远程 OracleVM 系统缺少处理关键安全更新所需的补丁：有关详细信息，请参阅 Oracle VM 安全公告 OVMSA-2018-0248。

远程主机受到 GLSA-201611-09 中所述漏洞的影响（Xen：多个漏洞）

    已在 Xen 中发现多个漏洞。请检查下方引用的 CVE 标识符以了解详细信息。
  影响：

    恶意的客户机管理员可提升其在主机系统上的权限，或造成拒绝服务。此外，恶意的无权限客户机用户可能能够在相同客户机中，取得或损毁其他程序内的敏感信息（包括加密材料）。
  变通方案：

    目前无任何已知的变通方案。

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2020-0039 for details.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2017-0153 for details.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2018-0248 for details.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - xsa224 xen: grant table operations mishandle reference counts (XSA-224) (CVE-2017-10921)

  - The qemu implementation in libvirt before 1.3.0 and Xen allows local guest OS users to cause a denial of     service (host disk consumption) by writing to stdout or stderr. (CVE-2014-3672)

  - Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary     code by sending a packet with TXSTATUS_STARTPACKET set and then a crafted packet with TXSTATUS_DEVICEOWNS     set. (CVE-2015-3209)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote host is affected by the vulnerability described in GLSA-201611-09 (Xen: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Xen. Please review the       CVE identifiers referenced below for details.
  Impact :

    A malicious guest administrator could escalate their privileges on the       host system or cause a Denial of Service.  Additionally, a malicious       unprivileged guest user may be able to obtain or corrupt sensitive       information (including cryptographic material) in other programs in the       same guest.
  Workaround :

    There is no known workaround at this time.

qemu-kvm: Directory traversal flaw in 9p virtio backend [CVE-2016-7116] qemu: hw: net: Heap overflow in xlnx.xps-ethernetlite [CVE-2016-7161] CR0.TS and CR0.EM not always honored for x86 HVM guest [XSA-190, CVE-2016-7777]

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its self-reported version number, the Xen hypervisor installed on the remote host is affected by an information disclosure vulnerability in x86_emulate.c due to a failure to properly honor CR0.TS and CR0.EM. A local attacker within an x86 HVM guest operating system can exploit this, by modifying an instruction while the hypervisor is preparing to emulate it, to read or manipulate FPU, MMX, or XMM register state information for other tasks running in the guest.

Note that Nessus has checked the changeset versions based on the xen.git change log. Nessus did not check guest hardware configurations or if patches were applied manually to the source code before a recompile and reinstall.

ID	Name	Product	Family	Published	Updated	Severity
111992	OracleVM 3.4：xen (OVMSA-2018-0248) (Bunker Buster) (Foreshadow) (Meltdown) (POODLE) (Spectre)	Nessus	OracleVM Local Security Checks	8/20/2018	1/28/2021	critical
94893	GLSA-201611-09 ：Xen：多个漏洞 (Bunker Buster)	Nessus	Gentoo Local Security Checks	11/15/2016	1/11/2021	high
140019	OracleVM 3.4 : xen (OVMSA-2020-0039) (Bunker Buster) (Foreshadow) (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout) (Meltdown) (POODLE) (Spectre)	Nessus	OracleVM Local Security Checks	8/28/2020	12/7/2022	critical
103830	OracleVM 3.4 : xen (OVMSA-2017-0153)	Nessus	OracleVM Local Security Checks	10/13/2017	6/3/2021	critical
111992	OracleVM 3.4 : xen (OVMSA-2018-0248) (Bunker Buster) (Foreshadow) (Meltdown) (POODLE) (Spectre)	Nessus	OracleVM Local Security Checks	8/20/2018	1/28/2021	critical
199537	RHEL 5 : xen (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	6/3/2024	6/3/2024	critical
94893	GLSA-201611-09 : Xen: Multiple vulnerabilities (Bunker Buster)	Nessus	Gentoo Local Security Checks	11/15/2016	1/11/2021	high
94058	Fedora 24 : xen (2016-4c407cd849)	Nessus	Fedora Local Security Checks	10/14/2016	1/11/2021	critical
94162	Xen x86 CR0.TS and CR0.EM Honoring Cross-task Register State Information Disclosure (XSA-190)	Nessus	Misc.	10/20/2016	7/10/2020	medium

Detections

Analytics

Plugins Search

critical

high

critical

critical

critical

critical

high

critical

medium