SUSE-SU-2015:0744-1: moderate: Security update for Xen

[sle-updates at lists.suse.com]

   SUSE Security Update: Security update for Xen
______________________________________________________________________________

Announcement ID:    SUSE-SU-2015:0744-1
Rating:             moderate
References:         #918995 #918998 #919464 #922705 
Cross-References:   CVE-2013-3495 CVE-2014-3615 CVE-2014-5146
                    CVE-2014-5149 CVE-2014-9065 CVE-2014-9066
                    CVE-2015-0361 CVE-2015-2044 CVE-2015-2045
                   
Affected Products:
                    SUSE Linux Enterprise Server 10 SP4 LTSS
______________________________________________________________________________

   An update that fixes 9 vulnerabilities is now available.

Description:


   The Virtualization service XEN was updated to fix various bugs and
   security issues.

   The following security issues have been fixed:

       *

         XSA-125: Long latency MMIO mapping operations were not preemptible.

       *

         CVE-2015-2151: XSA-123: Instructions with register operands ignored
   eventual segment overrides encoded for them. Due to an insufficiently
   conditional assignment such a bogus segment override could have, however,
   corrupted a pointer used subsequently to store the result of the
   instruction.

       *

         CVE-2015-2045: XSA-122: The code handling certain sub-operations of
   the HYPERVISOR_xen_version hypercall failed to fully initialize all fields
   of structures subsequently copied back to guest memory. Due to this
   hypervisor stack contents were copied into the destination of the
   operation, thus becoming visible to the guest.

       *

         CVE-2015-2044: XSA-121: Emulation routines in the hypervisor dealing
   with certain system devices checked whether the access size by the guest
   is a supported one. When the access size is unsupported these routines
   failed to set the data to be returned to the guest for read accesses, so
   that hypervisor stack contents were copied into the destination of the
   operation, thus becoming visible to the guest.

   Security Issues:

       * CVE-2013-3495
         <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3495>
       * CVE-2014-5146
         <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5146>
       * CVE-2014-5149
         <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5149>
       * CVE-2014-3615
         <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3615>
       * CVE-2014-9065
         <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9065>
       * CVE-2014-9066
         <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9066>
       * CVE-2015-0361
         <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0361>
       * CVE-2015-2044
         <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2044>
       * CVE-2015-2045
         <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2045>


Special Instructions and Notes:

   Please reboot the system after installing this update.


Package List:

   - SUSE Linux Enterprise Server 10 SP4 LTSS (i586 x86_64):

      xen-3.2.3_17040_46-0.13.1
      xen-devel-3.2.3_17040_46-0.13.1
      xen-doc-html-3.2.3_17040_46-0.13.1
      xen-doc-pdf-3.2.3_17040_46-0.13.1
      xen-doc-ps-3.2.3_17040_46-0.13.1
      xen-kmp-debug-3.2.3_17040_46_2.6.16.60_0.107.36-0.13.1
      xen-kmp-default-3.2.3_17040_46_2.6.16.60_0.107.36-0.13.1
      xen-kmp-kdump-3.2.3_17040_46_2.6.16.60_0.107.36-0.13.1
      xen-kmp-smp-3.2.3_17040_46_2.6.16.60_0.107.36-0.13.1
      xen-libs-3.2.3_17040_46-0.13.1
      xen-tools-3.2.3_17040_46-0.13.1
      xen-tools-domU-3.2.3_17040_46-0.13.1
      xen-tools-ioemu-3.2.3_17040_46-0.13.1

   - SUSE Linux Enterprise Server 10 SP4 LTSS (x86_64):

      xen-libs-32bit-3.2.3_17040_46-0.13.1

   - SUSE Linux Enterprise Server 10 SP4 LTSS (i586):

      xen-kmp-bigsmp-3.2.3_17040_46_2.6.16.60_0.107.36-0.13.1
      xen-kmp-kdumppae-3.2.3_17040_46_2.6.16.60_0.107.36-0.13.1
      xen-kmp-vmi-3.2.3_17040_46_2.6.16.60_0.107.36-0.13.1
      xen-kmp-vmipae-3.2.3_17040_46_2.6.16.60_0.107.36-0.13.1


References:

   https://www.suse.com/security/cve/CVE-2013-3495.html
   https://www.suse.com/security/cve/CVE-2014-3615.html
   https://www.suse.com/security/cve/CVE-2014-5146.html
   https://www.suse.com/security/cve/CVE-2014-5149.html
   https://www.suse.com/security/cve/CVE-2014-9065.html
   https://www.suse.com/security/cve/CVE-2014-9066.html
   https://www.suse.com/security/cve/CVE-2015-0361.html
   https://www.suse.com/security/cve/CVE-2015-2044.html
   https://www.suse.com/security/cve/CVE-2015-2045.html
   https://bugzilla.suse.com/918995
   https://bugzilla.suse.com/918998
   https://bugzilla.suse.com/919464
   https://bugzilla.suse.com/922705
   https://download.suse.com/patch/finder/?keywords=eb058b67acad47659a336d914d8e2fd0