracleVM 3.2 : ovs-agent (OVMSA-2014-0037) (POODLE)

The remote OracleVM system is missing necessary patches to address critical security updates : - disable sslv3 due to CVE-2014-3566 - Allow to create more than 6 bonds Singed-off-by: Adnan Misherfi %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The package checks in this plugin were extract...

OracleVM 3.1 : xen (OVMSA-2013-0091)

The remote OracleVM system is missing necessary patches to address critical security updates : - x86/AMD: work around erratum 793 The recommendation is to set a bit in an MSR - do this if the firmware didn't, considering that otherwise we expose ourselves to a guest induced DoS. This is...

OracleVM 3.2 : onpenssl (OVMSA-2014-0008)

The remote OracleVM system is missing necessary patches to address critical security updates : - fix for CVE-2014-0224 - SSL/TLS MITM vulnerability - replace expired GlobalSign Root CA certificate in ca-bundle.crt - fix for CVE-2013-0169 - SSL/TLS CBC timing attack 907589 - fix for CVE-2013-0166 ...

OracleVM 2.2 : openssl (OVMSA-2014-0040) (POODLE)

The remote OracleVM system is missing necessary patches to address critical security updates : - add support for fallback SCSV to partially mitigate CVE-2014-3566 padding attack on SSL3 - fix CVE-2014-0221 - recursion in DTLS code leading to DoS - fix CVE-2014-3505 - doublefree in DTLS packet...

OracleVM 3.1 : xen (OVMSA-2012-0034)

The remote OracleVM system is missing necessary patches to address critical security updates : - Xen Security Advisory CVE-2012-3433 / XSA-11 HVM guest destroy p2m teardown host DoS vulnerability An HVM guest is able to manipulate its physical address space such that tearing down the guest takes ...

OracleVM 2.1 : xen (OVMSA-2008-2007)

The remote OracleVM system is missing necessary patches to address critical security updates : - CVE-2008-1945: add image format options for USB storage and removable media - CVE-2008-1952: included in fix for CVE-2008-1943 3.1.4-0.1.3.el5 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...