Revision as of 07:57, 13 June 2013

The following security advisories have been made in accordance with the xen.org security problem response process.

Please contact security@xen.org if you wish to disclose a security vulnerability.

See Xen Maintenance Releases for information relating to stable branch maintenance.

XSA-1 Host crash due to failure to correctly validate PV kernel execution state.

Date: 14 March 2011
References: CVE-2011-1166
Advisory: Cannot specify user mode execution without specifying user-mode pagetables. Failure to validate this allows a malicious or buggy 64 bit PV guest to crash the host.; nb: predates vulnerability handling process and therefore no formal announcement
Fixes: xen-unstable.hg: 23034:c79aae866ad8; xen-4.1-testing.hg: 22993:842aed720b84; xen-4.0-testing.hg: 21461:ee088a0b5cb8

XSA-2 PV kernel validation vulnerabilities

Date: 9 May 2011
References: CVE-2011-1583
Advisory: http://lists.xen.org/archives/html/xen-devel/2011-05/msg00483.html
Fixes: xen-unstable.hg: 23322:d9982136d8fa; xen-4.1-testing.hg: 23042:e2e575f8b5d9; xen-4.0-testing.hg: 21482:c2adc059e931

XSA-3 VT-d (PCI passthrough) MSI

Date: 12 May 2011
References: CVE-2011-1898
Advisory: http://lists.xen.org/archives/html/xen-devel/2011-05/msg00687.html
Fixes: xen-unstable.hg: 23337:cc91832a02c7; xen-4.1-testing.hg: 23046:ed630a821de1; xen-4.0-testing.hg: 21485:b85a9e58ec3a

XSA-4 Xen 3.3 vaddr validation

Date: 2 September 2011
References: CVE-2011-2901
Advisory: http://lists.xen.org/archives/html/xen-devel/2011-09/msg00119.html
Fixes: xen-unstable.hg: 23800:72edc40e2942; nb: although the off-by-one error was fixed in the above changeset only Xen version 3.3 and earlier were vulnerable due to this error.

XSA-5 IOMMU Fault Live lock

Date: 12 August 2011
References: CVE-2011-3131
Advisory: http://lists.xen.org/archives/html/xen-devel/2011-08/msg00450.html
Fixes: xen-unstable.hg: 23762:537ed3b74b3f; xen-4.1-testing.hg: 23112:84e3706df07a; xen-4.0-testing.hg: 21535:789ff1a462b8

XSA-6 HVM e1000, buffer overflow

Date: 2 February 2012
References: CVE-2012-0029
Advisory: http://lists.xen.org/archives/html/xen-devel/2012-02/msg00212.html
Fixes: qemu-xen-unstable.git: ebe37b2a3f844bad02dcc30d081f39eda06118f8; qemu-xen-4.1-testing.git: 3cf61880403b4e484539596a95937cc066243388; qemu-xen-4.0-testing.git: 36984c285a765541b04f378bfa84d2c850c167d3

In each case the QEMU_TAG in the corresponding xen.hg repository has been updated so that a completely fresh build will pick up the fix:

xen-unstable.hg: 24673:fcc071c31e3a

xen-4.1-testing.hg: 23224:cccd6c68e1b9

xen-4.0-testing.hg: 21563:3feb83eed6bd

XSA-7 64-bit PV guest privilege escalation vulnerability

Date: 12 June 2012 (public disclosure)
References: CVE-2012-0217
Advisory: http://lists.xen.org/archives/html/xen-announce/2012-06/msg00001.html
Fixes: xen-unstable.hg: 25480:76eaf5966c05; xen-4.1-testing.hg: 23299:f08e61b9b33f; xen-4.0-testing.hg: 21590:dd367837e089

XSA-8 guest denial of service on syscall/sysenter exception generation

Date: 12 June 2012 (public disclosure)
References: CVE-2012-0218
Advisory: http://lists.xen.org/archives/html/xen-announce/2012-06/msg00003.html
Fixes: xen-unstable.hg: 25200:80f4113be500 & 25204:569d6f05e1ef; xen-4.1-testing.hg: 23300:0fec1afa4638; xen-4.0-testing.hg: 21591:adb943a387c8

XSA-9 PV guest host Denial of Service (AMD erratum #121)

Date: 12 June 2012 (public disclosure)
References: CVE-2012-2934
Advisory: http://lists.xen.org/archives/html/xen-announce/2012-06/msg00002.html
Fixes: xen-unstable.hg: 25481:bc2f3a848f9a; xen-4.1-testing.hg: 23301:a9c0a89c08f2; xen-4.0-testing.hg: 21592:e35c8bb53255

XSA-10 HVM guest user mode MMIO emulation DoS vulnerability

Date: 26 July 2012 (public disclosure)
References: CVE-2012-3432
Advisory: http://lists.xen.org/archives/html/xen-devel/2012-07/msg01649.html
Fixes: xen-unstable.hg: 25682:ffcb24876b4f; xen-4.1-testing.hg: 23325:a43f5b4b0331; xen-4.0-testing.hg: 21604:82fcf3a5dc3a

XSA-11 HVM guest destroy p2m teardown host DoS vulnerability

Date: 8 August 2012 (public disclosure)
References: CVE-2012-3433
Advisory: http://lists.xen.org/archives/html/xen-devel/2012-08/msg00855.html
Fixes: xen-unstable.hg: Not vulnerable; xen-4.1-testing.hg: 23332:859205b36fe9; xen-4.0-testing.hg: 21608:a51c86b407d7

XSA-12 hypercall set_debugreg vulnerability

Date: 5 September 2012 (public disclosure)
References: CVE-2012-3494
Advisory: http://lists.xen.org/archives/html/xen-announce/2012-09/msg00000.html
Fixes: xen-unstable.hg: 25814:4f1c69648201; xen-4.1-testing.hg: 23349:bcc340292731; xen-4.0-testing.hg: 21613:92334c7f577e

XSA-13 hypercall physdev_get_free_pirq vulnerability

Date: 5 September 2012 (public disclosure)
References: CVE-2012-3495
Advisory: http://lists.xen.org/archives/html/xen-announce/2012-09/msg00001.html
Fixes: xen-unstable.hg: Not vulnerable; xen-4.1-testing.hg: 23350:6779ddca8593

XSA-14 XENMEM_populate_physmap DoS vulnerability

Date: 5 September 2012 (public disclosure)
References: CVE-2012-3496
Advisory: http://lists.xen.org/archives/html/xen-announce/2012-09/msg00002.html
Fixes: xen-unstable.hg: 25815:bcf58ef63b7c; xen-4.1-testing.hg: 23351:8ebda5388e4e; xen-4.0-testing.hg: 21614:96b08706a0ed

XSA-15 multiple TMEM hypercall vulnerabilities

Date: 5 September 2012 (public disclosure)
References: CVE-2012-3497
Advisory: http://lists.xen.org/archives/html/xen-announce/2012-09/msg00006.html
Fixes: None at this time. See advisory for details.

XSA-16 PHYSDEVOP_map_pirq index vulnerability

Date: 5 September 2012 (public disclosure)
References: CVE-2012-3498
Advisory: http://lists.xen.org/archives/html/xen-announce/2012-09/msg00005.html
Fixes: xen-unstable.hg: 25816:2750340a347d; xen-4.1-testing.hg: 23352:936f63ee4dad

XSA-17 Qemu VT100 emulation vulnerability

Date: 5 September 2012 (public disclosure)
References: CVE-2012-3515
Advisory: http://lists.xen.org/archives/html/xen-announce/2012-09/msg00003.html
Fixes: qemu-upstream-unstable.git: 87650d262dea07c955a683dcac75db86477c7ee3 (qemu-xen tree); qemu-xen-unstable.git: a56ae4b5069c7b23ee657b15f08443a9b14a8e7b (qemu-xen-traditional tree); qemu-xen-4.1-testing.git: 3220480734832a148d26f7a81f90af61c2ecfdd9 (qemu-xen-traditional tree); qemu-xen-4.0-testing.git: 091149d364e893e643a5da3175c3f84d2163cb3e (qemu-xen-traditional tree)

In each case the QEMU_TAG in the corresponding xen.hg repository has been updated so that a completely fresh build will pick up the fix to qemu-xen-traditional:

xen-unstable.hg: 25818:50adc933faaf

xen-4.1-testing.hg: 23353:3e4782f17f5c

xen-4.0-testing.hg: 21615:79444af3258c

XSA-18 grant table entry swaps have inadequate bounds checking

Date: 5 September 2012 (public disclosure)
References: CVE-2012-3516
Advisory: http://lists.xen.org/archives/html/xen-announce/2012-09/msg00004.html
Fixes: xen-unstable.hg: 25817:93e5a791d076

XSA-19 guest administrator can access qemu monitor console

Date: 6 September 2012 (public disclosure)
References: CVE-2012-4411
Advisory: http://lists.xen.org/archives/html/xen-announce/2012-09/msg00007.html
Fixes: qemu-upstream-unstable.git: Not vulnerable; qemu-xen-unstable.git: bacc0d302445c75f18f4c826750fb5853b60e7ca; qemu-xen-4.1-testing.git: d7d453f51459b591faa96d1c123b5bfff7c5b6b6; qemu-xen-4.0-testing.git: eaa1bd612f50d2f253738ed19e14981e4ede98a5

In each case the QEMU_TAG in the corresponding xen.hg repository has been updated so that a completely fresh build will pick up the fix:

xen-unstable.hg: 25822:ec23c2a11f6f

xen-4.1-testing.hg: 23354:9be1175d2ac3

xen-4.0-testing.hg: 21616:512168f88df9 & 21617:1d1538beeada

XSA 20 Timer overflow DoS vulnerability

Date: 13 November 2012
References: CVE-2012-4535
Advisory: http://lists.xen.org/archives/html/xen-announce/2012-11/msg00001.html
Fixes: xen-unstable.hg: 26148:bf58b94b3cef; xen-4.2-testing.hg: 25919:788af5959f69; xen-4.1-testing.hg: 23406:701f5e3321c1; xen-4.0-testing.hg: 21618:6b9809dc1e86

XSA 21 pirq range check DoS vulnerability

Date: 13 November 2012
References: CVE-2012-4536
Advisory: http://lists.xen.org/archives/html/xen-announce/2012-11/msg00003.html
Fixes: xen-unstable.hg: Not vulnerable; xen-4.2-testing.hg: Not vulnerable; xen-4.1-testing.hg: 23407:210f16b6509b

XSA 22 Memory mapping failure DoS vulnerability

Date: 13 November 2012
References: CVE-2012-4537
Advisory: http://lists.xen.org/archives/html/xen-announce/2012-11/msg00005.html
Fixes: xen-unstable.hg: 26149:6b6a4007a609; xen-4.2-testing.hg: 25920:4cffe28427e0; xen-4.1-testing.hg: 23408:f635b1447d7e; xen-4.0-testing.hg: 21619:04462a8c7966; xen-3.4-testing.hg: 20028:b42c35f6369a

XSA 23 Unhooking empty PAE entries DoS vulnerability

Date: 13 November 2012
References: CVE-2012-4538
Advisory: http://lists.xen.org/archives/html/xen-announce/2012-11/msg00004.html
Fixes: xen-unstable.hg: 26150:c7a01b6450e4; xen-4.2-testing.hg: 25921:159080b58dda; xen-4.1-testing.hg: 23409:61eb3d030f52; xen-4.0-testing.hg: 21620:c52d74b254dc

XSA 24 Grant table hypercall infinite loop DoS vulnerability

Date: 13 November 2012
References: CVE-2012-4539
Advisory: http://lists.xen.org/archives/html/xen-announce/2012-11/msg00002.html
Fixes: xen-unstable.hg: 26151:b64a7d868f06; xen-4.2-testing.hg: 25922:8ca6372315f8; xen-4.1-testing.hg: 23410:178f63286b02; xen-4.0-testing.hg: 21621:68d7b9cc8259

XSA 25 Xen domain builder Out-of-memory due to malicious kernel/ramdisk

Date: 13 November 2012
References: CVE-2012-4544,CVE-2012-2625
Advisory: http://lists.xen.org/archives/html/xen-announce/2012-11/msg00006.html
Fixes: xen-unstable.hg: 25589:60f09d1ab1fe 26115:37a8946eeb9d; xen-4.2-testing.hg: 25589:60f09d1ab1fe 25883:537776f51f79; xen-4.1-testing.hg: 23385:69d1cc78a5bd

XSA 26 Grant table version switch list corruption vulnerability

Date: 3 December 2012 (public disclosure)
References: CVE-2012-5510
Advisory: http://lists.xen.org/archives/html/xen-announce/2012-12/msg00000.html
Fixes: xen-unstable.hg: 26229:90a697f3e78c; xen-4.2-testing.hg: 25933:dea7d4e5bfc1; xen-4.1-testing.hg: 23416:7172203aec98

XSA 27 several HVM operations do not validate the range of their inputs

Date: 3 December 2012 (public disclosure)
References: CVE-2012-5511
Advisory: http://lists.xen.org/archives/html/xen-announce/2012-12/msg00006.html
Fixes: xen-unstable.hg: 26230:96fed5bcd097; xen-4.2-testing.hg: 25934:5771c761ff1b; xen-4.1-testing.hg: 23417:53ef1f35a0f8

XSA 28 HVMOP_get_mem_access crash / HVMOP_set_mem_access information leak

Date: 3 December 2012 (public disclosure)
References: CVE-2012-5512
Advisory: http://lists.xen.org/archives/html/xen-announce/2012-12/msg00003.html
Fixes: xen-unstable.hg: Not vulnerable; xen-4.2-testing.hg: Not vulnerable; xen-4.1-testing.hg: 23418:e7c8ffa11596

XSA 29 XENMEM_exchange may overwrite hypervisor memory

Date: 3 December 2012 (public disclosure)
References: CVE-2012-5513
Advisory: http://lists.xen.org/archives/html/xen-announce/2012-12/msg00004.html
Fixes: xen-unstable.hg: 26231:b406e395995f; xen-4.2-testing.hg: 25935:83ab3cd0f8e4; xen-4.1-testing.hg: 23419:f81286b3be32

XSA 30 Broken error handling in guest_physmap_mark_populate_on_demand()

Date: 3 December 2012 (public disclosure)
References: CVE-2012-5514
Advisory: http://lists.xen.org/archives/html/xen-announce/2012-12/msg00005.html
Fixes: xen-unstable.hg: 26232:ddf4ead1afda; xen-4.2-testing.hg: 25936:09a48c5da636; xen-4.1-testing.hg: 23420:cadc212c8ef3

XSA 31 Several memory hypercall operations allow invalid extent order values

Date: 3 December 2012 (public disclosure)
References: CVE-2012-5515
Advisory: http://lists.xen.org/archives/html/xen-announce/2012-12/msg00001.html
Fixes: xen-unstable.hg: 26233:f2c836302c0f; xen-4.2-testing.hg: 25937:2c3f00c5189b; xen-4.1-testing.hg: 23421:a8a9e1c126ea

XSA 32 several hypercalls do not validate input GFNs

Date: 3 December 2012 (public disclosure)
References: CVE-2012-5525
Advisory: http://lists.xen.org/archives/html/xen-announce/2012-12/msg00002.html
Fixes: xen-unstable.hg: 26234:bc624b00d6d6; xen-4.2-testing.hg: 25938:b306bce61341; xen-4.1-testing.hg: Not vulnerable

XSA 33 VT-d interrupt remapping source validation flaw

Date: 9 January 2013 (public release)
References: CVE-2012-5634
Advisory: http://lists.xen.org/archives/html/xen-announce/2013-01/msg00001.html
Fixes: xen-unstable.hg: 26340:19fd1237ff0d; xen-4.2-testing.hg: 25967:2fff08507add; xen-4.1-testing.hg: 23441:2a91623a5807

XSA 34 nested virtualization on 32-bit exposes host crash

Date: 22 January 2013 (public release)
References: CVE-2013-0151
Advisory: http://lists.xen.org/archives/html/xen-announce/2013-01/msg00008.html
Fixes: xen-unstable.hg: Not vulnerable; xen-4.2-testing.hg: 25972:fef7ef92f08e

XSA 35 Nested HVM exposes host to being driven out of memory by guest

Date: 22 January 2013 (public release)
References: CVE-2013-0152
Advisory: http://lists.xen.org/archives/html/xen-announce/2013-01/msg00009.html
Fixes: xen-unstable.hg: 26444:621b1a889e9b; xen-4.2-testing.hg: 25973:7c04074a0a0f

XSA 36 interrupt remap entries shared and old ones not cleared on AMD IOMMUs

Date: 5 February 2013
References: CVE-2013-0153
Advisory: http://lists.xen.org/archives/html/xen-announce/2013-02/msg00006.html
Fixes: xen-unstable.hg: 26516:32d4516a97f0 26517:601139e2b0db 26518:e379a23b0465 26519:1af531e7bc2f 26531:e68f14b9e739; xen-4.2-testing.hg: 25974:f3725a1da193 25975:7b294324e98e 25976:43308c02c07d 25977:b8a523d9f14c 25977:b8a523d9f14c 25990:6a03b38b9cd6; xen-4.1-testing.hg: 23448:dd6694df1a31 23449:cac6ae5e5dc6 23450:5c0fe82d6060 23451:e5ed73d172eb 23458:4d522221fa77

XSA 37 Hypervisor crash due to incorrect ASSERT (debug build only)

Date: 4 January 2013
References: CVE-2013-0154
Advisory: http://lists.xen.org/archives/html/xen-announce/2013-01/msg00000.html
Fixes: xen-unstable.hg: 26333:e1facbde56ff; xen-4.2-testing.hg: 25960:7dad27b2bcc7; xen-4.1-testing.hg: Not vulnerable

XSA 38 oxenstored incorrect handling of certain Xenbus ring states

Date: 5 February 2013
References: CVE-2013-0215
Advisory: http://lists.xen.org/archives/html/xen-announce/2013-02/msg00005.html
Fixes: xen-unstable.hg: 26521:2c0fd406f02c 26522:ffd30e7388ad 26539:759574df84a6; xen-4.2-testing.hg: 25979:c713f1f7d3c1 25978:b150d8787a05 25989:b40c7b690275; xen-4.1-testing.hg: 23452:47c7b8531923 23453:130446135528 23457:8792a805cc9a

XSA 39 Linux netback DoS via malicious guest ring.

Date: 5 February 2013
References: CVE-2013-0216; CVE-2013-0217
Advisory: http://lists.xen.org/archives/html/xen-announce/2013-02/msg00001.html
Fixes: linux: 48856286b64e4b66ec62b94e504d0b29c1ade664 7d5145d8eb2b9791533ffe4dc003b129b9696c48 4cc7c1cb7b11b6f3515bd9075527576a1eecc4aa b9149729ebdcfce63f853aa54a404c6a8f6ebbf3

XSA 40 Linux stack corruption in xen_failsafe_callback for 32bit PVOPS guests.

Date: 16 January 2013
References: CVE-2013-0190
Advisory: http://lists.xen.org/archives/html/xen-announce/2013-01/msg00002.html
Fixes: linux: 9174adbee4a9a49d0139f5d71969852b36720809

XSA 41 qemu (e1000 device driver): Buffer overflow when processing large packets

Date: 16 January 2013
References: CVE-2012-6075
Advisory: http://lists.xen.org/archives/html/xen-announce/2013-01/msg00006.html
Fixes: qemu: b0d9ffcd0251161c7c92f94804dcf599dfa3edeb 2c0331f4f7d241995452b99afaf0aab00493334a

XSA 42 Linux kernel hits general protection if %ds is corrupt for 32-bit PVOPS.

Date: 13 February 2013
References: CVE-2013-0228
Advisory: http://lists.xen.org/archives/html/xen-announce/2013-02/msg00004.html
Fixes: linux: 13d2b4d11d69a92574a55bfd985cfb0ca77aebdc

XSA 43 Linux pciback DoS via not rate limited log messages.

Date: 5 February 2013
References: CVE-2013-0231
Advisory: http://lists.xen.org/archives/html/xen-announce/2013-02/msg00003.html
Fixes: linux: 51ac8893a7a51b196501164e645583bf78138699

XSA 44 Xen PV DoS vulnerability with SYSENTER

Date: 18 April 2013
References: CVE-2013-1917
Advisory: http://lists.xen.org/archives/html/xen-announce/2013-04/msg00005.html
Fixes: xen unstable: fdac9515607b757c044e7ef0d61b1453ef999b08; xen 4.2: 68a30a91bad2d4ff1f7c0d4302ec1060d573f6da; xen 4.1: 584eb7c15e4c94baaba93468776572dd7373a33c

XSA 45 Several long latency operations are not preemptible

Date: 2 May 2013
References: CVE-2013-1918
Advisory: http://lists.xen.org/archives/html/xen-announce/2013-05/msg00000.html
Fixes: xen unstable: 6cdc9be e2e6b7b 918a5f1 4939f9a 99d2b14 a3e049f b8efae6 f2ddd52; xen 4.2: f8bdc88 a8f6949 f1d1abc f26f9b2 dba35fa 3e5c1c0 a4b2683; xen 4.1: 7a93b9a 06a68a0 210e61b c6fad96 02615aa 09f9f72 8eb2e89

XSA 46 Several access permission issues with IRQs for unprivileged guests

Date: 18 April 2013
References: CVE-2013-1919
Advisory: http://lists.xen.org/archives/html/xen-announce/2013-04/msg00003.html
Fixes: xen unstable: 545607e; xen 4.2: e414c40; xen 4.1: d3d1288

XSA 47 Potential use of freed memory in event channel operations

Date: 4 April 2013
References: CVE-2013-1920
Advisory: http://lists.xen.org/archives/html/xen-announce/2013-04/msg00000.html
Fixes: xen unstable: 99b9ab0; xen 4.2: 2bebeac; xen 4.1: b10b4af

XSA 48 qemu-nbd format-guessing due to missing format specification

Date: 15 April 2013
References: CVE-2013-1922
Advisory: http://lists.xen.org/archives/html/xen-announce/2013-04/msg00001.html
Fixes: qemu: e6b636779b51c97e67694be740ee972c52460c59

XSA 49 VT-d interrupt remapping source validation flaw for bridges

Date: 2 May 2013
References: CVE-2013-1952
Advisory: http://lists.xen.org/archives/html/xen-announce/2013-05/msg00001.html
Fixes: xen unstable: 63cec00; xen 4.2: 5f34d2f; xen 4.1: 4c45d2d

XSA 50 grant table hypercall acquire/release imbalance

Date: 18 April 2013
References: CVE-2013-1964
Advisory: http://lists.xen.org/archives/html/xen-announce/2013-04/msg00006.html
Fixes: xen 4.1: a12ed39

XSA 51 qemu guest agent (qga) insecure file permissions

Date: 6 May 2013
References: CVE-2013-2007
Advisory: http://lists.xen.org/archives/html/xen-announce/2013-05/msg00002.html
Fixes: qemu: c689b4f1bac352dcfd6ecb9a1d45337de0f1de67

XSA 52 Information leak on XSAVE/XRSTOR capable AMD CPUs

Date: 3 June 2013
References: CVE-2013-2076
Advisory: http://lists.xen.org/archives/html/xen-announce/2013-06/msg00002.html
Fixes: xen unstable: 8dcf9f0113454f233089e8e5bb3970d891928410; xen 4.2: 16b0db2eeef6491fee4277b030c84678b1579863; xen 4.1: c3401c1aece47dc5388184c9b6a3527655d5bbdf

XSA 53 Hypervisor crash due to missing exception recovery on XRSTOR

Date: 3 June 2013
References: CVE-2013-2077
Advisory: http://lists.xen.org/archives/html/xen-announce/2013-06/msg00002.html
Fixes: xen unstable: c6ae65db36b98f2866f74a9a7ae6ac5d51fedc67; xen 4.2: 93113dbc332b7befc334a1496bf6b6a325264d51; xen 4.1: 5849504a03725f553195c8d80b0d595ef8334e2a

XSA 54 Hypervisor crash due to missing exception recovery on XSETBV

Date: 3 June 2013
References: CVE-2013-2078
Advisory: http://lists.xen.org/archives/html/xen-announce/2013-06/msg00000.html
Fixes: xen unstable: 365c95f7de789e1dca03f119eab7dc61fe0f77c9; xen 4.2: 9c28f338208bdc3f8f03934f58aabf2724c42cdb; xen 4.1: 13e00caf1a01a4eb99f2269be6ce12a3a4703178

XSA 55 Multiple vulnerabilities in libelf PV kernel handling

Date: 7 June 2013
References
Advisory: http://lists.xen.org/archives/html/xen-announce/2013-06/msg00003.html
Fixes: Work is ongoing to resolve this issue. See http://lists.xen.org/archives/html/xen-devel/

XSA 56 Buffer overflow in xencontrol Python bindings affecting xend

Date: 17 May 2013
References: CVE-2013-2072
Advisory: http://lists.xen.org/archives/html/xen-announce/2013-05/msg00004.html
Fixes: xen unstable: 41abbadef60e5fccdfd688579dd458f7f7887cf5; xen 4.2: 34e2c78baa7eff6369595adc7e51e70a4a0c8727; xen 4.1: 8dd9cde5d454e4cee55d0202abfd52ceeff1cd94

@@ Line 622: / Line 622: @@
 ; Fixes
 : qemu: [http://git.qemu.org/?p=qemu.git;a=commit;h=c689b4f1bac352dcfd6ecb9a1d45337de0f1de67 c689b4f1bac352dcfd6ecb9a1d45337de0f1de67]
+= XSA 52 Information leak on XSAVE/XRSTOR capable AMD CPUs =
+; Date
+: 3 June 2013
+; References
+: [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2076 CVE-2013-2076]
+; Advisory
+: http://lists.xen.org/archives/html/xen-announce/2013-06/msg00002.html
+; Fixes
+: xen unstable: [http://xenbits.xen.org/gitweb/?p=xen.git;a=commit;h=8dcf9f0113454f233089e8e5bb3970d891928410 8dcf9f0113454f233089e8e5bb3970d891928410]
+: xen 4.2: [http://xenbits.xen.org/gitweb/?p=xen.git;a=commit;h=16b0db2eeef6491fee4277b030c84678b1579863 16b0db2eeef6491fee4277b030c84678b1579863]
+: xen 4.1: [http://xenbits.xen.org/gitweb/?p=xen.git;a=commit;h=c3401c1aece47dc5388184c9b6a3527655d5bbdf c3401c1aece47dc5388184c9b6a3527655d5bbdf]
+= XSA 53 Hypervisor crash due to missing exception recovery on XRSTOR =
+; Date
+: 3 June 2013
+; References
+: [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2077 CVE-2013-2077]
+; Advisory
+: http://lists.xen.org/archives/html/xen-announce/2013-06/msg00002.html
+; Fixes
+: xen unstable: [http://xenbits.xen.org/gitweb/?p=xen.git;a=commit;h=c6ae65db36b98f2866f74a9a7ae6ac5d51fedc67 c6ae65db36b98f2866f74a9a7ae6ac5d51fedc67]
+: xen 4.2: [http://xenbits.xen.org/gitweb/?p=xen.git;a=commit;h=93113dbc332b7befc334a1496bf6b6a325264d51 93113dbc332b7befc334a1496bf6b6a325264d51]
+: xen 4.1: [http://xenbits.xen.org/gitweb/?p=xen.git;a=commit;h=5849504a03725f553195c8d80b0d595ef8334e2a 5849504a03725f553195c8d80b0d595ef8334e2a]
+= XSA 54 Hypervisor crash due to missing exception recovery on XSETBV =
+; Date
+: 3 June 2013
+; References
+: [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2078 CVE-2013-2078]
+; Advisory
+: http://lists.xen.org/archives/html/xen-announce/2013-06/msg00000.html
+; Fixes
+: xen unstable: [http://xenbits.xen.org/gitweb/?p=xen.git;a=commit;h=365c95f7de789e1dca03f119eab7dc61fe0f77c9 365c95f7de789e1dca03f119eab7dc61fe0f77c9]
+: xen 4.2: [http://xenbits.xen.org/gitweb/?p=xen.git;a=commit;h=9c28f338208bdc3f8f03934f58aabf2724c42cdb 9c28f338208bdc3f8f03934f58aabf2724c42cdb]
+: xen 4.1: [http://xenbits.xen.org/gitweb/?p=xen.git;a=commit;h=13e00caf1a01a4eb99f2269be6ce12a3a4703178 13e00caf1a01a4eb99f2269be6ce12a3a4703178]
+= XSA 55 Multiple vulnerabilities in libelf PV kernel handling =
+; Date
+: 7 June 2013
+; References
+; Advisory
+: http://lists.xen.org/archives/html/xen-announce/2013-06/msg00003.html
+; Fixes
+: Work is ongoing to resolve this issue. See http://lists.xen.org/archives/html/xen-devel/
+= XSA 56 Buffer overflow in xencontrol Python bindings affecting xend =
+; Date
+: 17 May 2013
+; References
+: [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2072 CVE-2013-2072]
+; Advisory
+: http://lists.xen.org/archives/html/xen-announce/2013-05/msg00004.html
+; Fixes
+: xen unstable: [http://xenbits.xen.org/gitweb/?p=xen.git;a=commit;h=41abbadef60e5fccdfd688579dd458f7f7887cf5 41abbadef60e5fccdfd688579dd458f7f7887cf5]
+: xen 4.2: [http://xenbits.xen.org/gitweb/?p=xen.git;a=commit;h=34e2c78baa7eff6369595adc7e51e70a4a0c8727 34e2c78baa7eff6369595adc7e51e70a4a0c8727]
+: xen 4.1: [http://xenbits.xen.org/gitweb/?p=xen.git;a=commit;h=8dd9cde5d454e4cee55d0202abfd52ceeff1cd94 8dd9cde5d454e4cee55d0202abfd52ceeff1cd94]
 <!-- Template:

Security Announcements (Historical): Difference between revisions