-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2016.1675
               SUSE Security Update: Security update for xen
                                7 July 2016

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:          xen
Publisher:        SUSE
Operating System: SUSE
Impact/Access:    Execute Arbitrary Code/Commands -- Existing Account
                  Increased Privileges            -- Existing Account
                  Modify Arbitrary Files          -- Existing Account
                  Denial of Service               -- Existing Account
                  Access Confidential Data        -- Existing Account
                  Reduced Security                -- Existing Account
Resolution:       Patch/Upgrade
CVE Names:        CVE-2016-2841 CVE-2016-2538 CVE-2016-2392
                  CVE-2016-2391 CVE-2016-2271 CVE-2016-2270
                  CVE-2016-1981 CVE-2016-1714 CVE-2016-1571
                  CVE-2016-1570 CVE-2016-1568 CVE-2015-8745
                  CVE-2015-8743 CVE-2015-8558 CVE-2015-8555
                  CVE-2015-8554 CVE-2015-8550 CVE-2015-8504
                  CVE-2015-8345 CVE-2015-7512 CVE-2015-6855
                  CVE-2015-5278 CVE-2014-9718 CVE-2014-7815
                  CVE-2014-3689 CVE-2014-3640 CVE-2014-0222
                  CVE-2013-4539 CVE-2013-4538 CVE-2013-4537
                  CVE-2013-4534 CVE-2013-4533 CVE-2013-4530
                  CVE-2013-4529 CVE-2013-4527 

Reference:        ESB-2016.0862
                  ESB-2016.0803
                  ESB-2016.0416
                  ESB-2016.0161
                  ESB-2015.3218

- --------------------------BEGIN INCLUDED TEXT--------------------

   SUSE Security Update: Security update for xen
______________________________________________________________________________

Announcement ID:    SUSE-SU-2016:1745-1
Rating:             important
References:         #864391 #864655 #864673 #864678 #864682 #864769 
                    #864805 #864811 #877642 #897654 #901508 #902737 
                    #928393 #945404 #945989 #954872 #956829 #957162 
                    #957988 #958007 #958009 #958491 #958523 #959005 
                    #959695 #959928 #960707 #960725 #960861 #960862 
                    #961332 #961691 #963782 #965315 #965317 #967012 
                    #967013 #967630 #967969 #969350 
Cross-References:   CVE-2013-4527 CVE-2013-4529 CVE-2013-4530
                    CVE-2013-4533 CVE-2013-4534 CVE-2013-4537
                    CVE-2013-4538 CVE-2013-4539 CVE-2014-0222
                    CVE-2014-3640 CVE-2014-3689 CVE-2014-7815
                    CVE-2014-9718 CVE-2015-5278 CVE-2015-6855
                    CVE-2015-7512 CVE-2015-8345 CVE-2015-8504
                    CVE-2015-8550 CVE-2015-8554 CVE-2015-8555
                    CVE-2015-8558 CVE-2015-8743 CVE-2015-8745
                    CVE-2016-1568 CVE-2016-1570 CVE-2016-1571
                    CVE-2016-1714 CVE-2016-1981 CVE-2016-2270
                    CVE-2016-2271 CVE-2016-2391 CVE-2016-2392
                    CVE-2016-2538 CVE-2016-2841
Affected Products:
                    SUSE Linux Enterprise Server 11-SP3-LTSS
                    SUSE Linux Enterprise Debuginfo 11-SP3
______________________________________________________________________________

   An update that solves 35 vulnerabilities and has 5 fixes is
   now available.

Description:

   xen was updated to fix 36 security issues.

   These security issues were fixed:
   - CVE-2013-4527: Buffer overflow in hw/timer/hpet.c might have allowed
     remote attackers to execute arbitrary code via vectors related to the
     number of timers (bnc#864673).
   - CVE-2013-4529: Buffer overflow in hw/pci/pcie_aer.c allowed remote
     attackers to cause a denial of service and possibly execute arbitrary
     code via a large log_num value in a savevm image (bnc#864678).
   - CVE-2013-4530: Buffer overflow in hw/ssi/pl022.c allowed remote
     attackers to cause a denial of service or possibly execute arbitrary
     code via crafted tx_fifo_head and rx_fifo_head values in a savevm image
     (bnc#864682).
   - CVE-2013-4533: Buffer overflow in the pxa2xx_ssp_load function in
     hw/arm/pxa2xx.c allowed remote attackers to cause a denial of service or
     possibly execute arbitrary code via a crafted s->rx_level value in a
     savevm image (bsc#864655).
   - CVE-2013-4534: Buffer overflow in hw/intc/openpic.c allowed remote
     attackers to cause a denial of service or possibly execute arbitrary
     code via vectors related to IRQDest elements (bsc#864811).
   - CVE-2013-4537: The ssi_sd_transfer function in hw/sd/ssi-sd.c allowed
     remote attackers to execute arbitrary code via a crafted arglen value in
     a savevm image (bsc#864391).
   - CVE-2013-4538: Multiple buffer overflows in the ssd0323_load function in
     hw/display/ssd0323.c allowed remote attackers to cause a denial of
     service (memory corruption) or possibly execute arbitrary code via
     crafted (1) cmd_len, (2) row, or (3) col values; (4) row_start and
     row_end values; or (5) col_star and col_end values in a savevm image
     (bsc#864769).
   - CVE-2013-4539: Multiple buffer overflows in the tsc210x_load function in
     hw/input/tsc210x.c might have allowed remote attackers to execute
     arbitrary code via a crafted (1) precision, (2) nextprecision, (3)
     function, or (4) nextfunction value in a savevm image (bsc#864805).
   - CVE-2014-0222: Integer overflow in the qcow_open function in
     block/qcow.c allowed remote attackers to cause a denial of service
     (crash) via a large L2 table in a QCOW version 1 image (bsc#877642).
   - CVE-2014-3640: The sosendto function in slirp/udp.c allowed local users
     to cause a denial of service (NULL pointer dereference) by sending a udp
     packet with a value of 0 in the source port and address, which triggers
     access of an uninitialized socket (bsc#897654).
   - CVE-2014-3689: The vmware-vga driver (hw/display/vmware_vga.c) allowed
     local guest users to write to qemu memory locations and gain privileges
     via unspecified parameters related to rectangle handling (bsc#901508).
   - CVE-2014-7815: The set_pixel_format function in ui/vnc.c allowed remote
     attackers to cause a denial of service (crash) via a small
     bytes_per_pixel value (bsc#902737).
   - CVE-2014-9718: The (1) BMDMA and (2) AHCI HBA interfaces in the IDE
     functionality had multiple interpretations of a function's return value,
     which allowed guest OS users to cause a host OS denial of service
     (memory consumption or infinite loop, and system crash) via a PRDT with
     zero complete sectors, related to the bmdma_prepare_buf and
     ahci_dma_prepare_buf functions (bsc#928393).
   - CVE-2015-5278: Infinite loop in ne2000_receive() function (bsc#945989).
   - CVE-2015-6855: hw/ide/core.c did not properly restrict the commands
     accepted by an ATAPI device, which allowed guest users to cause a denial
     of service or possibly have unspecified other impact via certain IDE
     commands, as demonstrated by a WIN_READ_NATIVE_MAX command to an empty
     drive, which triggers a divide-by-zero error and instance crash
     (bsc#945404).
   - CVE-2015-7512: Buffer overflow in the pcnet_receive function in
     hw/net/pcnet.c, when a guest NIC has a larger MTU, allowed remote
     attackers to cause a denial of service (guest OS crash) or execute
     arbitrary code via a large packet (bsc#957162).
   - CVE-2015-8345: eepro100: infinite loop in processing command block list
     (bsc#956829).
   - CVE-2015-8504: VNC: floating point exception (bsc#958491).
   - CVE-2015-8550: Paravirtualized drivers were incautious about shared
     memory contents (XSA-155) (bsc#957988).
   - CVE-2015-8554: qemu-dm buffer overrun in MSI-X handling (XSA-164)
     (bsc#958007).
   - CVE-2015-8555: Information leak in legacy x86 FPU/XMM initialization
     (XSA-165) (bsc#958009).
   - CVE-2015-8558: Infinite loop in ehci_advance_state resulted in DoS
     (bsc#959005).
   - CVE-2015-8743: ne2000: OOB memory access in ioport r/w functions
     (bsc#960725).
   - CVE-2015-8745: Reading IMR registers lead to a crash via assert(2) call
     (bsc#960707).
   - CVE-2016-1568: AHCI use-after-free vulnerability in aio port commands
     (bsc#961332).
   - CVE-2016-1570: The PV superpage functionality in arch/x86/mm.c allowed
     local PV guests to obtain sensitive information, cause a denial of
     service, gain privileges, or have unspecified other impact via a crafted
     page identifier (MFN) to the (1) MMUEXT_MARK_SUPER or (2)
     MMUEXT_UNMARK_SUPER sub-op in the HYPERVISOR_mmuext_op hypercall or (3)
     unknown vectors related to page table updates (bsc#960861).
   - CVE-2016-1571: VMX: intercept issue with INVLPG on non-canonical address
     (XSA-168) (bsc#960862).
   - CVE-2016-1714: nvram: OOB r/w access in processing firmware
     configurations (bsc#961691).
   - CVE-2016-1981: e1000 infinite loop in start_xmit and e1000_receive_iov
     routines (bsc#963782).
   - CVE-2016-2270: Xen allowed local guest administrators to cause a denial
     of service (host reboot) via vectors related to multiple mappings of
     MMIO pages with different cachability settings (bsc#965315).
   - CVE-2016-2271: VMX when using an Intel or Cyrix CPU, allowed local HVM
     guest users to cause a denial of service (guest crash) via vectors
     related to a non-canonical RIP (bsc#965317).
   - CVE-2016-2391: usb: multiple eof_timers in ohci module lead to NULL
     pointer dereference (bsc#967013).
   - CVE-2016-2392: NULL pointer dereference in remote NDIS control message
     handling (bsc#967012).
   - CVE-2016-2538: Integer overflow in remote NDIS control message handling
     (bsc#967969).
   - CVE-2016-2841: ne2000: Infinite loop in ne2000_receive (bsc#969350).
   - XSA-166: ioreq handling possibly susceptible to multiple read issue
     (bsc#958523).

   These non-security issues were fixed:
   - bsc#954872: script block-dmmd not working as expected
   - bsc#959695: Missing docs for xen
   - bsc#967630: Discrepancy in reported memory size with correction XSA-153
     for xend
   - bsc#959928: When DomU is in state running xm domstate returned nothing


Patch Instructions:

   To install this SUSE Security Update use YaST online_update.
   Alternatively you can run the command listed for your product:

   - SUSE Linux Enterprise Server 11-SP3-LTSS:

      zypper in -t patch slessp3-xen-12639=1

   - SUSE Linux Enterprise Debuginfo 11-SP3:

      zypper in -t patch dbgsp3-xen-12639=1

   To bring your system up-to-date, use "zypper patch".


Package List:

   - SUSE Linux Enterprise Server 11-SP3-LTSS (i586 x86_64):

      xen-kmp-default-4.2.5_20_3.0.101_0.47.79-24.9
      xen-libs-4.2.5_20-24.9
      xen-tools-domU-4.2.5_20-24.9

   - SUSE Linux Enterprise Server 11-SP3-LTSS (x86_64):

      xen-4.2.5_20-24.9
      xen-doc-html-4.2.5_20-24.9
      xen-doc-pdf-4.2.5_20-24.9
      xen-libs-32bit-4.2.5_20-24.9
      xen-tools-4.2.5_20-24.9

   - SUSE Linux Enterprise Server 11-SP3-LTSS (i586):

      xen-kmp-pae-4.2.5_20_3.0.101_0.47.79-24.9

   - SUSE Linux Enterprise Debuginfo 11-SP3 (i586 x86_64):

      xen-debuginfo-4.2.5_20-24.9
      xen-debugsource-4.2.5_20-24.9


References:

   https://www.suse.com/security/cve/CVE-2013-4527.html
   https://www.suse.com/security/cve/CVE-2013-4529.html
   https://www.suse.com/security/cve/CVE-2013-4530.html
   https://www.suse.com/security/cve/CVE-2013-4533.html
   https://www.suse.com/security/cve/CVE-2013-4534.html
   https://www.suse.com/security/cve/CVE-2013-4537.html
   https://www.suse.com/security/cve/CVE-2013-4538.html
   https://www.suse.com/security/cve/CVE-2013-4539.html
   https://www.suse.com/security/cve/CVE-2014-0222.html
   https://www.suse.com/security/cve/CVE-2014-3640.html
   https://www.suse.com/security/cve/CVE-2014-3689.html
   https://www.suse.com/security/cve/CVE-2014-7815.html
   https://www.suse.com/security/cve/CVE-2014-9718.html
   https://www.suse.com/security/cve/CVE-2015-5278.html
   https://www.suse.com/security/cve/CVE-2015-6855.html
   https://www.suse.com/security/cve/CVE-2015-7512.html
   https://www.suse.com/security/cve/CVE-2015-8345.html
   https://www.suse.com/security/cve/CVE-2015-8504.html
   https://www.suse.com/security/cve/CVE-2015-8550.html
   https://www.suse.com/security/cve/CVE-2015-8554.html
   https://www.suse.com/security/cve/CVE-2015-8555.html
   https://www.suse.com/security/cve/CVE-2015-8558.html
   https://www.suse.com/security/cve/CVE-2015-8743.html
   https://www.suse.com/security/cve/CVE-2015-8745.html
   https://www.suse.com/security/cve/CVE-2016-1568.html
   https://www.suse.com/security/cve/CVE-2016-1570.html
   https://www.suse.com/security/cve/CVE-2016-1571.html
   https://www.suse.com/security/cve/CVE-2016-1714.html
   https://www.suse.com/security/cve/CVE-2016-1981.html
   https://www.suse.com/security/cve/CVE-2016-2270.html
   https://www.suse.com/security/cve/CVE-2016-2271.html
   https://www.suse.com/security/cve/CVE-2016-2391.html
   https://www.suse.com/security/cve/CVE-2016-2392.html
   https://www.suse.com/security/cve/CVE-2016-2538.html
   https://www.suse.com/security/cve/CVE-2016-2841.html
   https://bugzilla.suse.com/864391
   https://bugzilla.suse.com/864655
   https://bugzilla.suse.com/864673
   https://bugzilla.suse.com/864678
   https://bugzilla.suse.com/864682
   https://bugzilla.suse.com/864769
   https://bugzilla.suse.com/864805
   https://bugzilla.suse.com/864811
   https://bugzilla.suse.com/877642
   https://bugzilla.suse.com/897654
   https://bugzilla.suse.com/901508
   https://bugzilla.suse.com/902737
   https://bugzilla.suse.com/928393
   https://bugzilla.suse.com/945404
   https://bugzilla.suse.com/945989
   https://bugzilla.suse.com/954872
   https://bugzilla.suse.com/956829
   https://bugzilla.suse.com/957162
   https://bugzilla.suse.com/957988
   https://bugzilla.suse.com/958007
   https://bugzilla.suse.com/958009
   https://bugzilla.suse.com/958491
   https://bugzilla.suse.com/958523
   https://bugzilla.suse.com/959005
   https://bugzilla.suse.com/959695
   https://bugzilla.suse.com/959928
   https://bugzilla.suse.com/960707
   https://bugzilla.suse.com/960725
   https://bugzilla.suse.com/960861
   https://bugzilla.suse.com/960862
   https://bugzilla.suse.com/961332
   https://bugzilla.suse.com/961691
   https://bugzilla.suse.com/963782
   https://bugzilla.suse.com/965315
   https://bugzilla.suse.com/965317
   https://bugzilla.suse.com/967012
   https://bugzilla.suse.com/967013
   https://bugzilla.suse.com/967630
   https://bugzilla.suse.com/967969
   https://bugzilla.suse.com/969350

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBV32qLYx+lLeg9Ub1AQjWiA/+PFJ0EHNbXQA/ptJIVU+MSOD8UanxPD4j
6oJAq5rJO5HKprAKoxeDdimOZnuQVOSnUd1NDKksg222bUKmKTQAz/idxaGLHBhK
pGKtwa8Z6BgHvDOPRx4z4ZcQSx917A/RbtzeyyJ89PYxaeUucX4ADNcaNPUpUXeF
GLTJ6p5IHgPu0+t2kuFuadjPn5ivYOlp2u6fYkJXN9p1PIZl74jCp1ow83BQalZy
XYS+tV5jF5hVWMSLMagFalprZmoYmd9rQtaTYfibU2E9UpHeEOjO2CD1Wetx6Kqq
jPXjeMea5842AGwb3Li6y+vaoJXamd8s5c0qysaB/wQ5248vW8hSo8ODUH1PNFHH
UlQtzNyrlzdIgs5SXTCVrAe/WCb1HdqU0wJmOePTn+7Whtzz6qDnoo+10/FgG+1i
jsO48M6562/GcH3ZJoF3K0qAz4l1o1OYZKNspDOb9ELGnqcCIi9r9W1EfMf5S6x2
ZY8EIqj7VnZrrHwJAQhBQniVVQQYXzveGMC/oHyhsEQyY9qL3KCF28AmBdiz8Gr8
4jUXARhV2U458HnGvLN/b2FKY2HjIyNLUq5jeyzaPWZns/eNBwnl14e92h14Tc5b
XW0UdJid4Z3+2TaQf0wfyGX4JYY8weP1EhxnmfNO0d/HkspzViDe3KhlN0PpTFEs
b2rjY88gnO4=
=t3Tn
-----END PGP SIGNATURE-----