The remote OracleVM system is missing necessary patches to address critical security updates :

  - oxenstored incorrect handling of certain Xenbus ring     states Xen Security Advisory 38 (CVE-2013-0215) Patch     xsa38.patch The oxenstored daemon (the ocaml version of     the xenstore daemon) does not correctly handle unusual     or malicious contents in the xenstore ring. A malicious     guest can exploit this to cause oxenstored to read past     the end of the ring (and very likely crash) or to     allocate large amounts of RAM. Signed-off-by Chuck     Anderson (CVE-2013-0215)

  - ACPI: acpi_table_parse should return handler's error     code Currently, the error code returned by     acpi_table_parse's handler is ignored. This patch will     propagate handler's return value to acpi_table_parse's     caller. AMD,IOMMU: Clean up old entries in remapping     tables when creating new interrupt mapping. When     changing the affinity of an IRQ associated with a passed     through PCI device, clear previous mapping. In addition,     because some BIOSes may incorrectly program IVRS entries     for IOAPIC try to check for entry's consistency.
    Specifically, if conflicting entries are found disable     IOMMU if per-device remapping table is used. If entries     refer to bogus IOAPIC IDs disable IOMMU unconditionally     AMD,IOMMU: Disable IOMMU if SATA Combined mode is on     AMD's SP5100 chipset can be placed into SATA Combined     mode that may cause prevent dom0 from booting when IOMMU     is enabled and per-device interrupt remapping table is     used. While SP5100 erratum 28 requires BIOSes to disable     this mode, some may still use it. This patch checks     whether this mode is on and, if per-device table is in     use, disables IOMMU. AMD,IOMMU: Make per-device     interrupt remapping table default Using global interrupt     remapping table may be insecure, as described by XSA-36.
    This patch makes per-device mode default. This is XSA-36     / CVE-2013-0153. (CVE-2013-0153)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - kmod: make __request_module killable (Oleg Nesterov)     [Orabug: 16286305] (CVE-2012-4398)

  - kmod: introduce call_modprobe helper (Oleg Nesterov)     [Orabug: 16286305] (CVE-2012-4398)

  - usermodehelper: implement UMH_KILLABLE (Oleg Nesterov)     [Orabug: 16286305] (CVE-2012-4398)

  - usermodehelper: introduce umh_complete(sub_info) (Oleg     Nesterov) [Orabug: 16286305] (CVE-2012-4398)

  - KVM: x86: invalid opcode oops on SET_SREGS with OSXSAVE     bit set (CVE-2012-4461) (Jerry Snitselaar) [Orabug:
    16286290] (CVE-2012-4461)

  - exec: do not leave bprm->interp on stack (Kees Cook)     [Orabug: 16286267] (CVE-2012-4530)

  - exec: use -ELOOP for max recursion depth (Kees Cook)     [Orabug: 16286267] (CVE-2012-4530)

  - xen-pciback: rate limit error messages from     xen_pcibk_enable_msi[,x] (Jan Beulich) [Orabug:
    16243736] (CVE-2013-0231)

  - Xen: Fix stack corruption in xen_failsafe_callback for     32bit PVOPS guests. (Frediano Ziglio) [Orabug: 16274171]     (CVE-2013-0190)

  - netback: correct netbk_tx_err to handle wrap around.
    (Ian Campbell) [Orabug: 16243309]

  - xen/netback: free already allocated memory on failure in     xen_netbk_get_requests (Ian Campbell) [Orabug: 16243309]

  - xen/netback: don't leak pages on failure in     xen_netbk_tx_check_gop. (Ian Campbell) [Orabug:
    16243309]

  - xen/netback: shutdown the ring if it contains garbage.
    (Ian Campbell) [Orabug: 16243309]

  - ixgbevf fix typo in Makefile (Maxim Uvarov) [Orabug:
    16179639 16168292]

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Xen Security Advisory CVE-2012-5634 / XSA-33 (v3) VT-d     interrupt remapping source validation flaw

    The patch supplied for Xen 4.1 (xsa33-4.1.patch)     contained a build error. A corrected patch is attached.
    The fix is also now available in as changeset     23441:2a91623a5807

    When passing a device which is behind a legacy PCI     Bridge through to a guest Xen incorrectly configures the     VT-d hardware. This could allow incorrect interrupts to     be injected to other guests which also have passthrough     devices. In a typical Xen system many devices are owned     by domain 0 or driver domains, leaving them vulnerable     to such an attack. Such a DoS is likely to have an     impact on other guests running in the system.

    A malicious domain, given access to a device which is     behind a legacy PCI bridge, can mount a denial of     service attack affecting the whole system.

    Xen version 4.0 onwards is vulnerable. Only systems     using Intel VT-d for PCI passthrough are vulnerable. Any     domain which is given access to a PCI device that is     behind a legacy PCI bridge can take advantage of this     vulnerability. Domains which are given access to PCIe     devices only are not able to take advantage of this     vulnerability.

    This issue can be avoided by not assigning PCI devices     which are behind a legacy PCI bridge to untrusted     guests.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - bonding: fixup typo in rlb mode of bond and bridge fix     (Guru Anbalagane) [Orabug: 16069448]

  - bonding: rlb mode of bond should not alter ARP     originating via bridge (zheng.li) [Orabug: 14650975]

  - compilation fix oracleasm typo (Maxim Uvarov)

  - mm/hotplug: correctly add new zone to all other nodes'     zone lists (Jiang Liu) [Orabug: 16020976 Bug-db: 14798]     (CVE-2012-5517)

  - Divide by zero in TCP congestion control Algorithm.
    (Jesper Dangaard Brouer) [Orabug: 16020656 Bug-db:
    14798] (CVE-2012-4565)

  - Fix length of buffer copied in __nfs4_get_acl_uncached     (Sachin Prabhu) [Bug- db: 14798] (CVE-2012-2375)

  - Avoid reading past buffer when calling GETACL (Sachin     Prabhu) [Bug-db: 14798] (CVE-2012-2375)

  - Avoid beyond bounds copy while caching ACL (Sachin     Prabhu) [Bug-db: 14798] (CVE-2012-2375)

  - oracleasm: Introduce module parameter for block size     selection (Martin K. Petersen) [Orabug: 15924773     16017829]

  - kernel posttrans remove all crashkernel=* (Jason Luan)     [Orabug: 15882974]

The remote OracleVM system is missing necessary patches to address critical security updates :

  - VT-d: fix interrupt remapping source validation for     devices behind legacy bridges Using SVT_VERIFY_BUS here     doesn't make sense  native Linux also uses     SVT_VERIFY_SID_SQ here instead. (CVE-2012-5634)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - VT-d: fix interrupt remapping source validation for     devices behind legacy bridges Using SVT_VERIFY_BUS here     doesn't make sense  native Linux also uses     SVT_VERIFY_SID_SQ here instead. (CVE-2012-5634)

  - When xend re-writes the files which store domains'     information and if the file is empty , do things like     file does not exist

The remote OracleVM system is missing necessary patches to address critical security updates :

XSA-27: hvm: Limit the size of large HVM op batches [orabug 15907978] (CVE-2012-5511) XSA-29: add missing guest address range checks to XENMEM_exchange handlers [orabug 15907996] (CVE-2012-5513) XSA-30:
xen: fix error handling of guest_physmap_mark_populate_on_demand [orabug 15908008] (CVE-2012-5514) XSA-31: memop: limit guest specified extent order [orabug 15908028] (CVE-2012-5515)

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2012-0057 for details.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - xen: fix error handling of     guest_physmap_mark_populate_on_demand The only user of     the 'out' label bypasses a necessary unlock, thus     enabling the caller to lock up Xen. Also, the function     was never meant to be called by a guest for itself, so     rather than inspecting the code paths in depth for     potential other problems this might cause, and adjusting     e.g. the non-guest printk in the above error path, just     disallow the guest access to it. Finally, the printk     (considering its potential of spamming the log, the more     that it's not using XENLOG_GUEST), is being converted to     P2M_DEBUG, as debugging is what it apparently was added     for in the first place. This is XSA-30 / CVE-2012-5514.
    (CVE-2012-5514)

  - Revert version 2 of XSA-30 / CVE-2012-5514     (CVE-2012-5514)

  - memop: limit guest specified extent order Allowing     unbounded order values here causes almost unbounded     loops and/or partially incomplete requests, particularly     in PoD code. The added range checks in populate_physmap,     decrease_reservation, and the 'in' one in     memory_exchange architecturally all could use PADDR_BITS
    - PAGE_SHIFT, and are being artificially constrained to     MAX_ORDER. This is XSA-31 / CVE-2012-5515.
    (CVE-2012-5515)

  - xen: fix error path of     guest_physmap_mark_populate_on_demand The only user of     the 'out' label bypasses a necessary unlock, thus     enabling the caller to lock up Xen. This is XSA-30 /     CVE-2012-5514. (CVE-2012-5514)

  - xen: add missing guest address range checks to     XENMEM_exchange handlers Ever since its existence (3.0.3     iirc) the handler for this has been using non address     range checking guest memory accessors (i.e. the ones     prefixed with two underscores) without first range     checking the accessed space (via guest_handle_okay),     allowing a guest to access and overwrite hypervisor     memory. This is XSA-29 / CVE-2012-5513.

  - hvm: Limit the size of large HVM op batches Doing large     p2m updates for HVMOP_track_dirty_vram without     preemption ties up the physical processor. Integrating     preemption into the p2m updates is hard so simply limit     to 1GB which is sufficient for a 15000 * 15000 * 32bpp     framebuffer. For HVMOP_modified_memory and     HVMOP_set_mem_type preemptible add the necessary     machinery to handle preemption. This is CVE-2012-5511 /     XSA-27.

    x86/paging: Don't allocate user-controlled amounts of     stack memory. This is XSA-27 / CVE-2012-5511.

    v2: Provide definition of GB to fix x86-32 compile.

  - xen/common/grant_table.c gnttab: fix releasing of memory     upon switches between versions     gnttab_unpopulate_status_frames incompletely freed the     pages previously used as status frame in that they did     not get removed from the domain's xenpage_list, thus     causing subsequent list corruption when those pages did     get allocated again for the same or another purpose.
    Similarly, grant_table_create and gnttab_grow_table both     improperly clean up in the event of an error - pages     already shared with the guest can't be freed by just     passing them to free_xenheap_page. Fix this by sharing     the pages only after all allocations succeeded. This is     CVE-2012-5510 / XSA-26. (CVE-2012-5510)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - libxc: builder: limit maximum size of kernel/ramdisk.
    Allowing user supplied kernels of arbitrary sizes,     especially during decompression, can swallow up dom0     memory leading to either virtual address space     exhaustion in the builder process or allocation     failures/OOM killing of both toolstack and unrelated     processes. We disable these checks when building in a     stub domain for pvgrub since this uses the guest's own     memory and is isolated. Decompression of gzip compressed     kernels and ramdisks has been safe since     14954:58205257517d (Xen 3.1.0 onwards). This is XSA-25 /     CVE-2012-4544. Also make explicit checks for buffer     overflows in various decompression routines. These were     already ruled out due to other properties of the code     but check them as a belt-and-braces measure.

    [ Includes 25589:60f09d1ab1fe for CVE-2012-2625]     (CVE-2012-4544)

  - compat/gnttab: Prevent infinite loop in compat code c/s     20281:95ea2052b41b, which introduces Grant Table version     2 hypercalls introduces a vulnerability whereby the     compat hypercall handler can fall into an infinite loop.
    If the watchdog is enabled, Xen will die after the     timeout. This is a security problem, XSA-24 /     CVE-2012-4539. (CVE-2012-4539)

  - xen/mm/shadow: check toplevel pagetables are present     before unhooking them. If the guest has not fully     populated its top-level PAE entries when it calls     HVMOP_pagetable_dying, the shadow code could try to     unhook entries from MFN 0. Add a check to avoid that     case. This issue was introduced by c/s     21239:b9d2db109cf5. This is a security problem, XSA-23 /     CVE-2012-4538. (CVE-2012-4538)

  - x86/physmap: Prevent incorrect updates of m2p mappings     In certain conditions, such as low memory, set_p2m_entry     can fail. Currently, the p2m and m2p tables will get out     of sync because we still update the m2p table after the     p2m update has failed. If that happens, subsequent     guest-invoked memory operations can cause BUGs and     ASSERTs to kill Xen. This is fixed by only updating the     m2p table iff the p2m was successfully updated. This is     a security problem, XSA-22 / CVE-2012-4537.
    (CVE-2012-4537)

  - x86/physdev: Range check pirq parameter from guests     Otherwise Xen will read beyond either end of the struct     domain.arch.pirq_emuirq array, usually resulting in a     fatal page fault. This vulnerability was introduced by     c/s 23241:d21100f1d00e, which adds a call to     domain_pirq_to_emuirq which uses the guest provided pirq     value before range checking it, and was fixed by c/s     23573:584c2e5e03d9 which changed the behaviour of the     domain_pirq_to_emuirq macro to use radix trees instead     of a flat array. This is XSA-21 / CVE-2012-4536.
    (CVE-2012-4536)

  - VCPU/timers: Prevent overflow in calculations, leading     to DoS vulnerability The timer action for a vcpu     periodic timer is to calculate the next expiry time, and     to reinsert itself into the timer queue. If the deadline     ends up in the past, Xen never leaves __do_softirq. The     affected PCPU will stay in an infinite loop until Xen is     killed by the watchdog (if enabled). This is a security     problem, XSA-20 / CVE-2012-4535. (CVE-2012-4535)

  - Correct RTC time offset update error for HVM guest     changeset 24947:b198ada9689d

  - always release vm running lock on VM shutdown Before     this patch, when xend restarted, the VM running lock     will not be released on shutdown, so the VM could never     start again. Talked with Junjie, we recommend always     releasing the lock on VM shutdown. So even when xend     restarted, there should be no stale lock leaving there.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - compat/gnttab: Prevent infinite loop in compat code c/s     20281:95ea2052b41b, which introduces Grant Table version     2 hypercalls introduces a vulnerability whereby the     compat hypercall handler can fall into an infinite loop.
    If the watchdog is enabled, Xen will die after the     timeout. This is a security problem, XSA-24 /     CVE-2012-4539. (CVE-2012-4539)

  - xen/mm/shadow: check toplevel pagetables are present     before unhooking them. If the guest has not fully     populated its top-level PAE entries when it calls     HVMOP_pagetable_dying, the shadow code could try to     unhook entries from MFN 0. Add a check to avoid that     case. This issue was introduced by c/s     21239:b9d2db109cf5. This is a security problem, XSA-23 /     CVE-2012-4538. (CVE-2012-4538)

  - x86/physmap: Prevent incorrect updates of m2p mappings     In certain conditions, such as low memory, set_p2m_entry     can fail. Currently, the p2m and m2p tables will get out     of sync because we still update the m2p table after the     p2m update has failed. If that happens, subsequent     guest-invoked memory operations can cause BUGs and     ASSERTs to kill Xen. This is fixed by only updating the     m2p table iff the p2m was successfully updated. This is     a security problem, XSA-22 / CVE-2012-4537.
    (CVE-2012-4537)

  - VCPU/timers: Prevent overflow in calculations, leading     to DoS vulnerability The timer action for a vcpu     periodic timer is to calculate the next expiry time, and     to reinsert itself into the timer queue. If the deadline     ends up in the past, Xen never leaves __do_softirq. The     affected PCPU will stay in an infinite loop until Xen is     killed by the watchdog (if enabled). This is a security     problem, XSA-20 / CVE-2012-4535. (CVE-2012-4535)

  - always release vm running lock on VM shutdown Before     this patch, when xend restarted, the VM running lock     will not be released on shutdown, so the VM could never     start again. Talked with Junjie, we recommend always     releasing the lock on VM shutdown. So even when xend     restarted, there should be no stale lock leaving there.

  - Xen Security Advisory CVE-2012-4411 / XSA-19 version 2     guest administrator can access qemu monitor console     Disable qemu monitor by default. The qemu monitor is an     overly powerful feature which must be protected from     untrusted (guest) administrators. (CVE-2012-4411)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - XSA-20: VCPU/timers: Prevent overflow in calculations     [orabug 15852489] (CVE-2012-4535)

  - XSA-22: Prevent incorrect updates of m2p mappings     [orabug 15852490] (CVE-2012-4537)

  - Increase network hotplug script timeout to 200 (Chuang     Cao) [Orabug 14378502]

The remote OracleVM system is missing necessary patches to address critical security updates :

  - XSA-12: prevent a 64 bit guest setting reserved bits in     DR7 [orabug 14554090] (CVE-2012-3494)

  - XSA-14: Don't BUG_ON PoD operations on a non-translated     guest [orabug 14554272] (CVE-2012-3496)

  - XSA-17: console: bounds check whenever changing the     cursor due to an escape code [orabug 14554401]     (CVE-2012-3515)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Xen Security Advisory CVE-2012-4411 / XSA-19 version 2     guest administrator can access qemu monitor console     Disable qemu monitor by default. The qemu monitor is an     overly powerful feature which must be protected from     untrusted (guest) administrators. (CVE-2012-4411)

  - fix xm create vcpu_avail exceeds XMLRPC int limits If     maxvcpus = vcpus = 40, (1<<40 -1) will exceed XMLRPC int     limit. Change it to str will work. Then in the xend     side, it will converted back to int. (CVE-2012-3515)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Fix bug number for commit 'cciss: Update HPSA_BOUNDARY'     (Joe Jin) [Orabug: 14681166]

  - cciss: Update HPSA_BOUNDARY. (Joe Jin) [Orabug:
    14319765]

  - KVM: introduce kvm_for_each_memslot macro (Maxim Uvarov)     [Bugdb: 13966]

  - dl2k: Clean up rio_ioctl (Jeff Mahoney) [Orabug:
    14126896] (CVE-2012-2313)

  - NFSv4: include bitmap in nfsv4 get acl data (Andy     Adamson) (CVE-2011-4131)

  - KVM: Fix buffer overflow in kvm_set_irq (Avi Kivity)     [Bugdb: 13966] (CVE-2012-2137)

  - net: sock: validate data_len before allocating skb in     sock_alloc_send_pskb (Jason Wang) [Bugdb: 13966]     (CVE-2012-2136)

  - mm: pmd_read_atomic: fix 32bit PAE pmd walk vs     pmd_populate SMP race condition (Andrea Arcangeli)     [Bugdb: 13966] (CVE-2012-2373)

  - KVM: lock slots_lock around device assignment (Alex     Williamson) [Bugdb: 13966] (CVE-2012-2121)

  - KVM: unmap pages from the iommu when slots are removed     (Maxim Uvarov) [Bugdb: 13966] (CVE-2012-2121)

  - fcaps: clear the same personality flags as suid when     fcaps are used (Eric Paris) [Bugdb: 13966]     (CVE-2012-2123)

  - tilegx: enable SYSCALL_WRAPPERS support (Chris Metcalf)     (CVE-2009-0029)

  - drm/i915: fix integer overflow in i915_gem_do_execbuffer     (Xi Wang) [Orabug: 14107456] (CVE-2012-2384)

  - drm/i915: fix integer overflow in i915_gem_execbuffer2     (Xi Wang) [Orabug: 14107445] (CVE-2012-2383)

  - [dm] do not forward ioctls from logical volumes to the     underlying device (Joe Jin) (CVE-2011-4127)

  - [block] fail SCSI passthrough ioctls on partition     devices (Joe Jin) (CVE-2011-4127)

  - [block] add and use scsi_blk_cmd_ioctl (Joe Jin)     [Orabug: 14056755] (CVE-2011-4127)

  - KVM: Ensure all vcpus are consistent with in-kernel     irqchip settings (Avi Kivity) [Bugdb: 13871]     (CVE-2012-1601)

  - regset: Return -EFAULT, not -EIO, on host-side memory     fault (H. Peter Anvin) (CVE-2012-1097)

  - regset: Prevent null pointer reference on readonly     regsets (H. Peter Anvin) (CVE-2012-1097)

  - cifs: fix dentry refcount leak when opening a FIFO on     lookup (Jeff Layton) (CVE-2012-1090)

  - mm: thp: fix pmd_bad triggering in code paths holding     mmap_sem read mode (Andrea Arcangeli) (CVE-2012-1179)

  - ext4: fix undefined behavior in ext4_fill_flex_info (Xi     Wang) (CVE-2009-4307)

  - ocfs2: clear unaligned io flag when dio fails (Junxiao     Bi) [Orabug: 14063941]

  - aio: make kiocb->private NUll in init_sync_kiocb     (Junxiao Bi) [Orabug: 14063941]

  - igb: Fix for Alt MAC Address feature on 82580 and later     devices (Carolyn Wyborny) [Orabug: 14258706]

  - igb: Alternate MAC Address Updates for Func2&3 (Akeem G.
    Abodunrin) [Orabug: 14258706]

  - igb: Alternate MAC Address EEPROM Updates (Akeem G.
    Abodunrin) [Orabug: 14258706]

  - cciss: only enable cciss_allow_hpsa when for ol5 (Joe     Jin) [Orabug: 14106006]

  - Revert 'cciss: remove controllers supported by hpsa'     (Joe Jin) [Orabug: 14106006]

  - [scsi] hpsa: add all support devices for ol5 (Joe Jin)     [Orabug: 14106006]

  - Disable VLAN 0 tagging for none VLAN traffic (Adnan     Misherfi) [Orabug: 14406424]

  - x86: Add Xen kexec control code size check to linker     script (Daniel Kiper)

  - drivers/xen: Export vmcoreinfo through sysfs (Daniel     Kiper)

  - x86/xen/enlighten: Add init and crash kexec/kdump hooks     (Maxim Uvarov)

  - x86/xen: Add kexec/kdump makefile rules (Daniel Kiper)

  - x86/xen: Add x86_64 kexec/kdump implementation (Daniel     Kiper)

  - x86/xen: Add placeholder for i386 kexec/kdump     implementation (Daniel Kiper)

  - x86/xen: Register resources required by kexec-tools     (Daniel Kiper)

  - x86/xen: Introduce architecture dependent data for     kexec/kdump (Daniel Kiper)

  - xen: Introduce architecture independent data for     kexec/kdump (Daniel Kiper)

  - x86/kexec: Add extra pointers to transition page table     PGD, PUD, PMD and PTE (Daniel Kiper)

  - kexec: introduce kexec_ops struct (Daniel Kiper)

  - SPEC: replace DEFAULTKERNEL from kernel-ovs to     kernel-uek

The remote OracleVM system is missing necessary patches to address critical security updates :

  - console: bounds check whenever changing the cursor due     to an escape code The device model used by fully     virtualised (HVM) domains, qemu, does not properly     handle escape VT100 sequences when emulating certain     devices with a virtual console backend. (CVE-2012-3515)

  - xen: Don't BUG_ON PoD operations on a non-translated     guest. XENMEM_populate_physmap can be called with     invalid flags. By calling it with     MEMF_populate_on_demand flag set, a BUG can be triggered     if a translating paging mode is not being used.
    (CVE-2012-3494)

  - xen: prevent a 64 bit guest setting reserved bits in DR7     The upper 32 bits of this register are reserved and     should be written as zero. (CVE-2012-3494)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - console: bounds check whenever changing the cursor due     to an escape code The device model used by fully     virtualised (HVM) domains, qemu, does not properly     handle escape VT100 sequences when emulating certain     devices with a virtual console backend. (CVE-2012-3515)

  - x86/pvhvm: properly range-check     PHYSDEVOP_map_pirq/MAP_PIRQ_TYPE_GSI PHYSDEVOP_map_pirq     with MAP_PIRQ_TYPE_GSI does not range check map->index.
    This is being used as a array index, and hence must be     validated before use. A malicious HVM guest kernel can     crash the host. It might also be able to read hypervisor     or guest memory. (CVE-2012-3496)

  - xen: Don't BUG_ON PoD operations on a non-translated     guest. XENMEM_populate_physmap can be called with     invalid flags. By calling it with     MEMF_populate_on_demand flag set, a BUG can be triggered     if a translating paging mode is not being used.
    (CVE-2012-3496)

  - xen: handle out-of-pirq condition correctly in     PHYSDEVOP_get_free_pirq PHYSDEVOP_get_free_pirq does not     check that its call to get_free_pirq succeeded, and if     it fails will use the error code as an array index.
    (CVE-2012-3495)

  - xen: prevent a 64 bit guest setting reserved bits in DR7     The upper 32 bits of this register are reserved and     should be written as zero. (CVE-2012-3494)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - CVE-2012-3432 / XSA-10: HVM guest user mode MMIO     emulation DoS vulnerability [orabug 14463558]     (CVE-2012-3432)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Xen Security Advisory CVE-2012-3433 / XSA-11 HVM guest     destroy p2m teardown host DoS vulnerability An HVM guest     is able to manipulate its physical address space such     that tearing down the guest takes an extended period     amount of time searching for shared pages. This causes     the domain 0 VCPU which tears down the domain to be     blocked in the destroy hypercall. This causes that     domain 0 VCPU to become unavailable and may cause the     domain 0 kernel to panic. There is no requirement for     memory sharing to be in use. From the patch description:
    xen: only check for shared pages while any exist on     teardown Avoids worst case behavour when guest has a     large p2m. This is XSA-11 / CVE-2012-nnn

  - Xen Security Advisory XSA-10 HVM guest user mode MMIO     emulation DoS vulnerability Internal data of the     emulator for MMIO operations may, under certain rare     conditions, at the end of one emulation cycle be left in     a state affecting a subsequent emulation such that this     second emulation would fail, causing an exception to be     reported to the guest kernel where none is expected.
    NOTE: No CVE number! The patch description is as follow:
    x86/hvm: don't leave emulator in inconsistent state The     fact that handle_mmio, and thus the instruction     emulator, is being run through twice for emulations that     require involvement of the device model, allows for the     second run to see a different guest state than the first     one. Since only the MMIO-specific emulation routines     update the vCPU's io_state, if they get invoked on the     second pass, internal state (and particularly this     variable) can be left in a state making successful     emulation of a subsequent MMIO operation impossible.
    Consequently, whenever the emulator invocation returns     without requesting a retry of the guest instruction,     reset io_state.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Xen Security Advisory CVE-2012-3433 / XSA-11 HVM guest     destroy p2m teardown host DoS vulnerability An HVM guest     is able to manipulate its physical address space such     that tearing down the guest takes an extended period     amount of time searching for shared pages. This causes     the domain 0 VCPU which tears down the domain to be     blocked in the destroy hypercall. This causes that     domain 0 VCPU to become unavailable and may cause the     domain 0 kernel to panic. There is no requirement for     memory sharing to be in use. From the patch description:
    xen: only check for shared pages while any exist on     teardown Avoids worst case behavour when guest has a     large p2m. This is XSA-11 / CVE-2012-nnn

  - Xen Security Advisory XSA-10 HVM guest user mode MMIO     emulation DoS vulnerability Internal data of the     emulator for MMIO operations may, under certain rare     conditions, at the end of one emulation cycle be left in     a state affecting a subsequent emulation such that this     second emulation would fail, causing an exception to be     reported to the guest kernel where none is expected.
    NOTE: No CVE number! The patch description is as follow:
    x86/hvm: don't leave emulator in inconsistent state The     fact that handle_mmio, and thus the instruction     emulator, is being run through twice for emulations that     require involvement of the device model, allows for the     second run to see a different guest state than the first     one. Since only the MMIO-specific emulation routines     update the vCPU's io_state, if they get invoked on the     second pass, internal state (and particularly this     variable) can be left in a state making successful     emulation of a subsequent MMIO operation impossible.
    Consequently, whenever the emulator invocation returns     without requesting a retry of the guest instruction,     reset io_state.

  - Add 'allowhugepage' flag as a synonym for     'allowsuperpage' for compatibility with previous     releases.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - CVE-2012-0217 CVE-2012-0218: guest DoS on     syscall/sysenter exception generation [orabug 13993157]

The remote OracleVM system is missing necessary patches to address critical security updates :

  - x86-64: detect processors subject to AMD erratum #121     and refuse to boot(CVE-2006-0744)

  - guest denial of service on syscall/sysenter exception     generation (CVE-2012-0217),(CVE-2012-0218)

  - Remove unnecessary balloon retries on vm create. This is     a backport from fix for bug 14143327.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - x86-64: detect processors subject to AMD erratum #121     and refuse to boot(CVE-2006-0744)

  - guest denial of service on syscall/sysenter exception     generation (CVE-2012-0217)

  - Remove unnecessary balloon retries on vm create. This is     a backport from fix for bug 14143327.

  - This backport from 3.1.1: Author: amisherf Put back the     patch that prevent older guest that uses kudzu from     hanging on a reboot. Fixed the patch to prevent     excessive watcher writes which causes xend, xenstored to     run at a 100% cpu usage. Now the watch is written only     if console in Initialising, InitWait, Initialised states     which happen once at boot time. [bug 13523487]

  - Backport from upstream changeset 20968 xend: notify     xenpv device model that console info is ready Sometimes     PV domain with vfb doesn't boot up. /sbin/kudzu is     stuck. After investigation, I've found that the evtchn     for console is not bound at all. Normal sequence of     evtchn initialization in qemu-dm for xenpv is: 1) watch     xenstore backpath     (/local/domain/0/backend/console/<domid>/0) 2) read     console info (/local/domain/<domid>/console/[type,     ring-ref, port..= ]) 3) bind the evtchn to the port. But     in some case, xend writes to the backpath before the     console info is prepared, and never write to the     backpath again. So the qemu-dm fails at 2) and never     reach to 3). When this happens, manually xenstore-write     command on Domain-0 resumes the guest.

  - Set max cstate to 1. This is a backport requirement for     bug 13703504. We have several bugs that cstate made     system unstable, both for ovm2 and ovm3: For OVM3.x: Bug     13703504 - unexplained network disconnect causes ocfs to     fence the server For OVM2.x

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Fix for (CVE-2011-4862)

  - incorporate a fix to teach the file labeling bits about     when replay caches are expunged (#712453)

  - rebuild

  - ftp: handle larger command inputs (#665833)

  - don't bail halfway through an unlock operation when the     result will be discarded and the end-result not cleaned     up (Martin Osvald, #586032)

  - add a versioned dependency between krb5-server-ldap and     krb5-libs (internal tooling)

  - don't discard the error code from an error message     received in response to a change-password request     (#658871, RT#6893)

  - ftpd: add patch from Jatin Nansi to correctly match     restrict lines in /etc/ftpusers (#644215, RT#6889)

  - ftp: add modified patch from Rogan Kyuseok Lee to report     the number of bytes transferred correctly when     transferring large files on 32-bit systems (#648404)

  - backport fix for RT#6514: memory leak freeing rcache     type none (#678205)

  - add upstream patch to fix hang or crash in the KDC when     using the LDAP kdb backend (CVE-2011-0281,     CVE-2011-0282, #671097)

  - incorporate upstream patch for checksum acceptance     issues from MITKRB5-SA-2010-007 (CVE-2010-1323, #652308)

  - backport a fix to the previous change (#539423)

  - backport the k5login_directory and k5login_authoritative     settings (#539423)

  - krshd: don't limit user names to 16 chars when utmp can     handle names at least a bit longer than that (#611713)

  - fix a logic bug in computing key expiration times     (RT#6762, #627038)

  - correct the post-rotate scriptlet in the kadmind     logrotate config (more of #462658)

  - ftpd: backport changes to modify behavior to match     telnetd,rshd,rlogind and accept GSSAPI auth to any     service for which we have a matching key (#538075)

  - pull in fix for RT#5551 to treat the referral realm when     seen in a ticket as though it were the local realm     (#498554, also very likely #450122)

  - add aes256-cts:normal and aes128-cts:normal to the list     of keysalts in the default kdc.conf (part of #565941)

  - add a note to kdc.conf(5) pointing to the admin guide     for the list of recognized key and salt types (the rest     of #565941)

  - add logrotate configuration files for krb5kdc and     kadmind (#462658)

  - libgssapi: backport patch from svn to stop returning     context-expired errors when the ticket which was used to     set up the context expires (#605367, upstream #6739)

  - enable building the -server-ldap subpackage (#514362)

  - stop caring about the endianness of stash files     (#514741), which will be replaced by proper keytab files     in later releases

  - don't crash in krb5_get_init_creds_password if the     passed-in options struct is NULL and the clients keys     have expired (#555875)

  - ksu: perform PAM account and session management before     dropping privileges to those of the target user (#540769     and #596887, respectively)

  - add candidate patch to correct libgssapi null pointer     dereference which could be triggered by malformed client     requests (CVE-2010-1321, #583704)

  - fix a null pointer dereference and crash introduced in     our PAM patch that would happen if ftpd was given the     name of a user who wasnt known to the local system,     limited to being triggerable by gssapi-authenticated     clients by the default xinetd config (Olivier Fourdan,     #569472)

  - add upstream patch to fix a few use-after-free bugs,     including one in kadmind (CVE-2010-0629, #578186)

  - merge patch to correct KDC integer overflows which could     be triggered by malformed RC4 and AES ciphertexts     (CVE-2009-4212, #546348)

  - pull changes to libkrb5 to properly handle and chase     off-path referrals back from 1.7 (#546538)

  - add an auth stack to ksus PAM configuration so that it     can successfully pam_setcred

  - also set PAM_RUSER in ksu for completeness     (#479071+#477033)

  - fix various typos, except for bits pertaining to     licensing (#499190)

  - kdb5_util: when renaming a database, if the new names     associated lock files don't exist, go ahead and create     them (#442879)

  - ksu: perform PAM account and session management for the     target user  authentication is still performed as before     (#477033)

  - fix typo in ksus reporting of errors getting credentials     (#462890)

  - kadmind.init: stop setting up a keytab, as kadminds been     able to use the database directly for a while now     (#473151)

  - pull up patch to set PAM_RHOST (James Leddy, #479071)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Passthrough: disable bus-mastering on any card that     causes an IOMMU fault (Tim Deegan) (CVE-2011-3131)

  - Serialize iptables calls in hotplug scripts (rhbz     460410)

  - Fix iptables service check bug (orabug 11727087)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Integer overflows and lack of checking of length fields     (CVE-2011-1583)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Resolves: #515062 CVE-2009-4033 acpid: log file created     with random permissions

  - start acpid before hal

  - Resolves: #503177

  - Updated the License entry

  - Fixed CVE-2009-0798 (too many open files DoS)

  - Resolves: #496292

The remote OracleVM system is missing necessary patches to address critical security updates :

  - fix DoS with mode 7 packets (#532639, CVE-2009-3563)

  - compile with -fno-strict-aliasing

The remote OracleVM system is missing necessary patches to address critical security updates :

  - [security] require root for mmap_min_addr (Eric Paris)     [518142 518143] (CVE-2009-2695)

  - [md] prevent crash when accessing suspend_* sysfs attr     (Danny Feng) [518135 518136] (CVE-2009-2849)

  - [nfs] knfsd: fix NFSv4 O_EXCL creates (Jeff Layton)     [522163 524521] (CVE-2009-3286)

  - [fs] fix pipe null pointer dereference (Jeff Moyer)     [530938 530939] (CVE-2009-3547)

  - [net] r8169: balance pci_map/unmap pair, use hw padding     (Ivan Vecera) [529143 515857] (CVE-2009-3613)

  - [net] tc: fix uninitialized kernel memory leak (Jiri     Pirko) [520994 520863](CVE-2009-3228)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Add grub.conf password protection support to pygrub     (rhbz 525142)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - fix #235411 - CVE-2007-2027 - elinks tries to load .po     files from non-absolute path

  - fix #523258 - CVE-2008-7224 - entity_cache static array     buffer overflow

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Fix buffer overrun risks caused by unchecked integer     overflow (CVE-2009-2347) Resolves: #507725

  - Fix some more LZW decoding vulnerabilities     (CVE-2009-2285) Resolves: #507725

  - Update upstream URL

  - Use -fno-strict-aliasing per rpmdiff recommendation

  - Fix LZW decoding vulnerabilities (CVE-2008-2327)     Resolves: #458812

  - Remove sgi2tiff.1 and tiffsv.1, since they are for     programs we don't ship Resolves: #460120

The remote OracleVM system is missing necessary patches to address critical security updates :

  - fix buffer overflow in textbox when reflowing (#524618,     CVE-2009-2905)

  - add release to -devel requires

  - escape macros in changelog

  - add support for tuples of strings in EntryWindow prompts     in snack (#219679)

  - fix multibyte and double width character handling in     entry (#249717)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - backport for online resize of blockdev [orabug 8585251]     [rh bugz 444964]

  - CVE-2009-2692 - [net] make sock_sendpage use     kernel_sendpage (Jiri Pirko) [517445 516955]

  - CVE-2009-2698 - [net] prevent null pointer dereference     in udp_sendmsg (Vitaly Mayatskikh) [518047 518043]

  - Updated cciss module to 3.6.20 

  - update bnx2x 1.48.107 

  - update bnx2 1.8.8b 

  - update bfa to 1.1.0.9-0 [bugz 9518]

  - Fix dom0 crash in loopback_start_xmit+0x107/0x2BD [bug     7634343]

The remote OracleVM system is missing necessary patches to address critical security updates :

CVE-2009-2957 Heap-based buffer overflow in the tftp_request function in tftp.c in dnsmasq before 2.50, when --enable-tftp is used, might allow remote attackers to execute arbitrary code via a long filename in a TFTP packet, as demonstrated by a read (aka RRQ) request.
CVE-2009-2958 The tftp_request function in tftp.c in dnsmasq before 2.50, when 

--enable-tftp is used, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a TFTP read (aka RRQ) request with a malformed blksize option.

  - problems with strings when enabling tftp (CVE-2009-2957,     CVE-2009-2957)

  - Resolves: rhbg#519021

  - update to new upstream version

  - fixes for CVE-2008-1447/CERT VU#800113

  - Resolves: rhbz#454869

The remote OracleVM system is missing necessary patches to address critical security updates :

  - fix CVE-2009-2417 (#516257)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Add bug347316.patch to backport fix for bug#347316 from     upstream version

  - Add libxml2-enterprise.patch and update logos in tarball

  - Fix a couple of crash (CVE-2009-2414, CVE-2009-2416)

  - Resolves: rhbz#515236

  - two patches for size overflows problems (CVE-2008-4225,     CVE-2008-4226)

  - Resolves: rhbz#470474

  - Patch to fix an entity name copy buffer overflow     (CVE-2008-3529)

  - Resolves: rhbz#461023

  - Better fix for (CVE-2008-3281)

  - Resolves: rhbz#458095

  - change the patch for CVE-2008-3281 due to ABI issues

  - Resolves: rhbz#458095

  - Patch to fix recursive entities handling (CVE-2008-3281)

  - Resolves: rhbz#458095

  - Patch to fix UTF-8 decoding problem (CVE-2007-6284)

  - Resolves: rhbz#425933

The remote OracleVM system is missing necessary patches to address critical security updates :

CVE-2009-1895 The personality subsystem in the Linux kernel before 2.6.31-rc3 has a PER_CLEAR_ON_SETID setting that does not clear the ADDR_COMPAT_LAYOUT and MMAP_PAGE_ZERO flags when executing a setuid or setgid program, which makes it easier for local users to leverage the details of memory usage to (1) conduct NULL pointer dereference attacks, (2) bypass the mmap_min_addr protection mechanism, or (3) defeat address space layout randomization (ASLR).

CVE-2007-5966 Integer overflow in the hrtimer_start function in kernel/hrtimer.c in the Linux kernel before 2.6.23.10 allows local users to execute arbitrary code or cause a denial of service (panic) via a large relative timeout value. NOTE: some of these details are obtained from third party information.

CVE-2009-1389 Buffer overflow in the RTL8169 NIC driver (drivers/net/r8169.c) in the Linux kernel before 2.6.30 allows remote attackers to cause a denial of service (kernel memory corruption and crash) via a long packet.

  - [misc] personality handling: fix PER_CLEAR_ON_SETID     (Vitaly Mayatskikh) [511173 508842] (CVE-2009-1895)

  - [misc] hrtimer: fix a soft lockup (Amerigo Wang) [418061     418071] (CVE-2007-5966)

  - [net] r8169: fix crash when large packets are received     (Ivan Vecera) [504731 504732] (CVE-2009-1389)

The remote OracleVM system is missing necessary patches to address critical security updates :

CVE-2009-1192 The (1) agp_generic_alloc_page and (2) agp_generic_alloc_pages functions in drivers/char/agp/generic.c in the agp subsystem in the Linux kernel before 2.6.30-rc3 do not zero out pages that may later be available to a user-space process, which allows local users to obtain sensitive information by reading these pages.

CVE-2009-1072 nfsd in the Linux kernel before 2.6.28.9 does not drop the CAP_MKNOD capability before handling a user request in a thread, which allows local users to create device nodes, as demonstrated on a filesystem that has been exported with the root_squash option.

CVE-2009-1758 The hypervisor_callback function in Xen, possibly before 3.4.0, as applied to the Linux kernel 2.6.30-rc4, 2.6.18, and probably other versions allows guest user applications to cause a denial of service (kernel oops) of the guest OS by triggering a segmentation fault in 'certain address ranges.'

CVE-2009-1439 Buffer overflow in fs/cifs/connect.c in CIFS in the Linux kernel 2.6.29 and earlier allows remote attackers to cause a denial of service (crash) via a long nativeFileSystem field in a Tree Connect response to an SMB mount request.

CVE-2009-1633 Multiple buffer overflows in the cifs subsystem in the Linux kernel before 2.6.29.4 allow remote CIFS servers to cause a denial of service (memory corruption) and possibly have unspecified other impact via (1) a malformed Unicode string, related to Unicode string area alignment in fs/cifs/sess.c  or (2) long Unicode characters, related to fs/cifs/cifssmb.c and the cifs_readdir function in fs/cifs/readdir.c.

CVE-2009-1630 The nfs_permission function in fs/nfs/dir.c in the NFS client implementation in the Linux kernel 2.6.29.3 and earlier, when atomic_open is available, does not check execute (aka EXEC or MAY_EXEC) permission bits, which allows local users to bypass permissions and execute files, as demonstrated by files on an NFSv4 fileserver.

  - [agp] zero pages before sending to userspace (Jiri Olsa)     [497025 497026] (CVE-2009-1192)

  - [misc] add some long-missing capabilities to CAP_FS_MASK     (Eric Paris) [499075 497271 499076 497272]     (CVE-2009-1072)

  - [x86] xen: fix local denial of service (Chris     Lalancette) [500950 500951] (CVE-2009-1758)

  - [fs] cifs: unicode alignment and buffer sizing problems     (Jeff Layton) [494279 494280] (CVE-2009-1439)

  - [fs] cifs: buffer overruns when converting strings (Jeff     Layton) [496576 496577] (CVE-2009-1633)

  - [fs] cifs: fix error handling in parse_DFS_referrals     (Jeff Layton) [496576 496577] (CVE-2009-1633)

  - [fs] cifs: fix pointer and checks in cifs_follow_symlink     (Jeff Layton) [496576 496577] (CVE-2009-1633)

  - [nfs] v4: client handling of MAY_EXEC in nfs_permission     (Peter Staubach) [500301 500302] (CVE-2009-1630)

  - backport cifs support from OEL5U3

The remote OracleVM system is missing necessary patches to address critical security updates :

CVE-2009-0946 Multiple integer overflows in FreeType 2.3.9 and earlier allow remote attackers to execute arbitrary code via vectors related to large values in certain inputs in (1) smooth/ftsmooth.c, (2) sfnt/ttcmap.c, and (3) cff/cffload.c.

CVE-2008-1806 Integer overflow in FreeType2 before 2.3.6 allows context-dependent attackers to execute arbitrary code via a crafted set of 16-bit length values within the Private dictionary table in a Printer Font Binary (PFB) file, which triggers a heap-based buffer overflow.

CVE-2008-1807 FreeType2 before 2.3.6 allow context-dependent attackers to execute arbitrary code via an invalid 'number of axes' field in a Printer Font Binary (PFB) file, which triggers a free of arbitrary memory locations, leading to memory corruption.

CVE-2008-1808 Multiple off-by-one errors in FreeType2 before 2.3.6 allow context-dependent attackers to execute arbitrary code via (1) a crafted table in a Printer Font Binary (PFB) file or (2) a crafted SHC instruction in a TrueType Font (TTF) file, which triggers a heap-based buffer overflow.

  - Add freetype-2009-CVEs.patch

  - Resolves: #496111

  - Add freetype-2.3.5-CVEs.patch

  - Resolves: #450910

The remote OracleVM system is missing necessary patches to address critical security updates :

CVE-2009-0159 Stack-based buffer overflow in the cookedprint function in ntpq/ntpq.c in ntpq in NTP before 4.2.4p7-RC2 allows remote NTP servers to execute arbitrary code via a crafted response.

CVE-2009-1252 Stack-based buffer overflow in the crypto_recv function in ntp_crypto.c in ntpd in NTP before 4.2.4p7 and 4.2.5 before 4.2.5p74, when OpenSSL and autokey are enabled, allows remote attackers to execute arbitrary code via a crafted packet containing an extension field.

CVE-2009-0021 NTP 4.2.4 before 4.2.4p5 and 4.2.5 before 4.2.5p150 does not properly check the return value from the OpenSSL EVP_VerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature for DSA and ECDSA keys, a similar vulnerability to CVE-2008-5077.

  - fix buffer overflow when parsing Autokey association     message (#500783, CVE-2009-1252)

  - fix buffer overflow in ntpq (#500783, CVE-2009-0159)

  - fix check for malformed signatures (#479698,     CVE-2009-0021)

  - fix selecting multicast interface (#444106)

  - disable kernel discipline when -x option is used     (#431729)

  - avoid use of uninitialized floating-point values in     clock_select (#250838)

  - generate man pages from html source, include config man     pages (#307271)

  - add note about paths and exit codes to ntpd man page     (#242925, #246568)

  - add section about exit codes to ntpd man page (#319591)

  - always return 0 in scriptlets

  - pass additional options to ntpdate (#240141)

  - fix broadcast client to accept broadcasts on     255.255.255.255 (#226958)

  - compile with crypto support on 64bit architectures     (#239580)

  - add ncurses-devel to buildrequires (#239580)

  - exit with nonzero code if ntpd -q did not set clock     (#240134)

  - fix return codes in init script (#240118)

The remote OracleVM system is missing necessary patches to address critical security updates :

CVE-2009-1574 racoon/isakmp_frag.c in ipsec-tools before 0.7.2 allows remote attackers to cause a denial of service (crash) via crafted fragmented packets without a payload, which triggers a NULL pointer dereference.

CVE-2009-1632 Multiple memory leaks in Ipsec-tools before 0.7.2 allow remote attackers to cause a denial of service (memory consumption) via vectors involving (1) signature verification during user authentication with X.509 certificates, related to the eay_check_x509sign function in src/racoon/crypto_openssl.c  and (2) the NAT-Traversal (aka NAT-T) keepalive implementation, related to src/racoon/nattraversal.c.

CVE-2008-3651 Memory leak in racoon/proposal.c in the racoon daemon in ipsec-tools before 0.7.1 allows remote authenticated users to cause a denial of service (memory consumption) via invalid proposals.

CVE-2008-3652 src/racoon/handler.c in racoon in ipsec-tools does not remove an 'orphaned ph1' (phase 1) handle when it has been initiated remotely, which allows remote attackers to cause a denial of service (resource consumption).

  - fix nul dereference in frag code and some memory leaks     (#497990)

  - also do not destroy ports in ph2 (#231604)

  - improved fix for cleanup of IPSEC SAs in SADB (#231604)

  - fix cleanup of IPSEC SAs in SADB (#231604)

  - fix segfault in timer (#378551)

  - handle new interfaces immediately (#247301)

  - eliminate debug logging overhead when log level is lower     (#248567)

  - use the adminsock_path as specified on the command line     (#247294)

  - link only necessary libraries (#458631)

  - make racoon PIE executable (#210023)

  - fix for DoS through various memory leaks (CVE-2008-3651     #456660, CVE-2008-3652 #458846)

  - use the current kernel headers instead of the private     copy (#446979)

  - Resolves: rhbz#435803 - update pfkeyv2.h with new     #defines

The remote OracleVM system is missing necessary patches to address critical security updates :

CVE-2008-4307 Race condition in the do_setlk function in fs/nfs/file.c in the Linux kernel before 2.6.26 allows local users to cause a denial of service (crash) via vectors resulting in an interrupted RPC call that leads to a stray FL_POSIX lock, related to improper handling of a race between fcntl and close in the EINTR case.

CVE-2009-1337 The exit_notify function in kernel/exit.c in the Linux kernel before 2.6.30-rc1 does not restrict exit signals when the CAP_KILL capability is held, which allows local users to send an arbitrary signal to a process by running a program that modifies the exit_signal field and then uses an exec system call to launch a setuid application.

CVE-2009-0834 The audit_syscall_entry function in the Linux kernel 2.6.28.7 and earlier on the x86_64 platform does not properly handle (1) a 32-bit process making a 64-bit syscall or (2) a 64-bit process making a 32-bit syscall, which allows local users to bypass certain syscall audit configurations via crafted syscalls, a related issue to CVE-2009-0342 and CVE-2009-0343.

CVE-2009-1336 fs/nfs/client.c in the Linux kernel before 2.6.23 does not properly initialize a certain structure member that stores the maximum NFS filename length, which allows local users to cause a denial of service (OOPS) via a long filename, related to the encode_lookup function.

  - CVE-2008-4307 -[nfs] remove bogus lock-if-signalled case     (Bryn M. Reeves) [456287 456288]

  - CVE-2009-1337 - [misc] exit_notify: kill the wrong     capable check 

  - CVE-2009-0834 - [ptrace] audit_syscall_entry to use     right syscall number (Jiri Pirko) [488001 488002]

  - CVE-2009-1336 - [nfs] v4: client crash on file lookup     with long names (Sachin S. Prabhu) [494078 493942]

The remote OracleVM system is missing necessary patches to address critical security updates :

CVE-2009-0798 

The daemon in acpid before 1.0.10 allows remote attackers to cause a denial of service (CPU consumption and connectivity loss) by opening a large number of UNIX sockets without closing them, which triggers an infinite loop.

  - Updated the License entry

  - Fixed CVE-2009-0798 (too many open files DoS)

  - Resolves: #496291

  - Minor fixes in init script

  - Resolves: #237752

  - Review of init script

  - Fixed fd leaking

  - Resolves: #237752 #441686

The remote OracleVM system is missing necessary patches to address critical security updates :

CVE-2009-1185 udev before 1.4.1 does not verify whether a NETLINK message originates from kernel space, which allows local users to gain privileges by sending a NETLINK message from user space.

  - fix for CVE-2009-1185 (bug #495051)

  - Resolves: rhbz#495055

  - removed zaptel rules (rhbz #294061)

  - fixed segfault for empty lines in passwd (rhbz#413831)

  - added patch for iscsi ids (Daniel Berrange)     (rhbz#427640)

  - added /etc/sysconfig/udev-stw, which makes MODULES     configurable (Jeff Bastian) (rhbz#437979)

  - added ext4 support to vol_id (rhbz#444528)

  - updated dasd_id from dasdinfo of s390-tools-1.6.2     (rhbz#430532)

  - Resolves: rhbz#294061, rhbz#413831, rhbz#427640

  - Resolves: rhbz#437979, rhbz#444528, rhbz#430532

  - scsi_id, retry open on EBUSY (rhbz#450279)

  - Resolves: rhbz#450279

  - set selinux context for .udev dirs and symlinks     (rhbz#442886)

  - fixed rule for hp iLO2 virtual mouse device     (rhbz#429215)

  - Resolves: rhbz#429215, rhbz#442886

  - fixed selinux context setting for symlinks (rhbz#441054)

  - Resolves: rhbz#441054

  - fixed regression bug rhbz#430667 introduced by fix for     rhbz#275441

  - Resolves: rhbz#275441

  - added rule for hp iLO2 virtual mouse device     (rhbz#429215)

  - Resolves: rhbz#429215

  - fix for looping vol_id, because of a malformed passwd     (rhbz#425941)

  - revised fix for tape devices (rhbz#231990)

  - Resolves: rhbz#425941, rhbz#231990

  - moved 'ignore_device' for dm devices to 90-dm.rules     (rhbz#275441)

  - added cciss support (rhbz#250484)

  - support more than 10 nst devices in the persistent rules     (rhbz#231990)

  - extra double check for symlinks improved (rhbz#217917)

  - Resolves: rhbz#217917, rhbz#231990, rhbz#250484,     rhbz#275441

  - do not fail, if EEXIST on symlink (#217917)

  - Resolves: rhbz#217917

  - corrected rules for tape devices (#231990)

  - Resolves: rhbz#231990

  - removed pie link flag from static build flags

  - Resolves: rhbz#233956, rhbz#233307, rhbz#226997,     rhbz#236242

  - Resolves: rhbz#217917, rhbz#231990

  - added RPM_OPT_FLAGS and pie to static build flags

  - Resolves: rhbz#233956, rhbz#233307, rhbz#226997,     rhbz#236242

  - Resolves: rhbz#217917, rhbz#231990

  - do not fail, if EEXIST on mkdir (#217917)

  - configure process numbers dynamically according to CPU     and MEM (#226997)

  - link statically (#236242, #233307)

  - fixed rule for raw1394 (#233956)

  - added persistent device names for tape devices (#231990)

  - Resolves: rhbz#233956, rhbz#233307, rhbz#226997,     rhbz#236242

  - Resolves: rhbz#217917, rhbz#231990

The remote OracleVM system is missing necessary patches to address critical security updates :

CVE-2008-3528 The error-reporting functionality in (1) fs/ext2/dir.c, (2) fs/ext3/dir.c, and possibly (3) fs/ext4/dir.c in the Linux kernel 2.6.26.5 does not limit the number of printk console messages that report directory corruption, which allows physically proximate attackers to cause a denial of service (temporary system hang) by mounting a filesystem that has corrupted dir->i_size and dir->i_blocks values and performing (a) read or (b) write operations. NOTE: there are limited scenarios in which this crosses privilege boundaries.

CVE-2008-5700 libata in the Linux kernel before 2.6.27.9 does not set minimum timeouts for SG_IO requests, which allows local users to cause a denial of service (Programmed I/O mode on drives) via multiple simultaneous invocations of an unspecified test program.

CVE-2009-0028 The clone system call in the Linux kernel 2.6.28 and earlier allows local users to send arbitrary signals to a parent process from an unprivileged child process by launching an additional child process with the CLONE_PARENT flag, and then letting this new process exit. CVE-2009-0322 drivers/firmware/dell_rbu.c in the Linux kernel before 2.6.27.13, and 2.6.28.x before 2.6.28.2, allows local users to cause a denial of service (system crash) via a read system call that specifies zero bytes from the (1) image_type or (2) packet_size file in /sys/devices/platform/dell_rbu/. CVE-2009-0675 The skfp_ioctl function in drivers/net/skfp/skfddi.c in the Linux kernel before 2.6.28.6 permits SKFP_CLR_STATS requests only when the CAP_NET_ADMIN capability is absent, instead of when this capability is present, which allows local users to reset the driver statistics, related to an 'inverted logic' issue. CVE-2009-0676 The sock_getsockopt function in net/core/sock.c in the Linux kernel before 2.6.28.6 does not initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel memory via an SO_BSDCOMPAT getsockopt request.

  - CVE-2008-3528 - [fs] ext[234]: directory corruption DoS     (Eugene Teo) 

  - CVE-2008-5700 - [block] enforce a minimum SG_IO timeout     (Eugene Teo) 

  - CVE-2009-0322 - [firmware] dell_rbu: prevent oops (Don     Howard) 

  - CVE-2009-0028 - [misc] minor signal handling     vulnerability (Oleg Nesterov) [479963 479964]

  - CVE-2009-0676 - [net] memory disclosure in SO_BSDCOMPAT     gsopt (Eugene Teo) [486517 486518]

  - CVE-2009-0675 - [net] skfp_ioctl inverted logic flaw     (Eugene Teo) 

  - CVE-2009-0778 - not required

  - CVE-2009-0269 - not required

  - Enable enic

  - Finish porting infrastructure for fnic but disable it on     32bit

  - Add netconsole support for bonding in dom0 (Tina Yang)     [orabug 8231228]

  - Add Cisco fnic/enic support, requires fc infrastructure     from el5u3

The remote OracleVM system is missing necessary patches to address critical security updates :

CVE-2009-0844 The get_input_token function in the SPNEGO implementation in MIT Kerberos 5 (aka krb5) 1.5 through 1.6.3 allows remote attackers to cause a denial of service (daemon crash) and possibly obtain sensitive information via a crafted length value that triggers a buffer over-read.

CVE-2009-0845 The spnego_gss_accept_sec_context function in lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) 1.5 through 1.6.3, when SPNEGO is used, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via invalid ContextFlags data in the reqFlags field in a negTokenInit token.

CVE-2009-0846 The asn1_decode_generaltime function in lib/krb5/asn.1/asn1_decode.c in the ASN.1 GeneralizedTime decoder in MIT Kerberos 5 (aka krb5) before 1.6.4 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via vectors involving an invalid DER encoding that triggers a free of an uninitialized pointer.

  - update to revised patch for (CVE-2009-0844,     CVE-2009-0845)

  - add fix for potential buffer read overrun in the SPNEGO     GSSAPI mechanism (#490635, CVE-2009-0844)

  - add fix for NULL pointer dereference when handling     certain error cases in the SPNEGO GSSAPI mechanism     (#490635, CVE-2009-0845)

  - add fix for attempt to free uninitialized pointer in the     ASN.1 decoder (#490635, CVE-2009-0846)

  - add fix for bug in length validation in the ASN.1     decoder (CVE-2009-0847)

  - add backport of svn patch to fix a bug in how the gssapi     library handles certain error cases in     gss_accept_sec_context (CVE-2009-0845, 

  - add a backported patch which adds a check on credentials     obtained from a foreign realm to make sure that they're     of an acceptable type, and if not, retry to the request     to get one of the right type (Sadique Puthen,

  - backport fix from 1.6.3 to register file-based ccaches     created with the krb5_cc_new_unique function with the     global list, so that we don't crash when we go to close     the ccache (#468729)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Fix permissions problem with VM.GuestMetrics [bugz 7265]

  - Disable     ovs-disabled-create-netif-if-vif-type-set-ioemu.patch

  - Include proper patch for bugz 7807

  - Implement VM.GuestMetrics to communicate info with guest     OS [bugz 7265]

  - Support long command line [bugz 7264]

  - Fix bug in valid_object function in XendAPI.py [bugz     7363]

  - Update MAC address for HVM guest after live migration     [bugz 7978] [bug 7573550]

  - Fix problem preventing guest from rebooting after     migration [bugz 7807]

  - Fix guest hang when migrating HVM guests in parallel     [bugz #7816] 

  - Disable creating backend network device when vif type     set ioemu [bugz #7592] 

  - pull in cs18449 from xen-3.3-stable 

  - fix invalid reference to XendDomain.VMROOT 

  - Updates from EL5U2 for (CVE-2008-4405, CVE-2008-4993)

  - Fix unsafe use of xenstore data (CVE-2008-4405)

  - Remove qemu-dm.debug wrapper script (CVE-2008-4993)

  - Fix reboots after CVE-2008-4405 changes

  - Fix block-detach regression due to (CVE-2008-4405)

  - make coredump-[destroy|restart] work through traditional     domU config, back ported from xen unstable cs16989

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Update post install scripts to properly set default boot     kernel.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - CVE-2008-1945: add image format options for USB storage     and removable media

  - CVE-2008-1952: included in fix for CVE-2008-1943     (3.1.4-0.1.3.el5)

ID	Name	Severity
79498	OracleVM 3.1 : xen (OVMSA-2013-0009)	medium
79497	OracleVM 3.2 : kernel-uek (OVMSA-2013-0008)	medium
79496	OracleVM 3.2 : xen (OVMSA-2013-0004)	medium
79495	OracleVM 3.2 : kernel-uek (OVMSA-2013-0003)	medium
79494	OracleVM 3.0 : xen (OVMSA-2013-0002)	medium
79493	OracleVM 3.1 : xen (OVMSA-2013-0001)	medium
79492	OracleVM 2.2 : xen (OVMSA-2012-0058)	medium
79491	OracleVM 3.1 : xen (OVMSA-2012-0057)	medium
79490	OracleVM 3.0 : xen (OVMSA-2012-0056)	medium
79489	OracleVM 3.1 : xen (OVMSA-2012-0051)	medium
79488	OracleVM 3.0 : xen (OVMSA-2012-0050)	medium
79487	OracleVM 2.2 : xen (OVMSA-2012-0049)	low
79486	OracleVM 2.2 : xen (OVMSA-2012-0048)	high
79485	OracleVM 3.1 : xen (OVMSA-2012-0046)	high
79484	OracleVM 3.1 : kernel-uek (OVMSA-2012-0042)	high
79483	OracleVM 3.0 : xen (OVMSA-2012-0040)	high
79482	OracleVM 3.1 : xen (OVMSA-2012-0039)	high
79481	OracleVM 2.2 : xen (OVMSA-2012-0036)	low
79480	OracleVM 3.0 : xen (OVMSA-2012-0035)	medium
79479	OracleVM 3.1 : xen (OVMSA-2012-0034)	medium
79478	OracleVM 2.2 : xen (OVMSA-2012-0022)	high
79477	OracleVM 3.1 : xen (OVMSA-2012-0021)	high
79476	OracleVM 3.0 : xen (OVMSA-2012-0020)	high
79475	OracleVM 2.2 : krb5 (OVMSA-2011-0015)	low
79474	OracleVM 2.2 : xen (OVMSA-2011-0008)	medium
79473	OracleVM 2.2 : xen (OVMSA-2011-0007)	medium
79472	OracleVM 2.2 : acpid (OVMSA-2009-0037)	medium
79471	OracleVM 2.2 : ntp (OVMSA-2009-0036)	medium
79470	OracleVM 2.2 : kernel (OVMSA-2009-0033)	high
79469	OracleVM 2.1 : xen (OVMSA-2009-0031)	medium
79468	OracleVM 2.1 : elinks (OVMSA-2009-0030)	high
79467	OracleVM 2.1 : libtiff (OVMSA-2009-0027)	high
79466	OracleVM 2.1 : newt (OVMSA-2009-0026)	medium
79465	OracleVM 2.1 : kernel (OVMSA-2009-0023)	high
79464	OracleVM 2.1 : dnsmasq (OVMSA-2009-0022)	medium
79463	OracleVM 2.1 : curl (OVMSA-2009-0019)	high
79462	OracleVM 2.1 : libxml2 (OVMSA-2009-0018)	critical
79461	OracleVM 2.1 : kernel (OVMSA-2009-0017)	high
79460	OracleVM 2.1 : kernel (OVMSA-2009-0014)	high
79459	OracleVM 2.1 : freetype (OVMSA-2009-0012)	critical
79458	OracleVM 2.1 : ntp (OVMSA-2009-0011)	medium
79457	OracleVM 2.1 : ipsec-tools (OVMSA-2009-0010)	high
79456	OracleVM 2.1 : kernel (OVMSA-2009-0009)	high
79455	OracleVM 2.1 : acpid (OVMSA-2009-0008)	medium
79454	OracleVM 2.1 : udev (OVMSA-2009-0006)	high
79453	OracleVM 2.1 : kernel (OVMSA-2009-0004)	high
79452	OracleVM 2.1 : krb5 (OVMSA-2009-0003)	critical
79451	OracleVM 2.1 : xen (OVMSA-2009-0001)	high
79450	OracleVM 2.1 : kernel (OVMSA-2008-2009)	high
79449	OracleVM 2.1 : xen (OVMSA-2008-2007)	medium

Detections

Analytics

OracleVM Local Security Checks Family for Nessus

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

low

high

high

high

high

high

low

medium

medium

high

high

high

low

medium

medium

medium

medium

high

medium

high

high

medium

high

medium

high

critical

high

high

critical

medium

high

high

medium

high

high

critical

high

high

medium