openSUSE Security Update : xen (openSUSE-SU-2013:1636-1)

Medium Nessus Plugin ID 75189


The remote openSUSE host is missing a security update.


Xen was updated to 4.1.6 c/s 23588 to fix various bugs and security issues.

Following changes are listed :

- Comment out the -include directive in as the build service build seems to error out not finding '.config' xen-config.diff

- bnc#845520 - CVE-2013-4416: xen: ocaml xenstored mishandles oversized message replies

- Improvements to block-dmmd script bnc#828623

- bnc#840196 - MTU size on Dom0 gets reset when booting DomU with e1000 device

- bnc#840592 - CVE-2013-4355: XSA-63: xen: Information leaks through I/O instruction emulation

- bnc#841766 - CVE-2013-4361: XSA-66: xen: Information leak through fbld instruction emulation

- bnc#842511 - CVE-2013-4368: XSA-67: xen: Information leak through outs instruction emulation

- xen/27397-ACPI-fix-acpi_os_map_memory.patch: address regression

- bnc#839596 - CVE-2013-1442: XSA-62: xen: Information leak on AVX and/or LWP capable CPUs

- bnc#833251 - In HP’s UEFI x86_64 platform and with xen environment, in booting stage ,xen hypervisor will panic.

- bnc#833796 - Xen: migration broken from xsave-capable to xsave-incapable host

- bnc#834751 - In xen, “shutdown –y 0 –h” cannot power off system

- bnc#833251 - In HP’s UEFI x86_64 platform and with xen environment, in booting stage ,xen hypervisor will panic.

- bnc#839600 - In HP’s UEFI x86_64 platform and sles11sp3 with xen environment, xen hypervisor will panic on multiple blades nPar.


Update the affected xen packages.

See Also

Plugin Details

Severity: Medium

ID: 75189

File Name: openSUSE-2013-821.nasl

Version: $Revision: 1.1 $

Type: local

Agent: unix

Published: 2014/06/13

Modified: 2014/06/13

Dependencies: 12634

Risk Information

Risk Factor: Medium


Base Score: 5.2

Temporal Score: 4.5

Vector: CVSS2#AV:A/AC:M/Au:S/C:N/I:N/A:C

Temporal Vector: CVSS2#E:ND/RL:OF/RC:C

Vulnerability Information

CPE: p-cpe:/a:novell:opensuse:xen, p-cpe:/a:novell:opensuse:xen-debugsource, p-cpe:/a:novell:opensuse:xen-devel, p-cpe:/a:novell:opensuse:xen-doc-html, p-cpe:/a:novell:opensuse:xen-doc-pdf, p-cpe:/a:novell:opensuse:xen-kmp-default, p-cpe:/a:novell:opensuse:xen-kmp-default-debuginfo, p-cpe:/a:novell:opensuse:xen-kmp-desktop, p-cpe:/a:novell:opensuse:xen-kmp-desktop-debuginfo, p-cpe:/a:novell:opensuse:xen-kmp-pae, p-cpe:/a:novell:opensuse:xen-kmp-pae-debuginfo, p-cpe:/a:novell:opensuse:xen-libs, p-cpe:/a:novell:opensuse:xen-libs-32bit, p-cpe:/a:novell:opensuse:xen-libs-debuginfo, p-cpe:/a:novell:opensuse:xen-libs-debuginfo-32bit, p-cpe:/a:novell:opensuse:xen-tools, p-cpe:/a:novell:opensuse:xen-tools-debuginfo, p-cpe:/a:novell:opensuse:xen-tools-domU, p-cpe:/a:novell:opensuse:xen-tools-domU-debuginfo, cpe:/o:novell:opensuse:12.2

Required KB Items: Host/local_checks_enabled, Host/SuSE/release, Host/SuSE/rpm-list, Host/cpu

Exploit Available: false

Exploit Ease: No known exploits are available

Patch Publication Date: 2013/10/30

Reference Information

CVE: CVE-2013-1442, CVE-2013-4355, CVE-2013-4361, CVE-2013-4368, CVE-2013-4416

BID: 62630, 62708, 62710, 62935, 63404

OSVDB: 97770, 97954, 97955, 98290, 99072