SUSE-SU-2017:1058-1

HIGH8.2

Security update for xen

Published Apr 19, 2017

Modified 1 months ago

Fix available

Details

Description of the patch:

This update for xen fixes the following security issues:

CVE-2017-7228: Broken check in memory_exchange() permited PV guest breakout (bsc#1030442).
CVE-2017-6414: Memory leak in the vcard_apdu_new function in card_7816.c in libcacard allowed local guest OS users to cause a denial of service (host memory consumption) via vectors related to allocating a new APDU object (bsc#1027570).
CVE-2017-6505: The ohci_service_ed_list function in hw/usb/hcd-ohci.c allowed local guest OS users to cause a denial of service (infinite loop) via vectors involving the number of link endpoint list descriptors (bsc#1028235).

Affected Packages

xen

SUSE Linux Enterprise High Performance Computing 11 SP3SUSE Linux Enterprise Server 11 SP3SUSE Linux Enterprise Server 11 SP3-LTSSSUSE Linux Enterprise Server for SAP Applications 11 SP3SUSE Manager 2.1

Fixed in:

0:4.2.5_21-38.1

xen-doc-html

Fixed in:

0:4.2.5_21-38.1

xen-doc-pdf

Fixed in:

0:4.2.5_21-38.1

xen-kmp-default

SUSE Linux Enterprise High Performance Computing 11 SP3SUSE Linux Enterprise Point of Sale 11 SP3SUSE Linux Enterprise Server 11 SP3SUSE Linux Enterprise Server 11 SP3-LTSSSUSE Linux Enterprise Server for SAP Applications 11 SP3

Fixed in:

0:4.2.5_21_3.0.101_0.47.99-38.1

xen-kmp-pae

Fixed in:

0:4.2.5_21_3.0.101_0.47.99-38.1

xen-libs

Fixed in:

0:4.2.5_21-38.1

xen-libs-32bit

Fixed in:

0:4.2.5_21-38.1

xen-tools