Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 591
Alerts This Week
Warning Icon 1 591

openSUSE: 2017:2394-1 Important: Xen Issues Require Immediate Attention

opensuse
Calendar Grey September 8, 2017
Dist Opensuse Esm H88
A significant update for Linux Mint's security framework tackles various vulnerabilities and offers solutions to bolster system integrity.
An update that solves 6 vulnerabilities and has 5 fixes is now available.

Description

This update for xen fixes several issues.

These security issues were fixed:

- CVE-2017-12135: Unbounded recursion in grant table code allowed a

malicious guest to crash the host or potentially escalate

privileges/leak information (XSA-226, bsc#1051787).

- CVE-2017-12137: Incorrectly-aligned updates to pagetables allowed for

privilege escalation (XSA-227, bsc#1051788).

- CVE-2017-12136: Race conditions with maptrack free list handling allows

a malicious guest administrator to crash the host or escalate their

privilege to that of the host (XSA-228, bsc#1051789).

- CVE-2017-11434: The dhcp_decode function in slirp/bootp.c allowed local

guest OS users to cause a denial of service (out-of-bounds read) via a

crafted DHCP

options string (bsc#1049578).

- CVE-2017-10664: qemu-nbd did not ignore SIGPIPE, which allowed remote

attackers to cause a denial of service (daemon crash) by disconnecting

during a server-to-client...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory denial of service privilege escalation important xen openSUSE patch instructions

Patch

Patch Instructions:

To install this openSUSE Security Update use YaST online_update.

Alternatively you can run the command listed for your product:

- openSUSE Leap 42.3:

zypper in -t patch openSUSE-2017-1023=1

To bring your system up-to-date, use "zypper patch".

Package List

- openSUSE Leap 42.3 (x86_64):

xen-4.9.0_11-4.1

xen-debugsource-4.9.0_11-4.1

xen-devel-4.9.0_11-4.1

xen-doc-html-4.9.0_11-4.1

xen-libs-4.9.0_11-4.1

xen-libs-debuginfo-4.9.0_11-4.1

xen-tools-4.9.0_11-4.1

xen-tools-debuginfo-4.9.0_11-4.1

xen-tools-domU-4.9.0_11-4.1

xen-tools-domU-debuginfo-4.9.0_11-4.1

References

https://www.suse.com/security/cve/CVE-2017-10664.html

https://www.suse.com/security/cve/CVE-2017-11434.html

https://www.suse.com/security/cve/CVE-2017-12135.html

https://www.suse.com/security/cve/CVE-2017-12136.html

https://www.suse.com/security/cve/CVE-2017-12137.html

https://www.suse.com/security/cve/CVE-2017-12855.html

https://bugzilla.suse.com/1002573

https://bugzilla.suse.com/1026236

https://bugzilla.suse.com/1027519

https://bugzilla.suse.com/1035231

https://bugzilla.suse.com/1046637

https://bugzilla.suse.com/1049578

https://bugzilla.suse.com/1051787

https://bugzilla.suse.com/1051788

https://bugzilla.suse.com/1051789

https://bugzilla.suse.com/1052686

https://bugzilla.suse.com/1055695

--

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: openSUSE-SU-2017:2394-1
Rating: important
Affected Products: openSUSE Leap 42.3 le.

Topics%20covered

Topics Covered

security advisory denial of service privilege escalation important xen openSUSE patch instructions

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.