SUSE Security Update: Security update for Xen ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:1132-1 Rating: important References: #776300 #776995 #777084 #777086 #777088 #777090 #777091 Cross-References: CVE-2012-3494 CVE-2012-3495 CVE-2012-3496 CVE-2012-3498 CVE-2012-3515 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP2 SUSE Linux Enterprise Server 11 SP2 for VMware SUSE Linux Enterprise Server 11 SP2 SUSE Linux Enterprise Desktop 11 SP2 ______________________________________________________________________________ An update that solves 5 vulnerabilities and has two fixes is now available. It includes one version update. Description: XEN was updated 4.1.3 to fix multiple bugs and security issues. The following security issues have been fixed: * CVE-2012-3494: xen: hypercall set_debugreg vulnerability (XSA-12) * CVE-2012-3495: xen: hypercall physdev_get_free_pirq vulnerability (XSA-13) * CVE-2012-3496: xen: XENMEM_populate_physmap DoS vulnerability (XSA-14) * CVE-2012-3498: xen: PHYSDEVOP_map_pirq index vulnerability (XSA-16) * CVE-2012-3515: xen: Qemu VT100 emulation vulnerability (XSA-17) Also the following bugs have been fixed: * pvscsi support of attaching Luns - bnc#776995 The following related bugs in vm-install 0.5.12 have been fixed: * bnc#776300 - vm-install does not pass --extra-args in --upgrade * Add for support Open Enterprise Server 11 * Add support for Windows 8 and Windows Server 2012 * Add support for Ubuntu 12 (Precise Pangolin) Security Issue references: * CVE-2012-3496 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3496

* CVE-2012-3494 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3494

* CVE-2012-3495 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3495

* CVE-2012-3498 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3498

* CVE-2012-3515 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3515

Indications: Everyone using XEN should update. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP2: zypper in -t patch sdksp2-xen-201209-6748 - SUSE Linux Enterprise Server 11 SP2 for VMware: zypper in -t patch slessp2-xen-201209-6748 - SUSE Linux Enterprise Server 11 SP2: zypper in -t patch slessp2-xen-201209-6748 - SUSE Linux Enterprise Desktop 11 SP2: zypper in -t patch sledsp2-xen-201209-6748 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP2 (i586 x86_64): xen-devel-4.1.3_02-0.5.1 - SUSE Linux Enterprise Server 11 SP2 for VMware (i586 x86_64): xen-kmp-trace-4.1.3_02_3.0.38_0.5-0.5.1 - SUSE Linux Enterprise Server 11 SP2 (i586 x86_64): xen-kmp-default-4.1.3_02_3.0.38_0.5-0.5.1 xen-kmp-trace-4.1.3_02_3.0.38_0.5-0.5.1 xen-libs-4.1.3_02-0.5.1 xen-tools-domU-4.1.3_02-0.5.1 - SUSE Linux Enterprise Server 11 SP2 (x86_64) [New Version: 0.5.12]: vm-install-0.5.12-0.5.1 xen-4.1.3_02-0.5.1 xen-doc-html-4.1.3_02-0.5.1 xen-doc-pdf-4.1.3_02-0.5.1 xen-libs-32bit-4.1.3_02-0.5.1 xen-tools-4.1.3_02-0.5.1 - SUSE Linux Enterprise Server 11 SP2 (i586) [New Version: 0.5.12]: vm-install-0.5.12-0.5.3 - SUSE Linux Enterprise Desktop 11 SP2 (i586 x86_64): xen-kmp-default-4.1.3_02_3.0.38_0.5-0.5.1 xen-kmp-trace-4.1.3_02_3.0.38_0.5-0.5.1 xen-libs-4.1.3_02-0.5.1 xen-tools-domU-4.1.3_02-0.5.1 - SUSE Linux Enterprise Desktop 11 SP2 (x86_64) [New Version: 0.5.12]: vm-install-0.5.12-0.5.1 xen-4.1.3_02-0.5.1 xen-doc-html-4.1.3_02-0.5.1 xen-doc-pdf-4.1.3_02-0.5.1 xen-libs-32bit-4.1.3_02-0.5.1 xen-tools-4.1.3_02-0.5.1 - SUSE Linux Enterprise Desktop 11 SP2 (i586) [New Version: 0.5.12]: vm-install-0.5.12-0.5.3 References: http://support.novell.com/security/cve/CVE-2012-3494.html http://support.novell.com/security/cve/CVE-2012-3495.html http://support.novell.com/security/cve/CVE-2012-3496.html http://support.novell.com/security/cve/CVE-2012-3498.html http://support.novell.com/security/cve/CVE-2012-3515.html https://bugzilla.novell.com/776300 https://bugzilla.novell.com/776995 https://bugzilla.novell.com/777084 https://bugzilla.novell.com/777086 https://bugzilla.novell.com/777088 https://bugzilla.novell.com/777090 https://bugzilla.novell.com/777091 http://download.novell.com/patch/finder/?keywords=2940fd614757e4aece023d8a6e... -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe@opensuse.org For additional commands, e-mail: opensuse-security-announce+help@opensuse.org