bugtraq - [SECURITY] [DSA 3181-1] xen security update

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Tue, 10 Mar 2015 21:40:17 +0100
From: Moritz Muehlenhoff <jmm@...ian.org>
To: bugtraq@...urityfocus.com
Subject: [SECURITY] [DSA 3181-1] xen security update

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- -------------------------------------------------------------------------
Debian Security Advisory DSA-3181-1                   security@...ian.org
http://www.debian.org/security/                        Moritz Muehlenhoff
March 10, 2015                         http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : xen
CVE ID         : CVE-2015-2044 CVE-2015-2045 CVE-2015-2151

Multiple security issues have been found in the Xen virtualisation
solution:

CVE-2015-2044

    Information leak via x86 system device emulation.

CVE-2015-2045

    Information leak in the HYPERVISOR_xen_version() hypercall.

CVE-2015-2151

    Missing input sanitising in the x86 emulator could result in
    information disclosure, denial of service or potentially
    privilege escalation.

In addition the Xen developers reported an unfixable limitation in the
handling of non-standard PCI devices. Please refer to
http://xenbits.xen.org/xsa/advisory-124.html for further information.

For the stable distribution (wheezy), these problems have been fixed in
version 4.1.4-3+deb7u5.

For the unstable distribution (sid), these problems will be fixed soon.

We recommend that you upgrade your xen packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@...ts.debian.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBAgAGBQJU/1Z2AAoJEBDCk7bDfE42jMwP/3l+iMp668MaGgtkz3bMmAvK
H9kx7CPmmUt1RYQmsYorzEV/AvxcN9sWTaqCBVwRe+Bq1H232Np3u4OT2p9o6riA
JlKn1KA+V7GA3IC2rFBPCKN9YeMviD9JaZF3Kis1Ey5QOLOZfhsZpmw0IL/Lqv9S
Z0zry7QTZtzCskgXBR6MpplcwC/X9zJ1lkOkf45cYfp2Vus/3INSR0WpjW9Vy69Y
eCCJzNapCRRj3AZw7dydalq03dm0ODTdGKjq+coKIbUp/hHtkHdZ8N4xgqDEohtY
A28ndBVw/WZP1AdandNGGPTPnADv32gMrToOhmAjOIIDq4r7oDA4L4oDOOKZBgT4
Nju7nJWqypO+SaRPdt9dYom+0lnfPZkeqCy8uSmougFUZAj+AqdwCbGi7HIMU2Jd
J01X7xoR6JOklFQTMHxhdloYt7S3ysNbARC2mC1kCLrwOEvN9F/rcaj/kt4M3QpW
j3cx7EUIbA100kj8uHV+uJJfx4wMYWhMEEe1JFb7Xjtm3hW1OgqF2adS9GjnbkbX
sa9p04VLA4B/FYBJ0AACQJGSQmwkd03/Max6B9WfH0nlHuNBT+62eAvccbkbkELe
KH41MHRgwULkQe+iJz1in/c3Wmv6aL/Yla5rYLvoh/tNUHqPpOhiMi3FcFRMqK1p
+ugpkYC8a0vGIuIPduW/
=78BW
-----END PGP SIGNATURE-----