Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -1 articles for you...
89
security advisoryFedoracritical updateFedora 38: FEDORA-2023-ec64a06fe2 Critical EDK2 Firmware Update
include latest dbx update (may 9th, black lotus edition).. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2023-ec64a06fe2 2023-05-27 01:17:05.076743 --------------------------------------------------------------------------------Name : edk2 Product : Fedora 38 Version : 20230301gitf80f052277c8 Release : 26.fc38 URL : https://www.tianocore.org/ Summary : UEFI firmware for 64-bit virtual machines Description : EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications. This package contains sample 64-bit UEFI firmware builds for QEMU and KVM. --------------------------------------------------------------------------------Update Information: include latest dbx update (may 9th, black lotus edition). --------------------------------------------------------------------------------ChangeLog: --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2023-ec64a06fe2' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
May 27, 2023
•Critical
Fedora
89
security advisoryFedoramanagement toolFedora 33: FEDORA-2020-64859a826b Critical: Xen Permissions Issues
xenstore watch notifications lacking permission checks [XSA-115, CVE-2020-29480] (#1908091) Xenstore: new domains inheriting existing node permissions [XSA-322, CVE-2020-29481] (#1908095) Xenstore: wrong path length check [XSA-323, CVE-2020-29482] (#1908096) Xenstore: guests can crash xenstored via watchs [XSA-324, CVE-2020-29484] (#1908088) Xenstore: guests can disturb domain cleanup. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2020-64859a826b 2020-12-25 01:21:55.445209 --------------------------------------------------------------------------------Name : xen Product : Fedora 33 Version : 4.14.0 Release : 14.fc33 URL : https://xenproject.org/ Summary : Xen is a virtual machine monitor Description : This package contains the XenD daemon and xm command line tools, needed to manage virtual machines running under the Xen hypervisor --------------------------------------------------------------------------------Update Information: xenstore watch notifications lacking permission checks [XSA-115, CVE-2020-29480] (#1908091) Xenstore: new domains inheriting existing node permissions [XSA-322, CVE-2020-29481] (#1908095) Xenstore: wrong path length check [XSA-323, CVE-2020-29482] (#1908096) Xenstore: guests can crash xenstored via watchs [XSA-324, CVE-2020-29484] (#1908088) Xenstore: guests can disturb domain cleanup [XSA-325, CVE-2020-29483] (#1908087) oxenstored memory leak in reset_watches [XSA-330, CVE-2020-29485] (#1908000) undue recursion in x86 HVM context switch code [XSA-348, CVE-2020-29566] (#1908085) oxenstored: node ownership can be changed by unprivileged clients [XSA-352, CVE-2020-29486] (#1908003) oxenstored: permissions not checked on root node [XSA-353, CVE-2020-29479] (#1908002) infinite loop when cleaning up IRQ vectors [XSA-356, CVE-2020-29567] (#1907932) FIFO event channels control block related ordering [XSA-358, CVE-2020-29570] (#1907931) FIFO event channels controlstructure ordering [XSA-359, CVE-2020-29571] (#1908089) --------------------------------------------------------------------------------ChangeLog: * Tue Dec 15 2020 Michael Young - 4.14.0-14 - xenstore watch notifications lacking permission checks [XSA-115, CVE-2020-29480] (#1908091) - Xenstore: new domains inheriting existing node permissions [XSA-322, CVE-2020-29481] (#1908095) - Xenstore: wrong path length check [XSA-323, CVE-2020-29482] (#1908096) - Xenstore: guests can crash xenstored via watchs [XSA-324, CVE-2020-29484] (#1908088) - Xenstore: guests can disturb domain cleanup [XSA-325, CVE-2020-29483] (#1905648) - oxenstored memory leak in reset_watches [XSA-330, CVE-2020-29485] (#1908000) - undue recursion in x86 HVM context switch code [XSA-348, CVE-2020-29566] (#1908085) - oxenstored: node ownership can be changed by unprivileged clients [XSA-352, CVE-2020-29486] (#1908003) - oxenstored: permissions not checked on root node [XSA-353, CVE-2020-29479] (#1908003) - infinite loop when cleaning up IRQ vectors [XSA-356, CVE-2020-29567] (#1907932) - FIFO event channels control block related ordering [XSA-358, CVE-2020-29570] (#1907931) - FIFO event channels control structure ordering [XSA-359, CVE-2020-29571] (#1908089) * Sat Dec 5 2020 Jeff Law - 4.14.0-13 - Work around another gcc-11 stringop-overflow diagnostic --------------------------------------------------------------------------------References: [ 1 ] Bug #1905623 - CVE-2020-29485 xen: oxenstored memory leak in reset_watches (XSA-330) https://bugzilla.redhat.com/show_bug.cgi?id=1905623 [ 2 ] Bug #1905626 - CVE-2020-29482 xen: Xenstore: wrong path length check (XSA-323) https://bugzilla.redhat.com/show_bug.cgi?id=1905626 [ 3 ] Bug #1905632 - CVE-2020-29481 xen: Xenstore: new domains inheriting existing node permissions (XSA-322) https://bugzilla.redhat.com/show_bug.cgi?id=1905632 [ 4 ] Bug #1905635 - CVE-2020-29484 xen: Xenstore: guests can crash xenstored viawatchs (XSA-324) https://bugzilla.redhat.com/show_bug.cgi?id=1905635 [ 5 ] Bug #1905648 - CVE-2020-29483 xen: Xenstore: guests can disturb domain cleanup (XSA-325) https://bugzilla.redhat.com/show_bug.cgi?id=1905648 [ 6 ] Bug #1905652 - CVE-2020-29486 xen: oxenstored: node ownership can be changed by unprivileged clients (XSA-352) https://bugzilla.redhat.com/show_bug.cgi?id=1905652 [ 7 ] Bug #1905656 - CVE-2020-29567 xen: infinite loop when cleaning up IRQ vectors (XSA-356) https://bugzilla.redhat.com/show_bug.cgi?id=1905656 [ 8 ] Bug #1905668 - CVE-2020-29479 xen: oxenstored: permissions not checked on root node (XSA-353) https://bugzilla.redhat.com/show_bug.cgi?id=1905668 [ 9 ] Bug #1905669 - CVE-2020-29566 xen: undue recursion in x86 HVM context switch code (XSA-348) https://bugzilla.redhat.com/show_bug.cgi?id=1905669 [ 10 ] Bug #1905672 - CVE-2020-29480 xen: xenstore watch notifications lacking permission checks (XSA-115) https://bugzilla.redhat.com/show_bug.cgi?id=1905672 [ 11 ] Bug #1905675 - CVE-2020-29570 xen: FIFO event channels control block related ordering (XSA-358) https://bugzilla.redhat.com/show_bug.cgi?id=1905675 [ 12 ] Bug #1905676 - CVE-2020-29571 xen: FIFO event channels control structure ordering https://bugzilla.redhat.com/show_bug.cgi?id=1905676 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2020-64859a826b' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be foundat https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Dec 24, 2020
•Critical
Fedora
89
security advisoryfedoraxenFedora 29: FEDORA-2018-8e457298ce moderate: xen host lockup
guest use of HLE constructs may lock up host [XSA-282]. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2018-8e457298ce 2018-11-14 03:11:43.672748 --------------------------------------------------------------------------------Name : xen Product : Fedora 29 Version : 4.11.0 Release : 9.fc29 URL : https://xenproject.org/ Summary : Xen is a virtual machine monitor Description : This package contains the XenD daemon and xm command line tools, needed to manage virtual machines running under the Xen hypervisor --------------------------------------------------------------------------------Update Information: guest use of HLE constructs may lock up host [XSA-282] --------------------------------------------------------------------------------ChangeLog: * Tue Nov 6 2018 Michael Young - 4.11.0-9 - guest use of HLE constructs may lock up host [XSA-282] * Wed Oct 24 2018 Michael Young - 4.11.0-8 - x86: Nested VT-x usable even when disabled [XSA-278, CVE-2018-18883] (#1643118) --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2018-8e457298ce' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list --
Nov 14, 2018
Fedora
98
security advisoryred hatimportantRed Hat OpenStack 8.0 RHSA-2018:1646-01 Critical: Qemu-KVM-RHEV Patch
An update for qemu-kvm-rhev is now available for Red Hat OpenStack Platform 8.0 (Liberty). Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: qemu-kvm-rhev security update Advisory ID: RHSA-2018:1646-01 Product: Red Hat Enterprise Linux OpenStack Platform Advisory URL: https://access.redhat.com/errata/RHSA-2018:1646 Issue date: 2018-05-21 CVE Names: CVE-2018-3639 ==================================================================== 1. Summary: An update for qemu-kvm-rhev is now available for Red Hat OpenStack Platform 8.0 (Liberty). Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat OpenStack Platform 8.0 (Liberty) - x86_64 3. Description: KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-rhev packages provide the user-space component for running virtual machines that use KVM in environments managed by Red Hat products. Security Fix(es): * An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of Load & Store instructions (a commonly used performance optimization). It relies on the presence of a precisely-defined instruction sequence in the privileged code as well as the fact that memory read from address to which a recent memory write has occurred may see an older value and subsequently cause an update into the microprocessor's data cache even for speculatively executed instructions thatnever actually commit (retire). As a result, an unprivileged attacker could use this flaw to read privileged memory by conducting targeted cache side-channel attacks. (CVE-2018-3639) Note: This is the qemu-kvm-rhev side of the CVE-2018-3639 mitigation. Red Hat would like to thank Ken Johnson (Microsoft Security Response Center) and Jann Horn (Google Project Zero) for reporting this issue. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect. 5. Bugs fixed (https://bugzilla.redhat.com/): 1566890 - CVE-2018-3639 hw: cpu: speculative store bypass 6. Package List: Red Hat OpenStack Platform 8.0 (Liberty): Source: qemu-kvm-rhev-2.10.0-21.el7_5.3.src.rpm x86_64: qemu-img-rhev-2.10.0-21.el7_5.3.x86_64.rpm qemu-kvm-common-rhev-2.10.0-21.el7_5.3.x86_64.rpm qemu-kvm-rhev-2.10.0-21.el7_5.3.x86_64.rpm qemu-kvm-rhev-debuginfo-2.10.0-21.el7_5.3.x86_64.rpm qemu-kvm-tools-rhev-2.10.0-21.el7_5.3.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2018-3639 https://access.redhat.com/security/updates/classification/#important https://access.redhat.com/security/vulnerabilities/ssbd 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2018 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPGv1 iQIVAwUBWwQpvtzjgjWX9erEAQh14g/8DRtASjPAOqFTDXHjINrSO/X7ou00tYED SuEg9KBc9E29wy9Ishe6Syicdd8J/TNrybdVzwvMycslPdO7bpPLKZLavl5c8vkG vcobEF+lgqGrBMJ39wIKZ0SyWOEO5HYZliMZkMsjz35oIHyZF+l+QhwBHaqA7+Rv 8ToQQ+s0BC6MZacr4ClI9a1EHtJrv9x1Uc1B1uruWhyL/QJNNN92egU3kUxbLihZ gtxw98NqnNf6yFIzanmF92kTuzVzGJGGLbstoZtugc4miSWQoKkIwaU5wXUzf7oc r/dPeyiyL0z/iGlkSbylxp75Br6mivhdQfiuQcoFYFrSoaRof8dSvEs7djKe1aTn OpGWWCCQvCnd4wyPqw8kJSV9qZt7fhoKF48saILmHY6xCOcFf1z8l40n+S5ahDJd Qzf+wuw6eaKPfEU7SWq0vlTh9hS1voOIY3+nbWw6nxkMWBDr3nGT7o/IYtxEbc8z 0kWWg8SklxBRe/t7b+M652OUhn/vUrj26fWPh0ZzEVHtqE8oQzlJkktkwNT2luaC 0LxFLKyjXF3MzbCJUc8tVz1v3GruzN3y1L8Y7jeNS/fLVyXsXrwJEAZlzwdsQEsM XqlBSGXcF3FYw2lKcUGsdIa0oAaC68y1P6MbyDGWciPlgWRvh+aRRAa3spxBK0Ta aZcw4Q7W3Dw=IVqz -----END PGP SIGNATURE----- -- RHSA-announce mailing list
May 22, 2018
•Important
Red Hat
89
security advisorycriticalFedoraFedora 27: 2017-c432db2971 Critical: Xen Security Issues Overview
xen: various flaws (#1501391) multiple MSI mapping issues on x86 [XSA-237] DMOP map/unmap missing argument checks [XSA-238] hypervisor stack leak in x86 I/O intercept code [XSA-239] Unlimited recursion in linear pagetable de-typing [XSA-240] Stale TLB entry due to page type release race [XSA-241] page type reference leak on x86 [XSA-242] x86: Incorrect handling of self-linear shadow. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2017-c432db2971 2017-11-11 01:32:26.750453 --------------------------------------------------------------------------------Name : xen Product : Fedora 27 Version : 4.9.0 Release : 12.fc27 URL : https://xenproject.org/ Summary : Xen is a virtual machine monitor Description : This package contains the XenD daemon and xm command line tools, needed to manage virtual machines running under the Xen hypervisor --------------------------------------------------------------------------------Update Information: xen: various flaws (#1501391) multiple MSI mapping issues on x86 [XSA-237] DMOP map/unmap missing argument checks [XSA-238] hypervisor stack leak in x86 I/O intercept code [XSA-239] Unlimited recursion in linear pagetable de-typing [XSA-240] Stale TLB entry due to page type release race [XSA-241] page type reference leak on x86 [XSA-242] x86: Incorrect handling of self-linear shadow mappings with translated guests [XSA-243] x86: Incorrect handling of IST settings during CPU hotplug [XSA-244] --------------------------------------------------------------------------------ChangeLog: --------------------------------------------------------------------------------References: [ 1 ] Bug #1499817 - CVE-2017-15590 xsa237 xen: multiple MSI mapping issues on x86 (XSA-237) https://bugzilla.redhat.com/show_bug.cgi?id=1499817 [ 2 ] Bug #1499818 - CVE-2017-15591 xsa238 xen: DMOP map/unmap missing argument checks (XSA-238) https://bugzilla.redhat.com/show_bug.cgi?id=1499818 [ 3 ] Bug #1499819 - CVE-2017-15589 xsa239 xen: hypervisor stack leak in x86 I/O intercept code (XSA-239) https://bugzilla.redhat.com/show_bug.cgi?id=1499819 [ 4 ] Bug #1499820 - CVE-2017-15595 xsa240 xen: Unlimited recursion in linear pagetable de-typing (XSA-240) https://bugzilla.redhat.com/show_bug.cgi?id=1499820 [ 5 ] Bug #1499821 - CVE-2017-15588 xsa241 xen: Stale TLB entry due to page type release race (XSA-241) https://bugzilla.redhat.com/show_bug.cgi?id=1499821 [ 6 ] Bug #1499822 - CVE-2017-15593 xsa242 xen: page type reference leak on x86 (XSA-242) https://bugzilla.redhat.com/show_bug.cgi?id=1499822 [ 7 ] Bug #1499823 - CVE-2017-15592 xsa243 xen: x86: Incorrect handling of self-linear shadow mappings with translated guests (XSA-243) https://bugzilla.redhat.com/show_bug.cgi?id=1499823 [ 8 ] Bug #1499824 - CVE-2017-15594 xsa244 xen: x86: Incorrect handling of IST settings during CPU hotplug (XSA-244) https://bugzilla.redhat.com/show_bug.cgi?id=1499824 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade xen' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list --
Nov 11, 2017
•Critical
Fedora
89
security advisorycriticalFedoraFedora 25: 2017-f7fd3fe7eb Critical: Xen Grant Table Security Flaws
xen: various flaws (#1490884) Missing NUMA node parameter verification [XSA-231, CVE-2017-14316] Missing check for grant table [XSA-232, CVE-2017-14318] cxenstored: Race in domain cleanup [XSA-233, CVE-2017-14317] insufficient grant unmapping checks for x86 PV guests [XSA-234, CVE-2017-14319]. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2017-f7fd3fe7eb 2017-10-01 18:17:17.995745 --------------------------------------------------------------------------------Name : xen Product : Fedora 25 Version : 4.7.3 Release : 5.fc25 URL : https://xenproject.org/ Summary : Xen is a virtual machine monitor Description : This package contains the XenD daemon and xm command line tools, needed to manage virtual machines running under the Xen hypervisor --------------------------------------------------------------------------------Update Information: xen: various flaws (#1490884) Missing NUMA node parameter verification [XSA-231, CVE-2017-14316] Missing check for grant table [XSA-232, CVE-2017-14318] cxenstored: Race in domain cleanup [XSA-233, CVE-2017-14317] insufficient grant unmapping checks for x86 PV guests [XSA-234, CVE-2017-14319] --------------------------------------------------------------------------------References: [ 1 ] Bug #1486707 - CVE-2017-14316 xsa231 xen: Missing NUMA node parameter verification (XSA-231) https://bugzilla.redhat.com/show_bug.cgi?id=1486707 [ 2 ] Bug #1486708 - CVE-2017-14318 xsa232 xen: Missing check for grant table (XSA-232) https://bugzilla.redhat.com/show_bug.cgi?id=1486708 [ 3 ] Bug #1486709 - CVE-2017-14317 xsa233 xen: cxenstored: Race in domain cleanup (XSA-233) https://bugzilla.redhat.com/show_bug.cgi?id=1486709 [ 4 ] Bug #1486710 - CVE-2017-14319 xsa234 xen: insufficient grant unmapping checks for x86 PV guests (XSA-234) https://bugzilla.redhat.com/show_bug.cgi?id=1486710 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade xen' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list --
Oct 01, 2017
•Critical
Fedora
89
security advisoryFedoracritical updateFedora 26: FEDORA-2017-08ec8b6dc4 Critical: Open-VM-Tools Race Condition
Fix /tmp race conditions in libDeployPkg (CVE-2015-5191).. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2017-08ec8b6dc4 2017-07-26 15:49:14.624143 --------------------------------------------------------------------------------Name : open-vm-tools Product : Fedora 26 Version : 10.1.5 Release : 5.fc26 URL : https://github.com/vmware/open-vm-tools Summary : Open Virtual Machine Tools for virtual machines hosted on VMware Description : The open-vm-tools project is an open source implementation of VMware Tools. It is a suite of open source virtualization utilities and drivers to improve the functionality, user experience and administration of VMware virtual machines. This package contains only the core user-space programs and libraries of open-vm-tools. --------------------------------------------------------------------------------Update Information: Fix /tmp race conditions in libDeployPkg (CVE-2015-5191). --------------------------------------------------------------------------------References: [ 1 ] Bug #1253689 - CVE-2015-5191 open-vm-tools: /tmp race conditions in the libDeployPkg component https://bugzilla.redhat.com/show_bug.cgi?id=1253689 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade open-vm-tools' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list --
Jul 26, 2017
•Critical
Fedora
89
security advisoryFedoraheap overflowFedora 22 2015-12657 Moderate: Xen Heap Overflow In ATAPI Commands
QEMU heap overflow flaw while processing certain ATAPI commands. [XSA-138, CVE-2015-5154] (#1247142) try again to fix xen-qemu-dom0-disk-backend.service (#1242246) correct qemu location in xen-qemu-dom0-disk-backend.service (#1242246), rebuild efi grub.cfg if it is present (#1239309),. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2015-12657 2015-08-03 02:18:56 -------------------------------------------------------------------------------- Name : xen Product : Fedora 22 Version : 4.5.1 Release : 5.fc22 URL : https://xenproject.org/ Summary : Xen is a virtual machine monitor Description : This package contains the XenD daemon and xm command line tools, needed to manage virtual machines running under the Xen hypervisor -------------------------------------------------------------------------------- Update Information: QEMU heap overflow flaw while processing certain ATAPI commands. [XSA-138, CVE-2015-5154] (#1247142) try again to fix xen-qemu-dom0-disk-backend.service (#1242246) correct qemu location in xen-qemu-dom0-disk-backend.service (#1242246), rebuild efi grub.cfg if it is present (#1239309), re-enable remus by building with libnl3, modify gnutls use in line with Fedora's crypto policies (#1179352) -------------------------------------------------------------------------------- ChangeLog: * Sun Aug 2 2015 Michael Young - 4.5.1-5 - QEMU heap overflow flaw while processing certain ATAPI commands. [XSA-138, CVE-2015-5154] (#1247142) - try again to fix xen-qemu-dom0-disk-backend.service (#1242246) * Thu Jul 30 2015 Richard W.M. Jones - 4.5.1-4 - OCaml 4.02.3 rebuild. * Thu Jul 23 2015 Michael Young - 4.5.1-3 - correct qemu location in xen-qemu-dom0-disk-backend.service (#1242246) - rebuild efi grub.cfg if it is present (#1239309) - re-enable remus by building with libnl3 - modify gnutls use in line with Fedora's crypto policies (#1179352) * Tue Jul 7 2015 Michael Young - 4.5.1-2 - xl command lineconfig handling stack overflow [XSA-137, CVE-2015-3259] * Mon Jun 22 2015 Michael Young - 4.5.1-1 - update to 4.5.1 adjust xen.use.fedora.ipxe.patch and xen.fedora.systemd.patch remove patches for issues now fixed upstream renumber patches * Fri Jun 19 2015 Richard W.M. Jones - 4.5.0-13 - Rebuild for ocaml-4.02.2. * Fri Jun 19 2015 Fedora Release Engineering - 4.5.0-12 - Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild * Tue Jun 16 2015 Michael Young - gcc 5 bug is fixed so remove workaround * Wed Jun 10 2015 Michael Young - 4.5.0-11 - stubs-32.h is back, so revert to previous behaviour - Heap overflow in QEMU PCNET controller, allowing guest-> host escape [XSA-135, CVE-2015-3209] (#1230537) - GNTTABOP_swap_grant_ref operation misbehavior [XSA-134, CVE-2015-4163] - vulnerability in the iret hypercall handler [XSA-136, CVE-2015-4164] * Wed Jun 3 2015 Michael Young - 4.5.0-10.1 - stubs-32.h has gone from rawhide, put it back manually * Tue Jun 2 2015 Michael Young - 4.5.0-10 - replace deprecated gnutls use in qemu-xen-traditional based on qemu-xen patches - work around a gcc 5 bug - Potential unintended writes to host MSI message data field via qemu [XSA-128, CVE-2015-4103] (#1227627) - PCI MSI mask bits inadvertently exposed to guests [XSA-129, CVE-2015-4104] (#1227628) - Guest triggerable qemu MSI-X pass-through error messages [XSA-130, CVE-2015-4105] (#1227629) - Unmediated PCI register access in qemu [XSA-131, CVE-2015-4106] (#1227631) * Wed May 13 2015 Michael Young - 4.5.0-9 - Privilege escalation via emulated floppy disk drive [XSA-133, CVE-2015-3456] (#1221153) -------------------------------------------------------------------------------- References: [ 1 ] Bug #1243563 - CVE-2015-5154 qemu: ide: atapi: heap overflow during I/O buffer memory access https://bugzilla.redhat.com/show_bug.cgi?id=1243563 -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su-c 'yum update xen' at the command line. For more information, refer to "Managing Software with yum", available at . All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list
Aug 12, 2015
Fedora
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!