SUSE-SU-2015:0746-1: moderate: Security update for Xen

sle-security-updates at sle-security-updates at
Tue Apr 21 12:06:49 MDT 2015

   SUSE Security Update: Security update for Xen

Announcement ID:    SUSE-SU-2015:0746-1
Rating:             moderate
References:         #907755 #918995 #918998 #919464 #922705 #922706 
Cross-References:   CVE-2015-2044 CVE-2015-2045 CVE-2015-2151
Affected Products:
                    SUSE Linux Enterprise Server 11 SP2 LTSS

   An update that solves four vulnerabilities and has two
   fixes is now available.


   The Virtualization service XEN was updated to fix various bugs and
   security issues.

   The following security issues have been fixed:


         CVE-2015-2756: XSA-126: Unmediated PCI command register access in
   qemu could have lead to denial of service attacks against the host, if PCI
   cards are passed through to guests.


         XSA-125: Long latency MMIO mapping operations were not preemptible.


         CVE-2015-2151: XSA-123: Instructions with register operands ignored
   eventual segment overrides encoded for them. Due to an insufficiently
   conditional assignment such a bogus segment override could have, however,
   corrupted a pointer used subsequently to store the result of the


         CVE-2015-2045: XSA-122: The code handling certain sub-operations of
   the HYPERVISOR_xen_version hypercall failed to fully initialize all fields
   of structures subsequently copied back to guest memory. Due to this
   hypervisor stack contents were copied into the destination of the
   operation, thus becoming visible to the guest.


         CVE-2015-2044: XSA-121: Emulation routines in the hypervisor dealing
   with certain system devices checked whether the access size by the guest
   is a supported one. When the access size is unsupported these routines
   failed to set the data to be returned to the guest for read accesses, so
   that hypervisor stack contents were copied into the destination of the
   operation, thus becoming visible to the guest.

   Also fixed:

       * Regular crashes of dom-0 on different servers due to races in MCE
         access were fixed. bsc#907755

   Security Issues:

       * CVE-2015-2044
       * CVE-2015-2045
       * CVE-2015-2151
       * CVE-2015-2756

Special Instructions and Notes:

   Please reboot the system after installing this update.

Patch Instructions:

   To install this SUSE Security Update use YaST online_update.
   Alternatively you can run the command listed for your product:

   - SUSE Linux Enterprise Server 11 SP2 LTSS:

      zypper in -t patch slessp2-xen-201503=10561

   To bring your system up-to-date, use "zypper patch".

Package List:

   - SUSE Linux Enterprise Server 11 SP2 LTSS (i586 x86_64):


   - SUSE Linux Enterprise Server 11 SP2 LTSS (x86_64):


   - SUSE Linux Enterprise Server 11 SP2 LTSS (i586):



More information about the sle-security-updates mailing list