Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2016.0862
SUSE Security Update: Security update for xen
6 April 2016
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Xen
Publisher: SUSE
Operating System: SUSE
Impact/Access: Execute Arbitrary Code/Commands -- Remote/Unauthenticated
Increased Privileges -- Existing Account
Denial of Service -- Remote/Unauthenticated
Access Confidential Data -- Existing Account
Reduced Security -- Existing Account
Resolution: Patch/Upgrade
CVE Names: CVE-2016-2841 CVE-2016-2538 CVE-2016-2392
CVE-2016-2391 CVE-2016-2271 CVE-2016-2270
CVE-2016-2198 CVE-2016-1981 CVE-2016-1922
CVE-2016-1714 CVE-2016-1571 CVE-2016-1570
CVE-2016-1568 CVE-2015-8818 CVE-2015-8817
CVE-2015-8745 CVE-2015-8744 CVE-2015-8743
CVE-2015-8619 CVE-2015-8613 CVE-2015-8568
CVE-2015-8567 CVE-2015-8558 CVE-2015-8555
CVE-2015-8554 CVE-2015-8550 CVE-2015-8504
CVE-2015-8345 CVE-2015-7549 CVE-2015-7512
CVE-2015-6855 CVE-2015-5278 CVE-2015-1779
CVE-2014-9718 CVE-2014-7815 CVE-2014-3689
CVE-2014-3640 CVE-2014-0222 CVE-2013-4539
CVE-2013-4538 CVE-2013-4537 CVE-2013-4534
CVE-2013-4533 CVE-2013-4530 CVE-2013-4529
CVE-2013-4527
Reference: ESB-2016.0416
ESB-2016.0161
ESB-2015.3218
- --------------------------BEGIN INCLUDED TEXT--------------------
SUSE Security Update: Security update for xen
______________________________________________________________________________
Announcement ID: SUSE-SU-2016:0955-1
Rating: important
References: #864391 #864655 #864673 #864678 #864682 #864769
#864805 #864811 #877642 #897654 #901508 #902737
#924018 #928393 #945404 #945989 #954872 #956829
#957162 #957988 #958007 #958009 #958491 #958523
#958917 #959005 #959387 #959695 #959928 #960334
#960707 #960725 #960835 #960861 #960862 #961332
#961358 #961691 #962320 #963782 #963923 #964413
#965315 #965317 #967012 #967013 #967630 #967969
#969121 #969122 #969350
Cross-References: CVE-2013-4527 CVE-2013-4529 CVE-2013-4530
CVE-2013-4533 CVE-2013-4534 CVE-2013-4537
CVE-2013-4538 CVE-2013-4539 CVE-2014-0222
CVE-2014-3640 CVE-2014-3689 CVE-2014-7815
CVE-2014-9718 CVE-2015-1779 CVE-2015-5278
CVE-2015-6855 CVE-2015-7512 CVE-2015-7549
CVE-2015-8345 CVE-2015-8504 CVE-2015-8550
CVE-2015-8554 CVE-2015-8555 CVE-2015-8558
CVE-2015-8567 CVE-2015-8568 CVE-2015-8613
CVE-2015-8619 CVE-2015-8743 CVE-2015-8744
CVE-2015-8745 CVE-2015-8817 CVE-2015-8818
CVE-2016-1568 CVE-2016-1570 CVE-2016-1571
CVE-2016-1714 CVE-2016-1922 CVE-2016-1981
CVE-2016-2198 CVE-2016-2270 CVE-2016-2271
CVE-2016-2391 CVE-2016-2392 CVE-2016-2538
CVE-2016-2841
Affected Products:
SUSE Linux Enterprise Software Development Kit 11-SP4
SUSE Linux Enterprise Server 11-SP4
SUSE Linux Enterprise Desktop 11-SP4
SUSE Linux Enterprise Debuginfo 11-SP4
______________________________________________________________________________
An update that solves 46 vulnerabilities and has 5 fixes is
now available.
Description:
xen was updated to fix 47 security issues.
These security issues were fixed:
- CVE-2013-4527: Buffer overflow in hw/timer/hpet.c might have allowed
remote attackers to execute arbitrary code via vectors related to the
number of timers (bnc#864673).
- CVE-2013-4529: Buffer overflow in hw/pci/pcie_aer.c allowed remote
attackers to cause a denial of service and possibly execute arbitrary
code via a large log_num value in a savevm image (bnc#864678).
- CVE-2013-4530: Buffer overflow in hw/ssi/pl022.c allowed remote
attackers to cause a denial of service or possibly execute arbitrary
code via crafted tx_fifo_head and rx_fifo_head values in a savevm image
(bnc#864682).
- CVE-2013-4533: Buffer overflow in the pxa2xx_ssp_load function in
hw/arm/pxa2xx.c allowed remote attackers to cause a denial of service or
possibly execute arbitrary code via a crafted s->rx_level value in a
savevm image (bsc#864655).
- CVE-2013-4534: Buffer overflow in hw/intc/openpic.c allowed remote
attackers to cause a denial of service or possibly execute arbitrary
code via vectors related to IRQDest elements (bsc#864811).
- CVE-2013-4537: The ssi_sd_transfer function in hw/sd/ssi-sd.c allowed
remote attackers to execute arbitrary code via a crafted arglen value in
a savevm image (bsc#864391).
- CVE-2013-4538: Multiple buffer overflows in the ssd0323_load function in
hw/display/ssd0323.c allowed remote attackers to cause a denial of
service (memory corruption) or possibly execute arbitrary code via
crafted (1) cmd_len, (2) row, or (3) col values; (4) row_start and
row_end values; or (5) col_star and col_end values in a savevm image
(bsc#864769).
- CVE-2013-4539: Multiple buffer overflows in the tsc210x_load function in
hw/input/tsc210x.c might have allowed remote attackers to execute
arbitrary code via a crafted (1) precision, (2) nextprecision, (3)
function, or (4) nextfunction value in a savevm image (bsc#864805).
- CVE-2014-0222: Integer overflow in the qcow_open function in
block/qcow.c allowed remote attackers to cause a denial of service
(crash) via a large L2 table in a QCOW version 1 image (bsc#877642).
- CVE-2014-3640: The sosendto function in slirp/udp.c allowed local users
to cause a denial of service (NULL pointer dereference) by sending a udp
packet with a value of 0 in the source port and address, which triggers
access of an uninitialized socket (bsc#897654).
- CVE-2014-3689: The vmware-vga driver (hw/display/vmware_vga.c) allowed
local guest users to write to qemu memory locations and gain privileges
via unspecified parameters related to rectangle handling (bsc#901508).
- CVE-2014-7815: The set_pixel_format function in ui/vnc.c allowed remote
attackers to cause a denial of service (crash) via a small
bytes_per_pixel value (bsc#902737).
- CVE-2014-9718: The (1) BMDMA and (2) AHCI HBA interfaces in the IDE
functionality had multiple interpretations of a function's return value,
which allowed guest OS users to cause a host OS denial of service
(memory consumption or infinite loop, and system crash) via a PRDT with
zero complete sectors, related to the bmdma_prepare_buf and
ahci_dma_prepare_buf functions (bsc#928393).
- CVE-2015-1779: The VNC websocket frame decoder allowed remote attackers
to cause a denial of service (memory and CPU consumption) via a large
(1) websocket payload or (2) HTTP headers section (bsc#924018).
- CVE-2015-5278: Infinite loop in ne2000_receive() function (bsc#945989).
- CVE-2015-6855: hw/ide/core.c did not properly restrict the commands
accepted by an ATAPI device, which allowed guest users to cause a denial
of service or possibly have unspecified other impact via certain IDE
commands, as demonstrated by a WIN_READ_NATIVE_MAX command to an empty
drive, which triggers a divide-by-zero error and instance crash
(bsc#945404).
- CVE-2015-7512: Buffer overflow in the pcnet_receive function in
hw/net/pcnet.c, when a guest NIC has a larger MTU, allowed remote
attackers to cause a denial of service (guest OS crash) or execute
arbitrary code via a large packet (bsc#957162).
- CVE-2015-7549: pci: NULL pointer dereference issue (bsc#958917).
- CVE-2015-8345: eepro100: infinite loop in processing command block list
(bsc#956829).
- CVE-2015-8504: VNC: floating point exception (bsc#958491).
- CVE-2015-8550: Paravirtualized drivers were incautious about shared
memory contents (XSA-155) (bsc#957988).
- CVE-2015-8554: qemu-dm buffer overrun in MSI-X handling (XSA-164)
(bsc#958007).
- CVE-2015-8555: Information leak in legacy x86 FPU/XMM initialization
(XSA-165) (bsc#958009).
- CVE-2015-8558: Infinite loop in ehci_advance_state resulted in DoS
(bsc#959005).
- CVE-2015-8567: vmxnet3: host memory leakage (bsc#959387).
- CVE-2015-8568: vmxnet3: host memory leakage (bsc#959387).
- CVE-2015-8613: SCSI: stack based buffer overflow in
megasas_ctrl_get_info (bsc#961358).
- CVE-2015-8619: Stack based OOB write in hmp_sendkey routine (bsc#960334).
- CVE-2015-8743: ne2000: OOB memory access in ioport r/w functions
(bsc#960725).
- CVE-2015-8744: vmxnet3: Incorrect l2 header validation lead to a crash
via assert(2) call (bsc#960835).
- CVE-2015-8745: Reading IMR registers lead to a crash via assert(2) call
(bsc#960707).
- CVE-2015-8817: OOB access in address_space_rw lead to segmentation fault
(I) (bsc#969121).
- CVE-2015-8818: OOB access in address_space_rw lead to segmentation fault
(II) (bsc#969122).
- CVE-2016-1568: AHCI use-after-free vulnerability in aio port commands
(bsc#961332).
- CVE-2016-1570: The PV superpage functionality in arch/x86/mm.c allowed
local PV guests to obtain sensitive information, cause a denial of
service, gain privileges, or have unspecified other impact via a crafted
page identifier (MFN) to the (1) MMUEXT_MARK_SUPER or (2)
MMUEXT_UNMARK_SUPER sub-op in the HYPERVISOR_mmuext_op hypercall or (3)
unknown vectors related to page table updates (bsc#960861).
- CVE-2016-1571: VMX: intercept issue with INVLPG on non-canonical address
(XSA-168) (bsc#960862).
- CVE-2016-1714: nvram: OOB r/w access in processing firmware
configurations (bsc#961691).
- CVE-2016-1922: NULL pointer dereference in vapic_write() (bsc#962320).
- CVE-2016-1981: e1000 infinite loop in start_xmit and e1000_receive_iov
routines (bsc#963782).
- CVE-2016-2198: EHCI NULL pointer dereference in ehci_caps_write
(bsc#964413).
- CVE-2016-2270: Xen allowed local guest administrators to cause a denial
of service (host reboot) via vectors related to multiple mappings of
MMIO pages with different cachability settings (bsc#965315).
- CVE-2016-2271: VMX when using an Intel or Cyrix CPU, allowed local HVM
guest users to cause a denial of service (guest crash) via vectors
related to a non-canonical RIP (bsc#965317).
- CVE-2016-2391: usb: multiple eof_timers in ohci module lead to NULL
pointer dereference (bsc#967013).
- CVE-2016-2392: NULL pointer dereference in remote NDIS control message
handling (bsc#967012).
- CVE-2016-2538: Integer overflow in remote NDIS control message handling
(bsc#967969).
- CVE-2016-2841: ne2000: Infinite loop in ne2000_receive (bsc#969350).
- XSA-166: ioreq handling possibly susceptible to multiple read issue
(bsc#958523).
These non-security issues were fixed:
- bsc#954872: script block-dmmd not working as expected
- bsc#963923: domain weights not honored when sched-credit tslice is
reduced
- bsc#959695: Missing docs for xen
- bsc#967630: Discrepancy in reported memory size with correction XSA-153
for xend
- bsc#959928: When DomU is in state running xm domstate returned nothing
Patch Instructions:
To install this SUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:
- SUSE Linux Enterprise Software Development Kit 11-SP4:
zypper in -t patch sdksp4-xen-12492=1
- SUSE Linux Enterprise Server 11-SP4:
zypper in -t patch slessp4-xen-12492=1
- SUSE Linux Enterprise Desktop 11-SP4:
zypper in -t patch sledsp4-xen-12492=1
- SUSE Linux Enterprise Debuginfo 11-SP4:
zypper in -t patch dbgsp4-xen-12492=1
To bring your system up-to-date, use "zypper patch".
Package List:
- SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 x86_64):
xen-devel-4.4.4_02-32.1
- SUSE Linux Enterprise Server 11-SP4 (i586 x86_64):
xen-kmp-default-4.4.4_02_3.0.101_68-32.1
xen-libs-4.4.4_02-32.1
xen-tools-domU-4.4.4_02-32.1
- SUSE Linux Enterprise Server 11-SP4 (x86_64):
xen-4.4.4_02-32.1
xen-doc-html-4.4.4_02-32.1
xen-libs-32bit-4.4.4_02-32.1
xen-tools-4.4.4_02-32.1
- SUSE Linux Enterprise Server 11-SP4 (i586):
xen-kmp-pae-4.4.4_02_3.0.101_68-32.1
- SUSE Linux Enterprise Desktop 11-SP4 (i586 x86_64):
xen-kmp-default-4.4.4_02_3.0.101_68-32.1
xen-libs-4.4.4_02-32.1
xen-tools-domU-4.4.4_02-32.1
- SUSE Linux Enterprise Desktop 11-SP4 (x86_64):
xen-4.4.4_02-32.1
xen-doc-html-4.4.4_02-32.1
xen-libs-32bit-4.4.4_02-32.1
xen-tools-4.4.4_02-32.1
- SUSE Linux Enterprise Desktop 11-SP4 (i586):
xen-kmp-pae-4.4.4_02_3.0.101_68-32.1
- SUSE Linux Enterprise Debuginfo 11-SP4 (i586 x86_64):
xen-debuginfo-4.4.4_02-32.1
xen-debugsource-4.4.4_02-32.1
References:
https://www.suse.com/security/cve/CVE-2013-4527.html
https://www.suse.com/security/cve/CVE-2013-4529.html
https://www.suse.com/security/cve/CVE-2013-4530.html
https://www.suse.com/security/cve/CVE-2013-4533.html
https://www.suse.com/security/cve/CVE-2013-4534.html
https://www.suse.com/security/cve/CVE-2013-4537.html
https://www.suse.com/security/cve/CVE-2013-4538.html
https://www.suse.com/security/cve/CVE-2013-4539.html
https://www.suse.com/security/cve/CVE-2014-0222.html
https://www.suse.com/security/cve/CVE-2014-3640.html
https://www.suse.com/security/cve/CVE-2014-3689.html
https://www.suse.com/security/cve/CVE-2014-7815.html
https://www.suse.com/security/cve/CVE-2014-9718.html
https://www.suse.com/security/cve/CVE-2015-1779.html
https://www.suse.com/security/cve/CVE-2015-5278.html
https://www.suse.com/security/cve/CVE-2015-6855.html
https://www.suse.com/security/cve/CVE-2015-7512.html
https://www.suse.com/security/cve/CVE-2015-7549.html
https://www.suse.com/security/cve/CVE-2015-8345.html
https://www.suse.com/security/cve/CVE-2015-8504.html
https://www.suse.com/security/cve/CVE-2015-8550.html
https://www.suse.com/security/cve/CVE-2015-8554.html
https://www.suse.com/security/cve/CVE-2015-8555.html
https://www.suse.com/security/cve/CVE-2015-8558.html
https://www.suse.com/security/cve/CVE-2015-8567.html
https://www.suse.com/security/cve/CVE-2015-8568.html
https://www.suse.com/security/cve/CVE-2015-8613.html
https://www.suse.com/security/cve/CVE-2015-8619.html
https://www.suse.com/security/cve/CVE-2015-8743.html
https://www.suse.com/security/cve/CVE-2015-8744.html
https://www.suse.com/security/cve/CVE-2015-8745.html
https://www.suse.com/security/cve/CVE-2015-8817.html
https://www.suse.com/security/cve/CVE-2015-8818.html
https://www.suse.com/security/cve/CVE-2016-1568.html
https://www.suse.com/security/cve/CVE-2016-1570.html
https://www.suse.com/security/cve/CVE-2016-1571.html
https://www.suse.com/security/cve/CVE-2016-1714.html
https://www.suse.com/security/cve/CVE-2016-1922.html
https://www.suse.com/security/cve/CVE-2016-1981.html
https://www.suse.com/security/cve/CVE-2016-2198.html
https://www.suse.com/security/cve/CVE-2016-2270.html
https://www.suse.com/security/cve/CVE-2016-2271.html
https://www.suse.com/security/cve/CVE-2016-2391.html
https://www.suse.com/security/cve/CVE-2016-2392.html
https://www.suse.com/security/cve/CVE-2016-2538.html
https://www.suse.com/security/cve/CVE-2016-2841.html
https://bugzilla.suse.com/864391
https://bugzilla.suse.com/864655
https://bugzilla.suse.com/864673
https://bugzilla.suse.com/864678
https://bugzilla.suse.com/864682
https://bugzilla.suse.com/864769
https://bugzilla.suse.com/864805
https://bugzilla.suse.com/864811
https://bugzilla.suse.com/877642
https://bugzilla.suse.com/897654
https://bugzilla.suse.com/901508
https://bugzilla.suse.com/902737
https://bugzilla.suse.com/924018
https://bugzilla.suse.com/928393
https://bugzilla.suse.com/945404
https://bugzilla.suse.com/945989
https://bugzilla.suse.com/954872
https://bugzilla.suse.com/956829
https://bugzilla.suse.com/957162
https://bugzilla.suse.com/957988
https://bugzilla.suse.com/958007
https://bugzilla.suse.com/958009
https://bugzilla.suse.com/958491
https://bugzilla.suse.com/958523
https://bugzilla.suse.com/958917
https://bugzilla.suse.com/959005
https://bugzilla.suse.com/959387
https://bugzilla.suse.com/959695
https://bugzilla.suse.com/959928
https://bugzilla.suse.com/960334
https://bugzilla.suse.com/960707
https://bugzilla.suse.com/960725
https://bugzilla.suse.com/960835
https://bugzilla.suse.com/960861
https://bugzilla.suse.com/960862
https://bugzilla.suse.com/961332
https://bugzilla.suse.com/961358
https://bugzilla.suse.com/961691
https://bugzilla.suse.com/962320
https://bugzilla.suse.com/963782
https://bugzilla.suse.com/963923
https://bugzilla.suse.com/964413
https://bugzilla.suse.com/965315
https://bugzilla.suse.com/965317
https://bugzilla.suse.com/967012
https://bugzilla.suse.com/967013
https://bugzilla.suse.com/967630
https://bugzilla.suse.com/967969
https://bugzilla.suse.com/969121
https://bugzilla.suse.com/969122
https://bugzilla.suse.com/969350
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBVwSq6H6ZAP0PgtI9AQKb2Q/+KQ41BHcRg4uQ6rrlw+bz8+DCCr15oIfP
8Km3F7szBOjH3/3trMDVpWIAkrdLNsukvQ1dsx9H2C5gemWpvRJPn8IpkOAFgnnu
udJaREgf85Jwyc5gTbJpOq/nMGqFwlCB2L5FAjCijzVYtKtasvVtsWhqDwNaasxR
bbYtBWjo2klZaRUMhF7+XaXde/D9yxJ9QmqO44fQUFkCb7Qn05C1AbDJkcuJhQgr
5rTvq3MlVE7kO1bvJzKgwhSjpZjkOgCyTVimEkz7o/WT3tSCHA1i3X0NWvB/Ek4N
jb2+MVQGysrE/bQk0whfqRlX7GqHRFMcxL0m30VO4n/a3vh51Wy6wfej1UF1FCeM
tgY07paMBcb76JmkvdKRYCOsm70gaYY8TptXd7wVnwU+BYVIUR1Z4WD/mti+f4Ik
osCOrBtPdr94QB18AKbLnhjFfEdfzCIQZAFA7B4pf3RUswvpYLdZex/jNvj3vZxx
//OIFPjRW+4g26wQdSbc8qhSdZGCAGyEI8+tBUxInXJ5seau25zkLbc8flfoGU9B
jeu4g/SLFBfycxARKVXWD7ouWk5SQJ+3vyXer9xJF0otKXFYyWwgtEZcXPbMvUnC
Hlp6UTJfI/eUzd6h1NQFCZghZ2ba7CPsawgmwJM91nW4Y6wtv3h3EFcMtc0SG/Uz
By826zERZ/o=
=PabG
-----END PGP SIGNATURE-----