Alerts This Week
Warning Icon 1 687
Alerts This Week
Warning Icon 1 687

openSUSE Leap 42.3: 2019:1226-1 Important: Xen Security Issues

opensuse
Calendar Grey April 17, 2019
Dist Opensuse Esm H88
Addresses various security vulnerabilities in openSUSE xen, including denial of service issues and heap buffer overflow flaws.
An update that solves 8 vulnerabilities and has 15 fixes is now available.

Description

This update for xen fixes the following issues:

Security issues fixed:

- CVE-2018-19967: Fixed HLE constructs that allowed guests to lock up the

host, resulting in a Denial of Service (DoS). (XSA-282) (bsc#1114988)

- CVE-2019-6778: Fixed a heap buffer overflow in tcp_emu() found in slirp

(bsc#1123157).

- Fixed an issue which could allow malicious or buggy guests with passed

through PCI devices to be able to escalate their privileges, crash the

host, or access data belonging to other guests. Additionally memory

leaks were also possible (bsc#1126140).

- Fixed a race condition issue which could allow malicious PV guests to

escalate their privilege to that

of the hypervisor (bsc#1126141).

- Fixed an issue which could allow a malicious unprivileged guest

userspace process to escalate its privilege to that of other userspace

processes in the same guest and potentially thereby to that

of the guest operating system...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory denial of service important fixes xen heap buffer overflow openSUSE

Patch

Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods

like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 42.3:

zypper in -t patch openSUSE-2019-1226=1

Package List

- openSUSE Leap 42.3 (i586 x86_64):

xen-debugsource-4.9.4_02-37.1

xen-devel-4.9.4_02-37.1

xen-libs-4.9.4_02-37.1

xen-libs-debuginfo-4.9.4_02-37.1

xen-tools-domU-4.9.4_02-37.1

xen-tools-domU-debuginfo-4.9.4_02-37.1

- openSUSE Leap 42.3 (x86_64):

xen-4.9.4_02-37.1

xen-doc-html-4.9.4_02-37.1

xen-libs-32bit-4.9.4_02-37.1

xen-libs-debuginfo-32bit-4.9.4_02-37.1

xen-tools-4.9.4_02-37.1

xen-tools-debuginfo-4.9.4_02-37.1

References

https://www.suse.com/security/cve/CVE-2018-19665.html

https://www.suse.com/security/cve/CVE-2018-19961.html

https://www.suse.com/security/cve/CVE-2018-19962.html

https://www.suse.com/security/cve/CVE-2018-19965.html

https://www.suse.com/security/cve/CVE-2018-19966.html

https://www.suse.com/security/cve/CVE-2018-19967.html

https://www.suse.com/security/cve/CVE-2019-6778.html

https://www.suse.com/security/cve/CVE-2019-9824.html

https://bugzilla.suse.com/1026236

https://bugzilla.suse.com/1027519

https://bugzilla.suse.com/1069468

https://bugzilla.suse.com/1105528

https://bugzilla.suse.com/1114988

https://bugzilla.suse.com/1115040

https://bugzilla.suse.com/1115045

https://bugzilla.suse.com/1115047

https://bugzilla.suse.com/1116380

https://bugzilla.suse.com/1117756

https://bugzilla.suse.com/1119161

https://bugzilla.suse.com/1123157

https://bugzilla.suse.com/1126140

https://bugzilla.suse.com/1126141

https://bugzilla.suse.com/1126192

https://bugzilla.suse.com/1126195

https://bugzilla.suse.com/1126196

https://bugzilla....

Read the Full Advisory

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: openSUSE-SU-2019:1226-1
Rating: important
Affected Products: openSUSE Leap 42.3 le.

Topics%20covered

Topics Covered

security advisory denial of service important fixes xen heap buffer overflow openSUSE

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Related News

Your message here