Alerts This Week
Warning Icon 1 684
Alerts This Week
Warning Icon 1 684

SUSE: 2018:1216-1 Important: Xen Denial of Service and Fixes

suse
Calendar Grey May 11, 2018
Dist Suse Esm H88
SUSE Security Patch for mysql addresses several concerns with critical assessments and offers guidelines for remediation.
An update that solves three vulnerabilities and has four fixes is now available.

Summary

This update for xen fixes several issues. These security issues were fixed: - CVE-2018-8897: Prevent mishandling of debug exceptions on x86 (XSA-260, bsc#1090820) - Handle HPET timers in IO-APIC mode correctly to prevent malicious or buggy HVM guests from causing a hypervisor crash or potentially privilege escalation/information leaks (XSA-261, bsc#1090822) - Prevent unbounded loop, induced by qemu allowing an attacker to permanently keep a physical CPU core busy (XSA-262, bsc#1090823) - CVE-2018-10472: x86 HVM guest OS users (in certain configurations) were able to read arbitrary dom0 files via QMP live insertion of a CDROM, in conjunction with specifying the target file as the backing file of a snapshot (bsc#1089152). - CVE-2018-10471: x86 PV guest OS users were able to cause a denial of

References

#1027519 #1086039 #1089152 #1089635 #1090820

#1090822 #1090823

Cross- CVE-2018-10471 CVE-2018-10472 CVE-2018-8897

Affected Products:

SUSE OpenStack Cloud 7

SUSE Linux Enterprise Server for SAP 12-SP2

SUSE Linux Enterprise Server 12-SP2-LTSS

SUSE Enterprise Storage 4

https://www.suse.com/security/cve/CVE-2018-10471.html

https://www.suse.com/security/cve/CVE-2018-10472.html

https://www.suse.com/security/cve/CVE-2018-8897.html

https://bugzilla.suse.com/1027519

https://bugzilla.suse.com/1086039

https://bugzilla.suse.com/1089152

https://bugzilla.suse.com/1089635

https://bugzilla.suse.com/1090820

https://bugzilla.suse.com/1090822

https://bugzilla.suse.com/1090823

--

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2018:1216-1
Rating: important

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Related News

Your message here