OracleVM 2.1 : newt (OVMSA-2009-0026)

The remote OracleVM system is missing necessary patches to address critical security updates : - fix buffer overflow in textbox when reflowing 524618, CVE-2009-2905 - add release to -devel requires - escape macros in changelog - add support for tuples of strings in EntryWindow prompts in snack...

OracleVM 2.1 : kernel (OVMSA-2009-0004)

The remote OracleVM system is missing necessary patches to address critical security updates : CVE-2008-3528 The error-reporting functionality in 1 fs/ext2/dir.c, 2 fs/ext3/dir.c, and possibly 3 fs/ext4/dir.c in the Linux kernel 2.6.26.5 does not limit the number of printk console messages that...

OracleVM 3.2 : openssl (OVMSA-2014-0039) (POODLE)

The remote OracleVM system is missing necessary patches to address critical security updates : - add support for fallback SCSV to partially mitigate CVE-2014-3566 padding attack on SSL3 - fix CVE-2014-0221 - recursion in DTLS code leading to DoS - fix CVE-2014-3505 - doublefree in DTLS packet...

OracleVM 2.1 : kernel (OVMSA-2008-2005)

The remote OracleVM system is missing necessary patches to address critical security updates : - fix utrace deadengine ops race - fix ptraceattach leak - CVE-2007-5093: kernel PWC driver DoS - CVE-2007-6282: IPSec ESP kernel panics - CVE-2007-6712: kernel: infinite loop in highres timers kernel...

OracleVM 2.1 : kernel (OVMSA-2008-2002)

The remote OracleVM system is missing necessary patches to address critical security updates : - x8664 kernel vmsplicetopipe flaw Alexander Viro 432252 CVE-2008-0600 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The package checks in this plugin were extracted from OracleVM Security Adviso...

OracleVM 3.2 : kernel-uek (OVMSA-2013-0015)

The remote OracleVM system is missing necessary patches to address critical security updates : - x86/xen: don't assume %ds is usable in xeniret for 32-bit PVOPS. Chuck Anderson Orabug: 16325076 CVE-2013-0228 XSA-42 CVE-2013-0190 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The package...

OracleVM 3.1 : xen (OVMSA-2013-0037)

The remote OracleVM system is missing necessary patches to address critical security updates : - VT-d: don't permit SVTNOVERIFY entries for known device types Only in cases where we don't know what to do we should leave the IRTE blank suppressing all validation, but we should always log a warning...

OracleVM 3.2 : xen (OVMSA-2013-0056)

The remote OracleVM system is missing necessary patches to address critical security updates : - x86: fix page refcount handling in page table pin error path In the original patch 7 of the series addressing XSA-45 I mistakenly took the addition of the call to getpagelight in allocpagetype to cove...

OracleVM 2.1 : xen (OVMSA-2008-2007)

The remote OracleVM system is missing necessary patches to address critical security updates : - CVE-2008-1945: add image format options for USB storage and removable media - CVE-2008-1952: included in fix for CVE-2008-1943 3.1.4-0.1.3.el5 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

OracleVM 2.2 : xen (OVMSA-2013-0033)

The remote OracleVM system is missing necessary patches to address critical security updates : - fix error in first version of the XSA-44 patch Chuck Anderson orabug 16632878, 16694867 CVE-2013-1917 - clear EFLAGS.NT in SYSENTER entry path Andrew Cooper orabug 16632878 CVE-2013-1917 - fix various...

OracleVM 3.3 : libXfont (OVMSA-2014-0080)

The remote OracleVM system is missing necessary patches to address critical security updates : - CVE-2014-0209: integer overflow of allocations in font metadata file parsing bug 1163602, bug 1163601 - CVE-2014-0210: unvalidated length fields when parsing xfs protocol replies bug 1163602, bug...

OracleVM 3.1 : xen (OVMSA-2013-0071)

The remote OracleVM system is missing necessary patches to address critical security updates : - Rebuild correcting changelog - x86: properly set up fbld emulation operand address This is XSA-66. CVE-2013-4361 - x86: properly handle hvmcopyfromguestphys,virt errors Ignoring them generally implies...

OracleVM 3.2 : xen (OVMSA-2013-0085)

The remote OracleVM system is missing necessary patches to address critical security updates : - x86/HVM: only allow ring 0 guest code to make hypercalls Anything else would allow for privilege escalation. This is CVE-2013-4554 / XSA-76. CVE-2013-4554 - x86: restrict XENDOMCTLgetmemlist Coverity ...

OracleVM 3.3 : wget (OVMSA-2014-0036)

The remote OracleVM system is missing necessary patches to address critical security updates : - Fix CVE-2014-4877 wget: FTP symlink arbitrary filesystem access 1156133 - Fix the parsing of weblink when doing recursive retrieving 960137 - Fix errors found by static analysis of source code 873216 ...

OracleVM 3.3 : glibc (OVMSA-2014-0017)

The remote OracleVM system is missing necessary patches to address critical security updates : - Remove gconv transliteration loadable modules support CVE-2014-5119, - nlfindlocale: Improve handling of crafted locale names CVE-2014-0475, - Don't use alloca in addgetnetgrentX 1087789. - Adjust...

OracleVM 2.1 : libtiff (OVMSA-2009-0027)

The remote OracleVM system is missing necessary patches to address critical security updates : - Fix buffer overrun risks caused by unchecked integer overflow CVE-2009-2347 Resolves: 507725 - Fix some more LZW decoding vulnerabilities CVE-2009-2285 Resolves: 507725 - Update upstream URL - Use...

OracleVM 3.2 : xen (OVMSA-2014-0041) (POODLE)

The remote OracleVM system is missing necessary patches to address critical security updates : - xend: disable sslv3 due to CVE-2014-3566 - Keep the maxmem and memory same in vm.cfg Singed-off-by: Annie Li %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The package checks in this plugin were...

OracleVM 3.0 : xen (OVMSA-2013-0002)

The remote OracleVM system is missing necessary patches to address critical security updates : - VT-d: fix interrupt remapping source validation for devices behind legacy bridges Using SVTVERIFYBUS here doesn't make sense native Linux also uses SVTVERIFYSIDSQ here instead. CVE-2012-5634...

OracleVM 2.2 : xen (OVMSA-2013-0088)

The remote OracleVM system is missing necessary patches to address critical security updates : - x86/HVM: only allow ring 0 guest code to make hypercalls XSA-76 Jan Beulich 17822325 CVE-2013-4554 - x86: restrict XENDOMCTLgetmemlist XSA-74 Jan Beulich 17821907 CVE-2013-4553 - gnttab: correct locki...

OracleVM 3.1 : xen (OVMSA-2013-0087)

The remote OracleVM system is missing necessary patches to address critical security updates : - x86/HVM: only allow ring 0 guest code to make hypercalls Anything else would allow for privilege escalation. This is CVE-2013-4554 / XSA-76. CVE-2013-4554 - x86: restrict XENDOMCTLgetmemlist Coverity ...