Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 524
Alerts This Week
Warning Icon 1 524

SUSE 12 SP3: 2020:1234-5 Critical: Kernel Memory Leak & Denial-of-Service

suse
Calendar Grey May 26, 2015
Scroller Suse
SUSE enhances Xen by addressing vital security vulnerabilities. Keep your system updated to mitigate potential threats.
An update that solves two vulnerabilities and has one An update that solves two vulnerabilities and has one An update that solves two vulnerabilities and has one errata is now avai...

Summary

Xen was updated to fix two security issues and a bug: * CVE-2015-3456: A buffer overflow in the floppy drive emulation, which could be used to carry out denial of service attacks or potential code execution against the host. This vulnerability is also known as VENOM. * CVE-2015-3340: Xen did not initialize certain fields, which allowed certain remote service domains to obtain sensitive information from memory via a (1) XEN_DOMCTL_gettscinfo or (2) XEN_SYSCTL_getdomaininfolist request. * An exception in setCPUAffinity when restoring guests. (bsc#910441) Security Issues: * CVE-2015-3456 * CVE-2015-3340 Patch Instructions:

Topics%20covered

Topics Covered

security advisory buffer overflow DoS important SUSE Xen

References

#910441 #927967 #929339

Cross- CVE-2015-3340 CVE-2015-3456

Affected Products:

SUSE Linux Enterprise Server 11 SP2 LTSS

https://www.suse.com/security/cve/CVE-2015-3340.html

https://www.suse.com/security/cve/CVE-2015-3456.html

https://bugzilla.suse.com/910441

https://bugzilla.suse.com/927967

https://bugzilla.suse.com/929339

https://scc.suse.com:443/patches/

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2015:0944-1
Rating: important

Topics%20covered

Topics Covered

security advisory buffer overflow DoS important SUSE Xen

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.