Fedora alert FEDORA-2016-2c15b72b01 (xen)
| From: | updates@fedoraproject.org | |
| To: | package-announce@lists.fedoraproject.org | |
| Subject: | [SECURITY] Fedora 23 Update: xen-4.5.2-7.fc23 | |
| Date: | Thu, 28 Jan 2016 18:35:02 +0000 (UTC) | |
| Message-ID: | <20160128183502.D3EC061CDFC5@bastion01.phx2.fedoraproject.org> |
-------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2016-2c15b72b01 2016-01-28 15:05:32.714721 -------------------------------------------------------------------------------- Name : xen Product : Fedora 23 Version : 4.5.2 Release : 7.fc23 URL : http://xen.org/ Summary : Xen is a virtual machine monitor Description : This package contains the XenD daemon and xm command line tools, needed to manage virtual machines running under the Xen hypervisor -------------------------------------------------------------------------------- Update Information: PV superpage functionality missing sanity checks [XSA-167, CVE-2016-1570] VMX: intercept issue with INVLPG on non-canonical address [XSA-168, CVE-2016-1571] Qemu: pci: null pointer dereference issue CVE-2015-7549 qemu: DoS by infinite loop in ehci_advance_state CVE-2015-8558 qemu: Heap-based buffer overrun during VM migration CVE-2015-8666 Qemu: net: vmxnet3: incorrect l2 header validation leads to a crash via assert(2) call CVE-2015-8744 qemu: Support reading IMR registers on bar0 CVE-2015-8745 Qemu: net: vmxnet3: host memory leakage CVE-2015-8567 CVE-2015-8568 Qemu: net: ne2000: OOB memory access in ioport r/w functions CVE-2015-8743 -------------------------------------------------------------------------------- References: [ 1 ] Bug #1270871 - CVE-2015-8744 Qemu: net: vmxnet3: incorrect l2 header validation leads to a crash via assert(2) call https://bugzilla.redhat.com/show_bug.cgi?id=1270871 [ 2 ] Bug #1296539 - CVE-2016-1570 xen: PV superpage functionality missing sanity checks https://bugzilla.redhat.com/show_bug.cgi?id=1296539 [ 3 ] Bug #1296544 - CVE-2016-1571 xen: Intercept issue with INVLPG on non-canonical address causing host to crash https://bugzilla.redhat.com/show_bug.cgi?id=1296544 [ 4 ] Bug #1291137 - CVE-2015-7549 Qemu: pci: null pointer dereference issue https://bugzilla.redhat.com/show_bug.cgi?id=1291137 [ 5 ] Bug #1277983 - CVE-2015-8558 Qemu: usb: infinite loop in ehci_advance_state results in DoS https://bugzilla.redhat.com/show_bug.cgi?id=1277983 [ 6 ] Bug #1283722 - CVE-2015-8666 Qemu: acpi: heap based buffer overrun during VM migration https://bugzilla.redhat.com/show_bug.cgi?id=1283722 [ 7 ] Bug #1270876 - CVE-2015-8745 Qemu: net: vmxnet3: reading IMR registers leads to a crash via assert(2) call https://bugzilla.redhat.com/show_bug.cgi?id=1270876 [ 8 ] Bug #1289816 - CVE-2015-8568 CVE-2015-8567 Qemu: net: vmxnet3: host memory leakage https://bugzilla.redhat.com/show_bug.cgi?id=1289816 [ 9 ] Bug #1264929 - CVE-2015-8743 Qemu: net: ne2000: OOB memory access in ioport r/w functions https://bugzilla.redhat.com/show_bug.cgi?id=1264929 -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update xen' at the command line. For more information, refer to "Managing Software with yum", available at https://docs.fedoraproject.org/yum/. All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list package-announce@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/package-...