openSUSE Security Update : xen (openSUSE-SU-2013:1636-1)
medium Nessus Plugin ID 75189
Language:
New! Plugin Severity Now Using CVSS v3
The calculated severity for Plugins has been updated to use CVSS v3 by default. Plugins that do not have a CVSS v3 score will fall back to CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.
Synopsis
The remote openSUSE host is missing a security update.Description
Xen was updated to 4.1.6 c/s 23588 to fix various bugs and security issues.Following changes are listed :
- Comment out the -include directive in Config.mk as the build service build seems to error out not finding '.config' xen-config.diff
- bnc#845520 - CVE-2013-4416: xen: ocaml xenstored mishandles oversized message replies
- Improvements to block-dmmd script bnc#828623
- bnc#840196 - MTU size on Dom0 gets reset when booting DomU with e1000 device
- bnc#840592 - CVE-2013-4355: XSA-63: xen: Information leaks through I/O instruction emulation
- bnc#841766 - CVE-2013-4361: XSA-66: xen: Information leak through fbld instruction emulation
- bnc#842511 - CVE-2013-4368: XSA-67: xen: Information leak through outs instruction emulation
- xen/27397-ACPI-fix-acpi_os_map_memory.patch: address regression
- bnc#839596 - CVE-2013-1442: XSA-62: xen: Information leak on AVX and/or LWP capable CPUs
- bnc#833251 - In HP’s UEFI x86_64 platform and with xen environment, in booting stage ,xen hypervisor will panic.
- bnc#833796 - Xen: migration broken from xsave-capable to xsave-incapable host
- bnc#834751 - In xen, “shutdown –y 0 –h” cannot power off system
- bnc#833251 - In HP’s UEFI x86_64 platform and with xen environment, in booting stage ,xen hypervisor will panic.
- bnc#839600 - In HP’s UEFI x86_64 platform and sles11sp3 with xen environment, xen hypervisor will panic on multiple blades nPar.
Solution
Update the affected xen packages.See Also
https://bugzilla.novell.com/show_bug.cgi?id=828623
https://bugzilla.novell.com/show_bug.cgi?id=833251
https://bugzilla.novell.com/show_bug.cgi?id=833796
https://bugzilla.novell.com/show_bug.cgi?id=834751
https://bugzilla.novell.com/show_bug.cgi?id=839596
https://bugzilla.novell.com/show_bug.cgi?id=839600
https://bugzilla.novell.com/show_bug.cgi?id=840196
https://bugzilla.novell.com/show_bug.cgi?id=840592
https://bugzilla.novell.com/show_bug.cgi?id=841766
https://bugzilla.novell.com/show_bug.cgi?id=842511
https://bugzilla.novell.com/show_bug.cgi?id=845520
https://lists.opensuse.org/opensuse-updates/2013-11/msg00009.html
Plugin Details
Severity: Medium
ID: 75189
File Name: openSUSE-2013-821.nasl
Version: 1.5
Type: local
Agent: unix
Family: SuSE Local Security Checks
Published: 6/13/2014
Updated: 1/19/2021
Dependencies: ssh_get_info.nasl
Risk Information
VPR
Risk Factor: Medium
Score: 4
CVSS v2
Risk Factor: Medium
Base Score: 5.2
Temporal Score: 3.8
Vector: AV:A/AC:M/Au:S/C:N/I:N/A:C
Temporal Vector: E:U/RL:OF/RC:C
Vulnerability Information
CPE: p-cpe:/a:novell:opensuse:xen, p-cpe:/a:novell:opensuse:xen-debugsource, p-cpe:/a:novell:opensuse:xen-devel, p-cpe:/a:novell:opensuse:xen-doc-html, p-cpe:/a:novell:opensuse:xen-doc-pdf, p-cpe:/a:novell:opensuse:xen-kmp-default, p-cpe:/a:novell:opensuse:xen-kmp-default-debuginfo, p-cpe:/a:novell:opensuse:xen-kmp-desktop, p-cpe:/a:novell:opensuse:xen-kmp-desktop-debuginfo, p-cpe:/a:novell:opensuse:xen-kmp-pae, p-cpe:/a:novell:opensuse:xen-kmp-pae-debuginfo, p-cpe:/a:novell:opensuse:xen-libs, p-cpe:/a:novell:opensuse:xen-libs-32bit, p-cpe:/a:novell:opensuse:xen-libs-debuginfo, p-cpe:/a:novell:opensuse:xen-libs-debuginfo-32bit, p-cpe:/a:novell:opensuse:xen-tools, p-cpe:/a:novell:opensuse:xen-tools-debuginfo, p-cpe:/a:novell:opensuse:xen-tools-domU, p-cpe:/a:novell:opensuse:xen-tools-domU-debuginfo, cpe:/o:novell:opensuse:12.2
Required KB Items: Host/local_checks_enabled, Host/SuSE/release, Host/SuSE/rpm-list, Host/cpu
Exploit Ease: No known exploits are available
Patch Publication Date: 10/30/2013
Reference Information
CVE: CVE-2013-1442, CVE-2013-4355, CVE-2013-4361, CVE-2013-4368, CVE-2013-4416