Synopsis
The remote host is missing a vendor-supplied security patch.
Description
The version of Citrix XenServer installed on the remote host is affected by multiple vulnerabilities :
- A flaw exists in the VGA emulator in QEMU that allows a local guest user to read host memory by setting the display to a high resolution. (CVE-2014-3615)
- A flaw exists in the set_pixel_format() function within ui/vnc.c in QEMU that allows a remote attacker, using a small bytes_per_pixel value, to cause a denial of service condition. (CVE-2014-7815)
- A heap-based buffer overflow flaw exists in the Cirrus VGA emulator that allows local guest users to execute arbitrary code via vectors related to blit regions.
(CVE-2014-8106)
Note that environments that contain only PV guests are not vulnerable to these issues.
Solution
Apply the relevant hotfix referenced in the vendor advisory.