Fedora alert FEDORA-2017-ed735463e3 (xen)

From:
    	     
 
updates@fedoraproject.org 
To:
    	     
 
package-announce@lists.fedoraproject.org 
Subject:
    	     
 
[SECURITY] Fedora 25 Update: xen-4.7.3-4.fc25 
Date:
    	     
 
Sat, 16 Sep 2017 03:24:28 +0000 (UTC)
Message-ID:
    	     
 
<20170916032428.A1CFA61C5F3E@bastion01.phx2.fedoraproject.org>
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2017-ed735463e3
2017-09-15 19:28:03.390969
--------------------------------------------------------------------------------

Name        : xen
Product     : Fedora 25
Version     : 4.7.3
Release     : 4.fc25
URL         : http://xen.org/

Summary     : Xen is a virtual machine monitor
Description :
This package contains the XenD daemon and xm command line
tools, needed to manage virtual machines running under the
Xen hypervisor

--------------------------------------------------------------------------------
Update Information:

Qemu: usb: ohci: infinite loop due to incorrect return value [CVE-2017-9330]
(#1457698) Qemu: qemu-nbd: server breaks with SIGPIPE upon client abort
[CVE-2017-10664] (#1466466) revised full fix for XSA-226 (regressed 32-bit Dom0
or backend domains)  ----  full fix for XSA-226, replacing workaround drop
conflict of xendomain and libvirtd as can cause problems (#1398590) add-to-
physmap error paths fail to release lock on ARM [XSA-235] (#1484476) Qemu:
audio: host memory leakage via capture buffer [CVE-2017-8309] (#1446521) Qemu:
input: host memory leakage via keyboard events [CVE-2017-8379] (#1446561)  ----
Qemu: serial: host memory leakage 16550A UART emulation [CVE-2017-5579]
(#1416162) Qemu: display: cirrus: OOB read access issue [CVE-2017-7718]
(#1443444) xen: various flaws (#1481765) multiple problems with transitive
grants [XSA-226, CVE-2017-12135] x86: PV privilege escalation via map_grant_ref
[XSA-227, CVE-2017-12137] grant_table: Race conditions with maptrack free list
handling [XSA-228, CVE-2017-12136] grant_table: possibly premature clearing of
GTF_writing / GTF_reading [XSA-230, CVE-2017-12855]
--------------------------------------------------------------------------------
References:

  [ 1 ] Bug #1457697 - CVE-2017-9330 Qemu: usb: ohci: infinite loop due to incorrect return value
        https://bugzilla.redhat.com/show_bug.cgi?id=1457697

  [ 2 ] Bug #1466190 - CVE-2017-10664 Qemu: qemu-nbd: server breaks with SIGPIPE upon client
abort
        https://bugzilla.redhat.com/show_bug.cgi?id=1466190

  [ 3 ] Bug #1484476 - xsa235 xen: add-to-physmap error paths fail to release lock on ARM
        https://bugzilla.redhat.com/show_bug.cgi?id=1484476

  [ 4 ] Bug #1446517 - CVE-2017-8309 Qemu: audio: host memory leakage via capture buffer
        https://bugzilla.redhat.com/show_bug.cgi?id=1446517

  [ 5 ] Bug #1446547 - CVE-2017-8379 Qemu: input: host memory lekage via keyboard events
        https://bugzilla.redhat.com/show_bug.cgi?id=1446547

  [ 6 ] Bug #1477651 - CVE-2017-12136 xsa228 xen: grant_table: Race conditions with maptrack free
list handling (XSA-228)
        https://bugzilla.redhat.com/show_bug.cgi?id=1477651

  [ 7 ] Bug #1477655 - CVE-2017-12135 xsa226 xen: possibly unbounded recursion in grant table code
(XSA-226)
        https://bugzilla.redhat.com/show_bug.cgi?id=1477655

  [ 8 ] Bug #1477657 - CVE-2017-12137 xsa227 xen: x86: PV privilege escalation via map_grant_ref
(XSA-227)
        https://bugzilla.redhat.com/show_bug.cgi?id=1477657

  [ 9 ] Bug #1481762 - CVE-2017-12855 xsa230 CVE-2017-12855 xen: grant_table: possibly premature
clearing of GTF_writing / GTF_reading  (XSA-230)
        https://bugzilla.redhat.com/show_bug.cgi?id=1481762

--------------------------------------------------------------------------------

This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade xen' at the command line.
For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgr...

All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys

--------------------------------------------------------------------------------
_______________________________________________
package-announce mailing list -- package-announce@lists.fedoraproject.org
To unsubscribe send an email to package-announce-leave@lists.fedoraproject.org