Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 547
Alerts This Week
Warning Icon 1 547

SUSE: 2017:2319-1 Important: Xen Security High-Risk Issues Fixed

suse
Calendar Grey September 1, 2017
Dist Suse Esm H88
Important SUSE Security Patch released for xen tackling various vulnerabilities, with remedial measures provided for impacted products.
An update that solves 6 vulnerabilities and has two fixes An update that solves 6 vulnerabilities and has two fixes An update that solves 6 vulnerabilities and has two fixes is now...

Summary

This update for xen fixes several issues. These security issues were fixed: - CVE-2017-12135: Unbounded recursion in grant table code allowed a malicious guest to crash the host or potentially escalate privileges/leak information (XSA-226, bsc#1051787). - CVE-2017-12137: Incorrectly-aligned updates to pagetables allowed for privilege escalation (XSA-227, bsc#1051788). - CVE-2017-11434: The dhcp_decode function in slirp/bootp.c allowed local guest OS users to cause a denial of service (out-of-bounds read) via a crafted DHCP options string (bsc#1049578). - CVE-2017-10664: qemu-nbd did not ignore SIGPIPE, which allowed remote attackers to cause a denial of service (daemon crash) by disconnecting during a server-to-client reply attempt (bsc#1046637).

Topics%20covered

Topics Covered

security advisory denial of service privilege escalation critical update important patch xen issue SUSE linux

References

#1002573 #1046637 #1047675 #1048920 #1049578

#1051787 #1051788 #1052686

Cross- CVE-2017-10664 CVE-2017-10806 CVE-2017-11334

CVE-2017-11434 CVE-2017-12135 CVE-2017-12137

Affected Products:

SUSE OpenStack Cloud 6

SUSE Linux Enterprise Server for SAP 12-SP1

SUSE Linux Enterprise Server 12-SP1-LTSS

https://www.suse.com/security/cve/CVE-2017-10664.html

https://www.suse.com/security/cve/CVE-2017-10806.html

https://www.suse.com/security/cve/CVE-2017-11334.html

https://www.suse.com/security/cve/CVE-2017-11434.html

https://www.suse.com/security/cve/CVE-2017-12135.html

https://www.suse.com/security/cve/CVE-2017-12137.html

https://bugzilla.suse.com/1002573

https://bugzilla.suse.com/1046637

https://bugzilla.suse.com/1047675

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2017:2319-1
Rating: important

Topics%20covered

Topics Covered

security advisory denial of service privilege escalation critical update important patch xen issue SUSE linux

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.