SB2015090207 - SUSE Linux update for xen
Published: September 2, 2015
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 6 secuirty vulnerabilities.
1) Input validation error (CVE-ID: CVE-2015-2751)
The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.
Xen 4.3.x, 4.4.x, and 4.5.x, when using toolstack disaggregation, allows remote domains with partial management control to cause a denial of service (host lock) via unspecified domctl operations.
2) Stack-based buffer overflow (CVE-ID: CVE-2015-3259)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when processing a long configuration argument. A remote unauthenticated attacker can trigger stack-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
3) Resource management error (CVE-ID: CVE-2015-4164)
The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.
The compat_iret function in Xen 3.1 through 4.5 iterates the wrong way through a loop, which allows local 32-bit PV guest administrators to cause a denial of service (large loop and system hang) via a hypercall_iret call with EFLAGS.VM set.
4) Heap-based buffer overflow (CVE-ID: CVE-2015-5154)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in Heap-based buffer overflow in the IDE subsystem in QEMU, as used in Xen 4.5.x and earlier, when the container has a CDROM drive enabled,. A remote attacker can use unspecified ATAPI commands. to trigger heap-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
5) Information disclosure (CVE-ID: CVE-2015-5165)
The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.
The C+ mode offload emulation in the RTL8139 network card device model in QEMU, as used in Xen 4.5.x and earlier, allows remote attackers to read process heap memory via unspecified vectors.
6) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2015-5166)
The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
Use-after-free vulnerability in QEMU in Xen 4.5.x and earlier does not completely unplug emulated block devices, which allows local HVM guest users to gain privileges by unplugging a block device twice.
Remediation
Install update from vendor's website.