Revision as of 04:14, 13 December 2011

The following security advisories have been made in accordance with the xen.org security problem response process.

Please contact security@xen.org if you wish to disclose a security vulnerability.

XSA-1 Host crash due to failure to correctly validate PV kernel execution state.

Date: 14 March 2011
References: CVE-2011-1166
Advisory: Cannot specify user mode execution without specifying user-mode pagetables. Failure to validate this allows a malicious or buggy 64 bit PV guest to crash the host.; nb: predates vulnerability handling process and therefore no formal announcement
Fixes: xen-unstable.hg: 23034:c79aae866ad8; xen-4.1-testing.hg: 22993:842aed720b84; xen-4.0-testing.hg: 21461:ee088a0b5cb8

Date: 9 May 2011
References: CVE-2011-1583
Advisory: http://lists.xen.org/archives/html/xen-devel/2011-05/msg00483.html
Fixes: xen-unstable.hg: 23322:d9982136d8fa; xen-4.1-testing.hg: 23042:e2e575f8b5d9; xen-4.0-testing.hg: 21482:c2adc059e931

Date: 12 May 2011
References: CVE-2011-1898
Advisory: http://lists.xen.org/archives/html/xen-devel/2011-05/msg00687.html
Fixes: xen-unstable.hg: 23337:cc91832a02c7; xen-4.1-testing.hg: 23046:ed630a821de1; xen-4.0-testing.hg: 21485:b85a9e58ec3a

Date: 2 September 2011
References: CVE-2011-2901
Advisory: http://lists.xen.org/archives/html/xen-devel/2011-09/msg00119.html
Fixes: xen-unstable.hg: 23800:72edc40e2942; nb: although the off-by-one error was fixed in the above changeset only Xen version 3.3 and earlier were vulnerable due to this error.

Date: 12 August 2011
References: CVE-2011-3131
Advisory: http://lists.xen.org/archives/html/xen-devel/2011-08/msg00450.html
Fixes: xen-unstable.hg: 23762:537ed3b74b3f; xen-4.1-testing.hg: 23112:84e3706df07a; xen-4.0-testing.hg: 21535:789ff1a462b8

Revision as of 17:29, 12 December 2011 (view source) Ijc (talk \| contribs) mNo edit summary ← Older edit		Revision as of 04:14, 13 December 2011 (view source) GarveyPatrickD (talk \| contribs) m (Changed Mailing List Archive link to xen.org project page link) Newer edit →
Line 1:		Line 1:
	The following security advisories have been made in accordance with the [http://~~lists~~.xen.org/~~archives~~/~~html/xen-devel/2011-12/msg00988~~.html xen.org security problem response process].		The following security advisories have been made in accordance with the [http://www.xen.org/projects/security_vulnerability_process.html xen.org security problem response process].

	Please contact [mailto:security@xen.org security@xen.org] if you wish to disclose a security vulnerability.		Please contact [mailto:security@xen.org security@xen.org] if you wish to disclose a security vulnerability.