This update for xen fixes the following issues:
These security issue were fixed:
- CVE-2018-3646: Systems with microprocessors utilizing speculative execution
and address translations may have allowed unauthorized disclosure of
information residing in the L1 data cache to an attacker with local user access
with guest OS privilege via a terminal page fault and a side-channel analysis
(bsc#1091107, bsc#1027519).
- CVE-2018-12617: An integer overflow that could cause a segmentation
fault in qmp_guest_file_read() with g_malloc() in qemu-guest-agent was
fixed (bsc#1098744)
- CVE-2018-3665: System software utilizing Lazy FP state restore technique
on systems using Intel Core-based microprocessors may potentially allow
a local process to infer data from another process through a speculative
execution side channel. (bsc#1095242)
- CVE-2018-3639: Systems with microprocessors utilizing speculative
execution and speculative execution of memory reads before the addresses
of all prior memory writes are known may allow unauthorized disclosure
of information to an attacker with local user access via a side-channel
analysis, aka Speculative Store Bypass (SSB), Variant 4. (bsc#1092631)
- CVE-2017-5715: Systems with microprocessors utilizing speculative
execution and indirect branch prediction may allow unauthorized disclosure
of information to an attacker with local user access via a side-channel
analysis. (bsc#1074562)
- CVE-2017-5753: Systems with microprocessors utilizing speculative
execution and branch prediction may allow unauthorized disclosure of
information to an attacker with local user access via a side-channel
analysis. (bsc#1074562)
- CVE-2017-5754: Systems with microprocessors utilizing speculative
execution and indirect branch prediction may allow unauthorized disclosure
of information to an attacker with local user access via a side-channel
analysis of the data cache. (bsc#1074562)
- CVE-2018-12891: Certain PV MMU...