Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges×

Alerts This Week
Warning Icon 1 523
Alerts This Week
Warning Icon 1 523

openSUSE 13.1: 2015:0732-1 Important: Xen Memory Corruption Issue

opensuse
Calendar Grey April 20, 2015
Scroller Opensuse
The recent OpenSUSE update for Xen addresses 7 vulnerabilities, mitigating risks such as memory corruption and potential data leaks.
An update that solves 7 vulnerabilities and has 5 fixes is An update that solves 7 vulnerabilities and has 5 fixes is An update that solves 7 vulnerabilities and has 5 fixes is now...

Description

Xen was updated to 4.3.4 to fix multiple vulnerabities and non-security

bugs.

The following vulnerabilities were fixed:

- Long latency MMIO mapping operations are not preemptible (XSA-125

CVE-2015-2752 bnc#922705)

- Unmediated PCI command register access in qemu (XSA-126 CVE-2015-2756

bnc#922706)

- Hypervisor memory corruption due to x86 emulator flaw (bnc#919464

CVE-2015-2151 XSA-123)

- Information leak through version information hypercall (bnc#918998

CVE-2015-2045 XSA-122)

- Information leak via internal x86 system device emulation (bnc#918995

(CVE-2015-2044 XSA-121)

- HVM qemu unexpectedly enabling emulated VGA graphics backends

(bnc#919663 CVE-2015-2152 XSA-119)

- information leakage when guest sets high resolution (bnc#895528

CVE-2014-3615)

The following non-security bugs were fixed:

- L3: XEN blktap device intermittently fails to connect (bnc#919098)

- Problems with detecting free loop devices on Xen...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory security update information leak memory corruption patch xen openSUSE

Patch

Patch Instructions:

To install this openSUSE Security Update use YaST online_update.

Alternatively you can run the command listed for your product:

- openSUSE 13.1:

zypper in -t patch openSUSE-2015-314=1

To bring your system up-to-date, use "zypper patch".

Package List

- openSUSE 13.1 (i586 x86_64):

xen-debugsource-4.3.4_02-41.1

xen-devel-4.3.4_02-41.1

xen-kmp-default-4.3.4_02_k3.11.10_29-41.1

xen-kmp-default-debuginfo-4.3.4_02_k3.11.10_29-41.1

xen-kmp-desktop-4.3.4_02_k3.11.10_29-41.1

xen-kmp-desktop-debuginfo-4.3.4_02_k3.11.10_29-41.1

xen-libs-4.3.4_02-41.1

xen-libs-debuginfo-4.3.4_02-41.1

xen-tools-domU-4.3.4_02-41.1

xen-tools-domU-debuginfo-4.3.4_02-41.1

- openSUSE 13.1 (x86_64):

xen-4.3.4_02-41.1

xen-doc-html-4.3.4_02-41.1

xen-libs-32bit-4.3.4_02-41.1

xen-libs-debuginfo-32bit-4.3.4_02-41.1

xen-tools-4.3.4_02-41.1

xen-tools-debuginfo-4.3.4_02-41.1

xen-xend-tools-4.3.4_02-41.1

xen-xend-tools-debuginfo-4.3.4_02-41.1

- openSUSE 13.1 (i586):

xen-kmp-pae-4.3.4_02_k3.11.10_29-41.1

xen-kmp-pae-debuginfo-4.3.4_02_k3.11.10_29-41.1

References

https://www.suse.com/security/cve/CVE-2014-3615.html

https://www.suse.com/security/cve/CVE-2015-2044.html

https://www.suse.com/security/cve/CVE-2015-2045.html

https://www.suse.com/security/cve/CVE-2015-2151.html

https://www.suse.com/security/cve/CVE-2015-2152.html

https://www.suse.com/security/cve/CVE-2015-2752.html

https://www.suse.com/security/cve/CVE-2015-2756.html

https://bugzilla.suse.com/861318

https://bugzilla.suse.com/895528

https://bugzilla.suse.com/901488

https://bugzilla.suse.com/903680

https://bugzilla.suse.com/910254

https://bugzilla.suse.com/918995

https://bugzilla.suse.com/918998

https://bugzilla.suse.com/919098

https://bugzilla.suse.com/919464

https://bugzilla.suse.com/919663

https://bugzilla.suse.com/922705

https://bugzilla.suse.com/922706

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: openSUSE-SU-2015:0732-1
Rating: important
Affected Products: openSUSE 13.1

Topics%20covered

Topics Covered

security advisory security update information leak memory corruption patch xen openSUSE

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.