Security update for xen SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2015:0983-1 Final 1 1 2015-05-13T21:26:27Z current 2015-05-13T21:26:27Z 2015-05-13T21:26:27Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for xen The XEN hypervisor was updated to fix two security issues: - Fixed a buffer overflow in the floppy drive emulation, which could be used to denial of service attacks or potential code execution against the host. (CVE-2015-3456) - Xen did not initialize certain fields, which allowed certain remote service domains to obtain sensitive information from memory via a (1) XEN_DOMCTL_gettscinfo or (2) XEN_SYSCTL_getdomaininfolist request. (CVE-2015-3340) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/opensuse-security-announce/2015-06/msg00001.html E-Mail link for openSUSE-SU-2015:0983-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings xen-4.3.4_04-44.1 xen-devel-4.3.4_04-44.1 xen-doc-html-4.3.4_04-44.1 xen-kmp-default-4.3.4_04_k3.11.10_29-44.1 xen-kmp-desktop-4.3.4_04_k3.11.10_29-44.1 xen-kmp-pae-4.3.4_04_k3.11.10_29-44.1 xen-libs-4.3.4_04-44.1 xen-libs-32bit-4.3.4_04-44.1 xen-tools-4.3.4_04-44.1 xen-tools-domU-4.3.4_04-44.1 xen-xend-tools-4.3.4_04-44.1 Xen 4.2.x through 4.5.x does not initialize certain fields, which allows certain remote service domains to obtain sensitive information from memory via a (1) XEN_DOMCTL_gettscinfo or (2) XEN_SYSCTL_getdomaininfolist request. CVE-2015-3340 low Please Install the update. https://lists.opensuse.org/opensuse-security-announce/2015-06/msg00001.html https://www.suse.com/security/cve/CVE-2015-3340.html CVE-2015-3340 https://bugzilla.suse.com/927967 SUSE Bug 927967 https://bugzilla.suse.com/929339 SUSE Bug 929339 The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a denial of service (out-of-bounds write and guest crash) or possibly execute arbitrary code via the (1) FD_CMD_READ_ID, (2) FD_CMD_DRIVE_SPECIFICATION_COMMAND, or other unspecified commands, aka VENOM. CVE-2015-3456 moderate Please Install the update. https://lists.opensuse.org/opensuse-security-announce/2015-06/msg00001.html https://www.suse.com/security/cve/CVE-2015-3456.html CVE-2015-3456 https://bugzilla.suse.com/929339 SUSE Bug 929339 https://bugzilla.suse.com/932770 SUSE Bug 932770 https://bugzilla.suse.com/935900 SUSE Bug 935900