- CVE-2016-6836: vmxnet: Information leakage in     vmxnet3_complete_packet (bz #1366370)

  - CVE-2016-7909: pcnet: Infinite loop in pcnet_rdra_addr     (bz #1381196)

  - CVE-2016-7994: virtio-gpu: memory leak in     resource_create_2d (bz #1382667)

  - CVE-2016-8577: 9pfs: host memory leakage in v9fs_read     (bz #1383286)

  - CVE-2016-8578: 9pfs: potential NULL dereferencein 9pfs     routines (bz #1383292)

  - CVE-2016-8668: OOB buffer access in rocker switch     emulation (bz #1384898)

  - CVE-2016-8669: divide by zero error in     serial_update_parameters (bz #1384911)

  - CVE-2016-8909: intel-hda: infinite loop in dma buffer     stream (bz #1388053)

  - Infinite loop vulnerability in a9_gtimer_update (bz     #1388300)

  - CVE-2016-9101: eepro100: memory leakage at device unplug     (bz #1389539)

  - CVE-2016-9103: 9pfs: information leakage via xattr (bz     #1389643)

  - CVE-2016-9102: 9pfs: memory leakage when creating     extended attribute (bz #1389551)

  - CVE-2016-9104: 9pfs: integer overflow leading to OOB     access (bz #1389687)

  - CVE-2016-9105: 9pfs: memory leakage in v9fs_link (bz     #1389704)

  - CVE-2016-9106: 9pfs: memory leakage in v9fs_write (bz     #1389713)

  - CVE-2016-9381: xen: incautious about shared ring     processing (bz #1397385)

  - CVE-2016-9921: Divide by zero vulnerability in     cirrus_do_copy (bz #1399054)

  - CVE-2016-9776: infinite loop while receiving data in     mcf_fec_receive (bz #1400830)

  - CVE-2016-9845: information leakage in     virgl_cmd_get_capset_info (bz #1402247)

  - CVE-2016-9846: virtio-gpu: memory leakage while updating     cursor data (bz #1402258)

  - CVE-2016-9907: usbredir: memory leakage when destroying     redirector (bz #1402266)

  - CVE-2016-9911: usb: ehci: memory leakage in     ehci_init_transfer (bz #1402273)

  - CVE-2016-9913: 9pfs: memory leakage via proxy/handle     callbacks (bz #1402277)

  - CVE-2016-10028: virtio-gpu-3d: OOB access while reading     virgl capabilities (bz #1406368)

  - CVE-2016-9908: virtio-gpu: information leakage in     virgl_cmd_get_capset (bz #1402263)

  - CVE-2016-9912: virtio-gpu: memory leakage when     destroying gpu resource (bz #1402285)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for xen fixes several issues. These security issues were fixed :

  - CVE-2017-5973: A infinite loop while doing control     transfer in xhci_kick_epctx allowed privileged user     inside the guest to crash the host process resulting in     DoS (bsc#1025188)

  - CVE-2016-10155: The virtual hardware watchdog     'wdt_i6300esb' was vulnerable to a memory leakage issue     allowing a privileged user to cause a DoS and/or     potentially crash the Qemu process on the host     (bsc#1024183)

  - CVE-2017-2620: In CIRRUS_BLTMODE_MEMSYSSRC mode the     bitblit copy routine cirrus_bitblt_cputovideo failed to     check the memory region, allowing for an out-of-bounds     write that allows for privilege escalation (bsc#1024834)

  - CVE-2017-5856: The MegaRAID SAS 8708EM2 Host Bus Adapter     emulation support was vulnerable to a memory leakage     issue allowing a privileged user to leak host memory     resulting in DoS (bsc#1024186)

  - CVE-2017-5898: The CCID Card device emulator support was     vulnerable to an integer overflow flaw allowing a     privileged user to crash the Qemu process on the host     resulting in DoS (bsc#1024307)

  - CVE-2017-2615: An error in the bitblt copy operation     could have allowed a malicious guest administrator to     cause an out of bounds memory access, possibly leading     to information disclosure or privilege escalation     (bsc#1023004)

  - CVE-2014-8106: A heap-based buffer overflow in the     Cirrus VGA emulator allowed local guest users to execute     arbitrary code via vectors related to blit regions     (bsc#907805)

  - CVE-2017-5579: The 16550A UART serial device emulation     support was vulnerable to a memory leakage issue     allowing a privileged user to cause a DoS and/or     potentially crash the Qemu process on the host     (bsc#1022627)

  - CVE-2016-9907: The USB redirector usb-guest support was     vulnerable to a memory leakage flaw when destroying the     USB redirector in 'usbredir_handle_destroy'. A guest     user/process could have used this issue to leak host     memory, resulting in DoS for a host (bsc#1014490)

  - CVE-2016-9911: The USB EHCI Emulation support was     vulnerable to a memory leakage issue while processing     packet data in 'ehci_init_transfer'. A guest     user/process could have used this issue to leak host     memory, resulting in DoS for the host (bsc#1014507)

  - CVE-2016-9921: The Cirrus CLGD 54xx VGA Emulator support     was vulnerable to a divide by zero issue while copying     VGA data. A privileged user inside guest could have used     this flaw to crash the process instance on the host,     resulting in DoS (bsc#1015169)

  - CVE-2016-9922: The Cirrus CLGD 54xx VGA Emulator support     was vulnerable to a divide by zero issue while copying     VGA data. A privileged user inside guest could have used     this flaw to crash the process instance on the host,     resulting in DoS (bsc#1015169)

  - CVE-2016-9101: A memory leak in hw/net/eepro100.c     allowed local guest OS administrators to cause a denial     of service (memory consumption and QEMU process crash)     by repeatedly unplugging an i8255x (PRO100) NIC device     (bsc#1013668)

  - CVE-2016-9776: The ColdFire Fast Ethernet Controller     emulator support was vulnerable to an infinite loop     issue while receiving packets in 'mcf_fec_receive'. A     privileged user/process inside guest could have used     this issue to crash the Qemu process on the host leading     to DoS (bsc#1013657)

  - A malicious guest could have, by frequently rebooting     over extended periods of time, run the host system out     of memory, resulting in a Denial of Service (DoS)     (bsc#1022871)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for kvm fixes several issues. These security issues were fixed :

  - CVE-2017-2620: In CIRRUS_BLTMODE_MEMSYSSRC mode the     bitblit copy routine cirrus_bitblt_cputovideo failed to     check the memory region, allowing for an out-of-bounds     write that allows for privilege escalation (bsc#1024972)

  - CVE-2017-2615: An error in the bitblt copy operation     could have allowed a malicious guest administrator to     cause an out of bounds memory access, possibly leading     to information disclosure or privilege escalation     (bsc#1023004)

  - CVE-2016-9776: The ColdFire Fast Ethernet Controller     emulator support was vulnerable to an infinite loop     issue while receiving packets in 'mcf_fec_receive'. A     privileged user/process inside guest could have used     this issue to crash the Qemu process on the host leading     to DoS (bsc#1013285)

  - CVE-2016-9911: The USB EHCI Emulation support was     vulnerable to a memory leakage issue while processing     packet data in 'ehci_init_transfer'. A guest     user/process could have used this issue to leak host     memory, resulting in DoS for the host (bsc#1014111)

  - CVE-2016-9907: The USB redirector usb-guest support was     vulnerable to a memory leakage flaw when destroying the     USB redirector in 'usbredir_handle_destroy'. A guest     user/process could have used this issue to leak host     memory, resulting in DoS for a host (bsc#1014109)

  - CVE-2016-9921: The Cirrus CLGD 54xx VGA Emulator support     was vulnerable to a divide by zero issue while copying     VGA data. A privileged user inside guest could have used     this flaw to crash the process instance on the host,     resulting in DoS (bsc#1014702)

  - CVE-2016-9922: The Cirrus CLGD 54xx VGA Emulator support     was vulnerable to a divide by zero issue while copying     VGA data. A privileged user inside guest could have used     this flaw to crash the process instance on the host,     resulting in DoS (bsc#1014702)

  - CVE-2017-5898: The CCID Card device emulator support was     vulnerable to an integer overflow allowing a privileged     user inside the guest to crash the Qemu process     resulting in DoS (bnc#1023907)

  - CVE-2016-10155: The virtual hardware watchdog     'wdt_i6300esb' was vulnerable to a memory leakage issue     allowing a privileged user to cause a DoS and/or     potentially crash the Qemu process on the host     (bsc#1021129)

  - CVE-2017-5856: The MegaRAID SAS 8708EM2 Host Bus Adapter     emulation support was vulnerable to a memory leakage     issue allowing a privileged user to leak host memory     resulting in DoS (bsc#1023053)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
96677	Fedora 25 : 2:qemu (2017-b953d4d3a4)	Nessus	Fedora Local Security Checks	1/23/2017	1/5/2026	high
97657	SUSE SLES11 Security Update : xen (SUSE-SU-2017:0647-1)	Nessus	SuSE Local Security Checks	3/10/2017	12/30/2025	critical
99758	SUSE SLES11 Security Update : kvm (SUSE-SU-2017:1135-1)	Nessus	SuSE Local Security Checks	5/1/2017	12/23/2025	critical

Detections

Analytics

Plugins Search

high

critical

critical