| Revision Date: | 2007-10-02 | Version: | 635 |
| Title: | RHSA-2007:0323: xen security update (Important) |
| Description: | The Xen package contains the tools for managing the virtual machine monitor in Red Hat Enterprise Linux virtualization.
The following security flaws are fixed in the updated Xen package:
Joris van Rantwijk found a flaw in the Pygrub utility which is used as a boot loader for guest domains. A malicious local administrator of a guest domain could create a carefully crafted grub.conf file which would trigger the execution of arbitrary code outside of that domain. (CVE-2007-4993)
Tavis Ormandy discovered a heap overflow flaw during video-to-video copy operations in the Cirrus VGA extension code used in Xen. A malicious local administrator of a guest domain could potentially trigger this flaw and execute arbitrary code outside of the domain. (CVE-2007-1320)
Tavis Ormandy discovered insufficient input validation leading to a heap overflow in the Xen NE2000 network driver. If the driver is in use, a malicious local administrator of a guest domain could potentially trigger this flaw and execute arbitrary code outside of the domain. Xen does not use this driver by default. (CVE-2007-1321)
Users of Xen should update to these erratum packages containing backported patches which correct these issues.
|
| Family: | unix | Class: | patch |
| Status: | | Reference(s): | CVE-2007-1320
CVE-2007-1321
CVE-2007-4993
RHSA-2007:0323
RHSA-2007:0323-01
RHSA-2007:0323-01
|
| Platform(s): | Red Hat Enterprise Linux 5
| Product(s): | |
| Definition Synopsis |
| Red Hat Enterprise Linux must be installed OR Package Information
Red Hat Enterprise Linux 5 is installed
AND
xen is earlier than 0:3.0.3-25.0.4.el5
AND xen is signed with Red Hat redhatrelease2 key
xen-devel is earlier than 0:3.0.3-25.0.4.el5
AND xen-devel is signed with Red Hat redhatrelease2 key
xen-libs is earlier than 0:3.0.3-25.0.4.el5
AND xen-libs is signed with Red Hat redhatrelease2 key
|