eepro100: Prevent two endless loops [CVE-2015-8345], pcnet: fix rx buffer overflow [CVE-2015-7512], ui: vnc: avoid floating point exception [CVE-2015-8504], additional patch for [XSA-158, CVE-2015-8338] long running memory operations on ARM [XSA-158, CVE-2015-8338] XENMEM_exchange error handling issues [XSA-159, CVE-2015-8339, CVE-2015-8340] libxl leak of pv kernel and initrd on error [XSA-160, CVE-2015-8341] ---- heap buffer overflow vulnerability in pcnet emulator [XSA-162, CVE-2015-7504], virtual PMU is unsupported [XSA-163]

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Fix SSE4 emulation with accel=tcg (bz #1270703) *     CVE-2015-8345: Fix infinite loop in eepro100 (bz     #1285214) * CVE-2015-7504: Fix heap overflow in pcnet     (bz #1286543) * CVE-2015-7512: Fix buffer overflow in     pcnet (bz #1286549)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-2694 advisory.

    - kvm-pcnet-fix-rx-buffer-overflow-CVE-2015-7512.patch [bz#1287950]

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for xen fixes the following security issues :

  - CVE-2015-8550: paravirtualized drivers incautious about     shared memory contents (XSA-155, boo#957988)

  - CVE-2015-8558: qemu: usb: infinite loop in     ehci_advance_state results in DoS (boo#959006)

  - CVE-2015-7549: qemu pci: NULL pointer dereference issue     (boo#958918)

  - CVE-2015-8504: qemu: ui: vnc: avoid floating point     exception (boo#958493)

  - CVE-2015-8554: qemu-dm buffer overrun in MSI-X handling     (XSA-164, boo#958007) 

  - CVE-2015-8555: information leak in legacy x86 FPU/XMM     initialization (XSA-165, boo#958009)

  - boo#958523 xen: ioreq handling possibly susceptible to     multiple read issue (XSA-166)

  - CVE-2015-8345: xen: qemu: net: eepro100: infinite loop     in processing command block list (boo#956832)

  - boo#956592: xen: virtual PMU is unsupported (XSA-163)

  - CVE-2015-8339, CVE-2015-8340: xen: XENMEM_exchange error     handling issues (XSA-159, boo#956408)

  - CVE-2015-8341: xen: libxl leak of pv kernel and initrd     on error (XSA-160, boo#956409)

  - CVE-2015-7504: xen: heap buffer overflow vulnerability     in pcnet emulator (XSA-162, boo#956411)

  - CVE-2015-7311: xen: libxl fails to honour readonly flag     on disks with qemu-xen (xsa-142, boo#947165)

  - CVE-2015-8104: Xen: guest to host DoS by triggering an     infinite loop in microcode via #DB exception     (boo#954405)

  - CVE-2015-5307: xen: x86: CPU lockup during fault     delivery (XSA-156, boo#954018)

  - CVE-2015-7970: xen: x86: Long latency populate-on-demand     operation is not preemptible (XSA-150, boo#950704)

This update for xen fixes the following issues :

  - CVE-2015-8567,CVE-2015-8568: xen: qemu: net: vmxnet3:
    host memory leakage (boo#959387)

  - CVE-2015-8550: xen: paravirtualized drivers incautious     about shared memory contents (XSA-155, boo#957988)

  - CVE-2015-8558: xen: qemu: usb: infinite loop in     ehci_advance_state results in DoS (boo#959006)

  - CVE-2015-7549: xen: qemu pci: NULL pointer dereference     issue (boo#958918)

  - CVE-2015-8504: xen: qemu: ui: vnc: avoid floating point     exception (boo#958493)

  - CVE-2015-8554: xen: qemu-dm buffer overrun in MSI-X     handling (XSA-164, boo#958007)

  - CVE-2015-8555: xen: information leak in legacy x86     FPU/XMM initialization (XSA-165, boo#958009)

  - boo#958523: xen: ioreq handling possibly susceptible to     multiple read issue (XSA-166)

  - CVE-2015-8345: xen: qemu: net: eepro100: infinite loop     in processing command block list (boo#956832)

  - CVE-2015-5307: xen: x86: CPU lockup during fault     delivery (XSA-156, boo#954018)

  - boo#956592: xen: virtual PMU is unsupported (XSA-163)

  - CVE-2015-8339, CVE-2015-8340: xen: XENMEM_exchange error     handling issues (XSA-159, boo#956408)

  - CVE-2015-8341: xen: libxl leak of pv kernel and initrd     on error (XSA-160, boo#956409)

  - CVE-2015-7504: xen: heap buffer overflow vulnerability     in pcnet emulator (XSA-162, boo#956411)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2828-1 advisory.

    Jason Wang discovered that QEMU incorrectly handled the virtio-net device. A remote attacker could use     this issue to cause guest network consumption, resulting in a denial of service. (CVE-2015-7295)

    Qinghao Tang and Ling Liu discovered that QEMU incorrectly handled the pcnet driver when used in loopback     mode. A malicious guest could use this issue to cause a denial of service, or possibly execute arbitrary     code on the host as the user running the QEMU process. In the default installation, when QEMU is used with     libvirt, attackers would be isolated by the libvirt AppArmor profile. (CVE-2015-7504)

    Ling Liu and Jason Wang discovered that QEMU incorrectly handled the pcnet driver. A remote attacker could     use this issue to cause a denial of service, or possibly execute arbitrary code on the host as the user     running the QEMU process. In the default installation, when QEMU is used with libvirt, attackers would be     isolated by the libvirt AppArmor profile. (CVE-2015-7512)

    Qinghao Tang discovered that QEMU incorrectly handled the eepro100 driver. A malicious guest could use     this issue to cause an infinite loop, leading to a denial of service. (CVE-2015-8345)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update fixes the following security issues :

  - bsc#956832 - CVE-2015-8345: xen: qemu: net: eepro100:
    infinite loop in processing command block list

  - Revert x86/IO-APIC: don't create pIRQ mapping from     masked RTE until kernel maintenance release goes out.

  - bsc#956592 - xen: virtual PMU is unsupported (XSA-163)

  - bsc#956408 - CVE-2015-8339, CVE-2015-8340: xen:
    XENMEM_exchange error handling issues (XSA-159)

  - bsc#956409 - CVE-2015-8341: xen: libxl leak of pv kernel     and initrd on error (XSA-160)

  - bsc#956411 - CVE-2015-7504: xen: heap buffer overflow     vulnerability in pcnet emulator (XSA-162)

  - bsc#947165 - CVE-2015-7311: xen: libxl fails to honour     readonly flag on disks with qemu-xen (xsa-142)

  - bsc#954405 - CVE-2015-8104: Xen: guest to host DoS by     triggering an infinite loop in microcode via #DB     exception

  - bsc#954018 - CVE-2015-5307: xen: x86: CPU lockup during     fault delivery (XSA-156)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Heap-based buffer overflow in the pcnet_receive function in hw/net/pcnet.c in QEMU allows guest OS     administrators to cause a denial of service (instance crash) or possibly execute arbitrary code via a     series of packets in loopback mode. (CVE-2015-7504)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2016-0081 for details.

eepro100: Prevent two endless loops [CVE-2015-8345] (#1285215), pcnet:
fix rx buffer overflow [CVE-2015-7512], ui: vnc: avoid floating point exception [CVE-2015-8504], additional patch for [XSA-158, CVE-2015-8338] long running memory operations on ARM [XSA-158, CVE-2015-8338] XENMEM_exchange error handling issues [XSA-159, CVE-2015-8339, CVE-2015-8340] libxl leak of pv kernel and initrd on error [XSA-160, CVE-2015-8341] ---- heap buffer overflow vulnerability in pcnet emulator [XSA-162, CVE-2015-7504], virtual PMU is unsupported [XSA-163]

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes the following security issues :

  - bsc#955399 - Fix xm migrate --log_progress. Due to logic     error progress was not logged when requested.

  - bsc#956832 - CVE-2015-8345: xen: qemu: net: eepro100:
    infinite loop in processing command block list

  - bsc#956592 - xen: virtual PMU is unsupported (XSA-163)

  - bsc#956408 - CVE-2015-8339, CVE-2015-8340: xen:
    XENMEM_exchange error handling issues (XSA-159)

  - bsc#956409 - CVE-2015-8341: xen: libxl leak of pv kernel     and initrd on error (XSA-160)

  - bsc#956411 - CVE-2015-7504: xen: heap buffer overflow     vulnerability in pcnet emulator (XSA-162)

  - bsc#947165 - CVE-2015-7311: xen: libxl fails to honour     readonly flag on disks with qemu-xen (xsa-142)

  - bsc#955399 - Fix xm migrate --live. The options were not     passed due to a merge error. As a result the migration     was not live, instead the suspended guest was migrated.

  - bsc#954405 - CVE-2015-8104: Xen: guest to host DoS by     triggering an infinite loop in microcode via #DB     exception

  - bsc#954018 - CVE-2015-5307: xen: x86: CPU lockup during     fault delivery (XSA-156)

  - bsc#950704 - CVE-2015-7970: xen: x86: Long latency     populate-on-demand operation is not preemptible     (XSA-150)

  - bsc#951845 - CVE-2015-7972: xen: x86: populate-on-demand     balloon size inaccuracy can crash guests (XSA-153)

  - Drop     5604f239-x86-PV-properly-populate-descriptor-tables.patc     h

  - bsc#950703 - CVE-2015-7969: xen: leak of main per-domain     vcpu pointer array (DoS) (XSA-149)

  - bsc#950705 - CVE-2015-7969: xen: x86: leak of per-domain     profiling-related vcpu pointer array (DoS) (XSA-151)

  - bsc#950706 - CVE-2015-7971: xen: x86: some pmu and     profiling hypercalls log without rate limiting (XSA-152)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated qemu-kvm-rhev packages that fix two security issues are now available for Red Hat Enterprise Virtualization.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on AMD64 and Intel 64 systems. The qemu-kvm-rhev package provides the user-space component for running virtual machines using KVM.

A heap-based buffer overflow flaw was discovered in the way QEMU's AMD PC-Net II Ethernet Controller emulation received certain packets in loopback mode. A privileged user (with the CAP_SYS_RAWIO capability) inside a guest could use this flaw to crash the host QEMU process (resulting in denial of service) or, potentially, execute arbitrary code with privileges of the host QEMU process. (CVE-2015-7504)

A buffer overflow flaw was found in the way QEMU's AMD PC-Net II emulation validated certain received packets from a remote host in non-loopback mode. A remote, unprivileged attacker could potentially use this flaw to execute arbitrary code on the host with the privileges of the QEMU process. Note that to exploit this flaw, the guest network interface must have a large MTU limit. (CVE-2015-7512)

Red Hat would like to thank Qinghao Tang of QIHU 360 Marvel Team and Ling Liu of Qihoo 360 Inc. for reporting the CVE-2015-7504 issue, and Ling Liu of Qihoo 360 Inc. for reporting the CVE-2015-7512 issue. The CVE-2015-7512 issue was independently discovered by Jason Wang of Red Hat.

All qemu-kvm-rhev users are advised to upgrade to these updated packages, which contain backported patches to correct these issues.
After installing this update, shut down all running virtual machines.
Once all virtual machines have shut down, start them again for this update to take effect.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
89151	Fedora 23 : xen-4.5.2-5.fc23 (2015-12a089920e)	Nessus	Fedora Local Security Checks	2016/3/4	2021/1/11	critical
89181	Fedora 23 : qemu-2.4.1-2.fc23 (2015-2773b85b49)	Nessus	Fedora Local Security Checks	2016/3/4	2021/1/11	critical
87636	Oracle Linux 6 : qemu-kvm (ELSA-2015-2694)	Nessus	Oracle Linux Local Security Checks	2015/12/29	2024/10/22	critical
88124	openSUSE Security Update : xen (openSUSE-2016-34)	Nessus	SuSE Local Security Checks	2016/1/25	2021/1/19	high
88126	openSUSE Security Update : xen (openSUSE-2016-36)	Nessus	SuSE Local Security Checks	2016/1/25	2021/1/19	high
87205	Ubuntu 14.04 LTS : QEMU vulnerabilities (USN-2828-1)	Nessus	Ubuntu Local Security Checks	2015/12/4	2024/8/27	critical
87588	SUSE SLED12 / SLES12 Security Update : xen (SUSE-SU-2015:2324-1)	Nessus	SuSE Local Security Checks	2015/12/22	2021/1/6	high
219062	Linux Distros Unpatched Vulnerability : CVE-2015-7504	Nessus	Misc.	2025/3/4	2026/7/27	high
91756	OracleVM 3.2 : xen (OVMSA-2016-0081)	Nessus	OracleVM Local Security Checks	2016/6/22	2021/1/4	high
89135	Fedora 22 : xen-4.5.2-5.fc22 (2015-08e4af5a20)	Nessus	Fedora Local Security Checks	2016/3/4	2021/1/11	critical
87650	SUSE SLED11 / SLES11 Security Update : xen (SUSE-SU-2015:2338-1)	Nessus	SuSE Local Security Checks	2015/12/29	2021/1/6	high
87664	RHEL 6 : qemu-kvm-rhev (RHSA-2015:2696)	Nessus	Red Hat Local Security Checks	2015/12/30	2019/10/24	critical

检测

插件搜索

critical

critical

critical

high

high

critical

high

high

high

critical

high

critical