security update for xen SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2015:1384-1 Final 1 1 2015-08-11T08:27:01Z current 2015-08-11T08:27:01Z 2015-08-11T08:27:01Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z security update for xen This security update of Xen fixes the following issues: * bsc#939712 (XSA-140): QEMU leak of uninitialized heap memory in rtl8139 device model (CVE-2015-5165) * bsc#939709 (XSA-139): Use after free in QEMU/Xen block unplug protocol (CVE-2015-5166) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-DESKTOP-12-2015-398,SUSE-SLE-SDK-12-2015-398,SUSE-SLE-SERVER-12-2015-398 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2015/suse-su-20151384-1/ Link for SUSE-SU-2015:1384-1 https://lists.suse.com/pipermail/sle-security-updates/2015-August/001541.html E-Mail link for SUSE-SU-2015:1384-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/939709 SUSE Bug 939709 https://bugzilla.suse.com/939712 SUSE Bug 939712 https://www.suse.com/security/cve/CVE-2015-5165/ SUSE CVE CVE-2015-5165 page https://www.suse.com/security/cve/CVE-2015-5166/ SUSE CVE CVE-2015-5166 page SUSE Linux Enterprise Desktop 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Server for SAP Applications 12 SUSE Linux Enterprise Software Development Kit 12 xen-4.4.2_10-22.8.1 xen-kmp-default-4.4.2_10_k3.12.44_52.10-22.8.1 xen-libs-4.4.2_10-22.8.1 xen-libs-32bit-4.4.2_10-22.8.1 xen-devel-4.4.2_10-22.8.1 xen-doc-html-4.4.2_10-22.8.1 xen-tools-4.4.2_10-22.8.1 xen-tools-domU-4.4.2_10-22.8.1 xen-4.4.2_10-22.8.1 as a component of SUSE Linux Enterprise Desktop 12 xen-kmp-default-4.4.2_10_k3.12.44_52.10-22.8.1 as a component of SUSE Linux Enterprise Desktop 12 xen-libs-4.4.2_10-22.8.1 as a component of SUSE Linux Enterprise Desktop 12 xen-libs-32bit-4.4.2_10-22.8.1 as a component of SUSE Linux Enterprise Desktop 12 xen-4.4.2_10-22.8.1 as a component of SUSE Linux Enterprise Server 12 xen-doc-html-4.4.2_10-22.8.1 as a component of SUSE Linux Enterprise Server 12 xen-kmp-default-4.4.2_10_k3.12.44_52.10-22.8.1 as a component of SUSE Linux Enterprise Server 12 xen-libs-4.4.2_10-22.8.1 as a component of SUSE Linux Enterprise Server 12 xen-libs-32bit-4.4.2_10-22.8.1 as a component of SUSE Linux Enterprise Server 12 xen-tools-4.4.2_10-22.8.1 as a component of SUSE Linux Enterprise Server 12 xen-tools-domU-4.4.2_10-22.8.1 as a component of SUSE Linux Enterprise Server 12 xen-4.4.2_10-22.8.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 xen-doc-html-4.4.2_10-22.8.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 xen-kmp-default-4.4.2_10_k3.12.44_52.10-22.8.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 xen-libs-4.4.2_10-22.8.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 xen-libs-32bit-4.4.2_10-22.8.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 xen-tools-4.4.2_10-22.8.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 xen-tools-domU-4.4.2_10-22.8.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 xen-devel-4.4.2_10-22.8.1 as a component of SUSE Linux Enterprise Software Development Kit 12 The C+ mode offload emulation in the RTL8139 network card device model in QEMU, as used in Xen 4.5.x and earlier, allows remote attackers to read process heap memory via unspecified vectors. CVE-2015-5165 SUSE Linux Enterprise Desktop 12:xen-4.4.2_10-22.8.1 SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.2_10_k3.12.44_52.10-22.8.1 SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.2_10-22.8.1 SUSE Linux Enterprise Desktop 12:xen-libs-4.4.2_10-22.8.1 SUSE Linux Enterprise Server 12:xen-4.4.2_10-22.8.1 SUSE Linux Enterprise Server 12:xen-doc-html-4.4.2_10-22.8.1 SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.2_10_k3.12.44_52.10-22.8.1 SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.2_10-22.8.1 SUSE Linux Enterprise Server 12:xen-libs-4.4.2_10-22.8.1 SUSE Linux Enterprise Server 12:xen-tools-4.4.2_10-22.8.1 SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.2_10-22.8.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.2_10-22.8.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.2_10-22.8.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.2_10_k3.12.44_52.10-22.8.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.2_10-22.8.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.2_10-22.8.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.2_10-22.8.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.2_10-22.8.1 SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.2_10-22.8.1 moderate 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20151384-1/ https://www.suse.com/security/cve/CVE-2015-5165.html CVE-2015-5165 https://bugzilla.suse.com/939712 SUSE Bug 939712 https://bugzilla.suse.com/950367 SUSE Bug 950367 Use-after-free vulnerability in QEMU in Xen 4.5.x and earlier does not completely unplug emulated block devices, which allows local HVM guest users to gain privileges by unplugging a block device twice. CVE-2015-5166 SUSE Linux Enterprise Desktop 12:xen-4.4.2_10-22.8.1 SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.2_10_k3.12.44_52.10-22.8.1 SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.2_10-22.8.1 SUSE Linux Enterprise Desktop 12:xen-libs-4.4.2_10-22.8.1 SUSE Linux Enterprise Server 12:xen-4.4.2_10-22.8.1 SUSE Linux Enterprise Server 12:xen-doc-html-4.4.2_10-22.8.1 SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.2_10_k3.12.44_52.10-22.8.1 SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.2_10-22.8.1 SUSE Linux Enterprise Server 12:xen-libs-4.4.2_10-22.8.1 SUSE Linux Enterprise Server 12:xen-tools-4.4.2_10-22.8.1 SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.2_10-22.8.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.2_10-22.8.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.2_10-22.8.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.2_10_k3.12.44_52.10-22.8.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.2_10-22.8.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.2_10-22.8.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.2_10-22.8.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.2_10-22.8.1 SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.2_10-22.8.1 moderate 7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20151384-1/ https://www.suse.com/security/cve/CVE-2015-5166.html CVE-2015-5166 https://bugzilla.suse.com/939709 SUSE Bug 939709 https://bugzilla.suse.com/950367 SUSE Bug 950367