Security update for Xen SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2015:0927-1 Final 1 1 2015-05-13T08:31:50Z current 2015-05-13T08:31:50Z 2015-05-13T08:31:50Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for Xen Xen was updated to fix two security issues and a bug: * CVE-2015-3456: A buffer overflow in the floppy drive emulation, which could be used to carry out denial of service attacks or potential code execution against the host. This vulnerability is also known as VENOM. * CVE-2015-3340: Xen did not initialize certain fields, which allowed certain remote service domains to obtain sensitive information from memory via a (1) XEN_DOMCTL_gettscinfo or (2) XEN_SYSCTL_getdomaininfolist request. * An exception in setCPUAffinity when restoring guests. (bsc#910441) Security Issues: * CVE-2015-3456 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3456> * CVE-2015-3340 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3340> The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sdksp3-xen,sledsp3-xen,slessp3-xen Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2015/suse-su-20150927-1/ Link for SUSE-SU-2015:0927-1 https://lists.opensuse.org/opensuse-security-announce/2015-05/msg00019.html E-Mail link for SUSE-SU-2015:0927-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/910441 SUSE Bug 910441 https://bugzilla.suse.com/927967 SUSE Bug 927967 https://bugzilla.suse.com/929339 SUSE Bug 929339 https://www.suse.com/security/cve/CVE-2015-3456/ SUSE CVE CVE-2015-3456 page SUSE Linux Enterprise Desktop 11 SP3 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA SUSE Linux Enterprise Server for SAP Applications 11 SP3 SUSE Linux Enterprise Software Development Kit 11 SP3 xen-devel-4.2.5_06-0.7.1 xen-4.2.5_06-0.7.1 xen-doc-html-4.2.5_06-0.7.1 xen-doc-pdf-4.2.5_06-0.7.1 xen-kmp-default-4.2.5_06_3.0.101_0.47.52-0.7.1 xen-kmp-pae-4.2.5_06_3.0.101_0.47.52-0.7.1 xen-libs-4.2.5_06-0.7.1 xen-libs-32bit-4.2.5_06-0.7.1 xen-tools-4.2.5_06-0.7.1 xen-tools-domU-4.2.5_06-0.7.1 xen-4.2.5_06-0.7.1 as a component of SUSE Linux Enterprise Desktop 11 SP3 xen-doc-html-4.2.5_06-0.7.1 as a component of SUSE Linux Enterprise Desktop 11 SP3 xen-doc-pdf-4.2.5_06-0.7.1 as a component of SUSE Linux Enterprise Desktop 11 SP3 xen-kmp-default-4.2.5_06_3.0.101_0.47.52-0.7.1 as a component of SUSE Linux Enterprise Desktop 11 SP3 xen-kmp-pae-4.2.5_06_3.0.101_0.47.52-0.7.1 as a component of SUSE Linux Enterprise Desktop 11 SP3 xen-libs-4.2.5_06-0.7.1 as a component of SUSE Linux Enterprise Desktop 11 SP3 xen-libs-32bit-4.2.5_06-0.7.1 as a component of SUSE Linux Enterprise Desktop 11 SP3 xen-tools-4.2.5_06-0.7.1 as a component of SUSE Linux Enterprise Desktop 11 SP3 xen-tools-domU-4.2.5_06-0.7.1 as a component of SUSE Linux Enterprise Desktop 11 SP3 xen-4.2.5_06-0.7.1 as a component of SUSE Linux Enterprise Server 11 SP3 xen-doc-html-4.2.5_06-0.7.1 as a component of SUSE Linux Enterprise Server 11 SP3 xen-doc-pdf-4.2.5_06-0.7.1 as a component of SUSE Linux Enterprise Server 11 SP3 xen-kmp-default-4.2.5_06_3.0.101_0.47.52-0.7.1 as a component of SUSE Linux Enterprise Server 11 SP3 xen-kmp-pae-4.2.5_06_3.0.101_0.47.52-0.7.1 as a component of SUSE Linux Enterprise Server 11 SP3 xen-libs-4.2.5_06-0.7.1 as a component of SUSE Linux Enterprise Server 11 SP3 xen-libs-32bit-4.2.5_06-0.7.1 as a component of SUSE Linux Enterprise Server 11 SP3 xen-tools-4.2.5_06-0.7.1 as a component of SUSE Linux Enterprise Server 11 SP3 xen-tools-domU-4.2.5_06-0.7.1 as a component of SUSE Linux Enterprise Server 11 SP3 xen-4.2.5_06-0.7.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA xen-doc-html-4.2.5_06-0.7.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA xen-doc-pdf-4.2.5_06-0.7.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA xen-kmp-default-4.2.5_06_3.0.101_0.47.52-0.7.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA xen-kmp-pae-4.2.5_06_3.0.101_0.47.52-0.7.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA xen-libs-4.2.5_06-0.7.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA xen-libs-32bit-4.2.5_06-0.7.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA xen-tools-4.2.5_06-0.7.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA xen-tools-domU-4.2.5_06-0.7.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA xen-4.2.5_06-0.7.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP3 xen-doc-html-4.2.5_06-0.7.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP3 xen-doc-pdf-4.2.5_06-0.7.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP3 xen-kmp-default-4.2.5_06_3.0.101_0.47.52-0.7.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP3 xen-kmp-pae-4.2.5_06_3.0.101_0.47.52-0.7.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP3 xen-libs-4.2.5_06-0.7.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP3 xen-libs-32bit-4.2.5_06-0.7.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP3 xen-tools-4.2.5_06-0.7.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP3 xen-tools-domU-4.2.5_06-0.7.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP3 xen-devel-4.2.5_06-0.7.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP3 The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a denial of service (out-of-bounds write and guest crash) or possibly execute arbitrary code via the (1) FD_CMD_READ_ID, (2) FD_CMD_DRIVE_SPECIFICATION_COMMAND, or other unspecified commands, aka VENOM. CVE-2015-3456 SUSE Linux Enterprise Desktop 11 SP3:xen-4.2.5_06-0.7.1 SUSE Linux Enterprise Desktop 11 SP3:xen-doc-html-4.2.5_06-0.7.1 SUSE Linux Enterprise Desktop 11 SP3:xen-doc-pdf-4.2.5_06-0.7.1 SUSE Linux Enterprise Desktop 11 SP3:xen-kmp-default-4.2.5_06_3.0.101_0.47.52-0.7.1 SUSE Linux Enterprise Desktop 11 SP3:xen-kmp-pae-4.2.5_06_3.0.101_0.47.52-0.7.1 SUSE Linux Enterprise Desktop 11 SP3:xen-libs-32bit-4.2.5_06-0.7.1 SUSE Linux Enterprise Desktop 11 SP3:xen-libs-4.2.5_06-0.7.1 SUSE Linux Enterprise Desktop 11 SP3:xen-tools-4.2.5_06-0.7.1 SUSE Linux Enterprise Desktop 11 SP3:xen-tools-domU-4.2.5_06-0.7.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:xen-4.2.5_06-0.7.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:xen-doc-html-4.2.5_06-0.7.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:xen-doc-pdf-4.2.5_06-0.7.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:xen-kmp-default-4.2.5_06_3.0.101_0.47.52-0.7.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:xen-kmp-pae-4.2.5_06_3.0.101_0.47.52-0.7.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:xen-libs-32bit-4.2.5_06-0.7.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:xen-libs-4.2.5_06-0.7.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:xen-tools-4.2.5_06-0.7.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:xen-tools-domU-4.2.5_06-0.7.1 SUSE Linux Enterprise Server 11 SP3:xen-4.2.5_06-0.7.1 SUSE Linux Enterprise Server 11 SP3:xen-doc-html-4.2.5_06-0.7.1 SUSE Linux Enterprise Server 11 SP3:xen-doc-pdf-4.2.5_06-0.7.1 SUSE Linux Enterprise Server 11 SP3:xen-kmp-default-4.2.5_06_3.0.101_0.47.52-0.7.1 SUSE Linux Enterprise Server 11 SP3:xen-kmp-pae-4.2.5_06_3.0.101_0.47.52-0.7.1 SUSE Linux Enterprise Server 11 SP3:xen-libs-32bit-4.2.5_06-0.7.1 SUSE Linux Enterprise Server 11 SP3:xen-libs-4.2.5_06-0.7.1 SUSE Linux Enterprise Server 11 SP3:xen-tools-4.2.5_06-0.7.1 SUSE Linux Enterprise Server 11 SP3:xen-tools-domU-4.2.5_06-0.7.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:xen-4.2.5_06-0.7.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:xen-doc-html-4.2.5_06-0.7.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:xen-doc-pdf-4.2.5_06-0.7.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:xen-kmp-default-4.2.5_06_3.0.101_0.47.52-0.7.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:xen-kmp-pae-4.2.5_06_3.0.101_0.47.52-0.7.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:xen-libs-32bit-4.2.5_06-0.7.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:xen-libs-4.2.5_06-0.7.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:xen-tools-4.2.5_06-0.7.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:xen-tools-domU-4.2.5_06-0.7.1 SUSE Linux Enterprise Software Development Kit 11 SP3:xen-devel-4.2.5_06-0.7.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150927-1/ https://www.suse.com/security/cve/CVE-2015-3456.html CVE-2015-3456 https://bugzilla.suse.com/929339 SUSE Bug 929339 https://bugzilla.suse.com/932770 SUSE Bug 932770 https://bugzilla.suse.com/935900 SUSE Bug 935900