Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2016.1675
SUSE Security Update: Security update for xen
7 July 2016
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: xen
Publisher: SUSE
Operating System: SUSE
Impact/Access: Execute Arbitrary Code/Commands -- Existing Account
Increased Privileges -- Existing Account
Modify Arbitrary Files -- Existing Account
Denial of Service -- Existing Account
Access Confidential Data -- Existing Account
Reduced Security -- Existing Account
Resolution: Patch/Upgrade
CVE Names: CVE-2016-2841 CVE-2016-2538 CVE-2016-2392
CVE-2016-2391 CVE-2016-2271 CVE-2016-2270
CVE-2016-1981 CVE-2016-1714 CVE-2016-1571
CVE-2016-1570 CVE-2016-1568 CVE-2015-8745
CVE-2015-8743 CVE-2015-8558 CVE-2015-8555
CVE-2015-8554 CVE-2015-8550 CVE-2015-8504
CVE-2015-8345 CVE-2015-7512 CVE-2015-6855
CVE-2015-5278 CVE-2014-9718 CVE-2014-7815
CVE-2014-3689 CVE-2014-3640 CVE-2014-0222
CVE-2013-4539 CVE-2013-4538 CVE-2013-4537
CVE-2013-4534 CVE-2013-4533 CVE-2013-4530
CVE-2013-4529 CVE-2013-4527
Reference: ESB-2016.0862
ESB-2016.0803
ESB-2016.0416
ESB-2016.0161
ESB-2015.3218
- --------------------------BEGIN INCLUDED TEXT--------------------
SUSE Security Update: Security update for xen
______________________________________________________________________________
Announcement ID: SUSE-SU-2016:1745-1
Rating: important
References: #864391 #864655 #864673 #864678 #864682 #864769
#864805 #864811 #877642 #897654 #901508 #902737
#928393 #945404 #945989 #954872 #956829 #957162
#957988 #958007 #958009 #958491 #958523 #959005
#959695 #959928 #960707 #960725 #960861 #960862
#961332 #961691 #963782 #965315 #965317 #967012
#967013 #967630 #967969 #969350
Cross-References: CVE-2013-4527 CVE-2013-4529 CVE-2013-4530
CVE-2013-4533 CVE-2013-4534 CVE-2013-4537
CVE-2013-4538 CVE-2013-4539 CVE-2014-0222
CVE-2014-3640 CVE-2014-3689 CVE-2014-7815
CVE-2014-9718 CVE-2015-5278 CVE-2015-6855
CVE-2015-7512 CVE-2015-8345 CVE-2015-8504
CVE-2015-8550 CVE-2015-8554 CVE-2015-8555
CVE-2015-8558 CVE-2015-8743 CVE-2015-8745
CVE-2016-1568 CVE-2016-1570 CVE-2016-1571
CVE-2016-1714 CVE-2016-1981 CVE-2016-2270
CVE-2016-2271 CVE-2016-2391 CVE-2016-2392
CVE-2016-2538 CVE-2016-2841
Affected Products:
SUSE Linux Enterprise Server 11-SP3-LTSS
SUSE Linux Enterprise Debuginfo 11-SP3
______________________________________________________________________________
An update that solves 35 vulnerabilities and has 5 fixes is
now available.
Description:
xen was updated to fix 36 security issues.
These security issues were fixed:
- CVE-2013-4527: Buffer overflow in hw/timer/hpet.c might have allowed
remote attackers to execute arbitrary code via vectors related to the
number of timers (bnc#864673).
- CVE-2013-4529: Buffer overflow in hw/pci/pcie_aer.c allowed remote
attackers to cause a denial of service and possibly execute arbitrary
code via a large log_num value in a savevm image (bnc#864678).
- CVE-2013-4530: Buffer overflow in hw/ssi/pl022.c allowed remote
attackers to cause a denial of service or possibly execute arbitrary
code via crafted tx_fifo_head and rx_fifo_head values in a savevm image
(bnc#864682).
- CVE-2013-4533: Buffer overflow in the pxa2xx_ssp_load function in
hw/arm/pxa2xx.c allowed remote attackers to cause a denial of service or
possibly execute arbitrary code via a crafted s->rx_level value in a
savevm image (bsc#864655).
- CVE-2013-4534: Buffer overflow in hw/intc/openpic.c allowed remote
attackers to cause a denial of service or possibly execute arbitrary
code via vectors related to IRQDest elements (bsc#864811).
- CVE-2013-4537: The ssi_sd_transfer function in hw/sd/ssi-sd.c allowed
remote attackers to execute arbitrary code via a crafted arglen value in
a savevm image (bsc#864391).
- CVE-2013-4538: Multiple buffer overflows in the ssd0323_load function in
hw/display/ssd0323.c allowed remote attackers to cause a denial of
service (memory corruption) or possibly execute arbitrary code via
crafted (1) cmd_len, (2) row, or (3) col values; (4) row_start and
row_end values; or (5) col_star and col_end values in a savevm image
(bsc#864769).
- CVE-2013-4539: Multiple buffer overflows in the tsc210x_load function in
hw/input/tsc210x.c might have allowed remote attackers to execute
arbitrary code via a crafted (1) precision, (2) nextprecision, (3)
function, or (4) nextfunction value in a savevm image (bsc#864805).
- CVE-2014-0222: Integer overflow in the qcow_open function in
block/qcow.c allowed remote attackers to cause a denial of service
(crash) via a large L2 table in a QCOW version 1 image (bsc#877642).
- CVE-2014-3640: The sosendto function in slirp/udp.c allowed local users
to cause a denial of service (NULL pointer dereference) by sending a udp
packet with a value of 0 in the source port and address, which triggers
access of an uninitialized socket (bsc#897654).
- CVE-2014-3689: The vmware-vga driver (hw/display/vmware_vga.c) allowed
local guest users to write to qemu memory locations and gain privileges
via unspecified parameters related to rectangle handling (bsc#901508).
- CVE-2014-7815: The set_pixel_format function in ui/vnc.c allowed remote
attackers to cause a denial of service (crash) via a small
bytes_per_pixel value (bsc#902737).
- CVE-2014-9718: The (1) BMDMA and (2) AHCI HBA interfaces in the IDE
functionality had multiple interpretations of a function's return value,
which allowed guest OS users to cause a host OS denial of service
(memory consumption or infinite loop, and system crash) via a PRDT with
zero complete sectors, related to the bmdma_prepare_buf and
ahci_dma_prepare_buf functions (bsc#928393).
- CVE-2015-5278: Infinite loop in ne2000_receive() function (bsc#945989).
- CVE-2015-6855: hw/ide/core.c did not properly restrict the commands
accepted by an ATAPI device, which allowed guest users to cause a denial
of service or possibly have unspecified other impact via certain IDE
commands, as demonstrated by a WIN_READ_NATIVE_MAX command to an empty
drive, which triggers a divide-by-zero error and instance crash
(bsc#945404).
- CVE-2015-7512: Buffer overflow in the pcnet_receive function in
hw/net/pcnet.c, when a guest NIC has a larger MTU, allowed remote
attackers to cause a denial of service (guest OS crash) or execute
arbitrary code via a large packet (bsc#957162).
- CVE-2015-8345: eepro100: infinite loop in processing command block list
(bsc#956829).
- CVE-2015-8504: VNC: floating point exception (bsc#958491).
- CVE-2015-8550: Paravirtualized drivers were incautious about shared
memory contents (XSA-155) (bsc#957988).
- CVE-2015-8554: qemu-dm buffer overrun in MSI-X handling (XSA-164)
(bsc#958007).
- CVE-2015-8555: Information leak in legacy x86 FPU/XMM initialization
(XSA-165) (bsc#958009).
- CVE-2015-8558: Infinite loop in ehci_advance_state resulted in DoS
(bsc#959005).
- CVE-2015-8743: ne2000: OOB memory access in ioport r/w functions
(bsc#960725).
- CVE-2015-8745: Reading IMR registers lead to a crash via assert(2) call
(bsc#960707).
- CVE-2016-1568: AHCI use-after-free vulnerability in aio port commands
(bsc#961332).
- CVE-2016-1570: The PV superpage functionality in arch/x86/mm.c allowed
local PV guests to obtain sensitive information, cause a denial of
service, gain privileges, or have unspecified other impact via a crafted
page identifier (MFN) to the (1) MMUEXT_MARK_SUPER or (2)
MMUEXT_UNMARK_SUPER sub-op in the HYPERVISOR_mmuext_op hypercall or (3)
unknown vectors related to page table updates (bsc#960861).
- CVE-2016-1571: VMX: intercept issue with INVLPG on non-canonical address
(XSA-168) (bsc#960862).
- CVE-2016-1714: nvram: OOB r/w access in processing firmware
configurations (bsc#961691).
- CVE-2016-1981: e1000 infinite loop in start_xmit and e1000_receive_iov
routines (bsc#963782).
- CVE-2016-2270: Xen allowed local guest administrators to cause a denial
of service (host reboot) via vectors related to multiple mappings of
MMIO pages with different cachability settings (bsc#965315).
- CVE-2016-2271: VMX when using an Intel or Cyrix CPU, allowed local HVM
guest users to cause a denial of service (guest crash) via vectors
related to a non-canonical RIP (bsc#965317).
- CVE-2016-2391: usb: multiple eof_timers in ohci module lead to NULL
pointer dereference (bsc#967013).
- CVE-2016-2392: NULL pointer dereference in remote NDIS control message
handling (bsc#967012).
- CVE-2016-2538: Integer overflow in remote NDIS control message handling
(bsc#967969).
- CVE-2016-2841: ne2000: Infinite loop in ne2000_receive (bsc#969350).
- XSA-166: ioreq handling possibly susceptible to multiple read issue
(bsc#958523).
These non-security issues were fixed:
- bsc#954872: script block-dmmd not working as expected
- bsc#959695: Missing docs for xen
- bsc#967630: Discrepancy in reported memory size with correction XSA-153
for xend
- bsc#959928: When DomU is in state running xm domstate returned nothing
Patch Instructions:
To install this SUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:
- SUSE Linux Enterprise Server 11-SP3-LTSS:
zypper in -t patch slessp3-xen-12639=1
- SUSE Linux Enterprise Debuginfo 11-SP3:
zypper in -t patch dbgsp3-xen-12639=1
To bring your system up-to-date, use "zypper patch".
Package List:
- SUSE Linux Enterprise Server 11-SP3-LTSS (i586 x86_64):
xen-kmp-default-4.2.5_20_3.0.101_0.47.79-24.9
xen-libs-4.2.5_20-24.9
xen-tools-domU-4.2.5_20-24.9
- SUSE Linux Enterprise Server 11-SP3-LTSS (x86_64):
xen-4.2.5_20-24.9
xen-doc-html-4.2.5_20-24.9
xen-doc-pdf-4.2.5_20-24.9
xen-libs-32bit-4.2.5_20-24.9
xen-tools-4.2.5_20-24.9
- SUSE Linux Enterprise Server 11-SP3-LTSS (i586):
xen-kmp-pae-4.2.5_20_3.0.101_0.47.79-24.9
- SUSE Linux Enterprise Debuginfo 11-SP3 (i586 x86_64):
xen-debuginfo-4.2.5_20-24.9
xen-debugsource-4.2.5_20-24.9
References:
https://www.suse.com/security/cve/CVE-2013-4527.html
https://www.suse.com/security/cve/CVE-2013-4529.html
https://www.suse.com/security/cve/CVE-2013-4530.html
https://www.suse.com/security/cve/CVE-2013-4533.html
https://www.suse.com/security/cve/CVE-2013-4534.html
https://www.suse.com/security/cve/CVE-2013-4537.html
https://www.suse.com/security/cve/CVE-2013-4538.html
https://www.suse.com/security/cve/CVE-2013-4539.html
https://www.suse.com/security/cve/CVE-2014-0222.html
https://www.suse.com/security/cve/CVE-2014-3640.html
https://www.suse.com/security/cve/CVE-2014-3689.html
https://www.suse.com/security/cve/CVE-2014-7815.html
https://www.suse.com/security/cve/CVE-2014-9718.html
https://www.suse.com/security/cve/CVE-2015-5278.html
https://www.suse.com/security/cve/CVE-2015-6855.html
https://www.suse.com/security/cve/CVE-2015-7512.html
https://www.suse.com/security/cve/CVE-2015-8345.html
https://www.suse.com/security/cve/CVE-2015-8504.html
https://www.suse.com/security/cve/CVE-2015-8550.html
https://www.suse.com/security/cve/CVE-2015-8554.html
https://www.suse.com/security/cve/CVE-2015-8555.html
https://www.suse.com/security/cve/CVE-2015-8558.html
https://www.suse.com/security/cve/CVE-2015-8743.html
https://www.suse.com/security/cve/CVE-2015-8745.html
https://www.suse.com/security/cve/CVE-2016-1568.html
https://www.suse.com/security/cve/CVE-2016-1570.html
https://www.suse.com/security/cve/CVE-2016-1571.html
https://www.suse.com/security/cve/CVE-2016-1714.html
https://www.suse.com/security/cve/CVE-2016-1981.html
https://www.suse.com/security/cve/CVE-2016-2270.html
https://www.suse.com/security/cve/CVE-2016-2271.html
https://www.suse.com/security/cve/CVE-2016-2391.html
https://www.suse.com/security/cve/CVE-2016-2392.html
https://www.suse.com/security/cve/CVE-2016-2538.html
https://www.suse.com/security/cve/CVE-2016-2841.html
https://bugzilla.suse.com/864391
https://bugzilla.suse.com/864655
https://bugzilla.suse.com/864673
https://bugzilla.suse.com/864678
https://bugzilla.suse.com/864682
https://bugzilla.suse.com/864769
https://bugzilla.suse.com/864805
https://bugzilla.suse.com/864811
https://bugzilla.suse.com/877642
https://bugzilla.suse.com/897654
https://bugzilla.suse.com/901508
https://bugzilla.suse.com/902737
https://bugzilla.suse.com/928393
https://bugzilla.suse.com/945404
https://bugzilla.suse.com/945989
https://bugzilla.suse.com/954872
https://bugzilla.suse.com/956829
https://bugzilla.suse.com/957162
https://bugzilla.suse.com/957988
https://bugzilla.suse.com/958007
https://bugzilla.suse.com/958009
https://bugzilla.suse.com/958491
https://bugzilla.suse.com/958523
https://bugzilla.suse.com/959005
https://bugzilla.suse.com/959695
https://bugzilla.suse.com/959928
https://bugzilla.suse.com/960707
https://bugzilla.suse.com/960725
https://bugzilla.suse.com/960861
https://bugzilla.suse.com/960862
https://bugzilla.suse.com/961332
https://bugzilla.suse.com/961691
https://bugzilla.suse.com/963782
https://bugzilla.suse.com/965315
https://bugzilla.suse.com/965317
https://bugzilla.suse.com/967012
https://bugzilla.suse.com/967013
https://bugzilla.suse.com/967630
https://bugzilla.suse.com/967969
https://bugzilla.suse.com/969350
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBV32qLYx+lLeg9Ub1AQjWiA/+PFJ0EHNbXQA/ptJIVU+MSOD8UanxPD4j
6oJAq5rJO5HKprAKoxeDdimOZnuQVOSnUd1NDKksg222bUKmKTQAz/idxaGLHBhK
pGKtwa8Z6BgHvDOPRx4z4ZcQSx917A/RbtzeyyJ89PYxaeUucX4ADNcaNPUpUXeF
GLTJ6p5IHgPu0+t2kuFuadjPn5ivYOlp2u6fYkJXN9p1PIZl74jCp1ow83BQalZy
XYS+tV5jF5hVWMSLMagFalprZmoYmd9rQtaTYfibU2E9UpHeEOjO2CD1Wetx6Kqq
jPXjeMea5842AGwb3Li6y+vaoJXamd8s5c0qysaB/wQ5248vW8hSo8ODUH1PNFHH
UlQtzNyrlzdIgs5SXTCVrAe/WCb1HdqU0wJmOePTn+7Whtzz6qDnoo+10/FgG+1i
jsO48M6562/GcH3ZJoF3K0qAz4l1o1OYZKNspDOb9ELGnqcCIi9r9W1EfMf5S6x2
ZY8EIqj7VnZrrHwJAQhBQniVVQQYXzveGMC/oHyhsEQyY9qL3KCF28AmBdiz8Gr8
4jUXARhV2U458HnGvLN/b2FKY2HjIyNLUq5jeyzaPWZns/eNBwnl14e92h14Tc5b
XW0UdJid4Z3+2TaQf0wfyGX4JYY8weP1EhxnmfNO0d/HkspzViDe3KhlN0PpTFEs
b2rjY88gnO4=
=t3Tn
-----END PGP SIGNATURE-----