Alerts This Week
Warning Icon 1 677
Alerts This Week
Warning Icon 1 677

SUSE: 2017:3212-1 Important: Xen DoS Fixes and Security Updates

suse
Calendar Grey December 5, 2017
Dist Suse Esm H88
New update ready for SUSE to address multiple vulnerabilities including Denial of Service, privilege escalation, and information exposure within Xen.
An update that solves four vulnerabilities and has two An update that solves four vulnerabilities and has two An update that solves four vulnerabilities and has two fixes is now av...

Summary

This update for xen fixes several issues. These security issues were fixed: - bsc#1068187: Failure to recognize errors in the Populate on Demand (PoD) code allowed for DoS (XSA-246) - bsc#1068191: Missing p2m error checking in PoD code allowed unprivileged guests to retain a writable mapping of freed memory leading to information leaks, privilege escalation or DoS (XSA-247). - CVE-2017-15289: The mode4and5 write functions allowed local OS guest privileged users to cause a denial of service (out-of-bounds write access and Qemu process crash) via vectors related to dst calculation (bsc#1063123) - CVE-2017-15597: A grant copy operation being done on a grant of a dying domain allowed a malicious guest administrator to corrupt hypervisor memory, allowing for DoS or potentially privilege escalation and

References

#1061075 #1061081 #1061086 #1063123 #1068187

#1068191

Cross- CVE-2017-15289 CVE-2017-15592 CVE-2017-15595

CVE-2017-15597

Affected Products:

SUSE Linux Enterprise Server 11-SP3-LTSS

SUSE Linux Enterprise Point of Sale 11-SP3

SUSE Linux Enterprise Debuginfo 11-SP3

https://www.suse.com/security/cve/CVE-2017-15289.html

https://www.suse.com/security/cve/CVE-2017-15592.html

https://www.suse.com/security/cve/CVE-2017-15595.html

https://www.suse.com/security/cve/CVE-2017-15597.html

https://bugzilla.suse.com/1061075

https://bugzilla.suse.com/1061081

https://bugzilla.suse.com/1061086

https://bugzilla.suse.com/1063123

https://bugzilla.suse.com/1068187

https://bugzilla.suse.com/1068191

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2017:3212-1
Rating: important

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Related News

Your message here