Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 443
Alerts This Week
Warning Icon 1 443

SUSE Linux 12-SP2: 2017:2326-1 Important Xen Escalation Risks

suse
Calendar Grey September 1, 2017
Dist Suse Esm H88
Debian has released a critical patch addressing multiple vulnerabilities in apache, aiming to mitigate data breach risks and ensure robust performance integrity.
An update that solves 7 vulnerabilities and has four fixes An update that solves 7 vulnerabilities and has four fixes An update that solves 7 vulnerabilities and has four fixes is ...

Summary

This update for xen to version 4.7.3 fixes several issues. These security issues were fixed: - CVE-2017-12135: Unbounded recursion in grant table code allowed a malicious guest to crash the host or potentially escalate privileges/leak information (XSA-226, bsc#1051787). - CVE-2017-12137: Incorrectly-aligned updates to pagetables allowed for privilege escalation (XSA-227, bsc#1051788). - CVE-2017-12136: Race conditions with maptrack free list handling allows a malicious guest administrator to crash the host or escalate their privilege to that of the host (XSA-228, bsc#1051789). - CVE-2017-11434: The dhcp_decode function in slirp/bootp.c allowed local guest OS users to cause a denial of service (out-of-bounds read) via a crafted DHCP options string (bsc#1049578).

Topics%20covered

Topics Covered

security advisory privilege escalation patch important service disruption SUSE Linux Xen issue

References

#1002573 #1026236 #1035231 #1037840 #1046637

#1049578 #1051787 #1051788 #1051789 #1052686

#1055695

Cross- CVE-2016-9603 CVE-2017-10664 CVE-2017-11434

CVE-2017-12135 CVE-2017-12136 CVE-2017-12137

CVE-2017-12855

Affected Products:

SUSE Linux Enterprise Software Development Kit 12-SP2

SUSE Linux Enterprise Server 12-SP2

SUSE Linux Enterprise Desktop 12-SP2

SUSE Container as a Service Platform ALL

https://www.suse.com/security/cve/CVE-2016-9603.html

https://www.suse.com/security/cve/CVE-2017-10664.html

https://www.suse.com/security/cve/CVE-2017-11434.html

https://www.suse.com/security/cve/CVE-2017-12135.html

https://www.suse.com/security/cve/CVE-2017-12136.html

https://www.suse.com/security/cve/CVE-2017-12137.html

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2017:2326-1
Rating: important

Topics%20covered

Topics Covered

security advisory privilege escalation patch important service disruption SUSE Linux Xen issue

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.