The remote OracleVM system is missing necessary patches to address critical security updates :

  - Remove gconv transliteration loadable modules support     (CVE-2014-5119, - _nl_find_locale: Improve handling of     crafted locale names (CVE-2014-0475, 

  - Switch gettimeofday from INTUSE to libc_hidden_proto     (#1099025).

  - Fix stack overflow due to large AF_INET6 requests     (CVE-2013-4458, #1111460).

  - Fix buffer overflow in readdir_r (CVE-2013-4237,     #1111460).

  - Fix memory order when reading libgcc handle (#905941).

  - Fix format specifier in malloc_info output (#1027261).

  - Fix nscd lookup for innetgr when netgroup has wildcards     (#1054846).

  - Add mmap usage to malloc_info output (#1027261).

  - Use NSS_STATUS_TRYAGAIN to indicate insufficient buffer     (#1087833).

  - [ppc] Add VDSO IFUNC for gettimeofday (#1028285).

  - [ppc] Fix ftime gettimeofday internal call returning     bogus data (#1099025).

  - Also relocate in dependency order when doing symbol     dependency testing (#1019916).

  - Fix infinite loop in nscd when netgroup is empty     (#1085273).

  - Provide correct buffer length to netgroup queries in     nscd (#1074342).

  - Return NULL for wildcard values in getnetgrent from nscd     (#1085289).

  - Avoid overlapping addresses to stpcpy calls in nscd     (#1082379).

  - Initialize all of datahead structure in nscd (#1074353).

  - Return EAI_AGAIN for AF_UNSPEC when herrno is TRY_AGAIN     (#1044628).

  - Do not fail if one of the two responses to AF_UNSPEC     fails (#845218).

  - nscd: Make SELinux checks dynamic (#1025933).

  - Fix race in free of fastbin chunk (#1027101).

  - Fix copy relocations handling of unique objects     (#1032628).

  - Fix encoding name for IDN in getaddrinfo (#981942).

  - Fix return code from getent netgroup when the netgroup     is not found (#1039988).

  - Fix handling of static TLS in dlopen'ed objects     (#995972).

  - Don't use alloca in addgetnetgrentX (#1043557).

  - Adjust pointers to triplets in netgroup query data     (#1043557).

The remote OracleVM system is missing necessary patches to address critical security updates :

  - fix CVE-2014-3567 - memory leak when handling session     tickets

  - fix CVE-2014-3513 - memory leak in srtp support

  - add support for fallback SCSV to partially mitigate     (CVE-2014-3566) (padding attack on SSL3)

  - add ECC TLS extensions to DTLS (#1119800)

  - fix CVE-2014-3505 - doublefree in DTLS packet processing

  - fix CVE-2014-3506 - avoid memory exhaustion in DTLS

  - fix CVE-2014-3507 - avoid memory leak in DTLS

  - fix CVE-2014-3508 - fix OID handling to avoid     information leak

  - fix CVE-2014-3509 - fix race condition when parsing     server hello

  - fix CVE-2014-3510 - fix DoS in anonymous (EC)DH handling     in DTLS

  - fix CVE-2014-3511 - disallow protocol downgrade via     fragmentation

  - fix CVE-2014-0224 fix that broke EAP-FAST session     resumption support

  - drop EXPORT, RC2, and DES from the default cipher list     (#1057520)

  - print ephemeral key size negotiated in TLS handshake     (#1057715)

  - do not include ECC ciphersuites in SSLv2 client hello     (#1090952)

  - properly detect encryption failure in BIO (#1100819)

  - fail on hmac integrity check if the .hmac file is empty     (#1105567)

  - FIPS mode: make the limitations on DSA, DH, and RSA     keygen length enforced only if     OPENSSL_ENFORCE_MODULUS_BITS environment variable is set

  - fix CVE-2010-5298 - possible use of memory after free

  - fix CVE-2014-0195 - buffer overflow via invalid DTLS     fragment

  - fix CVE-2014-0198 - possible NULL pointer dereference

  - fix CVE-2014-0221 - DoS from invalid DTLS handshake     packet

  - fix CVE-2014-0224 - SSL/TLS MITM vulnerability

  - fix CVE-2014-3470 - client-side DoS when using anonymous     ECDH

  - add back support for secp521r1 EC curve

  - fix CVE-2014-0160 - information disclosure in TLS     heartbeat extension

  - use 2048 bit RSA key in FIPS selftests

  - add DH_compute_key_padded needed for FIPS CAVS testing

  - make 3des strength to be 128 bits instead of 168     (#1056616)

  - FIPS mode: do not generate DSA keys and DH parameters <     2048 bits

  - FIPS mode: use approved RSA keygen (allows only 2048 and     3072 bit keys)

  - FIPS mode: add DH selftest

  - FIPS mode: reseed DRBG properly on RAND_add

  - FIPS mode: add RSA encrypt/decrypt selftest

  - FIPS mode: add hard limit for 2^32 GCM block encryptions     with the same key

  - use the key length from configuration file if req
    -newkey rsa is invoked

  - fix CVE-2013-4353 - Invalid TLS handshake crash

  - fix CVE-2013-6450 - possible MiTM attack on DTLS1

  - fix CVE-2013-6449 - crash when version in SSL structure     is incorrect

  - add back some no-op symbols that were inadvertently     dropped

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Update doc/redhat.gif in tarball

  - Add libxml2-oracle-enterprise.patch and update logos in     tarball

  - CVE-2014-3660 denial of service via recursive entity     expansion (rhbz#1149085)

  - Fix a set of regressions introduced in CVE-2014-0191     (rhbz#1105011)

  - Improve handling of xmlStopParser(CVE-2013-2877)

  - Do not fetch external parameter entities (CVE-2014-0191)

  - Fix a regression in 2.9.0 breaking validation while     streaming (rhbz#863166)

  - detect and stop excessive entities expansion upon     replacement (rhbz#912575)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - use setsid to get a controlling session and process     group [Orabug: 17346261] (Todd Vierling)

  - fix (CVE-2014-3634) resolves: #1149148

  - drop patch 5 which introduced a regression resolves:
    #927405 reverts: #847568

  - add a patch to prevent 'RepeatedMsgReduction' causing     missing hostnames resolves: #893197

  - add a patch to enable specifying UID/GID as a number     resolves: #886117

  - add a patch to prevent a segfault in gssapi resolves:
    #862517

The remote OracleVM system is missing necessary patches to address critical security updates :

  - disable sslv3 in ovs-agent [orabug 19893287]

  - Remove changing manual_shutdown value when doing     sync_vm_status function [orabug 16682111]

  - A test 2.3-88 version for bug 16695624, improve the log     of start_vm

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Backport xend: disable sslv3 due to CVE-2014-356     [19831405]

  - libxc: Support set affinity for more than 64 CPUs     [18938789]

The remote OracleVM system is missing necessary patches to address critical security updates :

  - x86/HVM: properly bound x2APIC MSR range This is     XSA-108. Additional changelog comments added to     4.1.3-25.el5.94.1.3 (CVE-2014-7188)

  - Fix for bug 19698532

  - x86emul: only emulate software interrupt injection for     real mode Protected mode emulation currently lacks     proper privilege checking of the referenced IDT entry,     and there's currently no legitimate way for any of the     respective instructions to reach the emulator when the     guest is in protected mode. This is XSA-106.
    (CVE-2014-7156)

  - x86/emulate: check cpl for all privileged instructions     Without this, it is possible for userspace to load its     own IDT or GDT. This is XSA-105. (CVE-2014-7155)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - x86/HVM: properly bound x2APIC MSR range This is     XSA-108. Additional changelog comments added to     4.3.0-55.el6.0.0.3 (CVE-2014-7188)

  - Fix for bug 19698535

  - x86emul: only emulate software interrupt injection for     real mode Protected mode emulation currently lacks     proper privilege checking of the referenced IDT entry,     and there's currently no legitimate way for any of the     respective instructions to reach the emulator when the     guest is in protected mode. This is XSA-106.
    (CVE-2014-7156)

  - x86/emulate: check cpl for all privileged instructions     Without this, it is possible for userspace to load its     own IDT or GDT. This is XSA-105. (CVE-2014-7155)

The remote OracleVM system is missing necessary patches to address critical security updates :

nss

  - Added nss-vendor.patch to change vendor

  - Replace expired PayPal test certificate that breaks the     build

  - Resolves: Bug 1145431 - (CVE-2014-1568)

  - Resolves: Bug 1145431 - (CVE-2014-1568)

  - Removed listed but unused patches detected by the     rpmdiff test

  - Resolves: Bug 1099619

  - Update some patches on account of the rebase

  - Resolves: Bug 1099619

  - Backport nss-3.12.6 upstream fix required by Firefox 31

  - Resolves: Bug 1099619

  - Remove two unused patches and apply a needed one that     was missed

  - Resolves: Bug 1112136 - Rebase nss in RHEL 6.5.Z to NSS     3.16.1

  - Update to nss-3.16.1

  - Resolves: Bug 1112136 - Rebase nss in RHEL 6.5.Z to NSS     3.16.1

  - Make pem's derEncodingsMatch function work with     encrypted keys

  - Resolves: Bug 1048713 - [PEM] active FTPS with encrypted     client key ends up with     SSL_ERROR_TOKEN_INSERTION_REMOVAL

  - Remove unused patches

  - Resolves: Bug 1048713

  - Resolves: Bug 1048713 - [PEM] active FTPS with encrypted     client key ends up with     SSL_ERROR_TOKEN_INSERTION_REMOVAL

  - Revoke trust in one mis-issued anssi certificate

  - Resolves: Bug 1042685 - nss: Mis-issued ANSSI/DCSSI     certificate (MFSA 2013-117) [rhel-6.6]

  - Enable patch with fix for deadlock in trust domain lock     and object lock

  - Resolves: Bug 1036477 - deadlock in trust domain lock     and object lock

  - Disable hw gcm on rhel-5 based build environments where     OS lacks support

  - Rollback changes to build nss without softokn until Bug     689919 is approved

  - Cipher suite was run as part of the nss-softokn build

  - Update to NSS_3_15_3_RTM

  - Resolves: Bug 1032470 - CVE-2013-5605 CVE-2013-5606     (CVE-2013-1741)

  - Using export NSS_DISABLE_HW_GCM=1 to deal with some     problemmatic build systems

  - Resolves: rhbz#1016044 - nss.s390: primary link for     libnssckbi.so must be /usr/lib64/libnssckbi.so

  - Add s390x and ia64 to the %define multilib_arches list     used for defining alt_ckbi

  - Resolves: rhbz#1016044 - nss.s390: primary link for     libnssckbi.so must be /usr/lib64/libnssckbi.so

  - Add zero default value to DISABLETEST check and fix the     TEST_FAILURES check and reporting

  - Resolves: rhbz#990631 - file permissions of     pkcs11.txt/secmod.db must be kept when modified by NSS

  - Related: rhbz#1002645 - Rebase RHEL 6 to NSS 3.15.1 (for     FF 24.x)

  - Add a zero default value to the DISABLETEST and     TEST_FAILURES checks

  - Resolves: rhbz#1002645 - Rebase RHEL 6 to NSS 3.15.1     (for FF 24.x)

  - Fix the test for zero failures in the %check section

  - Resolves: rhbz#1002645 - Rebase RHEL 6 to NSS 3.15.1     (for FF 24.x)

  - Restore a mistakenly removed patch

  - Resolves: rhbz#961659 - SQL backend does not reload     certificates

  - Rebuild for the pem module to link with freel from     nss-softokn-3.14.3-6.el6

  - Related: rhbz#993441 - NSS needs to conform to new FIPS     standard. 

  - Related: rhbz#1010224 - NSS 3.15 breaks SSL in OpenLDAP     clients

  - Don't require nss-softokn-fips

  - Resolves: rhbz#993441 - NSS needs to conform to new FIPS     standard. 

  - Additional syntax fixes in     nss-versus-softoken-test.patch

  - Resolves: rhbz#1002645 - Rebase RHEL 6 to NSS 3.15.1     (for FF 24.x)

  - Fix all.sh test for which application was last build by     updating nss-versus-softoken-test.path

  - Resolves: rhbz#1002645 - Rebase RHEL 6 to NSS 3.15.1     (for FF 24.x)

  - Disable the cipher suite already run as part of the     nss-softokn build

  - Resolves: rhbz#993441 - NSS needs to conform to new FIPS     standard. 

  - Require nss-softokn-fips

  - Resolves: rhbz#993441 - NSS needs to conform to new FIPS     standard. 

  - Require nspr-4.10.0

  - Related: rhbz#1002645 - Rebase RHEL 6 to NSS 3.15.1 (for     FF 24.x)

  - Fix relative path in %check section to prevent     undetected test failures

  - Resolves: rhbz#1002645 - Rebase RHEL 6 to NSS 3.15.1     (for FF 24.x)

  - Rebase to NSS_3.15.1_RTM

  - Resolves: rhbz#1002645 - Rebase RHEL 6 to NSS 3.15.1     (for FF 24.x)

  - Update patches on account of the shallow tree with the     rebase to 3.15.1

  - Update the pem module sources nss-pem-20130405.tar.bz2     with latest patches applied

  - Remove patches rendered obsolete by the nss rebase and     the updated nss-pem sources

  - Enable the iquote.patch to access newly introduced types

  - Do not hold issuer certificate handles in the crl cache

  - Resolves: rhbz#961659 - SQL backend does not reload     certificates

  - Resolves: rhbz#977341 - nss-tools certutil -H does not     list all options

  - Resolves: rhbz#702083 - don't require unique file     basenames

  - Fix race condition in cert code related to smart cards

  - Resolves: rhbz#903017 - Firefox hang when CAC/PIV smart     card certificates are viewed in the certificate manager

  - Configure libnssckbi.so to use the alternatives system     in order to prepare for a drop in replacement. Please     ensure that older packages that don't use the     alternatives system for libnssckbi.so have a smaller     n-v-r.

  - Syncup with uptream changes for aes gcm and ecc suiteb

  - Enable ecc support for suite b

  - Apply several upstream AES GCM fixes

  - Use the pristine nss upstream sources with ecc included

  - Export NSS_ENABLE_ECC=1 in both the build and the check     sections

  - Make failed requests for unsupoprted ssl pkcs 11 bypass     non fatal

  - Resolves: rhbz#882408 - NSS_NO_PKCS11_BYPASS must     preserve ABI

  - Related: rhbz#918950 - rebase nss to 3.14.3

nss-softokn

  - Adjust patch to be compatible with legacy softokn API.

  - Resolves: Bug 1145431 - (CVE-2014-1568)

  - Resolves: Bug 1145431 - (CVE-2014-1568)

  - Skip calls to CHECK_FORK in [C & NSC]_GetFunctionList

  - Resolves: Bug 1082900 - Admin server segfault when     configuration DS configured on SSL port

  - Add workaround to %check unset DISPLAY section for     RHEL-5 based build machines where kernel lacks support     for hardware GCM

  - back out -fips package changes

  - Enable new packaging but don't apply nss-fips-post.patch

  - Related: rhbz#1008513 - Unable to login in fips mode

  - Fix the PR_Access stub to actually access the correct     permissions

  - Resolves: rhbz#1008513 - Unable to login in fips mode

  - Run the lowhash tests

  - Require nspr-4.0.0 and nss-util-3.15.1

  - create -fips packages

  - patch submitted by Bob Relyea

  - fix the script that splits softoken off from nss

  - patch nss/cmd/lib/basicutil.c to build against     nss-util-3.15.1

  - Resolves: rhbz#993441 - NSS needs to conform to new FIPS     standard. 

  - Resolves: rhbz#976572 - Pick up various upstream GCM     code fixes applied since nss-3.14.3 was released

  - Display cpuifo as part of the tests and make     NSS_DISABLE_HW_GCM the environment variable to test for

  - When appling the patches use a backup file suffix that     better describes the patch purpose

  - Enable ECC support for suite b and add upstream fixes     for aec gcm

  - Use the unstripped upstream sources with ecc support

  - Limit the ECC support to suite b

  - Apply several upstream aes gcm fixes

  - Rename macros EC_MIN_KEY_BITS and EC_MAX_KEY_BITS per     upstream

  - Resolves: rhbz#960208 - Enable ECC in nss-softoken

  - Related: rhbz#919172

nss-util

  - Resolves: bug 1145431 - (CVE-2014-1568)

  - Update to nss-3.16.1

  - Resolves: rhbz#1112136

  - Update to NSS_3_15_3_RTM

  - Resolves: rhbz#1032470 - CVE-2013-5605 CVE-2013-5606     (CVE-2013-1741)

  - Preserve existing permissions when replacing existing     pkcs11.txt file, but keep strict default permissions for     new files

  - Resolves: rhbz#990631 - file permissions of     pkcs11.txt/secmod.db must be kept when modified by NSS

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Remove gconv transliteration loadable modules support     (CVE-2014-5119, - _nl_find_locale: Improve handling of     crafted locale names (CVE-2014-0475, 

  - Don't use alloca in addgetnetgrentX (#1087789).

  - Adjust pointers to triplets in netgroup query data     (#1087789).

  - Return EAI_AGAIN for AF_UNSPEC when herrno is TRY_AGAIN     (#1098050).

  - Fix race in free of fastbin chunk (#1091162).

  - Revert the addition of gettimeofday vDSO function for     ppc and ppc64 until OPD VDSO function call issues are     resolved (#1026533).

  - Call gethostbyname4_r only for PF_UNSPEC (#1022022).

  - Fix integer overflows in *valloc and memalign.
    (#1008310).

  - Initialize res_hconf in nscd (#970090).

  - Update previous patch for dcigettext.c and loadmsgcat.c     (#834386).

  - Save search paths before performing relro protection     (#988931).

  - Correctly name the 240-bit slow path sytemtap probe     slowpow_p10 for slowpow (#905575).

  - Align value of stacksize in nptl-init (#663641).

  - Renamed release engineering directory from 'fedora' to     `releng' (#903754).

  - Backport GLIBC sched_getcpu and gettimeofday vDSO     functions for ppc (#929302).

  - Fall back to local DNS if resolv.conf does not define     nameservers (#928318).

  - Add systemtap probes to slowexp and slowpow (#905575).

  - Fix getaddrinfo stack overflow resulting in application     crash (CVE-2013-1914, #951213).

  - Fix multibyte character processing crash in regexp     (CVE-2013-0242, #951213).

  - Add netgroup cache support for nscd (#629823).

  - Fix multiple nss_compat initgroups bugs (#966778).

  - Don't use simple lookup for AF_INET when AI_CANONNAME is     set (#863384).

  - Add MAP_HUGETLB and MAP_STACK support (#916986).

  - Update translation for stale file handle error     (#970776).

  - Improve performance of _SC_NPROCESSORS_ONLN (#rh952422).

  - Fix up _init in pt-initfini to accept arguments     (#663641).

  - Set reasonable limits on xdr requests to prevent memory     leaks (#848748).

  - Fix mutex locking for PI mutexes on spurious wake-ups on     pthread condvars (#552960).

  - New environment variable GLIBC_PTHREAD_STACKSIZE to set     thread stack size (#663641).

  - Improved handling of recursive calls in backtrace     (#868808).

  - The ttyname and ttyname_r functions on Linux now fall     back to searching for the tty file descriptor in     /dev/pts or /dev if /proc is not available. This allows     creation of chroots without the procfs mounted on /proc.
    (#851470)

  - Don't free rpath strings allocated during startup until     after ld.so is re-relocated. (#862094)

  - Consistantly MANGLE/DEMANGLE function pointers. Fix use     after free in dcigettext.c (#834386).

  - Change rounding mode only when necessary (#966775).

  - Backport of code to allow incremental loading of library     list (#886968).

  - Fix loading of audit libraries when TLS is in use     (#919562)

  - Fix application of SIMD FP exception mask (#929388).

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Update to nss-3.16.1

  - Resolves: rhbz#1112136

  - Update to NSS_3_15_3_RTM

  - Resolves: rhbz#1032470 - CVE-2013-5605 CVE-2013-5606     (CVE-2013-1741)

  - Preserve existing permissions when replacing existing     pkcs11.txt file, but keep strict default permissions for     new files

  - Resolves: rhbz#990631 - file permissions of     pkcs11.txt/secmod.db must be kept when modified by NSS

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Added nss-vendor.patch to change vendor

  - Update some patches on account of the rebase

  - Resolves: Bug 1099619

  - Backport nss-3.12.6 upstream fix required by Firefox 31

  - Resolves: Bug 1099619

  - Remove two unused patches and apply a needed one that     was missed

  - Resolves: Bug 1112136 - Rebase nss in RHEL 6.5.Z to NSS     3.16.1

  - Update to nss-3.16.1

  - Resolves: Bug 1112136 - Rebase nss in RHEL 6.5.Z to NSS     3.16.1

  - Make pem's derEncodingsMatch function work with     encrypted keys

  - Resolves: Bug 1048713 - [PEM] active FTPS with encrypted     client key ends up with     SSL_ERROR_TOKEN_INSERTION_REMOVAL

  - Remove unused patches

  - Resolves: Bug 1048713

  - Resolves: Bug 1048713 - [PEM] active FTPS with encrypted     client key ends up with     SSL_ERROR_TOKEN_INSERTION_REMOVAL

  - Revoke trust in one mis-issued anssi certificate

  - Resolves: Bug 1042685 - nss: Mis-issued ANSSI/DCSSI     certificate (MFSA 2013-117) [rhel-6.6]

  - Enable patch with fix for deadlock in trust domain lock     and object lock

  - Resolves: Bug 1036477 - deadlock in trust domain lock     and object lock

  - Disable hw gcm on rhel-5 based build environments where     OS lacks support

  - Rollback changes to build nss without softokn until Bug     689919 is approved

  - Cipher suite was run as part of the nss-softokn build

  - Update to NSS_3_15_3_RTM

  - Resolves: Bug 1032470 - CVE-2013-5605 CVE-2013-5606     (CVE-2013-1741)

  - Using export NSS_DISABLE_HW_GCM=1 to deal with some     problemmatic build systems

  - Resolves: rhbz#1016044 - nss.s390: primary link for     libnssckbi.so must be /usr/lib64/libnssckbi.so

  - Add s390x and ia64 to the %define multilib_arches list     used for defining alt_ckbi

  - Resolves: rhbz#1016044 - nss.s390: primary link for     libnssckbi.so must be /usr/lib64/libnssckbi.so

  - Add zero default value to DISABLETEST check and fix the     TEST_FAILURES check and reporting

  - Resolves: rhbz#990631 - file permissions of     pkcs11.txt/secmod.db must be kept when modified by NSS

  - Related: rhbz#1002645 - Rebase RHEL 6 to NSS 3.15.1 (for     FF 24.x)

  - Add a zero default value to the DISABLETEST and     TEST_FAILURES checks

  - Resolves: rhbz#1002645 - Rebase RHEL 6 to NSS 3.15.1     (for FF 24.x)

  - Fix the test for zero failures in the %check section

  - Resolves: rhbz#1002645 - Rebase RHEL 6 to NSS 3.15.1     (for FF 24.x)

  - Restore a mistakenly removed patch

  - Resolves: rhbz#961659 - SQL backend does not reload     certificates

  - Rebuild for the pem module to link with freel from     nss-softokn-3.14.3-6.el6

  - Related: rhbz#993441 - NSS needs to conform to new FIPS     standard. 

  - Related: rhbz#1010224 - NSS 3.15 breaks SSL in OpenLDAP     clients

  - Don't require nss-softokn-fips

  - Resolves: rhbz#993441 - NSS needs to conform to new FIPS     standard. 

  - Additional syntax fixes in     nss-versus-softoken-test.patch

  - Resolves: rhbz#1002645 - Rebase RHEL 6 to NSS 3.15.1     (for FF 24.x)

  - Fix all.sh test for which application was last build by     updating nss-versus-softoken-test.path

  - Resolves: rhbz#1002645 - Rebase RHEL 6 to NSS 3.15.1     (for FF 24.x)

  - Disable the cipher suite already run as part of the     nss-softokn build

  - Resolves: rhbz#993441 - NSS needs to conform to new FIPS     standard. 

  - Require nss-softokn-fips

  - Resolves: rhbz#993441 - NSS needs to conform to new FIPS     standard.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - fix CVE-2014-3505 - doublefree in DTLS packet processing

  - fix CVE-2014-3506 - avoid memory exhaustion in DTLS

  - fix CVE-2014-3507 - avoid memory leak in DTLS

  - fix CVE-2014-3508 - fix OID handling to avoid     information leak

  - fix CVE-2014-3509 - fix race condition when parsing     server hello

  - fix CVE-2014-3510 - fix DoS in anonymous (EC)DH handling     in DTLS

  - fix CVE-2014-3511 - disallow protocol downgrade via     fragmentation

The remote OracleVM system is missing necessary patches to address critical security updates :

  - page-alloc: scrub pages used by hypervisor upon freeing     XSA-100 (Jan Beulich) [18970618]

The remote OracleVM system is missing necessary patches to address critical security updates :

  - page-alloc: scrub pages used by hypervisor upon freeing     ... unless they're part of a fully separate pool (and     hence can't ever be used for guest allocations). This is     XSA-100.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - fix for CVE-2014-0224 - SSL/TLS MITM vulnerability

  - replace expired GlobalSign Root CA certificate in     ca-bundle.crt

  - fix for CVE-2013-0169 - SSL/TLS CBC timing attack     (#907589)

  - fix for CVE-2013-0166 - DoS in OCSP signatures checking     (#908052)

  - enable compression only if explicitly asked for or     OPENSSL_DEFAULT_ZLIB environment variable is set (fixes     CVE-2012-4929 #857051)

  - use __secure_getenv everywhere instead of getenv     (#839735)

  - fix for CVE-2012-2333 - improper checking for record     length in DTLS (#820686)

  - fix for CVE-2012-2110 - memory corruption in     asn1_d2i_read_bio (#814185)

  - fix problem with the SGC restart patch that might     terminate handshake incorrectly

  - fix for CVE-2012-0884 - MMA weakness in CMS and PKCS#7     code (#802725)

  - fix for CVE-2012-1165 - NULL read dereference on bad     MIME headers (#802489)

  - fix for CVE-2011-4108 & CVE-2012-0050 - DTLS plaintext     recovery vulnerability and additional DTLS fixes     (#771770)

  - fix for CVE-2011-4109 - double free in policy checks     (#771771)

  - fix for CVE-2011-4576 - uninitialized SSL 3.0 padding     (#771775)

  - fix for CVE-2011-4619 - SGC restart DoS attack (#771780)

  - add known answer test for SHA2 algorithms (#740866)

  - make default private key length in certificate Makefile     2048 bits (can be changed with PRIVATE_KEY_BITS setting)     (#745410)

  - fix incorrect return value in parse_yesno (#726593)

  - added DigiCert CA certificates to ca-bundle (#735819)

  - added a new section about error states to README.FIPS     (#628976)

  - add missing DH_check_pub_key call when DH key is     computed (#698175)

  - presort list of ciphers available in SSL (#688901)

  - accept connection in s_server even if getaddrinfo fails     (#561260)

  - point to openssl dgst for list of supported digests     (#608639)

  - fix handling of future TLS versions (#599112)

  - added VeriSign Class 3 Public Primary Certification     Authority - G5 and StartCom Certification Authority     certs to ca-bundle (#675671, #617856)

  - upstream fixes for the CHIL engine (#622003, #671484)

  - add SHA-2 hashes in SSL_library_init (#676384)

  - fix CVE-2010-4180 - completely disable code for     SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG (#659462)

  - fix CVE-2009-3245 - add missing bn_wexpand return checks     (#570924)

  - fix CVE-2010-0433 - do not pass NULL princ to     krb5_kt_get_entry which in the RHEL-5 and newer versions     will crash in such case (#569774)

  - fix CVE-2009-3555 - support the safe renegotiation     extension and do not allow legacy renegotiation on the     server by default (#533125)

  - fix CVE-2009-2409 - drop MD2 algorithm from EVP tables     (#510197)

  - fix CVE-2009-4355 - do not leak memory when     CRYPTO_cleanup_all_ex_data is called prematurely by     application (#546707)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - flask: restrict allocations done by hypercall interface     Other than in 4.2 and newer, we're not having an     overflow issue here, but uncontrolled exposure of the     operations opens the host to be driven out of memory by     an arbitrary guest. Since all operations other than     FLASK_LOAD simply deal with ASCII strings, limiting the     allocations (and incoming buffer sizes) to a page worth     of memory seems like the best thing we can do.
    Consequently, in order to not expose the larger     allocation to arbitrary guests, the permission check for     FLASK_LOAD needs to be pulled ahead of the allocation     (and it's perhaps worth noting that - afaict - it was     pointlessly done with the sel_sem spin lock held). Note     that this breaks FLASK_AVC_CACHESTATS on systems with     sufficiently many CPUs (as requiring a buffer bigger     than PAGE_SIZE there). No attempt is made to address     this here, as it would needlessly complicate this fix     with rather little gain. This is XSA-84.

    The index of boolean variables in FLASK_[GET,SET]BOOL     was not always checked against the bounds of the array.

18205387] (CVE-2014-1892, CVE-2014-1893)

  - libxc: Fix out-of-memory error handling in     xc_cpupool_getinfo Avoid freeing info then returning it     to the caller. This is XSA-88. Coverity-ID: 1056192

18206144] [CVE-2014-XXXX]

The remote OracleVM system is missing necessary patches to address critical security updates :

  - flask: restrict allocations done by hypercall interface     Other than in 4.2 and newer, we're not having an     overflow issue here, but uncontrolled exposure of the     operations opens the host to be driven out of memory by     an arbitrary guest. Since all operations other than     FLASK_LOAD simply deal with ASCII strings, limiting the     allocations (and incoming buffer sizes) to a page worth     of memory seems like the best thing we can do.
    Consequently, in order to not expose the larger     allocation to arbitrary guests, the permission check for     FLASK_LOAD needs to be pulled ahead of the allocation     (and it's perhaps worth noting that - afaict - it was     pointlessly done with the sel_sem spin lock held). Note     that this breaks FLASK_AVC_CACHESTATS on systems with     sufficiently many CPUs (as requiring a buffer bigger     than PAGE_SIZE there). No attempt is made to address     this here, as it would needlessly complicate this fix     with rather little gain. This is XSA-84.

    The index of boolean variables in FLASK_[GET,SET]BOOL     was not always checked against the bounds of the array.

18205362] (CVE-2014-1892, CVE-2014-1893)

  - libxc: Fix out-of-memory error handling in     xc_cpupool_getinfo Avoid freeing info then returning it     to the caller. This is XSA-88. Coverity-ID: 1056192

18206135] [CVE-2014-XXXX]

The remote OracleVM system is missing necessary patches to address critical security updates :

  - x86/AMD: work around erratum 793 XSA-82 (Jan Beulich)     [17884839] (CVE-2013-6885)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - x86/AMD: work around erratum 793 The recommendation is     to set a bit in an MSR - do this if the firmware didn't,     considering that otherwise we expose ourselves to a     guest induced DoS. This is CVE-2013-6885 / XSA-82.
    (CVE-2013-6885)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - x86/HVM: only allow ring 0 guest code to make hypercalls     XSA-76 (Jan Beulich) [17822325] (CVE-2013-4554)

  - x86: restrict XEN_DOMCTL_getmemlist XSA-74 (Jan Beulich)     [17821907] (CVE-2013-4553)

  - gnttab: correct locking order reversal XSA-73 (Andrew     Cooper) [orabug 17768955] (CVE-2013-4494)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - x86/HVM: only allow ring 0 guest code to make hypercalls     Anything else would allow for privilege escalation. This     is CVE-2013-4554 / XSA-76. (CVE-2013-4554)

  - x86: restrict XEN_DOMCTL_getmemlist Coverity ID 1055652     (See the code comment.) This is CVE-2013-4553 / XSA-74.
    (CVE-2013-4553)

  - gnttab: correct locking order reversal Coverity ID     1087189 Correct a lock order reversal between a domains     page allocation and grant table locks. This is     CVE-2013-4494 / XSA-73.

    Consolidate error handling.

    Backported to Xen-4.1 (CVE-2013-4494)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - x86/HVM: only allow ring 0 guest code to make hypercalls     Anything else would allow for privilege escalation. This     is CVE-2013-4554 / XSA-76. (CVE-2013-4554)

  - x86: restrict XEN_DOMCTL_getmemlist Coverity ID 1055652     (See the code comment.) This is CVE-2013-4553 / XSA-74.
    (CVE-2013-4553)

  - gnttab: update version 1 of xsa73-4.1.patch to version 3     Version 1 of xsa73-4.1.patch had an error: bool_t     drop_dom_ref = (e->tot_pages-- == 0)  should have been:
    bool_t drop_dom_ref = (e->tot_pages-- == 1) 

    Consolidate error handling.

    Backported to Xen-4.1 (CVE-2013-4494)

  - Xen: Spread boot time page scrubbing across all     available CPU's Written by Malcolm Crossley The page     scrubbing is done in 256MB chunks in lockstep across all     the CPU's. This allows for the boot CPU to hold the     heap_lock whilst each chunk is being scrubbed and then     release the heap_lock when all CPU's are finished     scrubing their individual chunk. This allows for the     heap_lock to not be held continously and for pending     softirqs are to be serviced periodically across all     CPU's. The page scrub memory chunks are allocated to the     CPU's in a NUMA aware fashion to reduce Socket     interconnect overhead and improve performance. This     patch reduces the boot page scrub time on a 256GB 16     core AMD Opteron machine from 1 minute 46 seconds to 38     seconds.

  - gnttab: correct locking order reversal Coverity ID     1087189 Correct a lock order reversal between a domains     page allocation and grant table locks. This is XSA-73.

    Consolidate error handling.

    Backported to Xen-4.1 (CVE-2013-4494)

  - piix4acpi, xen, hotplug: Fix race with ACPI AML code and     hotplug. This is a race so the amount varies but on a     4PCPU box I seem to get only ~14 out of 16 vCPUs I want     to online. The issue at hand is that QEMU xenstore.c     hotplug code changes the vCPU array and triggers an ACPI     SCI for each vCPU online/offline change. That means we     modify the array of vCPUs as the guests ACPI AML code is     reading it - resulting in the guest reading the data     only once and not changing the CPU states appropiately.
    The fix is to seperate the vCPU array changes from the     ACPI SCI notification. The code now will enumerate all     of the vCPUs and change the vCPU array if there is a     need for a change. If a change did occur then only _one_     ACPI SCI pulse is sent to the guest. The vCPU array at     that point has the online/offline modified to what the     user wanted to have.

    [v1: Use stack for the 'attr' instead of malloc/free]

  - piix4acpi, xen: Clarify that the qemu_set_irq calls just     do an IRQ pulse. The 'qemu_cpu_notify' raises and lowers     the ACPI SCI line when the vCPU state has changed.
    Instead of doing the two functions, just use one     function that describes exactly what it does.

  - piix4acpi, xen, vcpu hotplug: Split the notification     from the changes. This is a prepatory patch that splits     the notification of an vCPU change from the actual     changes to the vCPU array.

  - Backported Carson's changes - Requests to connect on     port 8003 with a LOW/weak cipher are now rejected.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - x86: check segment descriptor read result in 64-bit OUTS     emulation XSA-67 (Matthew Daley) [orabug 17571623]     (CVE-2013-4368)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - x86: check segment descriptor read result in 64-bit OUTS     emulation XSA-67 (Matthew Daley) [orabug 17571640]     (CVE-2013-4368)

  - x86: properly set up fbld emulation operand address     XSA-66 (Jan Beulich) [orabug 17472492] (CVE-2013-4361)

  - x86: properly handle hvm_copy_from_guest_[phys,virt]     errors XSA-63 (Jan Beulich) [orabug 17472461]     (CVE-2013-4355)

  - libxc: builder: limit maximum size of kernel/ramdisk     (Ian Campbell) [orabug 15852491] (CVE-2012-4544)

  - libxc: builder: Correct fix for CVE-2012-4544 (Ian     Campbell) [orabug 15852491] (CVE-2012-4544)

  - [PATCH 01/21] libelf: abolish libelf-relocate.c (Ian     Jackson) [orabug 16902308] (CVE-2013-2194 CVE-2013-2195     CVE-2013-2196)

  - [PATCH 02/21] libxc: introduce xc_dom_seg_to_ptr_pages     (Ian Jackson) [orabug 16902308] (CVE-2013-2194     CVE-2013-2195 CVE-2013-2196)

  - [PATCH 03/21] libxc: Fix range checking in     xc_dom_pfn_to_ptr etc. (Ian Jackson) [orabug 16902308]     (CVE-2013-2194 CVE-2013-2195 CVE-2013-2196)

  - [PATCH 04/21] libelf: abolish elf_sval and     elf_access_signed (Ian Jackson) [orabug 16902308]     (CVE-2013-2194 CVE-2013-2195 CVE-2013-2196)

  - [PATCH 05/21] libelf/xc_dom_load_elf_symtab: Do not use     'syms' uninitialised (Ian Jackson) [orabug 16902308]     (CVE-2013-2194 CVE-2013-2195 CVE-2013-2196)

  - [PATCH 06/21] libelf: introduce macros for memory access     and pointer handling (Ian Jackson) [orabug 16902308]     (CVE-2013-2194 CVE-2013-2195 CVE-2013-2196)

  - [PATCH 07/21] tools/xcutils/readnotes: adjust     print_l1_mfn_valid_note (Ian Jackson) [orabug 16902308]     (CVE-2013-2194 CVE-2013-2195 CVE-2013-2196)

  - [PATCH 08/21] libelf: check nul-terminated strings     properly (Ian Jackson) [orabug 16902308] (CVE-2013-2194     CVE-2013-2195 CVE-2013-2196)

  - [PATCH 09/21] libelf: check all pointer accesses (Ian     Jackson) [orabug 16902308] (CVE-2013-2194 CVE-2013-2195     CVE-2013-2196)

  - [PATCH 10/21] libelf: Check pointer references in     elf_is_elfbinary (Ian Jackson) [orabug 16902308]     (CVE-2013-2194 CVE-2013-2195 CVE-2013-2196)

  - [PATCH 11/21] libelf: Make all callers call     elf_check_broken (Ian Jackson) [orabug 16902308]     (CVE-2013-2194 CVE-2013-2195 CVE-2013-2196)

  - [PATCH 12/21] libelf: use C99 bool for booleans (Ian     Jackson) [orabug 16902308] (CVE-2013-2194 CVE-2013-2195     CVE-2013-2196)

  - [PATCH 13/21] libelf: use only unsigned integers (Ian     Jackson) [orabug 16902308] (CVE-2013-2194 CVE-2013-2195     CVE-2013-2196)

  - [PATCH 14/21] libxc: Introduce xc_bitops.h (Ian Jackson)     [orabug 16902308] (CVE-2013-2194 CVE-2013-2195     CVE-2013-2196)

  - [PATCH 15/21] libelf: check loops for running away (Ian     Jackson) [orabug 16902308] (CVE-2013-2194 CVE-2013-2195     CVE-2013-2196)

  - [PATCH 16/21] libelf: abolish obsolete macros (Ian     Jackson) [orabug 16902308] (CVE-2013-2194 CVE-2013-2195     CVE-2013-2196)

  - [PATCH 17/21] libxc: Add range checking to     xc_dom_binloader (Ian Jackson) [orabug 16902308]     (CVE-2013-2194 CVE-2013-2195 CVE-2013-2196)

  - [PATCH 18/21] libxc: check failure of xc_dom_*_to_ptr,     xc_map_foreign_range (Ian Jackson) [orabug 16902308]     (CVE-2013-2194 CVE-2013-2195 CVE-2013-2196)

  - [PATCH 19/21] libxc: check return values from malloc     (Ian Jackson) [orabug 16902308] (CVE-2013-2194     CVE-2013-2195 CVE-2013-2196)

  - [PATCH 20/21] libxc: range checks in xc_dom_p2m_host and
    _guest (Ian Jackson) [orabug 16902308] (CVE-2013-2194     CVE-2013-2195 CVE-2013-2196)

  - [PATCH 21/21] libxc: check blob size before proceeding     in xc_dom_check_gzip (Matthew Daley) [orabug 16902308]     (CVE-2013-2194 CVE-2013-2195 CVE-2013-2196)

  - libxc: define INVALID_MFN for the XSA-55 patchset (Chuck     Anderson) [orabug 16902308] (CVE-2013-2194 CVE-2013-2195     CVE-2013-2196)

  - fix page refcount handling in page table pin error path     (Andrew Cooper) [orabug 16949882] (CVE-2013-1432)

  - remove CVE-2013-1919 (Chuck Anderson) [orabug 16635741]     (CVE-2013-1919)

  - x86: make vcpu_destroy_pagetables preemptible (Jan     Beulich) [orabug 16714903] (CVE-2013-1918)

  - x86: make new_guest_cr3 preemptible (Jan Beulich)     [orabug 16714903] (CVE-2013-1918)

  - x86: make MMUEXT_NEW_USER_BASEPTR preemptible (Jan     Beulich) [orabug 16714903] (CVE-2013-1918)

  - x86: make vcpu_reset preemptible (Jan Beulich) [orabug     16714903] (CVE-2013-1918)

  - x86: make arch_set_info_guest preemptible (Jan Beulich)     [orabug 16714903] (CVE-2013-1918)

  - x86: make page table unpinning preemptible (Jan Beulich)     [orabug 16714903] (CVE-2013-1918)

  - x86: make page table handling error paths preemptible     (Jan Beulich) [orabug 16714903] (CVE-2013-1918)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - bug 17571611 (CVE-2013-4368)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - x86: check segment descriptor read result in 64-bit OUTS     emulation When emulating such an operation from a 64-bit     context (CS has long mode set), and the data segment is     overridden to FS/GS, the result of reading the     overridden segment's descriptor (read_descriptor) is not     checked. If it fails, data_base is left uninitialized.
    This can lead to 8 bytes of Xen's stack being leaked to     the guest (implicitly, i.e. via the address given in a     #PF). Coverity-ID: 1055116 This is CVE-2013-4368 /     XSA-67.

    Fix formatting. (CVE-2013-4368)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Rebuild correcting changelog

  - x86: properly set up fbld emulation operand address This     is XSA-66. (CVE-2013-4361)

  - x86: properly handle hvm_copy_from_guest_[phys,virt]     errors Ignoring them generally implies using     uninitialized data and, in all cases dealt with here,     potentially leaking hypervisor stack contents to guests.
    This is XSA-63. (CVE-2013-4355)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - x86: properly set up fbld emulation operand address This     is XSA-66. (CVE-2013-4361)

  - x86: properly handle hvm_copy_from_guest_[phys,virt]     errors Ignoring them generally implies using     uninitialized data and, in all cases dealt with here,     potentially leaking hypervisor stack contents to guests.
    This is XSA-63. (CVE-2013-4355)

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2013-0069 for details.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2013-0068 for details.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - x86: fix page refcount handling in page table pin error     path In the original patch 7 of the series addressing     XSA-45 I mistakenly took the addition of the call to     get_page_light in alloc_page_type to cover two     decrements that would happen: One for the PGT_partial     bit that is getting set along with the call, and the     other for the page reference the caller hold (and would     be dropping on its error path). But of course the     additional page reference is tied to the PGT_partial     bit, and hence any caller of a function that may leave
    ->arch.old_guest_table non-NULL for error cleanup     purposes has to make sure a respective page reference     gets retained. Similar issues were then also spotted     elsewhere: In effect all callers of     get_page_type_preemptible need to deal with errors in     similar ways. To make sure error handling can work this     way without leaking page references, a respective     assertion gets added to that function. This is     CVE-2013-1432 / XSA-58.

  - libxl: Restrict permissions on PV console device     xenstore nodes Matthew Daley has observed that the PV     console protocol places sensitive host state into a     guest writeable xenstore locations, this includes :

  - The pty used to communicate between the console backend     daemon and its client, allowing the guest administrator     to read and write arbitrary host files.

  - The output file, allowing the guest administrator to     write arbitrary host files or to target arbitrary qemu     chardevs which include sockets, udp, ptr, pipes etc (see
    -chardev in qemu(1) for a more complete list).

  - The maximum buffer size, allowing the guest     administrator to consume more resources than the host     administrator has configured.

  - The backend to use (qemu vs xenconsoled), potentially     allowing the guest administrator to confuse host     software. So we arrange to make the sensitive keys in     the xenstore frontend directory read only for the guest.
    This is safe since the xenstore permissions model,     unlike POSIX directory permissions, does not allow the     guest to remove and recreate a node if it has write     access to the containing directory. There are a few     associated wrinkles :

  - The primary PV console is 'special'. It's xenstore node     is not under the usual /devices/ subtree and it does not     use the customary xenstore state machine protocol.
    Unfortunately its directory is used for other things,     including the vnc-port node, which we do not want the     guest to be able to write to. Rather than trying to     track down all the possible secondary uses of this     directory just make it r/o to the guest. All newly     created subdirectories inherit these permissions and so     are now safe by default.

  - The other serial consoles do use the customary xenstore     state machine and therefore need write access to at     least the 'protocol' and 'state' nodes, however they may     also want to use arbitrary 'feature-foo' nodes (although     I'm not aware of any) and therefore we cannot simply     lock down the entire frontend directory. Instead we add     support to libxl__device_generic_add for frontend keys     which are explicitly read only and use that to lock down     the sensitive keys.

  - Minios' console frontend wants to write the 'type' node,     which it has no business doing since this is a     host/toolstack level decision. This fails now that the     node has become read only to the PV guest. Since the     toolstack already writes this node just remove the     attempt to set it. This is CVE-XXXX-XXX / XSA-57

    Conflicts (4.2 backport): tools/libxl/libxl.c (no vtpm,     free front_ro on error in libxl__device_console_add)     Conflicts (4.1 backport):
    extras/mini-os/console/xenbus.c tools/libxl/libxl.c     tools/libxl/libxl_device.c tools/libxl/libxl_internal.h     tools/libxl/libxl_pci.c tools/libxl/libxl_xshelp.c

  - minios code was in xencons_ring.c

  - many places need &gc not just gc

  - libxl__xs_writev path is not const

  - varios minor context fixups

The remote OracleVM system is missing necessary patches to address critical security updates :

  - x86/xsave: properly check guest input to XSETBV Other     than the HVM emulation path, the PV case so far failed     to check that YMM state requires SSE state to be     enabled, allowing for a #GP to occur upon passing the     inputs to XSETBV inside the hypervisor. This is     CVE-2013-2078 / XSA-54. (CVE-2013-2078)

  - 86/xsave: recover from faults on XRSTOR Just like     FXRSTOR, XRSTOR can raise #GP if bad content is being     passed to it in the memory block (i.e. aspects not under     the control of the hypervisor, other than e.g. proper     alignment of the block). Also correct the comment     explaining why FXRSTOR needs exception recovery code to     not wrongly state that this can only be a result of the     control tools passing a bad image. This is CVE-2013-2077     / XSA-53. (CVE-2013-2077)

  - x86/xsave: fix information leak on AMD CPUs Just like     for FXSAVE/FXRSTOR, XSAVE/XRSTOR also don't save/restore     the last instruction and operand pointers as well as the     last opcode if there's no pending unmasked exception     (see CVE-2006-1056 and commit 9747:4d667a139318). While     the FXSR solution sits in the save path, I prefer to     have this in the restore path because there the handling     is simpler (namely in the context of the pending changes     to properly save the selector values for 32-bit guest     code). Also this is using FFREE instead of EMMS, as it     doesn't seem unlikely that in the future we may see CPUs     with x87 and SSE/AVX but no MMX support. The goal here     anyway is just to avoid an FPU stack overflow. I would     have preferred to use FFREEP instead of FFREE (freeing     two stack slots at once), but AMD doesn't document that     instruction. This is CVE-2013-2076 / XSA-52.
    (CVE-2013-2076)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Other than the HVM emulation path, the PV case so far     failed to check that YMM state requires SSE state to be     enabled, allowing for a #GP to occur upon passing the     inputs to XSETBV inside the hypervisor. This is     CVE-2013-2078 / XSA-54. (CVE-2013-2078)

  - x86/xsave: recover from faults on XRSTOR Just like     FXRSTOR, XRSTOR can raise #GP if bad content is being     passed to it in the memory block (i.e. aspects not under     the control of the hypervisor, other than e.g. proper     alignment of the block). Also correct the comment     explaining why FXRSTOR needs exception recovery code to     not wrongly state that this can only be a result of the     control tools passing a bad image. This is CVE-2013-2077     / XSA-53. (CVE-2013-2077)

  - x86/xsave: fix information leak on AMD CPUs Just like     for FXSAVE/FXRSTOR, XSAVE/XRSTOR also don't save/restore     the last instruction and operand pointers as well as the     last opcode if there's no pending unmasked exception     (see CVE-2006-1056 and commit 9747:4d667a139318). While     the FXSR solution sits in the save path, I prefer to     have this in the restore path because there the handling     is simpler (namely in the context of the pending changes     to properly save the selector values for 32-bit guest     code). Also this is using FFREE instead of EMMS, as it     doesn't seem unlikely that in the future we may see CPUs     with x87 and SSE/AVX but no MMX support. The goal here     anyway is just to avoid an FPU stack overflow. I would     have preferred to use FFREEP instead of FFREE (freeing     two stack slots at once), but AMD doesn't document that     instruction. This is CVE-2013-2076 / XSA-52.
    (CVE-2013-2076)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - libxc: limit cpu values when setting vcpu affinity When     support for pinning more than 64 cpus was added, check     for cpu out-of-range values was removed. This can lead     to subsequent out-of-bounds cpumap array accesses in     case the cpu number is higher than the actual count.
    This patch returns the check. This is CVE-2013-2072 /     XSA-56 (CVE-2013-2072)

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2013-0039 for details.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - VT-d: don't permit SVT_NO_VERIFY entries for known     device types Only in cases where we don't know what to     do we should leave the IRTE blank (suppressing all     validation), but we should always log a warning in those     cases (as being insecure). This is CVE-2013-1952 /     XSA-49.

  - x86: make page table handling error paths preemptible     ... as they may take significant amounts of time. This     requires cloning the tweaked continuation logic from     do_mmuext_op to do_mmu_update. Note that in     mod_l[34]_entry a negative 'preemptible' value gets     passed to put_page_from_l[34]e now, telling the callee     to store the respective page in     current->arch.old_guest_table (for a hypercall     continuation to pick up), rather than carrying out the     put right away. This is going to be made a little more     explicit by a subsequent cleanup patch. This is part of     CVE-2013-1918 / XSA-45. (CVE-2013-1918)

  - x86: make page table unpinning preemptible ... as it may     take significant amounts of time. Since we can't     re-invoke the operation in a second attempt, the     continuation logic must be slightly tweaked so that we     make sure do_mmuext_op gets run one more time even when     the preempted unpin operation was the last one in a     batch. This is part of CVE-2013-1918 / XSA-45.
    (CVE-2013-1918)

  - x86: make arch_set_info_guest preemptible .. as the root     page table validation (and the dropping of an eventual     old one) can require meaningful amounts of time. This is     part of CVE-2013-1918 / XSA-45. (CVE-2013-1918)

  - x86: make vcpu_reset preemptible ... as dropping the old     page tables may take significant amounts of time. This     is part of CVE-2013-1918 / XSA-45. (CVE-2013-1918)

  - x86: make MMUEXT_NEW_USER_BASEPTR preemptible ... as it     may take significant amounts of time. This is part of     CVE-2013-1918 / XSA-45. (CVE-2013-1918)

  - x86: make new_guest_cr3 preemptible ... as it may take     significant amounts of time. This is part of     CVE-2013-1918 / XSA-45. (CVE-2013-1918)

  - x86: make vcpu_destroy_pagetables preemptible ... as it     may take significant amounts of time. The function,     being moved to mm.c as the better home for it anyway,     and to avoid having to make a new helper function there     non-static, is given a 'preemptible' parameter     temporarily (until, in a subsequent patch, its other     caller is also being made capable of dealing with     preemption). This is part of CVE-2013-1918 / XSA-45.
    (CVE-2013-1918)

  - Fix rcu domain locking for transitive grants When     acquiring a transitive grant for copy then the owning     domain needs to be locked down as well as the granting     domain. This was being done, but the unlocking was not.
    The acquire code now stores the struct domain * of the     owning domain (rather than the domid) in the active     entry in the granting domain. The release code then does     the unlock on the owning domain. Note that I believe I     also fixed a bug where, for non-transitive grants the     active entry contained a reference to the acquiring     domain rather than the granting domain. From my reading     of the code this would stop the release code for     transitive grants from terminating its recursion     correctly.

    Also, for non-transitive grants we now avoid incorrectly     recursing in __release_grant_for_copy. This is     CVE-2013-1964 / XSA-50. (CVE-2013-1964)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - VT-d: don't permit SVT_NO_VERIFY entries for known     device types Only in cases where we don't know what to     do we should leave the IRTE blank (suppressing all     validation), but we should always log a warning in those     cases (as being insecure). This is CVE-2013-1952 /     XSA-49. (CVE-2013-1952)

  - x86: make page table handling error paths preemptible     ... as they may take significant amounts of time. This     requires cloning the tweaked continuation logic from     do_mmuext_op to do_mmu_update. Note that in     mod_l[34]_entry a negative 'preemptible' value gets     passed to put_page_from_l[34]e now, telling the callee     to store the respective page in     current->arch.old_guest_table (for a hypercall     continuation to pick up), rather than carrying out the     put right away. This is going to be made a little more     explicit by a subsequent cleanup patch. This is part of     CVE-2013-1918 / XSA-45. (CVE-2013-1918)

  - x86: make page table unpinning preemptible ... as it may     take significant amounts of time. Since we can't     re-invoke the operation in a second attempt, the     continuation logic must be slightly tweaked so that we     make sure do_mmuext_op gets run one more time even when     the preempted unpin operation was the last one in a     batch. This is part of CVE-2013-1918 / XSA-45.
    (CVE-2013-1918) (CVE-2013-1918)

  - x86: make vcpu_reset preemptible ... as dropping the old     page tables may take significant amounts of time. This     is part of CVE-2013-1918 / XSA-45. (CVE-2013-1918)

  - x86: make MMUEXT_NEW_USER_BASEPTR preemptible ... as it     may take significant amounts of time. This is part of     CVE-2013-1918 / XSA-45. (CVE-2013-1918)

  - x86: make new_guest_cr3 preemptible ... as it may take     significant amounts of time. This is part of     CVE-2013-1918 / XSA-45. (CVE-2013-1918)

  - x86: make vcpu_destroy_pagetables preemptible ... as it     may take significant amounts of time. The function,     being moved to mm.c as the better home for it anyway,     and to avoid having to make a new helper function there     non-static, is given a 'preemptible' parameter     temporarily (until, in a subsequent patch, its other     caller is also being made capable of dealing with     preemption). This is part of CVE-2013-1918 / XSA-45.
    (CVE-2013-1918)

  - Fix rcu domain locking for transitive grants When     acquiring a transitive grant for copy then the owning     domain needs to be locked down as well as the granting     domain. This was being done, but the unlocking was not.
    The acquire code now stores the struct domain * of the     owning domain (rather than the domid) in the active     entry in the granting domain. The release code then does     the unlock on the owning domain. Note that I believe I     also fixed a bug where, for non-transitive grants the     active entry contained a reference to the acquiring     domain rather than the granting domain. From my reading     of the code this would stop the release code for     transitive grants from terminating its recursion     correctly.

    Also, for non-transitive grants we now avoid incorrectly     recursing in __release_grant_for_copy. This is     CVE-2013-1964 / XSA-50. (CVE-2013-1964)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - fix error in first version of the XSA-44 patch (Chuck     Anderson) [orabug 16632878, 16694867] (CVE-2013-1917)

  - clear EFLAGS.NT in SYSENTER entry path (Andrew Cooper)     [orabug 16632878] (CVE-2013-1917)

  - fix various issues with handling guest IRQs (Jan     Beulich) [orabug 16635741] (CVE-2013-1919)

  - defer event channel bucket pointer store until after XSM     checks [orabug 16635980] (CVE-2013-1920)

  - tools: xend: tolerate empty state/*.xml (Konrad Wilk,     Joe Jin) [orabug 14683665]

The remote OracleVM system is missing necessary patches to address critical security updates :

  - defer event channel bucket pointer store until after XSM     checks Otherwise a dangling pointer can be left, which     would cause subsequent memory corruption as soon as the     space got re-allocated for some other purpose. This is     CVE-2013-1920 / XSA-47.

  - x86: fix various issues with handling guest IRQs

  - properly revoke IRQ access in map_domain_pirq error path

  - don't permit replacing an in use IRQ

  - don't accept inputs in the GSI range for     MAP_PIRQ_TYPE_MSI

  - track IRQ access permission in host IRQ terms, not guest     IRQ ones (and with that, also disallow Dom0 access to     IRQ0) This is CVE-2013-1919 / XSA-46.

  - x86: clear EFLAGS.NT in SYSENTER entry path ... as it     causes problems if we happen to exit back via IRET: In     the course of trying to handle the fault, the hypervisor     creates a stack course of trying to handle the fault,     the hypervisor creates a stack frame by hand, and uses     PUSHFQ to set the respective EFLAGS field, but expects     to be able to IRET through that stack frame to the     second portion of the fixup code (which causes a #GP due     to the stored EFLAGS having NT set). And even if this     worked (e.g if we cleared NT in that path), it would     then (through the fail safe callback) cause a #GP in the     guest with the SYSENTER handler's first instruction as     the source, which in turn would allow guest user mode     code to crash the guest kernel. Inject a #GP on the fake     (NULL) address of the SYSENTER instruction instead, just     like in the case where the guest kernel didn't register     a corresponding entry point. On 32-bit we also need to     make sure we clear SYSENTER_CS for all CPUs (neither     #RESET nor #INIT guarantee this). This is CVE-2013-1917     / XSA-44. (CVE-2013-1917)

  - Current Xend allowing multiple call destroy for the same     domain, this lead multiple hard resets(FLR) for pci     pass-through, and some controller might failed. In our     test, we pass through 2 LSI HAB controllers to the PVHVM     guest, after guest brought up, call xm-destroy twice,     the adapters's BIOS will hung, and we had to reboot the     server to recovery it. BTW: I had send this patch to Xen     maillist, but developer said Xend will obsolete and     would not review and merge the fix.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - defer event channel bucket pointer store until after XSM     checks Otherwise a dangling pointer can be left, which     would cause subsequent memory corruption as soon as the     space got re-allocated for some other purpose. This is     CVE-2013-1920 / XSA-47.

    John Haxby 

  - x86: fix various issues with handling guest IRQs

  - properly revoke IRQ access in map_domain_pirq error path

  - don't permit replacing an in use IRQ

  - don't accept inputs in the GSI range for     MAP_PIRQ_TYPE_MSI

  - track IRQ access permission in host IRQ terms, not guest     IRQ ones (and with that, also disallow Dom0 access to     IRQ0) This is CVE-2013-1919 / XSA-46.

  - x86: clear EFLAGS.NT in SYSENTER entry path ... as it     causes problems if we happen to exit back via IRET: In     the course of trying to handle the fault, the hypervisor     creates a stack frame by hand, and uses PUSHFQ to set     the respective EFLAGS field, but expects to be able to     IRET through that stack frame to the second portion of     the fixup code (which causes a #GP due to the stored     EFLAGS having NT set). And even if this worked (e.g if     we cleared NT in that path), it would then (through the     fail safe callback) cause a #GP in the guest with the     SYSENTER handler's first instruction as the source,     which in turn would allow guest user mode code to crash     the guest kernel. Inject a #GP on the fake (NULL)     address of the SYSENTER instruction instead, just like     in the case where the guest kernel didn't register a     corresponding entry point. On 32-bit we also need to     make sure we clear SYSENTER_CS for all CPUs (neither     #RESET nor #INIT guarantee this). This is CVE-2013-1917     / XSA-44. (CVE-2013-1917)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - x86/xen: don't assume %ds is usable in xen_iret for     32-bit PVOPS. (Chuck Anderson) [Orabug: 16325076]     [CVE-2013-0228 XSA-42 CVE-2013-0190]

The remote OracleVM system is missing necessary patches to address critical security updates :

  - oxenstored incorrect handling of certain Xenbus ring     states Xen Security Advisory 38 (CVE-2013-0215) Patch     xsa38.patch The oxenstored daemon (the ocaml version of     the xenstore daemon) does not correctly handle unusual     or malicious contents in the xenstore ring. A malicious     guest can exploit this to cause oxenstored to read past     the end of the ring (and very likely crash) or to     allocate large amounts of RAM. Signed-off-by Chuck     Anderson (CVE-2013-0215)

  - ACPI: acpi_table_parse should return handler's error     code Currently, the error code returned by     acpi_table_parse's handler is ignored. This patch will     propagate handler's return value to acpi_table_parse's     caller. AMD,IOMMU: Clean up old entries in remapping     tables when creating new interrupt mapping. When     changing the affinity of an IRQ associated with a passed     through PCI device, clear previous mapping. In addition,     because some BIOSes may incorrectly program IVRS entries     for IOAPIC try to check for entry's consistency.
    Specifically, if conflicting entries are found disable     IOMMU if per-device remapping table is used. If entries     refer to bogus IOAPIC IDs disable IOMMU unconditionally     AMD,IOMMU: Disable IOMMU if SATA Combined mode is on     AMD's SP5100 chipset can be placed into SATA Combined     mode that may cause prevent dom0 from booting when IOMMU     is enabled and per-device interrupt remapping table is     used. While SP5100 erratum 28 requires BIOSes to disable     this mode, some may still use it. This patch checks     whether this mode is on and, if per-device table is in     use, disables IOMMU. AMD,IOMMU: Make per-device     interrupt remapping table default Using global interrupt     remapping table may be insecure, as described by XSA-36.
    This patch makes per-device mode default. This is XSA-36     / CVE-2013-0153. (CVE-2013-0153)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - xen-pciback: rate limit error messages from     xen_pcibk_enable_msi[,x] (Jan Beulich) [Orabug:
    16243736] (CVE-2013-0231)

  - Xen: Fix stack corruption in xen_failsafe_callback for     32bit PVOPS guests. (Frediano Ziglio) [Orabug: 16274171]     (CVE-2013-0190)

  - netback: correct netbk_tx_err to handle wrap around.
    (Ian Campbell) [Orabug: 16243309] (CVE-2013-0216     CVE-2013-0217)

  - xen/netback: free already allocated memory on failure in     xen_netbk_get_requests (Ian Campbell) [Orabug: 16243309]     (CVE-2013-0216 CVE-2013-0217)

  - xen/netback: don't leak pages on failure in     xen_netbk_tx_check_gop. (Ian Campbell) [Orabug:
    16243309] (CVE-2013-0216 CVE-2013-0217)

  - xen/netback: shutdown the ring if it contains garbage.
    (Ian Campbell) [Orabug: 16243309] (CVE-2013-0216     CVE-2013-0217)

  - e1000e: Avoid wrong check on TX hang (Jeff Kirsher)     [Orabug: 15834316]

ID	Name	Severity
79548	OracleVM 3.3 : glibc (OVMSA-2014-0033)	high
79547	OracleVM 3.3 : openssl (OVMSA-2014-0032) (Heartbleed) (POODLE)	high
79546	OracleVM 3.3 : libxml2 (OVMSA-2014-0031)	medium
79545	OracleVM 3.3 : rsyslog (OVMSA-2014-0030)	high
79544	OracleVM 2.2 : ovs-agent (OVMSA-2014-0029)	high
79543	OracleVM 2.2 : xen (OVMSA-2014-0028)	high
79542	OracleVM 3.2 : xen (OVMSA-2014-0026)	high
79541	OracleVM 3.3 : xen (OVMSA-2014-0025)	high
79540	OracleVM 3.3 : nss (OVMSA-2014-0023)	high
79539	OracleVM 3.3 : glibc (OVMSA-2014-0017)	high
79538	OracleVM 3.3 : nss-util (OVMSA-2014-0015)	high
79537	OracleVM 3.3 : nss (OVMSA-2014-0014)	high
79536	OracleVM 3.3 : openssl (OVMSA-2014-0012)	medium
79535	OracleVM 2.2 : xen (OVMSA-2014-0011)	high
79534	OracleVM 3.1 : xen (OVMSA-2014-0010)	high
79533	OracleVM 3.2 : xen (OVMSA-2014-0009)	high
79532	OracleVM 3.2 : onpenssl (OVMSA-2014-0008)	high
79531	OracleVM 2.2 : openssl (OVMSA-2014-0007)	high
79530	OracleVM 3.1 : xen (OVMSA-2014-0002)	medium
79529	OracleVM 3.2 : xen (OVMSA-2014-0001)	medium
79528	OracleVM 2.2 : xen (OVMSA-2013-0092)	medium
79527	OracleVM 3.1 : xen (OVMSA-2013-0091)	medium
79526	OracleVM 3.2 : xen (OVMSA-2013-0090)	medium
79525	OracleVM 2.2 : xen (OVMSA-2013-0088)	medium
79524	OracleVM 3.1 : xen (OVMSA-2013-0087)	medium
79523	OracleVM 3.2 : xen (OVMSA-2013-0085)	medium
79522	OracleVM 2.2 : xen (OVMSA-2013-0075)	low
79521	OracleVM 2.2 : xen (OVMSA-2013-0074)	high
79520	OracleVM 3.1 : xen (OVMSA-2013-0073)	low
79519	OracleVM 3.2 : xen (OVMSA-2013-0072)	low
79518	OracleVM 3.1 : xen (OVMSA-2013-0071)	low
79517	OracleVM 3.2 : xen (OVMSA-2013-0070)	low
79516	OracleVM 3.2 : xen (OVMSA-2013-0069)	medium
79515	OracleVM 3.1 : xen (OVMSA-2013-0068)	medium
79514	OracleVM 3.2 : xen (OVMSA-2013-0059)	high
79513	OracleVM 3.1 : xen (OVMSA-2013-0057)	high
79512	OracleVM 3.2 : xen (OVMSA-2013-0056)	high
79511	OracleVM 3.1 : xen (OVMSA-2013-0043)	medium
79510	OracleVM 3.2 : xen (OVMSA-2013-0042)	medium
79509	OracleVM 3.1 : xen (OVMSA-2013-0041)	high
79508	OracleVM 3.2 : xen (OVMSA-2013-0040)	high
79507	OracleVM 2.2 : kernel (OVMSA-2013-0039)	high
79506	OracleVM 3.1 : xen (OVMSA-2013-0037)	medium
79505	OracleVM 3.2 : xen (OVMSA-2013-0036)	medium
79504	OracleVM 2.2 : xen (OVMSA-2013-0033)	medium
79503	OracleVM 3.1 : xen (OVMSA-2013-0032)	medium
79502	OracleVM 3.2 : xen (OVMSA-2013-0031)	medium
79501	OracleVM 3.2 : kernel-uek (OVMSA-2013-0015)	medium
79500	OracleVM 3.2 : xen (OVMSA-2013-0011)	medium
79499	OracleVM 3.1 : kernel-uek (OVMSA-2013-0010)	medium

Detections

Analytics

OracleVM Local Security Checks Family for Nessus

high

high

medium

high

high

high

high

high

high

high

high

high

medium

high

high

high

high

high

medium

medium

medium

medium

medium

medium

medium

medium

low

high

low

low

low

low

medium

medium

high

high

high

medium

medium

high

high

high

medium

medium

medium

medium

medium

medium

medium

medium