OracleVM 3.3 : glibc (OVMSA-2014-0033)

The remote OracleVM system is missing necessary patches to address critical security updates : - Remove gconv transliteration loadable modules support CVE-2014-5119, - nlfindlocale: Improve handling of crafted locale names CVE-2014-0475, - Switch gettimeofday from INTUSE to libchiddenproto 109902...

OracleVM 3.3 : nss-util (OVMSA-2014-0015)

The remote OracleVM system is missing necessary patches to address critical security updates : - Update to nss-3.16.1 - Resolves: rhbz1112136 - Update to NSS3153RTM - Resolves: rhbz1032470 - CVE-2013-5605 CVE-2013-5606 CVE-2013-1741 - Preserve existing permissions when replacing existing pkcs11.t...

OracleVM 2.1 : freetype (OVMSA-2009-0012)

The remote OracleVM system is missing necessary patches to address critical security updates : CVE-2009-0946 Multiple integer overflows in FreeType 2.3.9 and earlier allow remote attackers to execute arbitrary code via vectors related to large values in certain inputs in 1 smooth/ftsmooth.c, 2...

OracleVM 3.2 : xen (OVMSA-2013-0085)

The remote OracleVM system is missing necessary patches to address critical security updates : - x86/HVM: only allow ring 0 guest code to make hypercalls Anything else would allow for privilege escalation. This is CVE-2013-4554 / XSA-76. CVE-2013-4554 - x86: restrict XENDOMCTLgetmemlist Coverity ...

OracleVM 3.1 : xen (OVMSA-2013-0071)

The remote OracleVM system is missing necessary patches to address critical security updates : - Rebuild correcting changelog - x86: properly set up fbld emulation operand address This is XSA-66. CVE-2013-4361 - x86: properly handle hvmcopyfromguestphys,virt errors Ignoring them generally implies...

OracleVM 2.1 : libtiff (OVMSA-2009-0027)

The remote OracleVM system is missing necessary patches to address critical security updates : - Fix buffer overrun risks caused by unchecked integer overflow CVE-2009-2347 Resolves: 507725 - Fix some more LZW decoding vulnerabilities CVE-2009-2285 Resolves: 507725 - Update upstream URL - Use...

OracleVM 3.3 : wget (OVMSA-2014-0036)

The remote OracleVM system is missing necessary patches to address critical security updates : - Fix CVE-2014-4877 wget: FTP symlink arbitrary filesystem access 1156133 - Fix the parsing of weblink when doing recursive retrieving 960137 - Fix errors found by static analysis of source code 873216 ...

OracleVM 3.1 : xen (OVMSA-2013-0041)

The remote OracleVM system is missing necessary patches to address critical security updates : - libxc: limit cpu values when setting vcpu affinity When support for pinning more than 64 cpus was added, check for cpu out-of-range values was removed. This can lead to subsequent out-of-bounds cpumap...

OracleVM 3.0 : xen (OVMSA-2013-0002)

The remote OracleVM system is missing necessary patches to address critical security updates : - VT-d: fix interrupt remapping source validation for devices behind legacy bridges Using SVTVERIFYBUS here doesn't make sense native Linux also uses SVTVERIFYSIDSQ here instead. CVE-2012-5634...

OracleVM 3.1 : xen (OVMSA-2012-0051)

The remote OracleVM system is missing necessary patches to address critical security updates : - libxc: builder: limit maximum size of kernel/ramdisk. Allowing user supplied kernels of arbitrary sizes, especially during decompression, can swallow up dom0 memory leading to either virtual address...

OracleVM 2.1 : xen (OVMSA-2009-0031)

The remote OracleVM system is missing necessary patches to address critical security updates : - Add grub.conf password protection support to pygrub rhbz 525142 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The package checks in this plugin were extracted from OracleVM Security Advisory...

OracleVM 3.2 : xen (OVMSA-2013-0031)

The remote OracleVM system is missing necessary patches to address critical security updates : - defer event channel bucket pointer store until after XSM checks Otherwise a dangling pointer can be left, which would cause subsequent memory corruption as soon as the space got re-allocated for some...

OracleVM 3.1 : xen (OVMSA-2013-0087)

The remote OracleVM system is missing necessary patches to address critical security updates : - x86/HVM: only allow ring 0 guest code to make hypercalls Anything else would allow for privilege escalation. This is CVE-2013-4554 / XSA-76. CVE-2013-4554 - x86: restrict XENDOMCTLgetmemlist Coverity ...

OracleVM 3.3 : cups (OVMSA-2014-0035)

The remote OracleVM system is missing necessary patches to address critical security updates : - Revert change to whitelist /rss/ resources, as this was not used upstream. - More STR 4461 fixes from upstream: make rss feeds world-readable, but cachedir private. - Fix icon display in web interface...

OracleVM 2.1 : kernel (OVMSA-2009-0009)

The remote OracleVM system is missing necessary patches to address critical security updates : CVE-2008-4307 Race condition in the dosetlk function in fs/nfs/file.c in the Linux kernel before 2.6.26 allows local users to cause a denial of service crash via vectors resulting in an interrupted RPC...

OracleVM 3.3 : xen (OVMSA-2014-0025)

The remote OracleVM system is missing necessary patches to address critical security updates : - x86/HVM: properly bound x2APIC MSR range This is XSA-108. Additional changelog comments added to 4.3.0-55.el6.0.0.3 CVE-2014-7188 - Fix for bug 19698535 - x86emul: only emulate software interrupt...

OracleVM 2.1 : elinks (OVMSA-2009-0030)

The remote OracleVM system is missing necessary patches to address critical security updates : - fix 235411 - CVE-2007-2027 - elinks tries to load .po files from non-absolute path - fix 523258 - CVE-2008-7224 - entitycache static array buffer overflow %NASLMINLEVEL 70300 C Tenable Network Securit...

OracleVM 2.1 : curl (OVMSA-2009-0019)

The remote OracleVM system is missing necessary patches to address critical security updates : - fix CVE-2009-2417 516257 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The package checks in this plugin were extracted from OracleVM Security Advisory OVMSA-2009-0019...

OracleVM 2.1 : ntp (OVMSA-2009-0011)

The remote OracleVM system is missing necessary patches to address critical security updates : CVE-2009-0159 Stack-based buffer overflow in the cookedprint function in ntpq/ntpq.c in ntpq in NTP before 4.2.4p7-RC2 allows remote NTP servers to execute arbitrary code via a crafted response...

OracleVM 2.1 : kernel (OVMSA-2009-0023)

The remote OracleVM system is missing necessary patches to address critical security updates : - backport for online resize of blockdev orabug 8585251 rh bugz 444964 - CVE-2009-2692 - net make socksendpage use kernelsendpage Jiri Pirko 517445 516955 - CVE-2009-2698 - net prevent null pointer...