[SECURITY] [DSA 3181-1] xen security update

2015-03-15T00:00:00
ID SECURITYVULNS:DOC:31784
Type securityvulns
Reporter Securityvulns
Modified 2015-03-15T00:00:00

Description

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1


Debian Security Advisory DSA-3181-1 security@debian.org http://www.debian.org/security/ Moritz Muehlenhoff March 10, 2015 http://www.debian.org/security/faq


Package : xen CVE ID : CVE-2015-2044 CVE-2015-2045 CVE-2015-2151

Multiple security issues have been found in the Xen virtualisation solution:

CVE-2015-2044

Information leak via x86 system device emulation.

CVE-2015-2045

Information leak in the HYPERVISOR_xen_version() hypercall.

CVE-2015-2151

Missing input sanitising in the x86 emulator could result in
information disclosure, denial of service or potentially
privilege escalation.

In addition the Xen developers reported an unfixable limitation in the handling of non-standard PCI devices. Please refer to http://xenbits.xen.org/xsa/advisory-124.html for further information.

For the stable distribution (wheezy), these problems have been fixed in version 4.1.4-3+deb7u5.

For the unstable distribution (sid), these problems will be fixed soon.

We recommend that you upgrade your xen packages.

Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE----- Version: GnuPG v1

iQIcBAEBAgAGBQJU/1Z2AAoJEBDCk7bDfE42jMwP/3l+iMp668MaGgtkz3bMmAvK H9kx7CPmmUt1RYQmsYorzEV/AvxcN9sWTaqCBVwRe+Bq1H232Np3u4OT2p9o6riA JlKn1KA+V7GA3IC2rFBPCKN9YeMviD9JaZF3Kis1Ey5QOLOZfhsZpmw0IL/Lqv9S Z0zry7QTZtzCskgXBR6MpplcwC/X9zJ1lkOkf45cYfp2Vus/3INSR0WpjW9Vy69Y eCCJzNapCRRj3AZw7dydalq03dm0ODTdGKjq+coKIbUp/hHtkHdZ8N4xgqDEohtY A28ndBVw/WZP1AdandNGGPTPnADv32gMrToOhmAjOIIDq4r7oDA4L4oDOOKZBgT4 Nju7nJWqypO+SaRPdt9dYom+0lnfPZkeqCy8uSmougFUZAj+AqdwCbGi7HIMU2Jd J01X7xoR6JOklFQTMHxhdloYt7S3ysNbARC2mC1kCLrwOEvN9F/rcaj/kt4M3QpW j3cx7EUIbA100kj8uHV+uJJfx4wMYWhMEEe1JFb7Xjtm3hW1OgqF2adS9GjnbkbX sa9p04VLA4B/FYBJ0AACQJGSQmwkd03/Max6B9WfH0nlHuNBT+62eAvccbkbkELe KH41MHRgwULkQe+iJz1in/c3Wmv6aL/Yla5rYLvoh/tNUHqPpOhiMi3FcFRMqK1p +ugpkYC8a0vGIuIPduW/ =78BW -----END PGP SIGNATURE-----