The VNC server implementation in QEMU, as used by Xen and possibly other environments, allows local users of a guest operating system to read arbitrary files on the host operating system via unspecified vectors related to QEMU monitor mode, as demonstrated by mapping files to a CDROM device. NOTE: some of these details are obtained from third party information.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2015-0068 for details.

The SUSE Linux Enterprise Server 11 Service Pack 1 LTSS Xen hypervisor and toolset have been updated to fix various security issues and some bugs.

The following security issues have been addressed :

XSA-84: CVE-2014-1894: Xen 3.2 (and presumably earlier) exhibit both problems with the overflow issue being present for more than just the suboperations listed above. (bnc#860163)

XSA-84: CVE-2014-1892 CVE-2014-1893: Xen 3.3 through 4.1, while not affected by the above overflow, have a different overflow issue on FLASK_{GET,SET}BOOL and expose unreasonably large memory allocation to arbitrary guests.
(bnc#860163)

XSA-84: CVE-2014-1891: The FLASK_{GET,SET}BOOL, FLASK_USER and FLASK_CONTEXT_TO_SID suboperations of the flask hypercall are vulnerable to an integer overflow on the input size. The hypercalls attempt to allocate a buffer which is 1 larger than this size and is therefore vulnerable to integer overflow and an attempt to allocate then access a zero byte buffer. (bnc#860163)

XSA-82: CVE-2013-6885: The microcode on AMD 16h 00h through 0Fh processors does not properly handle the interaction between locked instructions and write-combined memory types, which allows local users to cause a denial of service (system hang) via a crafted application, aka the errata 793 issue. (bnc#853049)

XSA-76: CVE-2013-4554: Xen 3.0.3 through 4.1.x (possibly 4.1.6.1), 4.2.x (possibly 4.2.3), and 4.3.x (possibly 4.3.1) does not properly prevent access to hypercalls, which allows local guest users to gain privileges via a crafted application running in ring 1 or 2. (bnc#849668)

XSA-74: CVE-2013-4553: The XEN_DOMCTL_getmemlist hypercall in Xen 3.4.x through 4.3.x (possibly 4.3.1) does not always obtain the page_alloc_lock and mm_rwlock in the same order, which allows local guest administrators to cause a denial of service (host deadlock). (bnc#849667)

XSA-73: CVE-2013-4494: Xen before 4.1.x, 4.2.x, and 4.3.x does not take the page_alloc_lock and grant_table.lock in the same order, which allows local guest administrators with access to multiple vcpus to cause a denial of service (host deadlock) via unspecified vectors. (bnc#848657)

XSA-67: CVE-2013-4368: The outs instruction emulation in Xen 3.1.x, 4.2.x, 4.3.x, and earlier, when using FS: or GS:
segment override, uses an uninitialized variable as a segment base, which allows local 64-bit PV guests to obtain sensitive information (hypervisor stack content) via unspecified vectors related to stale data in a segment register. (bnc#842511)

XSA-66: CVE-2013-4361: The fbld instruction emulation in Xen 3.3.x through 4.3.x does not use the correct variable for the source effective address, which allows local HVM guests to obtain hypervisor stack information by reading the values used by the instruction. (bnc#841766)

XSA-63: CVE-2013-4355: Xen 4.3.x and earlier does not properly handle certain errors, which allows local HVM guests to obtain hypervisor stack memory via a (1) port or (2) memory mapped I/O write or (3) other unspecified operations related to addresses without associated memory.
(bnc#840592)

XSA-62: CVE-2013-1442: Xen 4.0 through 4.3.x, when using AVX or LWP capable CPUs, does not properly clear previous data from registers when using an XSAVE or XRSTOR to extend the state components of a saved or restored vCPU after touching other restored extended registers, which allows local guest OSes to obtain sensitive information by reading the registers. (bnc#839596)

XSA-61: CVE-2013-4329: The xenlight library (libxl) in Xen 4.0.x through 4.2.x, when IOMMU is disabled, provides access to a busmastering-capable PCI passthrough device before the IOMMU setup is complete, which allows local HVM guest domains to gain privileges or cause a denial of service via a DMA instruction. (bnc#839618)

XSA-60: CVE-2013-2212: The vmx_set_uc_mode function in Xen 3.3 through 4.3, when disabling chaches, allows local HVM guests with access to memory mapped I/O regions to cause a denial of service (CPU consumption and possibly hypervisor or guest kernel panic) via a crafted GFN range. (bnc#831120)

XSA-58: CVE-2013-1918: Certain page table manipulation operations in Xen 4.1.x, 4.2.x, and earlier are not preemptible, which allows local PV kernels to cause a denial of service via vectors related to 'deep page table traversal.' (bnc#826882)

XSA-58: CVE-2013-1432: Xen 4.1.x and 4.2.x, when the XSA-45 patch is in place, does not properly maintain references on pages stored for deferred cleanup, which allows local PV guest kernels to cause a denial of service (premature page free and hypervisor crash) or possible gain privileges via unspecified vectors. (bnc#826882)

XSA-57: CVE-2013-2211: The libxenlight (libxl) toolstack library in Xen 4.0.x, 4.1.x, and 4.2.x uses weak permissions for xenstore keys for paravirtualised and emulated serial console devices, which allows local guest administrators to modify the xenstore value via unspecified vectors.
(bnc#823608)

XSA-56: CVE-2013-2072: Buffer overflow in the Python bindings for the xc_vcpu_setaffinity call in Xen 4.0.x, 4.1.x, and 4.2.x allows local administrators with permissions to configure VCPU affinity to cause a denial of service (memory corruption and xend toolstack crash) and possibly gain privileges via a crafted cpumap. (bnc#819416)

XSA-55: CVE-2013-2196: Multiple unspecified vulnerabilities in the Elf parser (libelf) in Xen 4.2.x and earlier allow local guest administrators with certain permissions to have an unspecified impact via a crafted kernel, related to 'other problems' that are not CVE-2013-2194 or CVE-2013-2195. (bnc#823011)

XSA-55: CVE-2013-2195: The Elf parser (libelf) in Xen 4.2.x and earlier allow local guest administrators with certain permissions to have an unspecified impact via a crafted kernel, related to 'pointer dereferences' involving unexpected calculations. (bnc#823011)

XSA-55: CVE-2013-2194: Multiple integer overflows in the Elf parser (libelf) in Xen 4.2.x and earlier allow local guest administrators with certain permissions to have an unspecified impact via a crafted kernel. (bnc#823011)

XSA-53: CVE-2013-2077: Xen 4.0.x, 4.1.x, and 4.2.x does not properly restrict the contents of a XRSTOR, which allows local PV guest users to cause a denial of service (unhandled exception and hypervisor crash) via unspecified vectors.
(bnc#820919)

XSA-52: CVE-2013-2076: Xen 4.0.x, 4.1.x, and 4.2.x, when running on AMD64 processors, only save/restore the FOP, FIP, and FDP x87 registers in FXSAVE/FXRSTOR when an exception is pending, which allows one domain to determine portions of the state of floating point instructions of other domains, which can be leveraged to obtain sensitive information such as cryptographic keys, a similar vulnerability to CVE-2006-1056. NOTE: this is the documented behavior of AMD64 processors, but it is inconsistent with Intel processors in a security-relevant fashion that was not addressed by the kernels. (bnc#820917)

XSA-50: CVE-2013-1964: Xen 4.0.x and 4.1.x incorrectly releases a grant reference when releasing a non-v1, non-transitive grant, which allows local guest administrators to cause a denial of service (host crash), obtain sensitive information, or possible have other impacts via unspecified vectors. (bnc#816156)

XSA-49: CVE-2013-1952: Xen 4.x, when using Intel VT-d for a bus mastering capable PCI device, does not properly check the source when accessing a bridge device's interrupt remapping table entries for MSI interrupts, which allows local guest domains to cause a denial of service (interrupt injection) via unspecified vectors. (bnc#816163)

XSA-47: CVE-2013-1920: Xen 4.2.x, 4.1.x, and earlier, when the hypervisor is running 'under memory pressure' and the Xen Security Module (XSM) is enabled, uses the wrong ordering of operations when extending the per-domain event channel tracking table, which causes a use-after-free and allows local guest kernels to inject arbitrary events and gain privileges via unspecified vectors. (bnc#813677)

XSA-46: CVE-2013-1919: Xen 4.2.x and 4.1.x does not properly restrict access to IRQs, which allows local stub domain clients to gain access to IRQs and cause a denial of service via vectors related to 'passed-through IRQs or PCI devices.' (bnc#813675)

XSA-45: CVE-2013-1918: Certain page table manipulation operations in Xen 4.1.x, 4.2.x, and earlier are not preemptible, which allows local PV kernels to cause a denial of service via vectors related to 'deep page table traversal.' (bnc#816159)

XSA-44: CVE-2013-1917: Xen 3.1 through 4.x, when running 64-bit hosts on Intel CPUs, does not clear the NT flag when using an IRET after a SYSENTER instruction, which allows PV guest users to cause a denial of service (hypervisor crash) by triggering a #GP fault, which is not properly handled by another IRET instruction. (bnc#813673)

XSA-41: CVE-2012-6075: Buffer overflow in the e1000_receive function in the e1000 device driver (hw/e1000.c) in QEMU 1.3.0-rc2 and other versions, when the SBP and LPE flags are disabled, allows remote attackers to cause a denial of service (guest OS crash) and possibly execute arbitrary guest code via a large packet. (bnc#797523)

XSA-37: CVE-2013-0154: The get_page_type function in xen/arch/x86/mm.c in Xen 4.2, when debugging is enabled, allows local PV or HVM guest administrators to cause a denial of service (assertion failure and hypervisor crash) via unspecified vectors related to a hypercall. (bnc#797031)

XSA-36: CVE-2013-0153: The AMD IOMMU support in Xen 4.2.x, 4.1.x, 3.3, and other versions, when using AMD-Vi for PCI passthrough, uses the same interrupt remapping table for the host and all guests, which allows guests to cause a denial of service by injecting an interrupt into other guests.
(bnc#800275)

XSA-33: CVE-2012-5634: Xen 4.2.x, 4.1.x, and 4.0, when using Intel VT-d for PCI passthrough, does not properly configure VT-d when supporting a device that is behind a legacy PCI Bridge, which allows local guests to cause a denial of service to other guests by injecting an interrupt.
(bnc#794316)

XSA-31: CVE-2012-5515: The (1) XENMEM_decrease_reservation, (2) XENMEM_populate_physmap, and (3) XENMEM_exchange hypercalls in Xen 4.2 and earlier allow local guest administrators to cause a denial of service (long loop and hang) via a crafted extent_order value. (bnc#789950)

XSA-30: CVE-2012-5514: The guest_physmap_mark_populate_on_demand function in Xen 4.2 and earlier does not properly unlock the subject GFNs when checking if they are in use, which allows local guest HVM administrators to cause a denial of service (hang) via unspecified vectors. (bnc#789948)

XSA-29: CVE-2012-5513: The XENMEM_exchange handler in Xen 4.2 and earlier does not properly check the memory address, which allows local PV guest OS administrators to cause a denial of service (crash) or possibly gain privileges via unspecified vectors that overwrite memory in the hypervisor reserved range. (bnc#789951)

XSA-27: CVE-2012-6333: Multiple HVM control operations in Xen 3.4 through 4.2 allow local HVM guest OS administrators to cause a denial of service (physical CPU consumption) via a large input. (bnc#789944)

XSA-27: CVE-2012-5511: Stack-based buffer overflow in the dirty video RAM tracking functionality in Xen 3.4 through 4.1 allows local HVM guest OS administrators to cause a denial of service (crash) via a large bitmap image.
(bnc#789944)

XSA-26: CVE-2012-5510: Xen 4.x, when downgrading the grant table version, does not properly remove the status page from the tracking list when freeing the page, which allows local guest OS administrators to cause a denial of service (hypervisor crash) via unspecified vectors. (bnc#789945)

XSA-25: CVE-2012-4544: The PV domain builder in Xen 4.2 and earlier does not validate the size of the kernel or ramdisk (1) before or (2) after decompression, which allows local guest administrators to cause a denial of service (domain 0 memory consumption) via a crafted (a) kernel or (b) ramdisk.
(bnc#787163)

XSA-24: CVE-2012-4539: Xen 4.0 through 4.2, when running 32-bit x86 PV guests on 64-bit hypervisors, allows local guest OS administrators to cause a denial of service (infinite loop and hang or crash) via invalid arguments to GNTTABOP_get_status_frames, aka 'Grant table hypercall infinite loop DoS vulnerability.' (bnc#786520)

XSA-23: CVE-2012-4538: The HVMOP_pagetable_dying hypercall in Xen 4.0, 4.1, and 4.2 does not properly check the pagetable state when running on shadow pagetables, which allows a local HVM guest OS to cause a denial of service (hypervisor crash) via unspecified vectors. (bnc#786519)

XSA-22: CVE-2012-4537: Xen 3.4 through 4.2, and possibly earlier versions, does not properly synchronize the p2m and m2p tables when the set_p2m_entry function fails, which allows local HVM guest OS administrators to cause a denial of service (memory consumption and assertion failure), aka 'Memory mapping failure DoS vulnerability.' (bnc#786517)

XSA-20: CVE-2012-4535: Xen 3.4 through 4.2, and possibly earlier versions, allows local guest OS administrators to cause a denial of service (Xen infinite loop and physical CPU consumption) by setting a VCPU with an 'inappropriate deadline.' (bnc#786516)

XSA-19: CVE-2012-4411: The graphical console in Xen 4.0, 4.1 and 4.2 allows local OS guest administrators to obtain sensitive host resource information via the qemu monitor.
NOTE: this might be a duplicate of CVE-2007-0998.
(bnc#779212)

XSA-15: CVE-2012-3497: (1) TMEMC_SAVE_GET_CLIENT_WEIGHT, (2) TMEMC_SAVE_GET_CLIENT_CAP, (3) TMEMC_SAVE_GET_CLIENT_FLAGS and (4) TMEMC_SAVE_END in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 allow local guest OS users to cause a denial of service (NULL pointer dereference or memory corruption and host crash) or possibly have other unspecified impacts via a NULL client id. (bnc#777890)

Also the following non-security bugs have been fixed :

  - xen hot plug attach/detach fails modified     blktap-pv-cdrom.patch. (bnc#805094)

  - guest 'disappears' after live migration Updated     block-dmmd script. (bnc#777628)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This security update of XEN fixes various bugs and security issues.

  - Upstream patch 26088-xend-xml-filesize-check.patch

  - bnc#787163 - CVE-2012-4544: xen: Domain builder Out-of-     memory due to malicious kernel/ramdisk (XSA 25)     CVE-2012-4544-xsa25.patch

  - bnc#779212 - CVE-2012-4411: XEN / qemu: guest     administrator can access qemu monitor console (XSA-19)     CVE-2012-4411-xsa19.patch

  - bnc#786516 - CVE-2012-4535: xen: Timer overflow DoS     vulnerability CVE-2012-4535-xsa20.patch

  - bnc#786518 - CVE-2012-4536: xen: pirq range check DoS     vulnerability CVE-2012-4536-xsa21.patch

  - bnc#786517 - CVE-2012-4537: xen: Memory mapping failure     DoS vulnerability CVE-2012-4537-xsa22.patch

  - bnc#786519 - CVE-2012-4538: xen: Unhooking empty PAE     entries DoS vulnerability CVE-2012-4538-xsa23.patch

  - bnc#786520 - CVE-2012-4539: xen: Grant table hypercall     infinite loop DoS vulnerability     CVE-2012-4539-xsa24.patch

  - bnc#784087 - L3: Xen BUG at io_apic.c:129     26102-x86-IOAPIC-legacy-not-first.patch

  - Upstream patches from Jan     26054-x86-AMD-perf-ctr-init.patch     26055-x86-oprof-hvm-mode.patch     26056-page-alloc-flush-filter.patch     26061-x86-oprof-counter-range.patch     26062-ACPI-ERST-move-data.patch     26063-x86-HPET-affinity-lock.patch     26093-HVM-PoD-grant-mem-type.patch

  - Upstream patches from Jan     25931-x86-domctl-iomem-mapping-checks.patch     25952-x86-MMIO-remap-permissions.patch

------------------------------------------------------------------- Mon Sep 24 16:41:58 CEST 2012 - ohering@suse.de

  - use BuildRequires: gcc46 only in sles11sp2 or 12.1 to     fix build in 11.4

------------------------------------------------------------------- Thu Sep 20 10:03:40 MDT 2012 - carnold@novell.com

  - Upstream patches from Jan     25808-domain_create-return-value.patch     25814-x86_64-set-debugreg-guest.patch     25815-x86-PoD-no-bug-in-non-translated.patch     25816-x86-hvm-map-pirq-range-check.patch     25833-32on64-bogus-pt_base-adjust.patch     25834-x86-S3-MSI-resume.patch     25835-adjust-rcu-lock-domain.patch     25836-VT-d-S3-MSI-resume.patch 25850-tmem-xsa-15-1.patch     25851-tmem-xsa-15-2.patch 25852-tmem-xsa-15-3.patch     25853-tmem-xsa-15-4.patch 25854-tmem-xsa-15-5.patch     25855-tmem-xsa-15-6.patch 25856-tmem-xsa-15-7.patch     25857-tmem-xsa-15-8.patch 25858-tmem-xsa-15-9.patch     25859-tmem-missing-break.patch 25860-tmem-cleanup.patch     25883-pt-MSI-cleanup.patch     25927-x86-domctl-ioport-mapping-range.patch     25929-tmem-restore-pool-version.patch

  - bnc#778105 - first XEN-PV VM fails to spawn xend:
    Increase wait time for disk to appear in host bootloader     Modified existing xen-domUloader.diff

  - Upstream patches from Jan     25752-ACPI-pm-op-valid-cpu.patch     25754-x86-PoD-early-access.patch     25755-x86-PoD-types.patch     25756-x86-MMIO-max-mapped-pfn.patch     25757-x86-EPT-PoD-1Gb-assert.patch     25764-x86-unknown-cpu-no-sysenter.patch     25765-x86_64-allow-unsafe-adjust.patch     25771-grant-copy-status-paged-out.patch     25773-x86-honor-no-real-mode.patch     25786-x86-prefer-multiboot-meminfo-over-e801.patch

  - bnc#777890 - CVE-2012-3497: xen: multiple TMEM hypercall     vulnerabilities (XSA-15)     CVE-2012-3497-tmem-xsa-15-1.patch     CVE-2012-3497-tmem-xsa-15-2.patch     CVE-2012-3497-tmem-xsa-15-3.patch     CVE-2012-3497-tmem-xsa-15-4.patch     CVE-2012-3497-tmem-xsa-15-5.patch     CVE-2012-3497-tmem-xsa-15-6.patch     CVE-2012-3497-tmem-xsa-15-7.patch     CVE-2012-3497-tmem-xsa-15-8.patch     CVE-2012-3497-tmem-xsa-15-9.patch     tmem-missing-break.patch

This security update of XEN fixes various bugs and security issues.

  - Upstream patch 26088-xend-xml-filesize-check.patch

  - bnc#787163 - CVE-2012-4544: xen: Domain builder Out-of-     memory due to malicious kernel/ramdisk (XSA 25)     CVE-2012-4544-xsa25.patch

  - bnc#779212 - CVE-2012-4411: XEN / qemu: guest     administrator can access qemu monitor console (XSA-19)     CVE-2012-4411-xsa19.patch

  - bnc#786516 - CVE-2012-4535: xen: Timer overflow DoS     vulnerability CVE-2012-4535-xsa20.patch

  - bnc#786518 - CVE-2012-4536: xen: pirq range check DoS     vulnerability CVE-2012-4536-xsa21.patch

  - bnc#786517 - CVE-2012-4537: xen: Memory mapping failure     DoS vulnerability CVE-2012-4537-xsa22.patch

  - bnc#786519 - CVE-2012-4538: xen: Unhooking empty PAE     entries DoS vulnerability CVE-2012-4538-xsa23.patch

  - bnc#786520 - CVE-2012-4539: xen: Grant table hypercall     infinite loop DoS vulnerability     CVE-2012-4539-xsa24.patch

  - bnc#784087 - L3: Xen BUG at io_apic.c:129     26102-x86-IOAPIC-legacy-not-first.patch

  - Upstream patches from Jan     26054-x86-AMD-perf-ctr-init.patch     26055-x86-oprof-hvm-mode.patch     26056-page-alloc-flush-filter.patch     26061-x86-oprof-counter-range.patch     26062-ACPI-ERST-move-data.patch     26063-x86-HPET-affinity-lock.patch     26093-HVM-PoD-grant-mem-type.patch

  - Upstream patches from Jan     25931-x86-domctl-iomem-mapping-checks.patch     25952-x86-MMIO-remap-permissions.patch

  - Upstream patches from Jan     25808-domain_create-return-value.patch     25814-x86_64-set-debugreg-guest.patch     25815-x86-PoD-no-bug-in-non-translated.patch     25816-x86-hvm-map-pirq-range-check.patch     25833-32on64-bogus-pt_base-adjust.patch     25834-x86-S3-MSI-resume.patch     25835-adjust-rcu-lock-domain.patch     25836-VT-d-S3-MSI-resume.patch 25850-tmem-xsa-15-1.patch     25851-tmem-xsa-15-2.patch 25852-tmem-xsa-15-3.patch     25853-tmem-xsa-15-4.patch 25854-tmem-xsa-15-5.patch     25855-tmem-xsa-15-6.patch 25856-tmem-xsa-15-7.patch     25857-tmem-xsa-15-8.patch 25858-tmem-xsa-15-9.patch     25859-tmem-missing-break.patch 25860-tmem-cleanup.patch     25883-pt-MSI-cleanup.patch     25927-x86-domctl-ioport-mapping-range.patch     25929-tmem-restore-pool-version.patch

  - bnc#778105 - first XEN-PV VM fails to spawn xend:
    Increase wait time for disk to appear in host bootloader     Modified existing xen-domUloader.diff

  - Upstream patches from Jan     25752-ACPI-pm-op-valid-cpu.patch     25754-x86-PoD-early-access.patch     25755-x86-PoD-types.patch     25756-x86-MMIO-max-mapped-pfn.patch     25757-x86-EPT-PoD-1Gb-assert.patch     25764-x86-unknown-cpu-no-sysenter.patch     25765-x86_64-allow-unsafe-adjust.patch     25771-grant-copy-status-paged-out.patch     25773-x86-honor-no-real-mode.patch     25786-x86-prefer-multiboot-meminfo-over-e801.patch

  - bnc#777890 - CVE-2012-3497: xen: multiple TMEM hypercall     vulnerabilities (XSA-15)     CVE-2012-3497-tmem-xsa-15-1.patch     CVE-2012-3497-tmem-xsa-15-2.patch     CVE-2012-3497-tmem-xsa-15-3.patch     CVE-2012-3497-tmem-xsa-15-4.patch     CVE-2012-3497-tmem-xsa-15-5.patch     CVE-2012-3497-tmem-xsa-15-6.patch     CVE-2012-3497-tmem-xsa-15-7.patch     CVE-2012-3497-tmem-xsa-15-8.patch     CVE-2012-3497-tmem-xsa-15-9.patch     tmem-missing-break.patch

From Red Hat Security Advisory 2007:0114 :

An updated Xen package to fix one security issue and two bugs is now available for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The Xen package contains the tools for managing the virtual machine monitor in Red Hat Enterprise Linux virtualization.

A flaw was found affecting the VNC server code in QEMU. On a fullyvirtualized guest VM, where qemu monitor mode is enabled, a user who had access to the VNC server could gain the ability to read arbitrary files as root in the host filesystem. (CVE-2007-0998)

In addition to disabling qemu monitor mode, the following bugs were also fixed :

* Fix IA64 fully virtualized (VTi) shadow page table mode initialization.

* Fix network bonding in balanced-rr mode. Without this update, a network path loss could result in packet loss.

Users of Xen should update to these erratum packages containing backported patches which correct these issues.

An updated Xen package to fix one security issue and two bugs is now available for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The Xen package contains the tools for managing the virtual machine monitor in Red Hat Enterprise Linux virtualization.

A flaw was found affecting the VNC server code in QEMU. On a fullyvirtualized guest VM, where qemu monitor mode is enabled, a user who had access to the VNC server could gain the ability to read arbitrary files as root in the host filesystem. (CVE-2007-0998)

In addition to disabling qemu monitor mode, the following bugs were also fixed :

* Fix IA64 fully virtualized (VTi) shadow page table mode initialization.

* Fix network bonding in balanced-rr mode. Without this update, a network path loss could result in packet loss.

Users of Xen should update to these erratum packages containing backported patches which correct these issues.

A flaw was found affecting the VNC server code in QEMU. On a fully virtualized guest VM, where qemu monitor mode is enabled, a user who had access to the VNC server could gain the ability to read arbitrary files as root in the host filesystem. (CVE-2007-0998)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
84140	OracleVM 3.2 : xen (OVMSA-2015-0068) (POODLE) (Venom)	Nessus	OracleVM Local Security Checks	low
83616	SUSE SLES11 Security Update : Xen (SUSE-SU-2014:0446-1)	Nessus	SuSE Local Security Checks	high
74821	openSUSE Security Update : XEN (openSUSE-SU-2012:1573-1)	Nessus	SuSE Local Security Checks	high
74820	openSUSE Security Update : XEN (openSUSE-SU-2012:1572-1)	Nessus	SuSE Local Security Checks	high
67461	Oracle Linux 5 : xen (ELSA-2007-0114)	Nessus	Oracle Linux Local Security Checks	medium
25321	RHEL 5 : xen (RHSA-2007:0114)	Nessus	Red Hat Local Security Checks	medium
24883	Fedora Core 5 : xen-3.0.3-5.fc5 (2007-344)	Nessus	Fedora Local Security Checks	medium
24882	Fedora Core 6 : xen-3.0.3-8.fc6 (2007-343)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2007-0998

medium

Tenable Plugins

low

high

high

high

medium

medium

medium

medium