Test ID:	1.3.6.1.4.1.25623.1.0.703663
Category:	Debian Local Security Checks
Title:	Debian: Security Advisory (DSA-3663-1)
Summary:	The remote host is missing an update for the Debian 'xen' package(s) announced via the DSA-3663-1 advisory.
Description:	Summary: The remote host is missing an update for the Debian 'xen' package(s) announced via the DSA-3663-1 advisory. Vulnerability Insight: Multiple vulnerabilities have been discovered in the Xen hypervisor. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2016-7092 (XSA-185) Jeremie Boutoille of Quarkslab and Shangcong Luan of Alibaba discovered a flaw in the handling of L3 pagetable entries, allowing a malicious 32-bit PV guest administrator can escalate their privilege to that of the host. CVE-2016-7094 (XSA-187) x86 HVM guests running with shadow paging use a subset of the x86 emulator to handle the guest writing to its own pagetables. Andrew Cooper of Citrix discovered that there are situations a guest can provoke which result in exceeding the space allocated for internal state. A malicious HVM guest administrator can cause Xen to fail a bug check, causing a denial of service to the host. CVE-2016-7154 (XSA-188) Mikhail Gorobets of Advanced Threat Research, Intel Security discovered a use after free flaw in the FIFO event channel code. A malicious guest administrator can crash the host, leading to a denial of service. Arbitrary code execution (and therefore privilege escalation), and information leaks, cannot be excluded. For the stable distribution (jessie), these problems have been fixed in version 4.4.1-9+deb8u7. We recommend that you upgrade your xen packages. Affected Software/OS: 'xen' package(s) on Debian 8. Solution: Please install the updated package(s). CVSS Score: 7.2 CVSS Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2016-7092 BugTraq ID: 92862 http://www.securityfocus.com/bid/92862 Debian Security Information: DSA-3663 (Google Search) http://www.debian.org/security/2016/dsa-3663 https://security.gentoo.org/glsa/201611-09 http://www.securitytracker.com/id/1036751 Common Vulnerability Exposure (CVE) ID: CVE-2016-7094 BugTraq ID: 92864 http://www.securityfocus.com/bid/92864 http://www.securitytracker.com/id/1036753 Common Vulnerability Exposure (CVE) ID: CVE-2016-7154 BugTraq ID: 92863 http://www.securityfocus.com/bid/92863 http://www.c7zero.info/stuff/csw2017_ExploringYourSystemDeeper_updated.pdf http://www.securitytracker.com/id/1036754
Copyright	Copyright (C) 2016 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.