Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2020.0127 xen security update 14 January 2020 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: xen Publisher: Debian Operating System: Debian GNU/Linux 9 Debian GNU/Linux 10 Impact/Access: Root Compromise -- Existing Account Execute Arbitrary Code/Commands -- Existing Account Increased Privileges -- Existing Account Access Privileged Data -- Existing Account Denial of Service -- Existing Account Access Confidential Data -- Existing Account Resolution: Patch/Upgrade CVE Names: CVE-2019-19583 CVE-2019-19582 CVE-2019-19581 CVE-2019-19580 CVE-2019-19579 CVE-2019-19578 CVE-2019-19577 CVE-2019-18425 CVE-2019-18424 CVE-2019-18423 CVE-2019-18422 CVE-2019-18421 CVE-2019-18420 CVE-2019-17350 CVE-2019-17349 CVE-2019-17348 CVE-2019-17347 CVE-2019-17346 CVE-2019-17345 CVE-2019-17344 CVE-2019-17343 CVE-2019-17342 CVE-2019-17341 CVE-2019-17340 CVE-2019-11135 CVE-2019-11091 CVE-2018-12207 CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 Reference: ESB-2019.4656 ESB-2019.4254 ESB-2019.4072 ESB-2019.4064 ESB-2019.4061 ESB-2019.3973 ESB-2019.1705 ESB-2019.4675.2 ESB-2019.3944.2 Original Bulletin: https://www.debian.org/security/2020/dsa-4602 Comment: This advisory references vulnerabilities in products which run on platforms other than Debian. It is recommended that administrators running xen check for an updated version of the software for their operating system. - --------------------------BEGIN INCLUDED TEXT-------------------- - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - - ------------------------------------------------------------------------- Debian Security Advisory DSA-4602-1 security@debian.org https://www.debian.org/security/ Moritz Muehlenhoff January 13, 2020 https://www.debian.org/security/faq - - ------------------------------------------------------------------------- Package : xen CVE ID : CVE-2019-17349 CVE-2019-17350 CVE-2019-18420 CVE-2019-18421 CVE-2019-18422 CVE-2019-18423 CVE-2019-18424 CVE-2019-18425 CVE-2019-19577 CVE-2019-19578 CVE-2019-19579 CVE-2019-19580 CVE-2019-19581 CVE-2019-19582 CVE-2019-19583 CVE-2018-12207 CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091 CVE-2019-11135 CVE-2019-17348 CVE-2019-17347 CVE-2019-17346 CVE-2019-17345 CVE-2019-17344 CVE-2019-17343 CVE-2019-17342 CVE-2019-17341 CVE-2019-17340 Multiple vulnerabilities have been discovered in the Xen hypervisor, which could result in denial of service, guest-to-host privilege escalation or information leaks. In addition this update provides mitigations for the "TSX Asynchronous Abort" speculative side channel attack. For additional information please refer to https://xenbits.xen.org/xsa/advisory-305.html For the oldstable distribution (stretch), these problems have been fixed in version 4.8.5.final+shim4.10.4-1+deb9u12. Note that this will be the last security update for Xen in the oldstable distribution; upstream support for the 4.8.x branch ended by the end of December 2019. If you rely on security support for your Xen installation an update to the stable distribution (buster) is recommended. For the stable distribution (buster), these problems have been fixed in version 4.11.3+24-g14b62ab3e5-1~deb10u1. We recommend that you upgrade your xen packages. For the detailed security status of xen please refer to its security tracker page at: https://security-tracker.debian.org/tracker/xen Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org - -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAl4c7kEACgkQEMKTtsN8 TjYTuQ//R8WXtoC9qnD7wrV1E9skzu0YgXXUJDgaY6V2cTxRZ9n+RC7szVBXqfjJ OzOhNDESTG1aeOg/vnwHgDLMigIe5HlNSYPMXFk9IqOtsRTaP+Ddp1e/msfudYqP rOiI+NzRk2MnFwT348SCuJK7tS/6coj2IECaYc+LOMp05eg+y4r+KLc6FFWm/UEB 9M0SQMv6vMHaSCqJ7OlzE9j1pta3qPHp6vDpDQC0ngjvTJI85Z6l1p2dJ600bcZR Am4nl/1va8Mxc6hFYQ0h8TV2leELsw3B4f5f4LPKh5U7ZiHM5DfWGZLKxf/SJRpf brt0wwYABM0qMqqelrEZOHWqdFg17ozYkNhuUYYLS3P/AWiOZURHq/xszsv98dGh EUzMPL/P0mHyxrOlG8BrhaZ0O2FfAABRdfNDEO4pDGQSFYYpniOW9a+6yZsmKJDg njryOlSwXa/yrqde5JSqDlJFtwnRZu5IhdeCERXfczpauBrqOzUCUX1n72JSrtlD TUeMMj3QBbuLtJhFbQZH+/dqbQlYKu0u7VPA5fP+7nxsG+9NqwRHv6J2lh0YKXYz ej2WFpM+oBpr12dtFx2buZVzZofHGZd5y1kjGq0yRwnBSrdSKYC5dhtX32weHfSL jnN2rWTafoKwSOJvvofoMjmjcYwTfBzorTO1EX01FPxZqy/nrsA= =3Qmh - -----END PGP SIGNATURE----- - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBXh0PJmaOgq3Tt24GAQi/9w/9GDPUOq6iB1ZfGqU1ShwWb3EJT1t4cfk0 0V4XC0Y5JJkn5yPWA891qvavjCi2eQcI+xc84F2LnaGdNbfcy01+2cbgQhXUtWS3 kjW1AB8til/M3nn7D7PbopzkFlLBEV2FZbCOUa7edr2A7ySH8rWNTzG0Kb+CjzBN 6+Fy+kd+QSW/LAqS6etRGZtEJAt/x0UVKVG7rH488nwy06vDjpGgURes7eVr1H11 +HoPHKRk+dYQMBmfMIjnUOTPcPG8ucAq62kWBuX7uaKBdOh3HxxyRLsXjS6GzDBq sWUPZeGd+XpebTxYiB6EYnq9J8CxdGMxmny1eiTIbuI3J6yRY27YAlPktueyk33N gioCEJFANbLr+c5nHxrzgKMQj0cnknJs1Hr+gc1tDqQi175ELqIH0HUBuFXxQPcO pZswfDsP3nYkHRZ/a2+fvXTFJqiaMz1cGSbpDbY8s0MFmauFxul+J6uQfk99qQTf /tsmelzBf/5FOyUkYA2RQ3V8bslWKh9indfg+QJhZDsy0GpTng4fE3tOhEJkgmDo nyQBwPwR7safdbuZDd2eGmvtap+Q8KNN48Q1909urLweOM7bytHB3zD+d7MjobZ+ CW/wBiHlMFMVBJDIp8yIY5qBHKC61P6Zbi1rIpoR6ly73vEv6cxB9CL+isuTUyzQ ZivVEoS1dIQ= =tnx5 -----END PGP SIGNATURE-----