Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 531
Alerts This Week
Warning Icon 1 531

SUSE: 2016:3273-1 Important: Fixes For Xen Privilege Escalation And DoS

suse
Calendar Grey December 27, 2016
Scroller Suse Esm H88
SUSE has released a significant update addressing 14 vulnerabilities in Xen, tackling issues such as privilege escalation and denial of service risks.
An update that fixes 14 vulnerabilities is now available

Summary

This update for xen fixes several issues. These security issues were fixed: - CVE-2016-9637: ioport array overflow allowing a malicious guest administrator can escalate their privilege to that of the host (bsc#1011652) - CVE-2016-9386: x86 null segments were not always treated as unusable allowing an unprivileged guest user program to elevate its privilege to that of the guest operating system. Exploit of this vulnerability is easy on Intel and more complicated on AMD (bsc#1009100) - CVE-2016-9382: x86 task switch to VM86 mode was mis-handled, allowing a unprivileged guest process to escalate its privilege to that of the guest operating system on AMD hardware. On Intel hardware a malicious unprivileged guest process can crash the guest (bsc#1009103)

Topics%20covered

Topics Covered

security advisory denial of service update privilege escalation security fix SUSE xen

References

#1000106 #1000893 #1003030 #1003032 #1005004

#1005005 #1007157 #1007160 #1009100 #1009103

#1009107 #1009109 #1009111 #1011652

Cross- CVE-2016-7777 CVE-2016-7908 CVE-2016-7909

CVE-2016-8667 CVE-2016-8669 CVE-2016-8909

CVE-2016-8910 CVE-2016-9379 CVE-2016-9380

CVE-2016-9381 CVE-2016-9382 CVE-2016-9383

CVE-2016-9386 CVE-2016-9637

Affected Products:

SUSE OpenStack Cloud 5

SUSE Manager Proxy 2.1

SUSE Manager 2.1

SUSE Linux Enterprise Server 11-SP3-LTSS

SUSE Linux Enterprise Point of Sale 11-SP3

SUSE Linux Enterprise Debuginfo 11-SP3

https://www.suse.com/security/cve/CVE-2016-7777.html

https://www.suse.com/security/cve/CVE-2016-7908.html

https://www.suse.com/security/cve/CVE-2016-7909.html

https://www.suse.com/security/cve/CVE-2016-8667.html

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2016:3273-1
Rating: important

Topics%20covered

Topics Covered

security advisory denial of service update privilege escalation security fix SUSE xen

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.