OracleVM 2.2 : xen (OVMSA-2012-0058)

The remote OracleVM system is missing necessary patches to address critical security updates : XSA-27: hvm: Limit the size of large HVM op batches orabug 15907978 CVE-2012-5511 XSA-29: add missing guest address range checks to XENMEMexchange handlers orabug 15907996 CVE-2012-5513 XSA-30: xen: fix...

OracleVM 3.1 : xen (OVMSA-2013-0041)

The remote OracleVM system is missing necessary patches to address critical security updates : - libxc: limit cpu values when setting vcpu affinity When support for pinning more than 64 cpus was added, check for cpu out-of-range values was removed. This can lead to subsequent out-of-bounds cpumap...

OracleVM 2.2 : kernel (OVMSA-2009-0033)

The remote OracleVM system is missing necessary patches to address critical security updates : - security require root for mmapminaddr Eric Paris 518142 518143 CVE-2009-2695 - md prevent crash when accessing suspend sysfs attr Danny Feng 518135 518136 CVE-2009-2849 - nfs knfsd: fix NFSv4 OEXCL...

OracleVM 3.1 : xen (OVMSA-2012-0051)

The remote OracleVM system is missing necessary patches to address critical security updates : - libxc: builder: limit maximum size of kernel/ramdisk. Allowing user supplied kernels of arbitrary sizes, especially during decompression, can swallow up dom0 memory leading to either virtual address...

OracleVM 3.3 : krb5 (OVMSA-2014-0034)

The remote OracleVM system is missing necessary patches to address critical security updates : - actually apply that last patch - incorporate fix for MITKRB5-SA-2014-001 CVE-2014-4345, 1128157 - ksu: when evaluating .k5users, don't throw away data from .k5users when we're not passed a command to...

OracleVM 3.0 : xen (OVMSA-2012-0020)

The remote OracleVM system is missing necessary patches to address critical security updates : - x86-64: detect processors subject to AMD erratum 121 and refuse to bootCVE-2006-0744 - guest denial of service on syscall/sysenter exception generation CVE-2012-0217 - Remove unnecessary balloon retri...

OracleVM 3.2 : xen (OVMSA-2014-0026)

The remote OracleVM system is missing necessary patches to address critical security updates : - x86/HVM: properly bound x2APIC MSR range This is XSA-108. Additional changelog comments added to 4.1.3-25.el5.94.1.3 CVE-2014-7188 - Fix for bug 19698532 - x86emul: only emulate software interrupt...

OracleVM 3.2 : kernel-uek (OVMSA-2013-0015)

The remote OracleVM system is missing necessary patches to address critical security updates : - x86/xen: don't assume %ds is usable in xeniret for 32-bit PVOPS. Chuck Anderson Orabug: 16325076 CVE-2013-0228 XSA-42 CVE-2013-0190 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The package...

OracleVM 3.3 : xen (OVMSA-2014-0038) (POODLE)

The remote OracleVM system is missing necessary patches to address critical security updates : - xend: disable sslv3 due to CVE-2014-3566 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The package checks in this plugin were extracted from OracleVM Security Advisory OVMSA-2014-0038...

OracleVM 2.2 : xen (OVMSA-2012-0022)

The remote OracleVM system is missing necessary patches to address critical security updates : - CVE-2012-0217 CVE-2012-0218: guest DoS on syscall/sysenter exception generation orabug 13993157 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The package checks in this plugin were extracted fr...

OracleVM 3.1 : xen (OVMSA-2013-0037)

The remote OracleVM system is missing necessary patches to address critical security updates : - VT-d: don't permit SVTNOVERIFY entries for known device types Only in cases where we don't know what to do we should leave the IRTE blank suppressing all validation, but we should always log a warning...

OracleVM 2.1 : ipsec-tools (OVMSA-2009-0010)

The remote OracleVM system is missing necessary patches to address critical security updates : CVE-2009-1574 racoon/isakmpfrag.c in ipsec-tools before 0.7.2 allows remote attackers to cause a denial of service crash via crafted fragmented packets without a payload, which triggers a NULL pointer...

OracleVM 2.1 : curl (OVMSA-2009-0019)

The remote OracleVM system is missing necessary patches to address critical security updates : - fix CVE-2009-2417 516257 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The package checks in this plugin were extracted from OracleVM Security Advisory OVMSA-2009-0019...

OracleVM 2.1 : xen (OVMSA-2008-2003)

The remote OracleVM system is missing necessary patches to address critical security updates : - Disable QEMU image format auto-detection CVE-2008-2004 - Fix PVFB to validate frame buffer description - Fix PVFB to cope with bogus update requests - Fix QEMU buffer overflow CVE-2007-5730 - Fix QEMU...

OracleVM 2.1 : krb5 (OVMSA-2009-0003)

The remote OracleVM system is missing necessary patches to address critical security updates : CVE-2009-0844 The getinputtoken function in the SPNEGO implementation in MIT Kerberos 5 aka krb5 1.5 through 1.6.3 allows remote attackers to cause a denial of service daemon crash and possibly obtain...

OracleVM 2.2 : openssl (OVMSA-2014-0007)

The remote OracleVM system is missing necessary patches to address critical security updates : - fix for CVE-2014-0224 - SSL/TLS MITM vulnerability - replace expired GlobalSign Root CA certificate in ca-bundle.crt - fix for CVE-2013-0169 - SSL/TLS CBC timing attack 907589 - fix for CVE-2013-0166 ...

OracleVM 3.1 : xen (OVMSA-2013-0032)

The remote OracleVM system is missing necessary patches to address critical security updates : - defer event channel bucket pointer store until after XSM checks Otherwise a dangling pointer can be left, which would cause subsequent memory corruption as soon as the space got re-allocated for some...

OracleVM 2.2 : acpid (OVMSA-2009-0037)

The remote OracleVM system is missing necessary patches to address critical security updates : - Resolves: 515062 CVE-2009-4033 acpid: log file created with random permissions - start acpid before hal - Resolves: 503177 - Updated the License entry - Fixed CVE-2009-0798 too many open files DoS -...

OracleVM 2.2 : ovs-agent (OVMSA-2014-0029)

The remote OracleVM system is missing necessary patches to address critical security updates : - disable sslv3 in ovs-agent orabug 19893287 - Remove changing manualshutdown value when doing syncvmstatus function orabug 16682111 - A test 2.3-88 version for bug 16695624, improve the log of startvm...

OracleVM 3.2 : xen (OVMSA-2013-0059)

The remote OracleVM system is missing necessary patches to address critical security updates : - x86: fix page refcount handling in page table pin error path In the original patch 7 of the series addressing XSA-45 I mistakenly took the addition of the call to getpagelight in allocpagetype to cove...