[SECURITY] [DSA 3262-1] xen security update

2015-05-1821:29:25

lists.debian.org

7.7 High

CVSS2

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:A/AC:L/Au:S/C:C/I:C/A:C

9.2 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

41.0%

JSON

Debian Security Advisory DSA-3262-1 [email protected]
http://www.debian.org/security/ Moritz Muehlenhoff
May 18, 2015 http://www.debian.org/security/faq

Package : xen
CVE ID : CVE-2015-3456

Jason Geffner discovered a buffer overflow in the emulated floppy
disk drive, resulting in the potential execution of arbitrary code.
This only affects HVM guests.

For the oldstable distribution (wheezy), this problem has been fixed
in version 4.1.4-3+deb7u6.

The stable distribution (jessie) is already fixed through the qemu
update provided as DSA-3259-1.

We recommend that you upgrade your xen packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: [email protected]

OSVersionArchitecturePackageVersionFilename
Debian7powerpcqemu< 1.1.2+dfsg-6a+deb7u7qemu_1.1.2+dfsg-6a+deb7u7_powerpc.deb
Debian8i386virtualbox-guest-x11< 4.3.18-dfsg-3+deb8u2virtualbox-guest-x11_4.3.18-dfsg-3+deb8u2_i386.deb
Debian7amd64qemu-system< 1.1.2+dfsg-6a+deb7u7qemu-system_1.1.2+dfsg-6a+deb7u7_amd64.deb
Debian6amd64qemu-user< 0.12.5+dfsg-3squeeze5qemu-user_0.12.5+dfsg-3squeeze5_amd64.deb
Debian7i386virtualbox-guest-utils< 4.1.18-dfsg-2+deb7u5virtualbox-guest-utils_4.1.18-dfsg-2+deb7u5_i386.deb
Debian7i386xen-utils-4.1< 4.1.4-3+deb7u6xen-utils-4.1_4.1.4-3+deb7u6_i386.deb
Debian8arm64qemu-system< 1:2.1+dfsg-12qemu-system_1:2.1+dfsg-12_arm64.deb
Debian7i386xen-system-i386< 4.1.4-3+deb7u6xen-system-i386_4.1.4-3+deb7u6_i386.deb
Debian8amd64qemu-system-sparc< 1:2.1+dfsg-12qemu-system-sparc_1:2.1+dfsg-12_amd64.deb
Debian6allvirtualbox-ose< 3.2.10-dfsg-1+squeeze4virtualbox-ose_3.2.10-dfsg-1+squeeze4_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	7	powerpc	qemu	< 1.1.2+dfsg-6a+deb7u7	qemu_1.1.2+dfsg-6a+deb7u7_powerpc.deb
Debian	8	i386	virtualbox-guest-x11	< 4.3.18-dfsg-3+deb8u2	virtualbox-guest-x11_4.3.18-dfsg-3+deb8u2_i386.deb
Debian	7	amd64	qemu-system	< 1.1.2+dfsg-6a+deb7u7	qemu-system_1.1.2+dfsg-6a+deb7u7_amd64.deb
Debian	6	amd64	qemu-user	< 0.12.5+dfsg-3squeeze5	qemu-user_0.12.5+dfsg-3squeeze5_amd64.deb
Debian	7	i386	virtualbox-guest-utils	< 4.1.18-dfsg-2+deb7u5	virtualbox-guest-utils_4.1.18-dfsg-2+deb7u5_i386.deb
Debian	7	i386	xen-utils-4.1	< 4.1.4-3+deb7u6	xen-utils-4.1_4.1.4-3+deb7u6_i386.deb
Debian	8	arm64	qemu-system	< 1:2.1+dfsg-12	qemu-system_1:2.1+dfsg-12_arm64.deb
Debian	7	i386	xen-system-i386	< 4.1.4-3+deb7u6	xen-system-i386_4.1.4-3+deb7u6_i386.deb
Debian	8	amd64	qemu-system-sparc	< 1:2.1+dfsg-12	qemu-system-sparc_1:2.1+dfsg-12_amd64.deb
Debian	6	all	virtualbox-ose	< 3.2.10-dfsg-1+squeeze4	virtualbox-ose_3.2.10-dfsg-1+squeeze4_all.deb