- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory                           GLSA 201604-03
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                           https://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

 Severity: Normal
    Title: Xen: Multiple vulnerabilities
     Date: April 05, 2016
     Bugs: #445254, #513832, #547202, #549200, #549950, #550658,
           #553664, #553718, #555532, #556304, #561110, #564472,
           #564932, #566798, #566838, #566842, #567962, #571552,
           #571556, #574012
       ID: 201604-03

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
=======
Multiple vulnerabilities have been found in Xen, the worst of which
cause a Denial of Service.

Background
=========
Xen is a bare-metal hypervisor.

Affected packages
================
    -------------------------------------------------------------------
     Package              /     Vulnerable     /            Unaffected
    -------------------------------------------------------------------
  1  app-emulation/xen           < 4.6.0-r9               >= 4.6.0-r9
                                                         *>= 4.5.2-r5
  2  app-emulation/xen-pvgrub
                                  < 4.6.0                  Vulnerable!
  3  app-emulation/xen-tools     < 4.6.0-r9               >= 4.6.0-r9
                                                         *>= 4.5.2-r5
  4  app-emulation/pvgrub                                    >= 4.6.0
                                                            *>= 4.5.2
    -------------------------------------------------------------------
     NOTE: Certain packages are still vulnerable. Users should migrate
           to another package if one is available or wait for the
           existing packages to be marked stable by their
           architecture maintainers.
    -------------------------------------------------------------------
     4 affected packages

Description
==========
Multiple vulnerabilities have been discovered in Xen. Please review the
CVE identifiers referenced below for details.

Impact
=====
A local attacker could possibly cause a Denial of Service condition or
obtain sensitive information.

Workaround
=========
There is no known workaround at this time.

Resolution
=========
All Xen 4.5 users should upgrade to the latest version:

  # emerge --sync
  # emerge --ask --oneshot --verbose ">=app-emulation/xen-4.5.2-r5"

All Xen 4.6 users should upgrade to the latest version:

  # emerge --sync
  # emerge --ask --oneshot --verbose ">=app-emulation/xen-4.6.0-r9"

All Xen tools 4.5 users should upgrade to the latest version:

  # emerge --sync
  # emerge --ask --oneshot -v ">=app-emulation/xen-tools-4.5.2-r5"

All Xen tools 4.6 users should upgrade to the latest version:

  # emerge --sync
  # emerge --ask --oneshot -v ">=app-emulation/xen-tools-4.6.0-r9"

All Xen pvgrub users should upgrade to the latest version:

  # emerge --sync
  # emerge --ask --oneshot --verbose ">=app-emulation/xen-pvgrub-4.6.0"

References
=========
[  1 ] CVE-2012-3494
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-3494
[  2 ] CVE-2012-3495
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-3495
[  3 ] CVE-2012-3496
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-3496
[  4 ] CVE-2012-3497
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-3497
[  5 ] CVE-2012-3498
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-3498
[  6 ] CVE-2012-3515
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-3515
[  7 ] CVE-2012-4411
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-4411
[  8 ] CVE-2012-4535
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-4535
[  9 ] CVE-2012-4536
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-4536
[ 10 ] CVE-2012-4537
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-4537
[ 11 ] CVE-2012-4538
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-4538
[ 12 ] CVE-2012-4539
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-4539
[ 13 ] CVE-2012-6030
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-6030
[ 14 ] CVE-2012-6031
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-6031
[ 15 ] CVE-2012-6032
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-6032
[ 16 ] CVE-2012-6033
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-6033
[ 17 ] CVE-2012-6034
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-6034
[ 18 ] CVE-2012-6035
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-6035
[ 19 ] CVE-2012-6036
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-6036
[ 20 ] CVE-2015-2151
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-2151
[ 21 ] CVE-2015-3209
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-3209
[ 22 ] CVE-2015-3259
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-3259
[ 23 ] CVE-2015-3340
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-3340
[ 24 ] CVE-2015-3456
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-3456
[ 25 ] CVE-2015-4103
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4103
[ 26 ] CVE-2015-4104
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4104
[ 27 ] CVE-2015-4105
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4105
[ 28 ] CVE-2015-4106
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4106
[ 29 ] CVE-2015-4163
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4163
[ 30 ] CVE-2015-4164
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4164
[ 31 ] CVE-2015-5154
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5154
[ 32 ] CVE-2015-7311
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7311
[ 33 ] CVE-2015-7504
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7504
[ 34 ] CVE-2015-7812
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7812
[ 35 ] CVE-2015-7813
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7813
[ 36 ] CVE-2015-7814
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7814
[ 37 ] CVE-2015-7835
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7835
[ 38 ] CVE-2015-7871
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7871
[ 39 ] CVE-2015-7969
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7969
[ 40 ] CVE-2015-7970
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7970
[ 41 ] CVE-2015-7971
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7971
[ 42 ] CVE-2015-7972
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7972
[ 43 ] CVE-2015-8339
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8339
[ 44 ] CVE-2015-8340
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8340
[ 45 ] CVE-2015-8341
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8341
[ 46 ] CVE-2015-8550
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8550
[ 47 ] CVE-2015-8551
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8551
[ 48 ] CVE-2015-8552
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8552
[ 49 ] CVE-2015-8554
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8554
[ 50 ] CVE-2015-8555
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8555
[ 51 ] CVE-2016-2270
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-2270
[ 52 ] CVE-2016-2271
       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-2271

Availability
===========
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

 https://security.gentoo.org/glsa/201604-03

Concerns?
========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.

License
======
Copyright 2016 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

https://creativecommons.org/licenses/by-sa/2.5/

Gentoo: GLSA-201604-03: Xen: Multiple vulnerabilities

Multiple vulnerabilities have been found in Xen, the worst of which cause a Denial of Service.

Summary

Multiple vulnerabilities have been discovered in Xen. Please review the CVE identifiers referenced below for details.

Resolution

All Xen 4.5 users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=app-emulation/xen-4.5.2-r5"
All Xen 4.6 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-emulation/xen-4.6.0-r9"
All Xen tools 4.5 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot -v ">=app-emulation/xen-tools-4.5.2-r5"
All Xen tools 4.6 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot -v ">=app-emulation/xen-tools-4.6.0-r9"
All Xen pvgrub users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-emulation/xen-pvgrub-4.6.0"

References

[ 1 ] CVE-2012-3494 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-3494 [ 2 ] CVE-2012-3495 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-3495 [ 3 ] CVE-2012-3496 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-3496 [ 4 ] CVE-2012-3497 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-3497 [ 5 ] CVE-2012-3498 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-3498 [ 6 ] CVE-2012-3515 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-3515 [ 7 ] CVE-2012-4411 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-4411 [ 8 ] CVE-2012-4535 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-4535 [ 9 ] CVE-2012-4536 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-4536 [ 10 ] CVE-2012-4537 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-4537 [ 11 ] CVE-2012-4538 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-4538 [ 12 ] CVE-2012-4539 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-4539 [ 13 ] CVE-2012-6030 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-6030 [ 14 ] CVE-2012-6031 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-6031 [ 15 ] CVE-2012-6032 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-6032 [ 16 ] CVE-2012-6033 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-6033 [ 17 ] CVE-2012-6034 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-6034 [ 18 ] CVE-2012-6035 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-6035 [ 19 ] CVE-2012-6036 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-6036 [ 20 ] CVE-2015-2151 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-2151 [ 21 ] CVE-2015-3209 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-3209 [ 22 ] CVE-2015-3259 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-3259 [ 23 ] CVE-2015-3340 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-3340 [ 24 ] CVE-2015-3456 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-3456 [ 25 ] CVE-2015-4103 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4103 [ 26 ] CVE-2015-4104 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4104 [ 27 ] CVE-2015-4105 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4105 [ 28 ] CVE-2015-4106 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4106 [ 29 ] CVE-2015-4163 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4163 [ 30 ] CVE-2015-4164 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4164 [ 31 ] CVE-2015-5154 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5154 [ 32 ] CVE-2015-7311 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7311 [ 33 ] CVE-2015-7504 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7504 [ 34 ] CVE-2015-7812 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7812 [ 35 ] CVE-2015-7813 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7813 [ 36 ] CVE-2015-7814 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7814 [ 37 ] CVE-2015-7835 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7835 [ 38 ] CVE-2015-7871 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7871 [ 39 ] CVE-2015-7969 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7969 [ 40 ] CVE-2015-7970 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7970 [ 41 ] CVE-2015-7971 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7971 [ 42 ] CVE-2015-7972 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7972 [ 43 ] CVE-2015-8339 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8339 [ 44 ] CVE-2015-8340 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8340 [ 45 ] CVE-2015-8341 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8341 [ 46 ] CVE-2015-8550 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8550 [ 47 ] CVE-2015-8551 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8551 [ 48 ] CVE-2015-8552 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8552 [ 49 ] CVE-2015-8554 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8554 [ 50 ] CVE-2015-8555 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8555 [ 51 ] CVE-2016-2270 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-2270 [ 52 ] CVE-2016-2271 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-2271

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201604-03

Concerns

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.

Severity
Severity: Normal
Title: Xen: Multiple vulnerabilities
Date: April 05, 2016
Bugs: #445254, #513832, #547202, #549200, #549950, #550658,
ID: 201604-03

Synopsis

Multiple vulnerabilities have been found in Xen, the worst of which cause a Denial of Service.

Background

Xen is a bare-metal hypervisor.

Affected Packages

------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 app-emulation/xen < 4.6.0-r9 >= 4.6.0-r9 *>= 4.5.2-r5 2 app-emulation/xen-pvgrub < 4.6.0 Vulnerable! 3 app-emulation/xen-tools < 4.6.0-r9 >= 4.6.0-r9 *>= 4.5.2-r5 4 app-emulation/pvgrub >= 4.6.0 *>= 4.5.2 ------------------------------------------------------------------- NOTE: Certain packages are still vulnerable. Users should migrate to another package if one is available or wait for the existing packages to be marked stable by their architecture maintainers. ------------------------------------------------------------------- 4 affected packages

Impact

===== A local attacker could possibly cause a Denial of Service condition or obtain sensitive information.

Workaround

There is no known workaround at this time.

Related News

Linux Mint 22: Elevating Security and Usability for Admins
3 - 5 min read
Linux Mint has has long been recognized as a versatile and user-friendly distribution and has earned great popularity among administrators and
Exim 4.98 Addresses Critical Vulnerabilities, Bolsters Email Server Security
2 - 4 min read
Exim is one of Unix-like systems' most widely used mail transfer agents. It's essential for email delivery and handling and is a significant part of
Recent OpenSSH RCE Bug Explained: Impact & Mitigations
2 - 4 min read
In an era where cybersecurity threats loom larger than ever, the discovery of a Remote Code Execution (RCE) vulnerability in OpenSSH by Qualys’
CVE-2024-4577: A Swiftly Weaponized Vulnerability for Ransomware Distribution
2 - 4 min read
Security researchers recently issued an update detailing how attackers are exploiting a PHP code execution vulnerability to spread TellYouThePass
Play Ransomware Group Unleashes New Threat on ESXi Environments: Analysis & Mitigation Strategies
3 - 5 min read
The Play ransomware group, well-known for its double-extortion tactics, recently unveiled a Linux variant targeting ESXi environments. This
Critical Linux Kernel Vulnerabilities Patched in Ubuntu Azure Systems
2 - 4 min read
Canonical has fixed several recently identified critical Linux kernel vulnerabilities in July 2024. These vulnerabilities primarily affect Microsoft
The Urgent Need for Secure Software Development: New Report Serves as a Wake-Up Call for the Industry
3 - 5 min read
The Linux Foundation and Open Source Security Foundation recently published a report entitled "Secure Software Development Education 2024
Severe Linux Kernel Privilege Escalation Bugs Could Compromise Entire Systems
2 - 4 min read
The Cybersecurity and Infrastructure Security Agency (CISA) recently added a new Linux kernel privilege escalation bug ( CVE-2024-1086 ) to its

Get the Latest News & Insights

Sign up to get the latest security news affecting Linux and open source delivered straight to your inbox.

© 2024 Guardian Digital, Inc All Rights Reserved