Alerts This Week
Warning Icon 1 626
Alerts This Week
Warning Icon 1 626

SUSE: 2016:3156-1 Important: Xen Security Threats and Updates

suse
Calendar Grey December 14, 2016
Dist Suse Esm H88
SUSE has rolled out a crucial security patch that addresses 16 significant vulnerabilities within xen, which could affect both the security and performance of systems.
An update that fixes 16 vulnerabilities is now available

Summary

This update for xen fixes several issues. These security issues were fixed: - CVE-2016-9637: ioport array overflow allowing a malicious guest administrator can escalate their privilege to that of the host (bsc#1011652) - CVE-2016-9386: x86 null segments were not always treated as unusable allowing an unprivileged guest user program to elevate its privilege to that of the guest operating system. Exploit of this vulnerability is easy on Intel and more complicated on AMD (bsc#1009100) - CVE-2016-9382: x86 task switch to VM86 mode was mis-handled, allowing a unprivileged guest process to escalate its privilege to that of the guest operating system on AMD hardware. On Intel hardware a malicious unprivileged guest process can crash the guest (bsc#1009103)

Topics%20covered

Topics Covered

security advisory denial of service important system update SUSE multiple threats xen

References

#1000106 #1003030 #1003032 #1004016 #1005004

#1005005 #1007157 #1007160 #1009100 #1009103

#1009104 #1009107 #1009109 #1009111 #1011652

#953518

Cross- CVE-2016-7777 CVE-2016-7908 CVE-2016-7909

CVE-2016-8576 CVE-2016-8667 CVE-2016-8669

CVE-2016-8909 CVE-2016-8910 CVE-2016-9379

CVE-2016-9380 CVE-2016-9381 CVE-2016-9382

CVE-2016-9383 CVE-2016-9385 CVE-2016-9386

CVE-2016-9637

Affected Products:

SUSE Linux Enterprise Server for SAP 12

SUSE Linux Enterprise Server 12-LTSS

https://www.suse.com/security/cve/CVE-2016-7777.html

https://www.suse.com/security/cve/CVE-2016-7908.html

https://www.suse.com/security/cve/CVE-2016-7909.html

https://www.suse.com/security/cve/CVE-2016-8576.html

https://www.suse.com/security/cve/CVE-2016-8667.html

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2016:3156-1
Rating: important

Topics%20covered

Topics Covered

security advisory denial of service important system update SUSE multiple threats xen

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Related News

Your message here