Security update for Xen SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2015:0613-1 Final 1 1 2015-03-09T18:38:17Z current 2015-03-09T18:38:17Z 2015-03-09T18:38:17Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for Xen The XEN hypervisor received updates to fix various security issues and bugs. The following security issues were fixed: - CVE-2015-2151: XSA-123: A hypervisor memory corruption due to x86 emulator flaw. - CVE-2015-2045: XSA-122: Information leak through version information hypercall. - CVE-2015-2044: XSA-121: Information leak via internal x86 system device emulation. - CVE-2015-2152: XSA-119: HVM qemu was unexpectedly enabling emulated VGA graphics backends. - CVE-2014-3615: Information leakage when guest sets high graphics resolution. - CVE-2015-0361: XSA-116: A xen crash due to use after free on hvm guest teardown. - CVE-2014-9065, CVE-2014-9066: XSA-114: xen: p2m lock starvation. Also the following bugs were fixed: - bnc#919098 - XEN blktap device intermittently fails to connect - bnc#882089 - Windows 2012 R2 fails to boot up with greater than 60 vcpus - bnc#903680 - Problems with detecting free loop devices on Xen guest startup - bnc#861318 - xentop reports 'Found interface vif101.0 but domain 101 does not exist.' - Update seabios to rel-1.7.3.1 which is the correct version for Xen 4.4 - Enhancement to virsh/libvirtd 'send-key' command The xen side small fix. (FATE#317240) - bnc#901488 - Intel ixgbe driver assigns rx/tx queues per core resulting in irq problems on servers with a large amount of CPU cores - bnc#910254 - SLES11 SP3 Xen VT-d igb NIC doesn't work - Add domain_migrate_constraints_set API to Xend's http interface (FATE#317239) - Restore missing fixes from block-dmmd script - bnc#904255 - XEN boot hangs in early boot on UEFI system - bsc#912011 - high ping latency after upgrade to latest SLES11SP3 on xen Dom0 - Fix missing banner by restoring the figlet program. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-DESKTOP-12-2015-147,SUSE-SLE-SDK-12-2015-147,SUSE-SLE-SERVER-12-2015-147 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2015/suse-su-20150613-1/ Link for SUSE-SU-2015:0613-1 https://lists.opensuse.org/opensuse-security-announce/2015-03/msg00031.html E-Mail link for SUSE-SU-2015:0613-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/861318 SUSE Bug 861318 https://bugzilla.suse.com/882089 SUSE Bug 882089 https://bugzilla.suse.com/895528 SUSE Bug 895528 https://bugzilla.suse.com/901488 SUSE Bug 901488 https://bugzilla.suse.com/903680 SUSE Bug 903680 https://bugzilla.suse.com/904255 SUSE Bug 904255 https://bugzilla.suse.com/906996 SUSE Bug 906996 https://bugzilla.suse.com/910254 SUSE Bug 910254 https://bugzilla.suse.com/910681 SUSE Bug 910681 https://bugzilla.suse.com/912011 SUSE Bug 912011 https://bugzilla.suse.com/918995 SUSE Bug 918995 https://bugzilla.suse.com/918998 SUSE Bug 918998 https://bugzilla.suse.com/919098 SUSE Bug 919098 https://bugzilla.suse.com/919464 SUSE Bug 919464 https://bugzilla.suse.com/919663 SUSE Bug 919663 https://www.suse.com/security/cve/CVE-2014-3615/ SUSE CVE CVE-2014-3615 page https://www.suse.com/security/cve/CVE-2014-9065/ SUSE CVE CVE-2014-9065 page https://www.suse.com/security/cve/CVE-2014-9066/ SUSE CVE CVE-2014-9066 page https://www.suse.com/security/cve/CVE-2015-0361/ SUSE CVE CVE-2015-0361 page https://www.suse.com/security/cve/CVE-2015-2044/ SUSE CVE CVE-2015-2044 page https://www.suse.com/security/cve/CVE-2015-2045/ SUSE CVE CVE-2015-2045 page https://www.suse.com/security/cve/CVE-2015-2151/ SUSE CVE CVE-2015-2151 page https://www.suse.com/security/cve/CVE-2015-2152/ SUSE CVE CVE-2015-2152 page SUSE Linux Enterprise Desktop 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Server for SAP Applications 12 SUSE Linux Enterprise Software Development Kit 12 xen-4.4.1_10-9.1 xen-kmp-default-4.4.1_10_k3.12.36_38-9.1 xen-libs-4.4.1_10-9.1 xen-libs-32bit-4.4.1_10-9.1 xen-devel-4.4.1_10-9.1 xen-doc-html-4.4.1_10-9.1 xen-tools-4.4.1_10-9.1 xen-tools-domU-4.4.1_10-9.1 xen-4.4.1_10-9.1 as a component of SUSE Linux Enterprise Desktop 12 xen-kmp-default-4.4.1_10_k3.12.36_38-9.1 as a component of SUSE Linux Enterprise Desktop 12 xen-libs-4.4.1_10-9.1 as a component of SUSE Linux Enterprise Desktop 12 xen-libs-32bit-4.4.1_10-9.1 as a component of SUSE Linux Enterprise Desktop 12 xen-4.4.1_10-9.1 as a component of SUSE Linux Enterprise Server 12 xen-doc-html-4.4.1_10-9.1 as a component of SUSE Linux Enterprise Server 12 xen-kmp-default-4.4.1_10_k3.12.36_38-9.1 as a component of SUSE Linux Enterprise Server 12 xen-libs-4.4.1_10-9.1 as a component of SUSE Linux Enterprise Server 12 xen-libs-32bit-4.4.1_10-9.1 as a component of SUSE Linux Enterprise Server 12 xen-tools-4.4.1_10-9.1 as a component of SUSE Linux Enterprise Server 12 xen-tools-domU-4.4.1_10-9.1 as a component of SUSE Linux Enterprise Server 12 xen-4.4.1_10-9.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 xen-doc-html-4.4.1_10-9.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 xen-kmp-default-4.4.1_10_k3.12.36_38-9.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 xen-libs-4.4.1_10-9.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 xen-libs-32bit-4.4.1_10-9.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 xen-tools-4.4.1_10-9.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 xen-tools-domU-4.4.1_10-9.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 xen-devel-4.4.1_10-9.1 as a component of SUSE Linux Enterprise Software Development Kit 12 The VGA emulator in QEMU allows local guest users to read host memory by setting the display to a high resolution. CVE-2014-3615 SUSE Linux Enterprise Desktop 12:xen-4.4.1_10-9.1 SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.1_10_k3.12.36_38-9.1 SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.1_10-9.1 SUSE Linux Enterprise Desktop 12:xen-libs-4.4.1_10-9.1 SUSE Linux Enterprise Server 12:xen-4.4.1_10-9.1 SUSE Linux Enterprise Server 12:xen-doc-html-4.4.1_10-9.1 SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.1_10_k3.12.36_38-9.1 SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.1_10-9.1 SUSE Linux Enterprise Server 12:xen-libs-4.4.1_10-9.1 SUSE Linux Enterprise Server 12:xen-tools-4.4.1_10-9.1 SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.1_10-9.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.1_10-9.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.1_10-9.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.1_10_k3.12.36_38-9.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.1_10-9.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.1_10-9.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.1_10-9.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.1_10-9.1 SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.1_10-9.1 important 1.7 AV:L/AC:L/Au:S/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150613-1/ https://www.suse.com/security/cve/CVE-2014-3615.html CVE-2014-3615 https://bugzilla.suse.com/895528 SUSE Bug 895528 https://bugzilla.suse.com/918998 SUSE Bug 918998 common/spinlock.c in Xen 4.4.x and earlier does not properly handle read and write locks, which allows local x86 guest users to cause a denial of service (write denial or NMI watchdog timeout and host crash) via a large number of read requests, a different vulnerability to CVE-2014-9066. CVE-2014-9065 SUSE Linux Enterprise Desktop 12:xen-4.4.1_10-9.1 SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.1_10_k3.12.36_38-9.1 SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.1_10-9.1 SUSE Linux Enterprise Desktop 12:xen-libs-4.4.1_10-9.1 SUSE Linux Enterprise Server 12:xen-4.4.1_10-9.1 SUSE Linux Enterprise Server 12:xen-doc-html-4.4.1_10-9.1 SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.1_10_k3.12.36_38-9.1 SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.1_10-9.1 SUSE Linux Enterprise Server 12:xen-libs-4.4.1_10-9.1 SUSE Linux Enterprise Server 12:xen-tools-4.4.1_10-9.1 SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.1_10-9.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.1_10-9.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.1_10-9.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.1_10_k3.12.36_38-9.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.1_10-9.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.1_10-9.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.1_10-9.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.1_10-9.1 SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.1_10-9.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150613-1/ https://www.suse.com/security/cve/CVE-2014-9065.html CVE-2014-9065 https://bugzilla.suse.com/906996 SUSE Bug 906996 https://bugzilla.suse.com/918998 SUSE Bug 918998 Xen 4.4.x and earlier, when using a large number of VCPUs, does not properly handle read and write locks, which allows local x86 guest users to cause a denial of service (write denial or NMI watchdog timeout and host crash) via a large number of read requests, a different vulnerability than CVE-2014-9065. CVE-2014-9066 SUSE Linux Enterprise Desktop 12:xen-4.4.1_10-9.1 SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.1_10_k3.12.36_38-9.1 SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.1_10-9.1 SUSE Linux Enterprise Desktop 12:xen-libs-4.4.1_10-9.1 SUSE Linux Enterprise Server 12:xen-4.4.1_10-9.1 SUSE Linux Enterprise Server 12:xen-doc-html-4.4.1_10-9.1 SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.1_10_k3.12.36_38-9.1 SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.1_10-9.1 SUSE Linux Enterprise Server 12:xen-libs-4.4.1_10-9.1 SUSE Linux Enterprise Server 12:xen-tools-4.4.1_10-9.1 SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.1_10-9.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.1_10-9.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.1_10-9.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.1_10_k3.12.36_38-9.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.1_10-9.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.1_10-9.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.1_10-9.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.1_10-9.1 SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.1_10-9.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150613-1/ https://www.suse.com/security/cve/CVE-2014-9066.html CVE-2014-9066 https://bugzilla.suse.com/906996 SUSE Bug 906996 https://bugzilla.suse.com/918998 SUSE Bug 918998 Use-after-free vulnerability in Xen 4.2.x, 4.3.x, and 4.4.x allows remote domains to cause a denial of service (system crash) via a crafted hypercall during HVM guest teardown. CVE-2015-0361 SUSE Linux Enterprise Desktop 12:xen-4.4.1_10-9.1 SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.1_10_k3.12.36_38-9.1 SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.1_10-9.1 SUSE Linux Enterprise Desktop 12:xen-libs-4.4.1_10-9.1 SUSE Linux Enterprise Server 12:xen-4.4.1_10-9.1 SUSE Linux Enterprise Server 12:xen-doc-html-4.4.1_10-9.1 SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.1_10_k3.12.36_38-9.1 SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.1_10-9.1 SUSE Linux Enterprise Server 12:xen-libs-4.4.1_10-9.1 SUSE Linux Enterprise Server 12:xen-tools-4.4.1_10-9.1 SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.1_10-9.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.1_10-9.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.1_10-9.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.1_10_k3.12.36_38-9.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.1_10-9.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.1_10-9.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.1_10-9.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.1_10-9.1 SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.1_10-9.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150613-1/ https://www.suse.com/security/cve/CVE-2015-0361.html CVE-2015-0361 https://bugzilla.suse.com/910681 SUSE Bug 910681 https://bugzilla.suse.com/918998 SUSE Bug 918998 https://bugzilla.suse.com/950367 SUSE Bug 950367 The emulation routines for unspecified X86 devices in Xen 3.2.x through 4.5.x does not properly initialize data, which allow local HVM guest users to obtain sensitive information via vectors involving an unsupported access size. CVE-2015-2044 SUSE Linux Enterprise Desktop 12:xen-4.4.1_10-9.1 SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.1_10_k3.12.36_38-9.1 SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.1_10-9.1 SUSE Linux Enterprise Desktop 12:xen-libs-4.4.1_10-9.1 SUSE Linux Enterprise Server 12:xen-4.4.1_10-9.1 SUSE Linux Enterprise Server 12:xen-doc-html-4.4.1_10-9.1 SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.1_10_k3.12.36_38-9.1 SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.1_10-9.1 SUSE Linux Enterprise Server 12:xen-libs-4.4.1_10-9.1 SUSE Linux Enterprise Server 12:xen-tools-4.4.1_10-9.1 SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.1_10-9.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.1_10-9.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.1_10-9.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.1_10_k3.12.36_38-9.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.1_10-9.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.1_10-9.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.1_10-9.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.1_10-9.1 SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.1_10-9.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150613-1/ https://www.suse.com/security/cve/CVE-2015-2044.html CVE-2015-2044 https://bugzilla.suse.com/918995 SUSE Bug 918995 https://bugzilla.suse.com/918998 SUSE Bug 918998 The HYPERVISOR_xen_version hypercall in Xen 3.2.x through 4.5.x does not properly initialize data structures, which allows local guest users to obtain sensitive information via unspecified vectors. CVE-2015-2045 SUSE Linux Enterprise Desktop 12:xen-4.4.1_10-9.1 SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.1_10_k3.12.36_38-9.1 SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.1_10-9.1 SUSE Linux Enterprise Desktop 12:xen-libs-4.4.1_10-9.1 SUSE Linux Enterprise Server 12:xen-4.4.1_10-9.1 SUSE Linux Enterprise Server 12:xen-doc-html-4.4.1_10-9.1 SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.1_10_k3.12.36_38-9.1 SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.1_10-9.1 SUSE Linux Enterprise Server 12:xen-libs-4.4.1_10-9.1 SUSE Linux Enterprise Server 12:xen-tools-4.4.1_10-9.1 SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.1_10-9.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.1_10-9.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.1_10-9.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.1_10_k3.12.36_38-9.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.1_10-9.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.1_10-9.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.1_10-9.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.1_10-9.1 SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.1_10-9.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150613-1/ https://www.suse.com/security/cve/CVE-2015-2045.html CVE-2015-2045 https://bugzilla.suse.com/918998 SUSE Bug 918998 The x86 emulator in Xen 3.2.x through 4.5.x does not properly ignore segment overrides for instructions with register operands, which allows local guest users to obtain sensitive information, cause a denial of service (memory corruption), or possibly execute arbitrary code via unspecified vectors. CVE-2015-2151 SUSE Linux Enterprise Desktop 12:xen-4.4.1_10-9.1 SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.1_10_k3.12.36_38-9.1 SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.1_10-9.1 SUSE Linux Enterprise Desktop 12:xen-libs-4.4.1_10-9.1 SUSE Linux Enterprise Server 12:xen-4.4.1_10-9.1 SUSE Linux Enterprise Server 12:xen-doc-html-4.4.1_10-9.1 SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.1_10_k3.12.36_38-9.1 SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.1_10-9.1 SUSE Linux Enterprise Server 12:xen-libs-4.4.1_10-9.1 SUSE Linux Enterprise Server 12:xen-tools-4.4.1_10-9.1 SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.1_10-9.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.1_10-9.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.1_10-9.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.1_10_k3.12.36_38-9.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.1_10-9.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.1_10-9.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.1_10-9.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.1_10-9.1 SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.1_10-9.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150613-1/ https://www.suse.com/security/cve/CVE-2015-2151.html CVE-2015-2151 https://bugzilla.suse.com/918998 SUSE Bug 918998 https://bugzilla.suse.com/919464 SUSE Bug 919464 Xen 4.5.x and earlier enables certain default backends when emulating a VGA device for an x86 HVM guest qemu even when the configuration disables them, which allows local guest users to obtain access to the VGA console by (1) setting the DISPLAY environment variable, when compiled with SDL support, or connecting to the VNC server on (2) ::1 or (3) 127.0.0.1, when not compiled with SDL support. CVE-2015-2152 SUSE Linux Enterprise Desktop 12:xen-4.4.1_10-9.1 SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.1_10_k3.12.36_38-9.1 SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.1_10-9.1 SUSE Linux Enterprise Desktop 12:xen-libs-4.4.1_10-9.1 SUSE Linux Enterprise Server 12:xen-4.4.1_10-9.1 SUSE Linux Enterprise Server 12:xen-doc-html-4.4.1_10-9.1 SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.1_10_k3.12.36_38-9.1 SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.1_10-9.1 SUSE Linux Enterprise Server 12:xen-libs-4.4.1_10-9.1 SUSE Linux Enterprise Server 12:xen-tools-4.4.1_10-9.1 SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.1_10-9.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.1_10-9.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.1_10-9.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.1_10_k3.12.36_38-9.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.1_10-9.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.1_10-9.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.1_10-9.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.1_10-9.1 SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.1_10-9.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150613-1/ https://www.suse.com/security/cve/CVE-2015-2152.html CVE-2015-2152 https://bugzilla.suse.com/918998 SUSE Bug 918998 https://bugzilla.suse.com/919663 SUSE Bug 919663 https://bugzilla.suse.com/950367 SUSE Bug 950367