[SECURITY] [DLA 1559-1] xen security update

2018-10-3007:46:34

lists.debian.org

410

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

AI Score

8.9

Confidence

Low

EPSS

0.001

Percentile

42.3%

JSON

Package : xen
Version : 4.4.4lts3-0+deb8u1
CVE ID : CVE-2017-15592 CVE-2017-15593 CVE-2017-15594 CVE-2017-15595
CVE-2017-17044 CVE-2017-17045 CVE-2018-10472 CVE-2018-10981

Multiple vulnerabilities have been discovered in the Xen hypervisor, which
could result in denial of service, informations leaks or privilege
escalation.

For Debian 8 "Jessie", these problems have been fixed in version
4.4.4lts3-0+deb8u1.

We recommend that you upgrade your xen packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

OSVersionArchitecturePackageVersionFilename
Debian8amd64xen-system-amd64< 4.4.4lts3-0+deb8u1xen-system-amd64_4.4.4lts3-0+deb8u1_amd64.deb
Debian8allxen-utils-common< 4.4.4lts3-0+deb8u1xen-utils-common_4.4.4lts3-0+deb8u1_all.deb
Debian7i386libxen-ocaml-dev< 4.1.6.lts1-10libxen-ocaml-dev_4.1.6.lts1-10_i386.deb
Debian9i386libxen-4.8-dbgsym< 4.8.2+xsa245-0+deb9u1libxen-4.8-dbgsym_4.8.2+xsa245-0+deb9u1_i386.deb
Debian9arm64xen-utils-4.8-dbgsym< 4.8.2+xsa245-0+deb9u1xen-utils-4.8-dbgsym_4.8.2+xsa245-0+deb9u1_arm64.deb
Debian9amd64libxenstore3.0< 4.8.2+xsa245-0+deb9u1libxenstore3.0_4.8.2+xsa245-0+deb9u1_amd64.deb
Debian8amd64libxen-dev< 4.4.4lts3-0+deb8u1libxen-dev_4.4.4lts3-0+deb8u1_amd64.deb
Debian8i386xen-utils-4.4< 4.4.4lts3-0+deb8u1xen-utils-4.4_4.4.4lts3-0+deb8u1_i386.deb
Debian9amd64libxen-4.8-dbgsym< 4.8.2+xsa245-0+deb9u1libxen-4.8-dbgsym_4.8.2+xsa245-0+deb9u1_amd64.deb
Debian9armhfxen-utils-4.8-dbgsym< 4.8.2+xsa245-0+deb9u1xen-utils-4.8-dbgsym_4.8.2+xsa245-0+deb9u1_armhf.deb

OS	Version	Architecture	Package	Version	Filename
Debian	8	amd64	xen-system-amd64	< 4.4.4lts3-0+deb8u1	xen-system-amd64_4.4.4lts3-0+deb8u1_amd64.deb
Debian	8	all	xen-utils-common	< 4.4.4lts3-0+deb8u1	xen-utils-common_4.4.4lts3-0+deb8u1_all.deb
Debian	7	i386	libxen-ocaml-dev	< 4.1.6.lts1-10	libxen-ocaml-dev_4.1.6.lts1-10_i386.deb
Debian	9	i386	libxen-4.8-dbgsym	< 4.8.2+xsa245-0+deb9u1	libxen-4.8-dbgsym_4.8.2+xsa245-0+deb9u1_i386.deb
Debian	9	arm64	xen-utils-4.8-dbgsym	< 4.8.2+xsa245-0+deb9u1	xen-utils-4.8-dbgsym_4.8.2+xsa245-0+deb9u1_arm64.deb
Debian	9	amd64	libxenstore3.0	< 4.8.2+xsa245-0+deb9u1	libxenstore3.0_4.8.2+xsa245-0+deb9u1_amd64.deb
Debian	8	amd64	libxen-dev	< 4.4.4lts3-0+deb8u1	libxen-dev_4.4.4lts3-0+deb8u1_amd64.deb
Debian	8	i386	xen-utils-4.4	< 4.4.4lts3-0+deb8u1	xen-utils-4.4_4.4.4lts3-0+deb8u1_i386.deb
Debian	9	amd64	libxen-4.8-dbgsym	< 4.8.2+xsa245-0+deb9u1	libxen-4.8-dbgsym_4.8.2+xsa245-0+deb9u1_amd64.deb
Debian	9	armhf	xen-utils-4.8-dbgsym	< 4.8.2+xsa245-0+deb9u1	xen-utils-4.8-dbgsym_4.8.2+xsa245-0+deb9u1_armhf.deb