Test ID:	1.3.6.1.4.1.25623.1.1.4.2017.2751.1
Category:	SuSE Local Security Checks
Title:	SUSE: Security Advisory (SUSE-SU-2017:2751-1)
Summary:	The remote host is missing an update for the 'xen' package(s) announced via the SUSE-SU-2017:2751-1 advisory.
Description:	Summary: The remote host is missing an update for the 'xen' package(s) announced via the SUSE-SU-2017:2751-1 advisory. Vulnerability Insight: This update for xen fixes several issues: These security issues were fixed: - CVE-2017-5526: The ES1370 audio device emulation support was vulnerable to a memory leakage issue allowing a privileged user inside the guest to cause a DoS and/or potentially crash the Qemu process on the host (bsc#1059777) - bsc#1061084: Missing cleanup in the page type system allowed a malicious or buggy PV guest to cause DoS (XSA-242) - bsc#1061086: A problem in the shadow pagetable code allowed a malicious or buggy HVM guest to cause DoS or cause hypervisor memory corruption potentially allowing the guest to escalate its privilege (XSA-243) - bsc#1061087: Problematic handling of the selector fields in the Interrupt Descriptor Table (IDT) allowed a malicious or buggy x86 PV guest to escalate its privileges or cause DoS (XSA-244) - bsc#1061077 Missing checks in the handling of DMOPs allowed malicious or buggy stub domain kernels or tool stacks otherwise living outside of Domain0 to cause a DoS (XSA-238) - bsc#1061080: Intercepted I/O write operations with less than a full machine word's worth of data were not properly handled, which allowed a malicious unprivileged x86 HVM guest to obtain sensitive information from the host or other guests (XSA-239) - bsc#1061081: In certain configurations of linear page tables a stack overflow might have occurred that allowed a malicious or buggy PV guest to cause DoS and potentially privilege escalation and information leaks (XSA-240) - bsc#1061082: Under certain conditions x86 PV guests could have caused the hypervisor to miss a necessary TLB flush for a page. This allowed a malicious x86 PV guest to access all of system memory, allowing for privilege escalation, DoS, and information leaks (XSA-241) - bsc#1061076: Multiple issues existed with the setup of PCI MSI interrupts that allowed a malicious or buggy guest to cause DoS and potentially privilege escalation and information leaks (XSA-237) - bsc#1055321: When dealing with the grant map space of add-to-physmap operations, ARM specific code failed to release a lock. This allowed a malicious guest administrator to cause DoS (XSA-235) Affected Software/OS: 'xen' package(s) on SUSE Linux Enterprise Desktop 12-SP3, SUSE Linux Enterprise Server 12-SP3, SUSE Linux Enterprise Server for SAP Applications 12-SP3. Solution: Please install the updated package(s). CVSS Score: 4.9 CVSS Vector: AV:L/AC:L/Au:N/C:N/I:N/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2017-5526 95669 http://www.securityfocus.com/bid/95669 [debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html [oss-security] 20170118 CVE request Qemu: audio: memory leakage in es1370 device http://www.openwall.com/lists/oss-security/2017/01/18/1 [oss-security] 20170118 Re: CVE request Qemu: audio: memory leakage in es1370 device http://www.openwall.com/lists/oss-security/2017/01/18/8 http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=069eb7b2b8fc47c7cb52e5a4af23ea98d939e3da
Copyright	Copyright (C) 2021 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.