OracleVM 2.2 : xen (OVMSA-2012-0058)

The remote OracleVM system is missing necessary patches to address critical security updates : XSA-27: hvm: Limit the size of large HVM op batches orabug 15907978 CVE-2012-5511 XSA-29: add missing guest address range checks to XENMEMexchange handlers orabug 15907996 CVE-2012-5513 XSA-30: xen: fix...

OracleVM 2.2 : xen (OVMSA-2013-0092)

The remote OracleVM system is missing necessary patches to address critical security updates : - x86/AMD: work around erratum 793 XSA-82 Jan Beulich 17884839 CVE-2013-6885 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The package checks in this plugin were extracted from OracleVM Security...

OracleVM 3.1 : xen (OVMSA-2013-0032)

The remote OracleVM system is missing necessary patches to address critical security updates : - defer event channel bucket pointer store until after XSM checks Otherwise a dangling pointer can be left, which would cause subsequent memory corruption as soon as the space got re-allocated for some...

OracleVM 3.3 : xen (OVMSA-2014-0025)

The remote OracleVM system is missing necessary patches to address critical security updates : - x86/HVM: properly bound x2APIC MSR range This is XSA-108. Additional changelog comments added to 4.3.0-55.el6.0.0.3 CVE-2014-7188 - Fix for bug 19698535 - x86emul: only emulate software interrupt...

OracleVM 2.2 : xen (OVMSA-2013-0033)

The remote OracleVM system is missing necessary patches to address critical security updates : - fix error in first version of the XSA-44 patch Chuck Anderson orabug 16632878, 16694867 CVE-2013-1917 - clear EFLAGS.NT in SYSENTER entry path Andrew Cooper orabug 16632878 CVE-2013-1917 - fix various...

OracleVM 3.1 : xen (OVMSA-2014-0002)

The remote OracleVM system is missing necessary patches to address critical security updates : - flask: restrict allocations done by hypercall interface Other than in 4.2 and newer, we're not having an overflow issue here, but uncontrolled exposure of the operations opens the host to be driven ou...

OracleVM 3.1 : xen (OVMSA-2013-0087)

The remote OracleVM system is missing necessary patches to address critical security updates : - x86/HVM: only allow ring 0 guest code to make hypercalls Anything else would allow for privilege escalation. This is CVE-2013-4554 / XSA-76. CVE-2013-4554 - x86: restrict XENDOMCTLgetmemlist Coverity ...

OracleVM 3.1 : xen (OVMSA-2013-0057)

The remote OracleVM system is missing necessary patches to address critical security updates : - x86: fix page refcount handling in page table pin error path In the original patch 7 of the series addressing XSA-45 I mistakenly took the addition of the call to getpagelight in allocpagetype to cove...

OracleVM 3.1 : xen (OVMSA-2013-0009)

The remote OracleVM system is missing necessary patches to address critical security updates : - oxenstored incorrect handling of certain Xenbus ring states Xen Security Advisory 38 CVE-2013-0215 Patch xsa38.patch The oxenstored daemon the ocaml version of the xenstore daemon does not correctly...

OracleVM 3.2 : xen (OVMSA-2013-0042)

The remote OracleVM system is missing necessary patches to address critical security updates : - Other than the HVM emulation path, the PV case so far failed to check that YMM state requires SSE state to be enabled, allowing for a GP to occur upon passing the inputs to XSETBV inside the hyperviso...

OracleVM 3.2 : xen (OVMSA-2013-0090)

The remote OracleVM system is missing necessary patches to address critical security updates : - x86/AMD: work around erratum 793 The recommendation is to set a bit in an MSR - do this if the firmware didn't, considering that otherwise we expose ourselves to a guest induced DoS. This is...

SuSE 11.3 Security Update : Xen (SAT Patch Number 9828)

The SUSE Linux Enterprise 11 Service Pack 3 Xen package was updated to fix various bugs and security issues. The following security issues have been fixed : - XSA-108: CVE-2014-7188: Improper MSR range used for x2APIC emulation. bnc897657 - XSA-106: CVE-2014-7156: Missing privilege level checks i...

Fedora 20 : xen-4.3.3-3.fc20 (2014-12036)

Improper MSR range used for x2APIC emulation XSA-108, CVE-2014-7188 Race condition in HVMOPtrackdirtyvram XSA-104 1145736 Missing privilege level checks in x86 HLT, LGDT, LIDT, and LMSW emulation XSA-105 1145737 Missing privilege level checks in x86 emulation of software interrupts XSA-106 114573...

Fedora 19 : xen-4.2.5-3.fc19 (2014-12000)

Improper MSR range used for x2APIC emulation XSA-108, CVE-2014-7188 Race condition in HVMOPtrackdirtyvram XSA-104 1145736 Missing privilege level checks in x86 HLT, LGDT, LIDT, and LMSW emulation XSA-105 1145737 Missing privilege level checks in x86 emulation of software interrupts XSA-106 114573...

openSUSE Security Update : xen (openSUSE-SU-2014:1281-1)

XEN was updated to fix security issues and bugs. Security issues fixed : - bnc897657 - CVE-2014-7188: XSA-108 Improper MSR range used for x2APIC emulation - bnc895802 - CVE-2014-7156: XSA-106: Missing privilege level checks in x86 emulation of software interrupts - bnc895799 - CVE-2014-7155:...

openSUSE Security Update : xen (openSUSE-SU-2014:1279-1)

XEN was updated to fix various bugs and security issues. Security issues fixed : - bnc897657 - CVE-2014-7188: XSA-108 Improper MSR range used for x2APIC emulation - bnc895802 - CVE-2014-7156: XSA-106: Missing privilege level checks in x86 emulation of software interrupts - bnc895799 -...

xen: security and bugfix update (important)

XEN was updated to fix security issues and bugs. Security issues fixed: - bnc897657 - CVE-2014-7188: XSA-108 Improper MSR range used for x2APIC emulation - bnc895802 - CVE-2014-7156: XSA-106: Missing privilege level checks in x86 emulation of software interrupts - bnc895799 - CVE-2014-7155:...

Fedora 19 : xen-4.2.4-7.fc19 (2014-9493)

Long latency virtual-mmu operations are not preemptible XSA-97, CVE-2014-5146 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without...

Fedora 20 : xen-4.3.2-7.fc20 (2014-9472)

Long latency virtual-mmu operations are not preemptible XSA-97, CVE-2014-5146 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without...

CVE-2014-4021

Xen 3.2.x through 4.4.x does not properly clean memory pages recovered from guests, which allows local guest OS users to obtain sensitive information via unspecified vectors...