Stay Secure with the Latest Linux Advisories

security advisorycriticalFedora

Fedora 23: 2016-1c3374bcb9 Critical: Xen Memory Overflow Issues

x86: Disallow L3 recursive pagetable for 32-bit PV guests [XSA-185, CVE-2016-7092] (#1374470) x86: Mishandling of instruction pointer truncation during emulation [XSA-186, CVE-2016-7093] (#1374471) x86 HVM: Overflow of sh_ctxt-> seg_reg[] [XSA-187, CVE-2016-7094] (#1374473). -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2016-1c3374bcb9 2016-09-21 15:50:18.284765 -------------------------------------------------------------------------------- Name : xen Product : Fedora 23 Version : 4.5.3 Release : 10.fc23 URL : https://xenproject.org/ Summary : Xen is a virtual machine monitor Description : This package contains the XenD daemon and xm command line tools, needed to manage virtual machines running under the Xen hypervisor -------------------------------------------------------------------------------- Update Information: x86: Disallow L3 recursive pagetable for 32-bit PV guests [XSA-185, CVE-2016-7092] (#1374470) x86: Mishandling of instruction pointer truncation during emulation [XSA-186, CVE-2016-7093] (#1374471) x86 HVM: Overflow of sh_ctxt-> seg_reg[] [XSA-187, CVE-2016-7094] (#1374473) -------------------------------------------------------------------------------- References: [ 1 ] Bug #1370319 - CVE-2016-7092 xen: x86: Disallow L3 recursive pagetable for 32-bit PV guests https://bugzilla.redhat.com/show_bug.cgi?id=1370319 [ 2 ] Bug #1370322 - CVE-2016-7093 xen: x86: Mishandling of instruction pointer truncation during emulation https://bugzilla.redhat.com/show_bug.cgi?id=1370322 [ 3 ] Bug #1370332 - CVE-2016-7094 xen: x86 HVM: Overflow of sh_ctxt-> seg_reg[] https://bugzilla.redhat.com/show_bug.cgi?id=1370332 -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update xen' at the command line. For more information, refer to "Managing Software with yum", available at. All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list -- This email address is being protected from spambots. You need JavaScript enabled to view it. To unsubscribe send an email to This email address is being protected from spambots. You need JavaScript enabled to view it. . The latest Fedora 23 update addresses multiple security flaws within Xen, specifically focusing on the management of instruction pointers and buffer overflows.. Fedora Update, Xen Security, Memory Management, Virtualization. . Severity: Critical. LinuxSecurity.com Team

Sep 21, 2016 •Critical Fedora