The remote OracleVM system is missing necessary patches to address critical security updates :

  - Rebuild correcting changelog

  - x86: properly set up fbld emulation operand address This     is XSA-66. (CVE-2013-4361)

  - x86: properly handle hvm_copy_from_guest_[phys,virt]     errors Ignoring them generally implies using     uninitialized data and, in all cases dealt with here,     potentially leaking hypervisor stack contents to guests.
    This is XSA-63. (CVE-2013-4355)

Three security fixes CVE-2013-4355 CVE-2013-4356 CVE-2013-4361, Set 'Domain-0' label in xenstored.service systemd file

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Two security fixes CVE-2013-4355 CVE-2013-4361, Set 'Domain-0' label in xenstored.service systemd file

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

XEN has been updated to version 4.2.3 c/s 26170, fixing various bugs and security issues.

  - CVE-2013-4416: XSA-72: Fixed ocaml xenstored that     mishandled oversized message replies

  - CVE-2013-4355: XSA-63: Fixed information leaks through     I/O instruction emulation

  - CVE-2013-4361: XSA-66: Fixed information leak through     fbld instruction emulation

  - CVE-2013-4368: XSA-67: Fixed information leak through     outs instruction emulation

  - CVE-2013-4369: XSA-68: Fixed possible null dereference     when parsing vif ratelimiting info

  - CVE-2013-4370: XSA-69: Fixed misplaced free in ocaml     xc_vcpu_getaffinity stub

  - CVE-2013-4371: XSA-70: Fixed use-after-free in     libxl_list_cpupool under memory pressure

  - CVE-2013-4375: XSA-71: xen: qemu disk backend (qdisk)     resource leak

  - CVE-2013-1442: XSA-62: Fixed information leak on AVX     and/or LWP capable CPUs

  - CVE-2013-1432: XSA-58: Page reference counting error due     to XSA-45/CVE-2013-1918 fixes.

Various bugs have also been fixed :

  - Boot failure with xen kernel in UEFI mode with error 'No     memory for trampoline' (bnc#833483)

  - Improvements to block-dmmd script (bnc#828623)

  - MTU size on Dom0 gets reset when booting DomU with e1000     device (bnc#840196)

  - In HP's UEFI x86_64 platform and with xen environment,     in booting stage, xen hypervisor will panic.
    (bnc#833251)

  - Xen: migration broken from xsave-capable to     xsave-incapable host (bnc#833796)

  - In xen, 'shutdown -y 0 -h' cannot power off system     (bnc#834751)

  - In HP's UEFI x86_64 platform with xen environment, xen     hypervisor will panic on multiple blades nPar.
    (bnc#839600)

  - vcpus not started after upgrading Dom0 from SLES 11 SP2     to SP3 (bnc#835896)

  - SLES 11 SP3 Xen security patch does not automatically     update UEFI boot binary (bnc#836239)

  - Failed to setup devices for vm instance when start     multiple vms simultaneously (bnc#824676)

  - SLES 9 SP4 guest fails to start after upgrading to SLES     11 SP3 (bnc#817799)

  - Various upstream fixes have been included.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201407-03 (Xen: Multiple Vunlerabilities)

    Multiple vulnerabilities have been discovered in Xen. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker can utilize multiple vectors to execute arbitrary       code, cause Denial of Service, or gain access to data on the host.
  Workaround :

    There is no known workaround at this time.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2015-0068 for details.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
79518	OracleVM 3.1 : xen (OVMSA-2013-0071)	Nessus	OracleVM Local Security Checks	2014/11/26	2021/1/4	low
70421	Fedora 20 : xen-4.3.0-7.fc20 (2013-18300)	Nessus	Fedora Local Security Checks	2013/10/15	2021/1/11	medium
70427	Fedora 18 : xen-4.2.3-3.fc18 (2013-18373)	Nessus	Fedora Local Security Checks	2013/10/15	2021/1/11	low
83602	SUSE SLED11 / SLES11 Security Update : Xen (SUSE-SU-2013:1774-1)	Nessus	SuSE Local Security Checks	2015/5/20	2021/1/19	high
76544	GLSA-201407-03 : Xen: Multiple Vunlerabilities	Nessus	Gentoo Local Security Checks	2014/7/17	2021/1/6	high
84140	OracleVM 3.2 : xen (OVMSA-2015-0068) (POODLE) (Venom)	Nessus	OracleVM Local Security Checks	2015/6/12	2021/1/4	low

检测

插件搜索

low

medium

low

high

high

low