[SUSE-SU-2018:1202-1] Security update for xen
Severity
Important
Affected Packages
7
CVEs
4
Security update for xen
This update for xen fixes several issues.
These security issues were fixed:
- CVE-2018-8897: Prevent mishandling of debug exceptions on x86 (XSA-260, bsc#1090820)
- Handle HPET timers in IO-APIC mode correctly to prevent malicious or buggy HVM guests from causing a hypervisor crash or potentially privilege escalation/information leaks (XSA-261, bsc#1090822)
- Prevent unbounded loop, induced by qemu allowing an attacker to permanently keep a physical CPU core busy (XSA-262, bsc#1090823)
- CVE-2018-10472: x86 HVM guest OS users (in certain configurations) were able to read arbitrary dom0 files via QMP live insertion of a CDROM, in conjunction with specifying the target file as the backing file of a snapshot (bsc#1089152).
- CVE-2018-10471: x86 PV guest OS users were able to cause a denial of service (out-of-bounds zero write and hypervisor crash) via unexpected INT 80 processing, because of an incorrect fix for CVE-2017-5754 (bsc#1089635).
- CVE-2018-7550: The load_multiboot function allowed local guest OS users to execute arbitrary code on the host via a mh_load_end_addr value greater than mh_bss_end_addr, which triggers an out-of-bounds read or write memory access (bsc#1083292).
Package | Affected Version |
---|---|
pkg:rpm/suse/xen?arch=x86_64&distro=sles-12&sp=1 | < 4.5.5_24-22.46.1 |
pkg:rpm/suse/xen-tools?arch=x86_64&distro=sles-12&sp=1 | < 4.5.5_24-22.46.1 |
pkg:rpm/suse/xen-tools-domU?arch=x86_64&distro=sles-12&sp=1 | < 4.5.5_24-22.46.1 |
pkg:rpm/suse/xen-libs?arch=x86_64&distro=sles-12&sp=1 | < 4.5.5_24-22.46.1 |
pkg:rpm/suse/xen-libs-32bit?arch=x86_64&distro=sles-12&sp=1 | < 4.5.5_24-22.46.1 |
pkg:rpm/suse/xen-kmp-default?arch=x86_64&distro=sles-12&sp=1 | < 4.5.5_24_k3.12.74_60.64.85-22.46.1 |
pkg:rpm/suse/xen-doc-html?arch=x86_64&distro=sles-12&sp=1 | < 4.5.5_24-22.46.1 |
- ID
- SUSE-SU-2018:1202-1
- Severity
- important
- URL
- https://www.suse.com/support/update/announcement/2018/suse-su-20181202-1/
- Published
-
2018-05-10T10:43:03
(6 years ago) - Modified
-
2018-05-10T10:43:03
(6 years ago) - Rights
- Copyright 2024 SUSE LLC. All rights reserved.
- Other Advisories
-
- ALAS-2018-1023
- ALAS-2018-1073
- ALAS2-2018-1023
- ALAS2-2018-1073
- ALPINE:CVE-2018-10471
- ALPINE:CVE-2018-10472
- ALPINE:CVE-2018-8897
- DSA-4196-1
- DSA-4201-1
- DSA-4213-1
- ELSA-2018-1318
- ELSA-2018-1319
- ELSA-2018-2462
- ELSA-2018-4096
- ELSA-2018-4097
- ELSA-2018-4098
- ELSA-2018-4219
- ELSA-2018-4285
- ELSA-2018-4289
- ELSA-2019-4585
- FEDORA-2018-1a467757ce
- FEDORA-2018-5521156807
- FEDORA-2018-604574c943
- FEDORA-2018-683dfde81a
- FEDORA-2018-6c1be5e1c8
- FEDORA-2018-73dd8de892
- FEDORA-2018-7cd077ddd3
- FEDORA-2018-915602df63
- FEDORA-2018-98684f429b
- FEDORA-2018-a7862a75f5
- FEDORA-2018-a7ac26523d
- FEDORA-2018-aec846c0ef
- FEDORA-2018-d3cb6f113c
- FEDORA-2018-eb69078020
- FEDORA-2018-f20a0cead5
- FEDORA-2018-fe24359b69
- FEDORA-2019-bce6498890
- FREEBSD:521CE804-52FD-11E8-9123-A4BADB2F4699
- GLSA-201804-08
- GLSA-201810-06
- MS:CVE-2018-8897
- RHSA-2018:1318
- RHSA-2018:1319
- RHSA-2018:1355
- RHSA-2018:2462
- SUSE-SU-2018:0762-1
- SUSE-SU-2018:0831-1
- SUSE-SU-2018:1077-1
- SUSE-SU-2018:1171-1
- SUSE-SU-2018:1172-1
- SUSE-SU-2018:1173-1
- SUSE-SU-2018:1173-2
- SUSE-SU-2018:1177-1
- SUSE-SU-2018:1181-1
- SUSE-SU-2018:1184-1
- SUSE-SU-2018:1203-1
- SUSE-SU-2018:1216-1
- SUSE-SU-2018:1220-1
- SUSE-SU-2018:1221-1
- SUSE-SU-2018:1308-1
- SUSE-SU-2018:1505-1
- SUSE-SU-2018:1506-1
- SUSE-SU-2018:1509-1
- SUSE-SU-2018:1510-1
- SUSE-SU-2018:1511-1
- SUSE-SU-2018:1512-1
- SUSE-SU-2018:1513-1
- SUSE-SU-2018:1514-1
- SUSE-SU-2018:1516-1
- SUSE-SU-2018:1517-1
- SUSE-SU-2018:1518-1
- SUSE-SU-2018:1519-1
- SUSE-SU-2018:1520-1
- SUSE-SU-2018:1521-1
- SUSE-SU-2018:1522-1
- SUSE-SU-2018:1523-1
- SUSE-SU-2018:1524-1
- SUSE-SU-2018:1526-1
- SUSE-SU-2018:1528-1
- SUSE-SU-2018:1529-1
- SUSE-SU-2018:1530-1
- SUSE-SU-2018:1531-1
- SUSE-SU-2018:1532-1
- SUSE-SU-2018:1533-1
- SUSE-SU-2018:1534-1
- SUSE-SU-2018:1535-1
- SUSE-SU-2018:1536-1
- SUSE-SU-2018:1537-1
- SUSE-SU-2018:1538-1
- SUSE-SU-2018:1539-1
- SUSE-SU-2018:1540-1
- SUSE-SU-2018:1541-1
- SUSE-SU-2018:1543-1
- SUSE-SU-2018:1545-1
- SUSE-SU-2018:1546-1
- SUSE-SU-2018:1548-1
- SUSE-SU-2018:1549-1
- SUSE-SU-2018:1636-1
- SUSE-SU-2018:1637-1
- SUSE-SU-2018:1639-1
- SUSE-SU-2018:1640-1
- SUSE-SU-2018:1641-1
- SUSE-SU-2018:1642-1
- SUSE-SU-2018:1643-1
- SUSE-SU-2018:1644-1
- SUSE-SU-2018:1645-1
- SUSE-SU-2018:1648-1
- SUSE-SU-2018:2340-1
- SUSE-SU-2018:3230-1
- USN-3641-1
- USN-3641-2
- USN-3649-1
- VU:631579
- XSA-258
- XSA-259
- XSA-260
Type | Package URL | Namespace | Name / Product | Version | Distribution / Platform | Arch | Patch / Fix |
---|---|---|---|---|---|---|---|
Affected | pkg:rpm/suse/xen?arch=x86_64&distro=sles-12&sp=1 | suse | xen | < 4.5.5_24-22.46.1 | sles-12 | x86_64 | |
Affected | pkg:rpm/suse/xen-tools?arch=x86_64&distro=sles-12&sp=1 | suse | xen-tools | < 4.5.5_24-22.46.1 | sles-12 | x86_64 | |
Affected | pkg:rpm/suse/xen-tools-domU?arch=x86_64&distro=sles-12&sp=1 | suse | xen-tools-domU | < 4.5.5_24-22.46.1 | sles-12 | x86_64 | |
Affected | pkg:rpm/suse/xen-libs?arch=x86_64&distro=sles-12&sp=1 | suse | xen-libs | < 4.5.5_24-22.46.1 | sles-12 | x86_64 | |
Affected | pkg:rpm/suse/xen-libs-32bit?arch=x86_64&distro=sles-12&sp=1 | suse | xen-libs-32bit | < 4.5.5_24-22.46.1 | sles-12 | x86_64 | |
Affected | pkg:rpm/suse/xen-kmp-default?arch=x86_64&distro=sles-12&sp=1 | suse | xen-kmp-default | < 4.5.5_24_k3.12.74_60.64.85-22.46.1 | sles-12 | x86_64 | |
Affected | pkg:rpm/suse/xen-doc-html?arch=x86_64&distro=sles-12&sp=1 | suse | xen-doc-html | < 4.5.5_24-22.46.1 | sles-12 | x86_64 |
# CVE | Description | CVSS | EPSS | EPSS Trend (30 days) | Affected Products | Weaknesses | Security Advisories | Exploits | PoC | Pubblication Date | Modification Date |
---|---|---|---|---|---|---|---|---|---|---|---|
# CVE | Description | CVSS | EPSS | EPSS Trend (30 days) | Affected Products | Weaknesses | Security Advisories | PoC | Pubblication Date | Modification Date |