The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Multiple unspecified vulnerabilities in the Elf parser (libelf) in Xen 4.2.x and earlier allow local guest     administrators with certain permissions to have an unspecified impact via a crafted kernel, related to     other problems that are not CVE-2013-2194 or CVE-2013-2195. (CVE-2013-2196)

Note that Nessus relies on the presence of the package as reported by the vendor.

The Xen hypervisor and toolset has been updated to 4.2.2_06 to fix various bugs and security issues :

The following security issues have been addressed :

  - Various integer overflows in the ELF loader were fixed.
    (XSA-55). (CVE-2013-2194)

  - Various pointer dereferences issues in the ELF loader     were fixed. (XSA-55). (CVE-2013-2195)

  - Various other problems in the ELF loader were fixed.
    (XSA-55). (CVE-2013-2196)

  - A Hypervisor crash due to missing exception recovery on     XSETBV was fixed. (XSA-54). (CVE-2013-2078)

  - A Hypervisor crash due to missing exception recovery on     XRSTOR was fixed. (XSA-53). (CVE-2013-2077)

  - libxl allowed guest write access to sensitive console     related xenstore keys. (XSA-57). (CVE-2013-2211)

  - An information leak on XSAVE/XRSTOR capable AMD CPUs     (XSA-52) was fixed, where parts of this state could leak     to other VMs. (CVE-2013-2076)

Also the following bugs have been fixed :

  - performance issues in mirror lvm. (bnc#801663)

  - aacraid driver panics mapping INT A when booting     kernel-xen. (bnc#808085)

  - Fully Virtualized Windows VM install failed on Ivy     Bridge platforms with Xen kernel. (bnc#808269)

  - Did not boot with i915 graphics controller with VT-d     enabled (bnc#817210)

XEN has been updated to version 4.2.3 c/s 26170, fixing various bugs and security issues.

  - XSA-72: Fixed ocaml xenstored that mishandled oversized     message replies. (CVE-2013-4416)

  - XSA-63: Fixed information leaks through I/O instruction     emulation. (CVE-2013-4355)

  - XSA-66: Fixed information leak through fbld instruction     emulation. (CVE-2013-4361)

  - XSA-67: Fixed information leak through outs instruction     emulation. (CVE-2013-4368)

  - XSA-68: Fixed possible null dereference when parsing vif     ratelimiting info. (CVE-2013-4369)

  - XSA-69: Fixed misplaced free in ocaml     xc_vcpu_getaffinity stub. (CVE-2013-4370)

  - XSA-70: Fixed use-after-free in libxl_list_cpupool under     memory pressure. (CVE-2013-4371)

  - XSA-71: xen: qemu disk backend (qdisk) resource leak.
    (CVE-2013-4375)

  - XSA-62: Fixed information leak on AVX and/or LWP capable     CPUs. (CVE-2013-1442)

  - XSA-58: Page reference counting error due to     XSA-45/CVE-2013-1918 fixes. Various bugs have also been     fixed:. (CVE-2013-1432)

  - Boot failure with xen kernel in UEFI mode with error 'No     memory for trampoline'. (bnc#833483)

  - Improvements to block-dmmd script. (bnc#828623)

  - MTU size on Dom0 gets reset when booting DomU with e1000     device. (bnc#840196)

  - In HP's UEFI x86_64 platform and with xen environment,     in booting stage, xen hypervisor will panic.
    (bnc#833251)

  - Xen: migration broken from xsave-capable to     xsave-incapable host. (bnc#833796)

  - In xen, 'shutdown -y 0 -h' cannot power off system.
    (bnc#834751)

  - In HP's UEFI x86_64 platform with xen environment, xen     hypervisor will panic on multiple blades nPar.
    (bnc#839600)

  - vcpus not started after upgrading Dom0 from SLES 11 SP2     to SP3. (bnc#835896)

  - SLES 11 SP3 Xen security patch does not automatically     update UEFI boot binary. (bnc#836239)

  - Failed to setup devices for vm instance when start     multiple vms simultaneously. (bnc#824676)

  - SLES 9 SP4 guest fails to start after upgrading to SLES     11 SP3. (bnc#817799)

  - Various upstream fixes have been included.

Revised fixes for [XSA-55]

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2015-0068 for details.

Multiple security issues have been discovered in the Xen virtualisation solution which may result in information leaks or denial of service.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
217808	Linux Distros Unpatched Vulnerability : CVE-2013-2196	Nessus	Misc.	2025/3/4	2026/1/28	critical
69297	SuSE 11.3 Security Update : Xen (SAT Patch Number 8063)	Nessus	SuSE Local Security Checks	2013/8/10	2021/1/19	high
70969	SuSE 11.2 / 11.3 Security Update : Xen (SAT Patch Numbers 8478 / 8479)	Nessus	SuSE Local Security Checks	2013/11/20	2021/1/19	high
67290	Fedora 19 : xen-4.2.2-7.fc19 (2013-10908)	Nessus	Fedora Local Security Checks	2013/7/12	2021/1/11	medium
84140	OracleVM 3.2 : xen (OVMSA-2015-0068) (POODLE) (Venom)	Nessus	OracleVM Local Security Checks	2015/6/12	2021/1/4	low
77240	Debian DSA-3006-1 : xen - security update	Nessus	Debian Local Security Checks	2014/8/19	2021/1/11	high

检测

插件搜索

critical

high

high

medium

low

high