{"affected":[{"ecosystem_specific":{"binaries":[{"xen-devel":"4.4.4_02-32.1"}]},"package":{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","name":"xen","purl":"pkg:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2011%20SP4"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"4.4.4_02-32.1"}],"type":"ECOSYSTEM"}]},{"ecosystem_specific":{"binaries":[{"xen":"4.4.4_02-32.1","xen-doc-html":"4.4.4_02-32.1","xen-kmp-default":"4.4.4_02_3.0.101_68-32.1","xen-kmp-pae":"4.4.4_02_3.0.101_68-32.1","xen-libs":"4.4.4_02-32.1","xen-libs-32bit":"4.4.4_02-32.1","xen-tools":"4.4.4_02-32.1","xen-tools-domU":"4.4.4_02-32.1"}]},"package":{"ecosystem":"SUSE:Linux Enterprise Desktop 11 SP4","name":"xen","purl":"pkg:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Desktop%2011%20SP4"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"4.4.4_02-32.1"}],"type":"ECOSYSTEM"}]},{"ecosystem_specific":{"binaries":[{"xen":"4.4.4_02-32.1","xen-doc-html":"4.4.4_02-32.1","xen-kmp-default":"4.4.4_02_3.0.101_68-32.1","xen-kmp-pae":"4.4.4_02_3.0.101_68-32.1","xen-libs":"4.4.4_02-32.1","xen-libs-32bit":"4.4.4_02-32.1","xen-tools":"4.4.4_02-32.1","xen-tools-domU":"4.4.4_02-32.1"}]},"package":{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4","name":"xen","purl":"pkg:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"4.4.4_02-32.1"}],"type":"ECOSYSTEM"}]},{"ecosystem_specific":{"binaries":[{"xen":"4.4.4_02-32.1","xen-doc-html":"4.4.4_02-32.1","xen-kmp-default":"4.4.4_02_3.0.101_68-32.1","xen-kmp-pae":"4.4.4_02_3.0.101_68-32.1","xen-libs":"4.4.4_02-32.1","xen-libs-32bit":"4.4.4_02-32.1","xen-tools":"4.4.4_02-32.1","xen-tools-domU":"4.4.4_02-32.1"}]},"package":{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","name":"xen","purl":"pkg:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2011%20SP4"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"4.4.4_02-32.1"}],"type":"ECOSYSTEM"}]}],"aliases":[],"details":"xen was updated to fix 47 security issues.\n\nThese security issues were fixed:\n- CVE-2013-4527: Buffer overflow in hw/timer/hpet.c might have allowed remote attackers to execute arbitrary code via vectors related to the number of timers (bnc#864673).\n- CVE-2013-4529: Buffer overflow in hw/pci/pcie_aer.c allowed remote attackers to cause a denial of service and possibly execute arbitrary code via a large log_num value in a savevm image (bnc#864678).\n- CVE-2013-4530: Buffer overflow in hw/ssi/pl022.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via crafted tx_fifo_head and rx_fifo_head values in a savevm image (bnc#864682).\n- CVE-2013-4533: Buffer overflow in the pxa2xx_ssp_load function in hw/arm/pxa2xx.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted s->rx_level value in a savevm image (bsc#864655).\n- CVE-2013-4534: Buffer overflow in hw/intc/openpic.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via vectors related to IRQDest elements (bsc#864811).\n- CVE-2013-4537: The ssi_sd_transfer function in hw/sd/ssi-sd.c allowed remote attackers to execute arbitrary code via a crafted arglen value in a savevm image (bsc#864391).\n- CVE-2013-4538: Multiple buffer overflows in the ssd0323_load function in hw/display/ssd0323.c allowed remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via crafted (1) cmd_len, (2) row, or (3) col values; (4) row_start and row_end values; or (5) col_star and col_end values in a savevm image (bsc#864769).\n- CVE-2013-4539: Multiple buffer overflows in the tsc210x_load function in hw/input/tsc210x.c might have allowed remote attackers to execute arbitrary code via a crafted (1) precision, (2) nextprecision, (3) function, or (4) nextfunction value in a savevm image (bsc#864805).\n- CVE-2014-0222: Integer overflow in the qcow_open function in block/qcow.c allowed remote attackers to cause a denial of service (crash) via a large L2 table in a QCOW version 1 image (bsc#877642).\n- CVE-2014-3640: The sosendto function in slirp/udp.c allowed local users to cause a denial of service (NULL pointer dereference) by sending a udp packet with a value of 0 in the source port and address, which triggers access of an uninitialized socket (bsc#897654).\n- CVE-2014-3689: The vmware-vga driver (hw/display/vmware_vga.c) allowed local guest users to write to qemu memory locations and gain privileges via unspecified parameters related to rectangle handling (bsc#901508).\n- CVE-2014-7815: The set_pixel_format function in ui/vnc.c allowed remote attackers to cause a denial of service (crash) via a small bytes_per_pixel value (bsc#902737).\n- CVE-2014-9718: The (1) BMDMA and (2) AHCI HBA interfaces in the IDE functionality had multiple interpretations of a function's return value, which allowed guest OS users to cause a host OS denial of service (memory consumption or infinite loop, and system crash) via a PRDT with zero complete sectors, related to the bmdma_prepare_buf and ahci_dma_prepare_buf functions (bsc#928393).\n- CVE-2015-1779: The VNC websocket frame decoder allowed remote attackers to cause a denial of service (memory and CPU consumption) via a large (1) websocket payload or (2) HTTP headers section (bsc#924018).\n- CVE-2015-5278: Infinite loop in ne2000_receive() function (bsc#945989).\n- CVE-2015-6855: hw/ide/core.c did not properly restrict the commands accepted by an ATAPI device, which allowed guest users to cause a denial of service or possibly have unspecified other impact via certain IDE commands, as demonstrated by a WIN_READ_NATIVE_MAX command to an empty drive, which triggers a divide-by-zero error and instance crash (bsc#945404).\n- CVE-2015-7512: Buffer overflow in the pcnet_receive function in hw/net/pcnet.c, when a guest NIC has a larger MTU, allowed remote attackers to cause a denial of service (guest OS crash) or execute arbitrary code via a large packet (bsc#957162).\n- CVE-2015-7549: pci: NULL pointer dereference issue (bsc#958917).\n- CVE-2015-8345: eepro100: infinite loop in processing command block list (bsc#956829).\n- CVE-2015-8504: VNC: floating point exception (bsc#958491).\n- CVE-2015-8550: Paravirtualized drivers were incautious about shared memory contents (XSA-155) (bsc#957988).\n- CVE-2015-8554: qemu-dm buffer overrun in MSI-X handling (XSA-164) (bsc#958007).\n- CVE-2015-8555: Information leak in legacy x86 FPU/XMM initialization (XSA-165) (bsc#958009).\n- CVE-2015-8558: Infinite loop in ehci_advance_state resulted in DoS (bsc#959005).\n- CVE-2015-8567: vmxnet3: host memory leakage (bsc#959387).\n- CVE-2015-8568: vmxnet3: host memory leakage (bsc#959387).\n- CVE-2015-8613: SCSI: stack based buffer overflow in megasas_ctrl_get_info (bsc#961358).\n- CVE-2015-8619: Stack based OOB write in hmp_sendkey routine (bsc#960334).\n- CVE-2015-8743: ne2000: OOB memory access in ioport r/w functions (bsc#960725).\n- CVE-2015-8744: vmxnet3: Incorrect l2 header validation lead to a crash via assert(2) call (bsc#960835).\n- CVE-2015-8745: Reading IMR registers lead to a crash via assert(2) call (bsc#960707).\n- CVE-2015-8817: OOB access in address_space_rw lead to segmentation fault (I) (bsc#969121).\n- CVE-2015-8818: OOB access in address_space_rw lead to segmentation fault (II) (bsc#969122).\n- CVE-2016-1568: AHCI use-after-free vulnerability in aio port commands (bsc#961332).\n- CVE-2016-1570: The PV superpage functionality in arch/x86/mm.c allowed local PV guests to obtain sensitive information, cause a denial of service, gain privileges, or have unspecified other impact via a crafted page identifier (MFN) to the (1) MMUEXT_MARK_SUPER or (2) MMUEXT_UNMARK_SUPER sub-op in the HYPERVISOR_mmuext_op hypercall or (3) unknown vectors related to page table updates (bsc#960861).\n- CVE-2016-1571: VMX: intercept issue with INVLPG on non-canonical address (XSA-168) (bsc#960862).\n- CVE-2016-1714: nvram: OOB r/w access in processing firmware configurations (bsc#961691).\n- CVE-2016-1922: NULL pointer dereference in vapic_write() (bsc#962320).\n- CVE-2016-1981: e1000 infinite loop in start_xmit and e1000_receive_iov routines (bsc#963782).\n- CVE-2016-2198: EHCI NULL pointer dereference in ehci_caps_write (bsc#964413).\n- CVE-2016-2270: Xen allowed local guest administrators to cause a denial of service (host reboot) via vectors related to multiple mappings of MMIO pages with different cachability settings (bsc#965315).\n- CVE-2016-2271: VMX when using an Intel or Cyrix CPU, allowed local HVM guest users to cause a denial of service (guest crash) via vectors related to a non-canonical RIP (bsc#965317).\n- CVE-2016-2391: usb: multiple eof_timers in ohci module lead to NULL pointer dereference (bsc#967013).\n- CVE-2016-2392: NULL pointer dereference in remote NDIS control message handling (bsc#967012).\n- CVE-2016-2538: Integer overflow in remote NDIS control message handling (bsc#967969).\n- CVE-2016-2841: ne2000: Infinite loop in ne2000_receive (bsc#969350).\n- XSA-166: ioreq handling possibly susceptible to multiple read issue (bsc#958523).\n\nThese non-security issues were fixed:\n- bsc#954872: script block-dmmd not working as expected \n- bsc#963923: domain weights not honored when sched-credit tslice is reduced\n- bsc#959695: Missing docs for xen\n- bsc#967630: Discrepancy in reported memory size with correction XSA-153 for xend\n- bsc#959928: When DomU is in state running xm domstate returned nothing\n","id":"SUSE-SU-2016:0955-1","modified":"2016-04-05T11:27:02Z","published":"2016-04-05T11:27:02Z","references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2016/suse-su-20160955-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/864391"},{"type":"REPORT","url":"https://bugzilla.suse.com/864655"},{"type":"REPORT","url":"https://bugzilla.suse.com/864673"},{"type":"REPORT","url":"https://bugzilla.suse.com/864678"},{"type":"REPORT","url":"https://bugzilla.suse.com/864682"},{"type":"REPORT","url":"https://bugzilla.suse.com/864769"},{"type":"REPORT","url":"https://bugzilla.suse.com/864805"},{"type":"REPORT","url":"https://bugzilla.suse.com/864811"},{"type":"REPORT","url":"https://bugzilla.suse.com/877642"},{"type":"REPORT","url":"https://bugzilla.suse.com/897654"},{"type":"REPORT","url":"https://bugzilla.suse.com/901508"},{"type":"REPORT","url":"https://bugzilla.suse.com/902737"},{"type":"REPORT","url":"https://bugzilla.suse.com/924018"},{"type":"REPORT","url":"https://bugzilla.suse.com/928393"},{"type":"REPORT","url":"https://bugzilla.suse.com/945404"},{"type":"REPORT","url":"https://bugzilla.suse.com/945989"},{"type":"REPORT","url":"https://bugzilla.suse.com/954872"},{"type":"REPORT","url":"https://bugzilla.suse.com/956829"},{"type":"REPORT","url":"https://bugzilla.suse.com/957162"},{"type":"REPORT","url":"https://bugzilla.suse.com/957988"},{"type":"REPORT","url":"https://bugzilla.suse.com/958007"},{"type":"REPORT","url":"https://bugzilla.suse.com/958009"},{"type":"REPORT","url":"https://bugzilla.suse.com/958491"},{"type":"REPORT","url":"https://bugzilla.suse.com/958523"},{"type":"REPORT","url":"https://bugzilla.suse.com/958917"},{"type":"REPORT","url":"https://bugzilla.suse.com/959005"},{"type":"REPORT","url":"https://bugzilla.suse.com/959387"},{"type":"REPORT","url":"https://bugzilla.suse.com/959695"},{"type":"REPORT","url":"https://bugzilla.suse.com/959928"},{"type":"REPORT","url":"https://bugzilla.suse.com/960334"},{"type":"REPORT","url":"https://bugzilla.suse.com/960707"},{"type":"REPORT","url":"https://bugzilla.suse.com/960725"},{"type":"REPORT","url":"https://bugzilla.suse.com/960835"},{"type":"REPORT","url":"https://bugzilla.suse.com/960861"},{"type":"REPORT","url":"https://bugzilla.suse.com/960862"},{"type":"REPORT","url":"https://bugzilla.suse.com/961332"},{"type":"REPORT","url":"https://bugzilla.suse.com/961358"},{"type":"REPORT","url":"https://bugzilla.suse.com/961691"},{"type":"REPORT","url":"https://bugzilla.suse.com/962320"},{"type":"REPORT","url":"https://bugzilla.suse.com/963782"},{"type":"REPORT","url":"https://bugzilla.suse.com/963923"},{"type":"REPORT","url":"https://bugzilla.suse.com/964413"},{"type":"REPORT","url":"https://bugzilla.suse.com/965315"},{"type":"REPORT","url":"https://bugzilla.suse.com/965317"},{"type":"REPORT","url":"https://bugzilla.suse.com/967012"},{"type":"REPORT","url":"https://bugzilla.suse.com/967013"},{"type":"REPORT","url":"https://bugzilla.suse.com/967630"},{"type":"REPORT","url":"https://bugzilla.suse.com/967969"},{"type":"REPORT","url":"https://bugzilla.suse.com/969121"},{"type":"REPORT","url":"https://bugzilla.suse.com/969122"},{"type":"REPORT","url":"https://bugzilla.suse.com/969350"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2013-4527"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2013-4529"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2013-4530"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2013-4533"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2013-4534"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2013-4537"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2013-4538"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2013-4539"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2014-0222"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2014-3640"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2014-3689"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2014-7815"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2014-9718"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2015-1779"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2015-5278"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2015-6855"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2015-7512"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2015-7549"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2015-8345"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2015-8504"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2015-8550"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2015-8554"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2015-8555"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2015-8558"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2015-8567"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2015-8568"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2015-8613"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2015-8619"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2015-8743"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2015-8744"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2015-8745"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2015-8817"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2015-8818"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2016-1568"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2016-1570"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2016-1571"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2016-1714"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2016-1922"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2016-1981"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2016-2198"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2016-2270"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2016-2271"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2016-2391"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2016-2392"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2016-2538"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2016-2841"}],"related":["CVE-2013-4527","CVE-2013-4529","CVE-2013-4530","CVE-2013-4533","CVE-2013-4534","CVE-2013-4537","CVE-2013-4538","CVE-2013-4539","CVE-2014-0222","CVE-2014-3640","CVE-2014-3689","CVE-2014-7815","CVE-2014-9718","CVE-2015-1779","CVE-2015-5278","CVE-2015-6855","CVE-2015-7512","CVE-2015-7549","CVE-2015-8345","CVE-2015-8504","CVE-2015-8550","CVE-2015-8554","CVE-2015-8555","CVE-2015-8558","CVE-2015-8567","CVE-2015-8568","CVE-2015-8613","CVE-2015-8619","CVE-2015-8743","CVE-2015-8744","CVE-2015-8745","CVE-2015-8817","CVE-2015-8818","CVE-2016-1568","CVE-2016-1570","CVE-2016-1571","CVE-2016-1714","CVE-2016-1922","CVE-2016-1981","CVE-2016-2198","CVE-2016-2270","CVE-2016-2271","CVE-2016-2391","CVE-2016-2392","CVE-2016-2538","CVE-2016-2841"],"summary":"Security update for xen","upstream":["CVE-2013-4527","CVE-2013-4529","CVE-2013-4530","CVE-2013-4533","CVE-2013-4534","CVE-2013-4537","CVE-2013-4538","CVE-2013-4539","CVE-2014-0222","CVE-2014-3640","CVE-2014-3689","CVE-2014-7815","CVE-2014-9718","CVE-2015-1779","CVE-2015-5278","CVE-2015-6855","CVE-2015-7512","CVE-2015-7549","CVE-2015-8345","CVE-2015-8504","CVE-2015-8550","CVE-2015-8554","CVE-2015-8555","CVE-2015-8558","CVE-2015-8567","CVE-2015-8568","CVE-2015-8613","CVE-2015-8619","CVE-2015-8743","CVE-2015-8744","CVE-2015-8745","CVE-2015-8817","CVE-2015-8818","CVE-2016-1568","CVE-2016-1570","CVE-2016-1571","CVE-2016-1714","CVE-2016-1922","CVE-2016-1981","CVE-2016-2198","CVE-2016-2270","CVE-2016-2271","CVE-2016-2391","CVE-2016-2392","CVE-2016-2538","CVE-2016-2841"]}