Long latency MMIO mapping operations are not preemptible [XSA-125, CVE-2015-2752] Unmediated PCI command register access in qemu [XSA-126, CVE-2015-2756] Certain domctl operations may be abused to lock up the host [XSA-127, CVE-2015-2751]

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2018-0248 for details.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2020-0039 for details.

The remote host is affected by the vulnerability described in GLSA-201504-04 (Xen: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Xen.  Please review the       CVE identifiers referenced below for details.
  Impact :

    A local attacker could possibly cause a Denial of Service condition or       obtain sensitive information.
  Workaround :

    There is no known workaround at this time.

xen was updated to fix the following security issues :

  - CVE-2015-5165: QEMU leak of uninitialized heap memory in     rtl8139 device model (bsc#939712, XSA-140)

  - CVE-2015-5166: Use after free in QEMU/Xen block unplug     protocol (bsc#939709, XSA-139)

  - CVE-2015-2751: Certain domctl operations could have be     used to lock up the host (bsc#922709, XSA-127)

  - CVE-2015-3259: xl command line config handling stack     overflow (bsc#935634, XSA-137)

  - CVE-2015-4164: DoS through iret hypercall handler     (bsc#932996, XSA-136)

  - CVE-2015-5154: Host code execution via IDE subsystem     CD-ROM (bsc#938344)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Xen was updated to fix eight vulnerabilities.

The following vulnerabilities were fixed :

  - CVE-2015-2751: Certain domctl operations may be abused     to lock up the host (XSA-127 boo#922709)

  - CVE-2015-4103: Potential unintended writes to host MSI     message data field via qemu (XSA-128) (boo#931625)

  - CVE-2015-4104: PCI MSI mask bits inadvertently exposed     to guests (XSA-129) (boo#931626)

  - CVE-2015-4105: Guest triggerable qemu MSI-X pass-through     error messages (XSA-130) (boo#931627)

  - CVE-2015-4106: Unmediated PCI register access in qemu     (XSA-131) (boo#931628)

  - CVE-2015-4163: GNTTABOP_swap_grant_ref operation     misbehavior (XSA-134) (boo#932790)

  - CVE-2015-3209: heap overflow in qemu pcnet controller     allowing guest to host escape (XSA-135) (boo#932770)

  - CVE-2015-4164: DoS through iret hypercall handler     (XSA-136) (boo#932996)

ID	Name	Product	Family	Published	Updated	Severity
82952	Fedora 22 : xen-4.5.0-7.fc22 (2015-5295)	Nessus	Fedora Local Security Checks	4/22/2015	1/11/2021	high
111992	OracleVM 3.4 : xen (OVMSA-2018-0248) (Bunker Buster) (Foreshadow) (Meltdown) (POODLE) (Spectre)	Nessus	OracleVM Local Security Checks	8/20/2018	1/9/2026	critical
140019	OracleVM 3.4 : xen (OVMSA-2020-0039) (Bunker Buster) (Foreshadow) (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout) (Meltdown) (POODLE) (Spectre)	Nessus	OracleVM Local Security Checks	8/28/2020	1/9/2026	critical
82734	GLSA-201504-04 : Xen: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	4/13/2015	1/11/2021	high
85792	SUSE SLED11 Security Update : xen (SUSE-SU-2015:1479-2)	Nessus	SuSE Local Security Checks	9/4/2015	1/6/2021	high
84334	openSUSE Security Update : xen (openSUSE-2015-435)	Nessus	SuSE Local Security Checks	6/23/2015	1/19/2021	high

Detections

Analytics

Plugins Search

high

critical

critical

high

high

high