csaf_suse - suse-su-2019:0003-1

suse-su-2019:0003-1

Vulnerability from csaf_suse

Published

2019-01-02 10:39

Modified

2019-01-02 10:39

Summary

Security update for xen

Notes

Title of the patch

Security update for xen

Description of the patch

This update for xen fixes the following issues: - Update to Xen 4.11.1 bug fix release (bsc#1027519) - CVE-2018-17963: Fixed an integer overflow issue in the QEMU emulator, which could occur when a packet with large packet size is processed. A user inside a guest could have used this flaw to crash the qemu process resulting in a Denial of Service (DoS). (bsc#1111014) - CVE-2018-18849: Fixed an out of bounds memory access in the LSI53C895A SCSI host bus adapter emulation, which allowed a user and/or process to crash the qemu process resulting in a Denial of Service (DoS). (bsc#1114423) - CVE-2018-18883: Fixed an issue related to inproper restriction of nested VT-x, which allowed a guest to cause Xen to crash, resulting in a Denial of Service (DoS). (XSA-278) (bsc#1114405) - CVE-2018-19961, CVE-2018-19962: Fixed an issue related to insufficient TLB flushing with AMD IOMMUs, which potentially allowed a guest to escalate its privileges, may cause a Denial of Service (DoS) affecting the entire host, or may be able to access data it is not supposed to access. (XSA-275) (bsc#1115040) - CVE-2018-19963: Fixed the allocation of pages used to communicate with external emulators, which may have cuased Xen to crash, resulting in a Denial of Service (DoS). (XSA-276) (bsc#1115043) - CVE-2018-19965: Fixed an issue related to the INVPCID instruction in case non-canonical addresses are accessed, which may allow a guest to cause Xen to crash, resulting in a Denial of Service (DoS) affecting the entire host. (XSA-279) (bsc#1115045) - CVE-2018-19966: Fixed an issue related to a previous fix for XSA-240, which conflicted with shadow paging and allowed a guest to cause Xen to crash, resulting in a Denial of Service (DoS) (XSA-280) (bsc#1115047) - CVE-2018-19967: Fixed HLE constructs that allowed guests to lock up the host, resulting in a Denial of Service (DoS). (XSA-282) (bsc#1114988) - CVE-2018-19964: Fixed the incorrect error handling of p2m page removals, which allowed a guest to cause a deadlock, resulting in a Denial of Service (DoS) affecting the entire host. (XSA-277) (bsc#1115044) - CVE-2018-19665: Fixed an integer overflow resulting in memory corruption in various Bluetooth functions, allowing this to crash qemu process resulting in Denial of Service (DoS). (bsc#1117756). Other bugs fixed: - Fixed an issue related to a domU hang on SLE12-SP3 HV (bsc#1108940)

Patchnames

SUSE-2019-3,SUSE-SLE-DESKTOP-12-SP4-2019-3,SUSE-SLE-SDK-12-SP4-2019-3,SUSE-SLE-SERVER-12-SP4-2019-3

CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for xen",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for xen fixes the following issues:\n\n- Update to Xen 4.11.1 bug fix release (bsc#1027519)\n\n- CVE-2018-17963: Fixed an integer overflow issue in the QEMU emulator, which\n  could occur when a packet with large packet size is processed. A user inside\n  a guest could have used this flaw to crash the qemu process resulting in a\n  Denial of Service (DoS). (bsc#1111014)\n- CVE-2018-18849: Fixed an out of bounds memory access in the LSI53C895A SCSI\n  host bus adapter emulation, which allowed a user and/or process to crash the\n  qemu process resulting in a Denial of Service (DoS). (bsc#1114423)\n- CVE-2018-18883: Fixed an issue related to inproper restriction of nested\n  VT-x, which allowed a guest to cause Xen to crash, resulting in a Denial of\n  Service (DoS). (XSA-278) (bsc#1114405)\n- CVE-2018-19961, CVE-2018-19962: Fixed an issue related to insufficient TLB\n  flushing with AMD IOMMUs, which potentially allowed a guest to escalate its\n  privileges, may cause a Denial of Service (DoS) affecting the entire host, or\n  may be able to access data it is not supposed to access. (XSA-275)\n  (bsc#1115040)\n- CVE-2018-19963: Fixed the allocation of pages used to communicate with\n  external emulators, which may have cuased Xen to crash, resulting in a Denial\n  of Service (DoS). (XSA-276) (bsc#1115043)\n- CVE-2018-19965: Fixed an issue related to the INVPCID instruction in case\n  non-canonical addresses are accessed, which may allow a guest to cause Xen to\n  crash, resulting in a Denial of Service (DoS) affecting the entire host.\n  (XSA-279) (bsc#1115045)\n- CVE-2018-19966: Fixed an issue related to a previous fix for XSA-240, which\n  conflicted with shadow paging and allowed a guest to cause Xen to crash,\n  resulting in a Denial of Service (DoS) (XSA-280) (bsc#1115047)\n- CVE-2018-19967: Fixed HLE constructs that allowed guests to lock up the host,\n  resulting in a Denial of Service (DoS). (XSA-282) (bsc#1114988)\n- CVE-2018-19964: Fixed the incorrect error handling of p2m page removals,\n  which allowed a guest to cause a deadlock, resulting in a Denial of Service\n  (DoS) affecting the entire host. (XSA-277) (bsc#1115044)\n- CVE-2018-19665: Fixed an integer overflow resulting in memory corruption in\n  various Bluetooth functions, allowing this to crash qemu process resulting in\n  Denial of Service (DoS). (bsc#1117756).\n\nOther bugs fixed:\n\n- Fixed an issue related to a domU hang on SLE12-SP3 HV (bsc#1108940)\n\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-2019-3,SUSE-SLE-DESKTOP-12-SP4-2019-3,SUSE-SLE-SDK-12-SP4-2019-3,SUSE-SLE-SERVER-12-SP4-2019-3",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2019_0003-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2019:0003-1",
        "url": "https://www.suse.com/support/update/announcement/2019/suse-su-20190003-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2019:0003-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2019-January/005011.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1027519",
        "url": "https://bugzilla.suse.com/1027519"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1108940",
        "url": "https://bugzilla.suse.com/1108940"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1111014",
        "url": "https://bugzilla.suse.com/1111014"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1114405",
        "url": "https://bugzilla.suse.com/1114405"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1114423",
        "url": "https://bugzilla.suse.com/1114423"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1114988",
        "url": "https://bugzilla.suse.com/1114988"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1115040",
        "url": "https://bugzilla.suse.com/1115040"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1115043",
        "url": "https://bugzilla.suse.com/1115043"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1115044",
        "url": "https://bugzilla.suse.com/1115044"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1115045",
        "url": "https://bugzilla.suse.com/1115045"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1115047",
        "url": "https://bugzilla.suse.com/1115047"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1117756",
        "url": "https://bugzilla.suse.com/1117756"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-17963 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-17963/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-18849 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-18849/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-18883 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-18883/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-19665 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-19665/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-19961 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-19961/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-19962 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-19962/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-19963 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-19963/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-19964 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-19964/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-19965 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-19965/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-19966 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-19966/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-19967 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-19967/"
      }
    ],
    "title": "Security update for xen",
    "tracking": {
      "current_release_date": "2019-01-02T10:39:50Z",
      "generator": {
        "date": "2019-01-02T10:39:50Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2019:0003-1",
      "initial_release_date": "2019-01-02T10:39:50Z",
      "revision_history": [
        {
          "date": "2019-01-02T10:39:50Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "xen-4.11.1_02-2.3.1.aarch64",
                "product": {
                  "name": "xen-4.11.1_02-2.3.1.aarch64",
                  "product_id": "xen-4.11.1_02-2.3.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "xen-devel-4.11.1_02-2.3.1.aarch64",
                "product": {
                  "name": "xen-devel-4.11.1_02-2.3.1.aarch64",
                  "product_id": "xen-devel-4.11.1_02-2.3.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "xen-doc-html-4.11.1_02-2.3.1.aarch64",
                "product": {
                  "name": "xen-doc-html-4.11.1_02-2.3.1.aarch64",
                  "product_id": "xen-doc-html-4.11.1_02-2.3.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "xen-libs-4.11.1_02-2.3.1.aarch64",
                "product": {
                  "name": "xen-libs-4.11.1_02-2.3.1.aarch64",
                  "product_id": "xen-libs-4.11.1_02-2.3.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "xen-tools-4.11.1_02-2.3.1.aarch64",
                "product": {
                  "name": "xen-tools-4.11.1_02-2.3.1.aarch64",
                  "product_id": "xen-tools-4.11.1_02-2.3.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "xen-tools-domU-4.11.1_02-2.3.1.aarch64",
                "product": {
                  "name": "xen-tools-domU-4.11.1_02-2.3.1.aarch64",
                  "product_id": "xen-tools-domU-4.11.1_02-2.3.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "xen-libs-64bit-4.11.1_02-2.3.1.aarch64_ilp32",
                "product": {
                  "name": "xen-libs-64bit-4.11.1_02-2.3.1.aarch64_ilp32",
                  "product_id": "xen-libs-64bit-4.11.1_02-2.3.1.aarch64_ilp32"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64_ilp32"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "xen-devel-4.11.1_02-2.3.1.i586",
                "product": {
                  "name": "xen-devel-4.11.1_02-2.3.1.i586",
                  "product_id": "xen-devel-4.11.1_02-2.3.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "xen-libs-4.11.1_02-2.3.1.i586",
                "product": {
                  "name": "xen-libs-4.11.1_02-2.3.1.i586",
                  "product_id": "xen-libs-4.11.1_02-2.3.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "xen-tools-domU-4.11.1_02-2.3.1.i586",
                "product": {
                  "name": "xen-tools-domU-4.11.1_02-2.3.1.i586",
                  "product_id": "xen-tools-domU-4.11.1_02-2.3.1.i586"
                }
              }
            ],
            "category": "architecture",
            "name": "i586"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "xen-4.11.1_02-2.3.1.x86_64",
                "product": {
                  "name": "xen-4.11.1_02-2.3.1.x86_64",
                  "product_id": "xen-4.11.1_02-2.3.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "xen-devel-4.11.1_02-2.3.1.x86_64",
                "product": {
                  "name": "xen-devel-4.11.1_02-2.3.1.x86_64",
                  "product_id": "xen-devel-4.11.1_02-2.3.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "xen-doc-html-4.11.1_02-2.3.1.x86_64",
                "product": {
                  "name": "xen-doc-html-4.11.1_02-2.3.1.x86_64",
                  "product_id": "xen-doc-html-4.11.1_02-2.3.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "xen-libs-4.11.1_02-2.3.1.x86_64",
                "product": {
                  "name": "xen-libs-4.11.1_02-2.3.1.x86_64",
                  "product_id": "xen-libs-4.11.1_02-2.3.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
                "product": {
                  "name": "xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
                  "product_id": "xen-libs-32bit-4.11.1_02-2.3.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "xen-tools-4.11.1_02-2.3.1.x86_64",
                "product": {
                  "name": "xen-tools-4.11.1_02-2.3.1.x86_64",
                  "product_id": "xen-tools-4.11.1_02-2.3.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "xen-tools-domU-4.11.1_02-2.3.1.x86_64",
                "product": {
                  "name": "xen-tools-domU-4.11.1_02-2.3.1.x86_64",
                  "product_id": "xen-tools-domU-4.11.1_02-2.3.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Desktop 12 SP4",
                "product": {
                  "name": "SUSE Linux Enterprise Desktop 12 SP4",
                  "product_id": "SUSE Linux Enterprise Desktop 12 SP4",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sled:12:sp4"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Software Development Kit 12 SP4",
                "product": {
                  "name": "SUSE Linux Enterprise Software Development Kit 12 SP4",
                  "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP4",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-sdk:12:sp4"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 12 SP4",
                "product": {
                  "name": "SUSE Linux Enterprise Server 12 SP4",
                  "product_id": "SUSE Linux Enterprise Server 12 SP4",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles:12:sp4"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP4",
                "product": {
                  "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP4",
                  "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP4",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles_sap:12:sp4"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-4.11.1_02-2.3.1.x86_64 as component of SUSE Linux Enterprise Desktop 12 SP4",
          "product_id": "SUSE Linux Enterprise Desktop 12 SP4:xen-4.11.1_02-2.3.1.x86_64"
        },
        "product_reference": "xen-4.11.1_02-2.3.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Desktop 12 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-libs-4.11.1_02-2.3.1.x86_64 as component of SUSE Linux Enterprise Desktop 12 SP4",
          "product_id": "SUSE Linux Enterprise Desktop 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64"
        },
        "product_reference": "xen-libs-4.11.1_02-2.3.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Desktop 12 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-libs-32bit-4.11.1_02-2.3.1.x86_64 as component of SUSE Linux Enterprise Desktop 12 SP4",
          "product_id": "SUSE Linux Enterprise Desktop 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64"
        },
        "product_reference": "xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Desktop 12 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-devel-4.11.1_02-2.3.1.aarch64 as component of SUSE Linux Enterprise Software Development Kit 12 SP4",
          "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP4:xen-devel-4.11.1_02-2.3.1.aarch64"
        },
        "product_reference": "xen-devel-4.11.1_02-2.3.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-devel-4.11.1_02-2.3.1.x86_64 as component of SUSE Linux Enterprise Software Development Kit 12 SP4",
          "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP4:xen-devel-4.11.1_02-2.3.1.x86_64"
        },
        "product_reference": "xen-devel-4.11.1_02-2.3.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-4.11.1_02-2.3.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP4",
          "product_id": "SUSE Linux Enterprise Server 12 SP4:xen-4.11.1_02-2.3.1.x86_64"
        },
        "product_reference": "xen-4.11.1_02-2.3.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-doc-html-4.11.1_02-2.3.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP4",
          "product_id": "SUSE Linux Enterprise Server 12 SP4:xen-doc-html-4.11.1_02-2.3.1.x86_64"
        },
        "product_reference": "xen-doc-html-4.11.1_02-2.3.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-libs-4.11.1_02-2.3.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP4",
          "product_id": "SUSE Linux Enterprise Server 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64"
        },
        "product_reference": "xen-libs-4.11.1_02-2.3.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-libs-32bit-4.11.1_02-2.3.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP4",
          "product_id": "SUSE Linux Enterprise Server 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64"
        },
        "product_reference": "xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-tools-4.11.1_02-2.3.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP4",
          "product_id": "SUSE Linux Enterprise Server 12 SP4:xen-tools-4.11.1_02-2.3.1.x86_64"
        },
        "product_reference": "xen-tools-4.11.1_02-2.3.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-tools-domU-4.11.1_02-2.3.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP4",
          "product_id": "SUSE Linux Enterprise Server 12 SP4:xen-tools-domU-4.11.1_02-2.3.1.x86_64"
        },
        "product_reference": "xen-tools-domU-4.11.1_02-2.3.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-4.11.1_02-2.3.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP4",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-4.11.1_02-2.3.1.x86_64"
        },
        "product_reference": "xen-4.11.1_02-2.3.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-doc-html-4.11.1_02-2.3.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP4",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-doc-html-4.11.1_02-2.3.1.x86_64"
        },
        "product_reference": "xen-doc-html-4.11.1_02-2.3.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-libs-4.11.1_02-2.3.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP4",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64"
        },
        "product_reference": "xen-libs-4.11.1_02-2.3.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-libs-32bit-4.11.1_02-2.3.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP4",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64"
        },
        "product_reference": "xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-tools-4.11.1_02-2.3.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP4",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-tools-4.11.1_02-2.3.1.x86_64"
        },
        "product_reference": "xen-tools-4.11.1_02-2.3.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-tools-domU-4.11.1_02-2.3.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP4",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-tools-domU-4.11.1_02-2.3.1.x86_64"
        },
        "product_reference": "xen-tools-domU-4.11.1_02-2.3.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP4"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2018-17963",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-17963"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "qemu_deliver_packet_iov in net/net.c in Qemu accepts packet sizes greater than INT_MAX, which allows attackers to cause a denial of service or possibly have unspecified other impact.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Desktop 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Desktop 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP4:xen-doc-html-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP4:xen-tools-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP4:xen-tools-domU-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-doc-html-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-tools-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-tools-domU-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12 SP4:xen-devel-4.11.1_02-2.3.1.aarch64",
          "SUSE Linux Enterprise Software Development Kit 12 SP4:xen-devel-4.11.1_02-2.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-17963",
          "url": "https://www.suse.com/security/cve/CVE-2018-17963"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1111013 for CVE-2018-17963",
          "url": "https://bugzilla.suse.com/1111013"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1111014 for CVE-2018-17963",
          "url": "https://bugzilla.suse.com/1111014"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1178658 for CVE-2018-17963",
          "url": "https://bugzilla.suse.com/1178658"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-doc-html-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-tools-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-tools-domU-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-doc-html-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-tools-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-tools-domU-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP4:xen-devel-4.11.1_02-2.3.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP4:xen-devel-4.11.1_02-2.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Desktop 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-doc-html-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-tools-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-tools-domU-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-doc-html-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-tools-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-tools-domU-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP4:xen-devel-4.11.1_02-2.3.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP4:xen-devel-4.11.1_02-2.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2019-01-02T10:39:50Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-17963"
    },
    {
      "cve": "CVE-2018-18849",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-18849"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In Qemu 3.0.0, lsi_do_msgin in hw/scsi/lsi53c895a.c allows out-of-bounds access by triggering an invalid msg_len value.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Desktop 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Desktop 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP4:xen-doc-html-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP4:xen-tools-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP4:xen-tools-domU-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-doc-html-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-tools-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-tools-domU-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12 SP4:xen-devel-4.11.1_02-2.3.1.aarch64",
          "SUSE Linux Enterprise Software Development Kit 12 SP4:xen-devel-4.11.1_02-2.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-18849",
          "url": "https://www.suse.com/security/cve/CVE-2018-18849"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1114422 for CVE-2018-18849",
          "url": "https://bugzilla.suse.com/1114422"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1114423 for CVE-2018-18849",
          "url": "https://bugzilla.suse.com/1114423"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1178658 for CVE-2018-18849",
          "url": "https://bugzilla.suse.com/1178658"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-doc-html-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-tools-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-tools-domU-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-doc-html-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-tools-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-tools-domU-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP4:xen-devel-4.11.1_02-2.3.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP4:xen-devel-4.11.1_02-2.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Desktop 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-doc-html-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-tools-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-tools-domU-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-doc-html-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-tools-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-tools-domU-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP4:xen-devel-4.11.1_02-2.3.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP4:xen-devel-4.11.1_02-2.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2019-01-02T10:39:50Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-18849"
    },
    {
      "cve": "CVE-2018-18883",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-18883"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An issue was discovered in Xen 4.9.x through 4.11.x, on Intel x86 platforms, allowing x86 HVM and PVH guests to cause a host OS denial of service (NULL pointer dereference) or possibly have unspecified other impact because nested VT-x is not properly restricted.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Desktop 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Desktop 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP4:xen-doc-html-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP4:xen-tools-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP4:xen-tools-domU-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-doc-html-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-tools-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-tools-domU-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12 SP4:xen-devel-4.11.1_02-2.3.1.aarch64",
          "SUSE Linux Enterprise Software Development Kit 12 SP4:xen-devel-4.11.1_02-2.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-18883",
          "url": "https://www.suse.com/security/cve/CVE-2018-18883"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1114405 for CVE-2018-18883",
          "url": "https://bugzilla.suse.com/1114405"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-doc-html-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-tools-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-tools-domU-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-doc-html-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-tools-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-tools-domU-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP4:xen-devel-4.11.1_02-2.3.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP4:xen-devel-4.11.1_02-2.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Desktop 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-doc-html-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-tools-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-tools-domU-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-doc-html-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-tools-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-tools-domU-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP4:xen-devel-4.11.1_02-2.3.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP4:xen-devel-4.11.1_02-2.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2019-01-02T10:39:50Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-18883"
    },
    {
      "cve": "CVE-2018-19665",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-19665"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The Bluetooth subsystem in QEMU mishandles negative values for length variables, leading to memory corruption.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Desktop 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Desktop 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP4:xen-doc-html-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP4:xen-tools-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP4:xen-tools-domU-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-doc-html-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-tools-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-tools-domU-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12 SP4:xen-devel-4.11.1_02-2.3.1.aarch64",
          "SUSE Linux Enterprise Software Development Kit 12 SP4:xen-devel-4.11.1_02-2.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-19665",
          "url": "https://www.suse.com/security/cve/CVE-2018-19665"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1117749 for CVE-2018-19665",
          "url": "https://bugzilla.suse.com/1117749"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1117756 for CVE-2018-19665",
          "url": "https://bugzilla.suse.com/1117756"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1178658 for CVE-2018-19665",
          "url": "https://bugzilla.suse.com/1178658"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-doc-html-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-tools-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-tools-domU-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-doc-html-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-tools-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-tools-domU-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP4:xen-devel-4.11.1_02-2.3.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP4:xen-devel-4.11.1_02-2.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Desktop 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-doc-html-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-tools-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-tools-domU-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-doc-html-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-tools-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-tools-domU-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP4:xen-devel-4.11.1_02-2.3.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP4:xen-devel-4.11.1_02-2.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2019-01-02T10:39:50Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-19665"
    },
    {
      "cve": "CVE-2018-19961",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-19961"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An issue was discovered in Xen through 4.11.x on AMD x86 platforms, possibly allowing guest OS users to gain host OS privileges because TLB flushes do not always occur after IOMMU mapping changes.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Desktop 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Desktop 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP4:xen-doc-html-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP4:xen-tools-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP4:xen-tools-domU-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-doc-html-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-tools-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-tools-domU-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12 SP4:xen-devel-4.11.1_02-2.3.1.aarch64",
          "SUSE Linux Enterprise Software Development Kit 12 SP4:xen-devel-4.11.1_02-2.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-19961",
          "url": "https://www.suse.com/security/cve/CVE-2018-19961"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1115040 for CVE-2018-19961",
          "url": "https://bugzilla.suse.com/1115040"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1178658 for CVE-2018-19961",
          "url": "https://bugzilla.suse.com/1178658"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-doc-html-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-tools-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-tools-domU-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-doc-html-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-tools-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-tools-domU-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP4:xen-devel-4.11.1_02-2.3.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP4:xen-devel-4.11.1_02-2.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Desktop 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-doc-html-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-tools-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-tools-domU-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-doc-html-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-tools-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-tools-domU-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP4:xen-devel-4.11.1_02-2.3.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP4:xen-devel-4.11.1_02-2.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2019-01-02T10:39:50Z",
          "details": "important"
        }
      ],
      "title": "CVE-2018-19961"
    },
    {
      "cve": "CVE-2018-19962",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-19962"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An issue was discovered in Xen through 4.11.x on AMD x86 platforms, possibly allowing guest OS users to gain host OS privileges because small IOMMU mappings are unsafely combined into larger ones.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Desktop 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Desktop 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP4:xen-doc-html-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP4:xen-tools-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP4:xen-tools-domU-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-doc-html-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-tools-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-tools-domU-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12 SP4:xen-devel-4.11.1_02-2.3.1.aarch64",
          "SUSE Linux Enterprise Software Development Kit 12 SP4:xen-devel-4.11.1_02-2.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-19962",
          "url": "https://www.suse.com/security/cve/CVE-2018-19962"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1115040 for CVE-2018-19962",
          "url": "https://bugzilla.suse.com/1115040"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1178658 for CVE-2018-19962",
          "url": "https://bugzilla.suse.com/1178658"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-doc-html-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-tools-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-tools-domU-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-doc-html-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-tools-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-tools-domU-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP4:xen-devel-4.11.1_02-2.3.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP4:xen-devel-4.11.1_02-2.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Desktop 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-doc-html-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-tools-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-tools-domU-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-doc-html-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-tools-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-tools-domU-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP4:xen-devel-4.11.1_02-2.3.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP4:xen-devel-4.11.1_02-2.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2019-01-02T10:39:50Z",
          "details": "important"
        }
      ],
      "title": "CVE-2018-19962"
    },
    {
      "cve": "CVE-2018-19963",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-19963"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An issue was discovered in Xen 4.11 allowing HVM guest OS users to cause a denial of service (host OS crash) or possibly gain host OS privileges because x86 IOREQ server resource accounting (for external emulators) was mishandled.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Desktop 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Desktop 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP4:xen-doc-html-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP4:xen-tools-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP4:xen-tools-domU-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-doc-html-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-tools-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-tools-domU-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12 SP4:xen-devel-4.11.1_02-2.3.1.aarch64",
          "SUSE Linux Enterprise Software Development Kit 12 SP4:xen-devel-4.11.1_02-2.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-19963",
          "url": "https://www.suse.com/security/cve/CVE-2018-19963"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1115043 for CVE-2018-19963",
          "url": "https://bugzilla.suse.com/1115043"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-doc-html-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-tools-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-tools-domU-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-doc-html-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-tools-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-tools-domU-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP4:xen-devel-4.11.1_02-2.3.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP4:xen-devel-4.11.1_02-2.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Desktop 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-doc-html-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-tools-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-tools-domU-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-doc-html-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-tools-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-tools-domU-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP4:xen-devel-4.11.1_02-2.3.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP4:xen-devel-4.11.1_02-2.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2019-01-02T10:39:50Z",
          "details": "important"
        }
      ],
      "title": "CVE-2018-19963"
    },
    {
      "cve": "CVE-2018-19964",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-19964"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An issue was discovered in Xen 4.11.x allowing x86 guest OS users to cause a denial of service (host OS hang) because the p2m lock remains unavailable indefinitely in certain error conditions.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Desktop 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Desktop 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP4:xen-doc-html-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP4:xen-tools-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP4:xen-tools-domU-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-doc-html-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-tools-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-tools-domU-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12 SP4:xen-devel-4.11.1_02-2.3.1.aarch64",
          "SUSE Linux Enterprise Software Development Kit 12 SP4:xen-devel-4.11.1_02-2.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-19964",
          "url": "https://www.suse.com/security/cve/CVE-2018-19964"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1115044 for CVE-2018-19964",
          "url": "https://bugzilla.suse.com/1115044"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-doc-html-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-tools-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-tools-domU-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-doc-html-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-tools-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-tools-domU-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP4:xen-devel-4.11.1_02-2.3.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP4:xen-devel-4.11.1_02-2.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.6,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Desktop 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-doc-html-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-tools-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-tools-domU-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-doc-html-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-tools-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-tools-domU-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP4:xen-devel-4.11.1_02-2.3.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP4:xen-devel-4.11.1_02-2.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2019-01-02T10:39:50Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-19964"
    },
    {
      "cve": "CVE-2018-19965",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-19965"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An issue was discovered in Xen through 4.11.x allowing 64-bit PV guest OS users to cause a denial of service (host OS crash) because #GP[0] can occur after a non-canonical address is passed to the TLB flushing code. NOTE: this issue exists because of an incorrect CVE-2017-5754 (aka Meltdown) mitigation.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Desktop 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Desktop 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP4:xen-doc-html-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP4:xen-tools-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP4:xen-tools-domU-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-doc-html-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-tools-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-tools-domU-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12 SP4:xen-devel-4.11.1_02-2.3.1.aarch64",
          "SUSE Linux Enterprise Software Development Kit 12 SP4:xen-devel-4.11.1_02-2.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-19965",
          "url": "https://www.suse.com/security/cve/CVE-2018-19965"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1115045 for CVE-2018-19965",
          "url": "https://bugzilla.suse.com/1115045"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-doc-html-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-tools-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-tools-domU-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-doc-html-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-tools-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-tools-domU-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP4:xen-devel-4.11.1_02-2.3.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP4:xen-devel-4.11.1_02-2.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.6,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Desktop 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-doc-html-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-tools-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-tools-domU-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-doc-html-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-tools-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-tools-domU-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP4:xen-devel-4.11.1_02-2.3.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP4:xen-devel-4.11.1_02-2.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2019-01-02T10:39:50Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-19965"
    },
    {
      "cve": "CVE-2018-19966",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-19966"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service (host OS crash) or possibly gain host OS privileges because of an interpretation conflict for a union data structure associated with shadow paging. NOTE: this issue exists because of an incorrect fix for CVE-2017-15595.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Desktop 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Desktop 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP4:xen-doc-html-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP4:xen-tools-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP4:xen-tools-domU-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-doc-html-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-tools-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-tools-domU-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12 SP4:xen-devel-4.11.1_02-2.3.1.aarch64",
          "SUSE Linux Enterprise Software Development Kit 12 SP4:xen-devel-4.11.1_02-2.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-19966",
          "url": "https://www.suse.com/security/cve/CVE-2018-19966"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1115047 for CVE-2018-19966",
          "url": "https://bugzilla.suse.com/1115047"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1178658 for CVE-2018-19966",
          "url": "https://bugzilla.suse.com/1178658"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-doc-html-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-tools-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-tools-domU-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-doc-html-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-tools-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-tools-domU-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP4:xen-devel-4.11.1_02-2.3.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP4:xen-devel-4.11.1_02-2.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Desktop 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-doc-html-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-tools-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-tools-domU-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-doc-html-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-tools-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-tools-domU-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP4:xen-devel-4.11.1_02-2.3.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP4:xen-devel-4.11.1_02-2.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2019-01-02T10:39:50Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-19966"
    },
    {
      "cve": "CVE-2018-19967",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-19967"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An issue was discovered in Xen through 4.11.x on Intel x86 platforms allowing guest OS users to cause a denial of service (host OS hang) because Xen does not work around Intel\u0027s mishandling of certain HLE transactions associated with the KACQUIRE instruction prefix.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Desktop 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Desktop 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP4:xen-doc-html-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP4:xen-tools-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP4:xen-tools-domU-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-doc-html-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-tools-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-tools-domU-4.11.1_02-2.3.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12 SP4:xen-devel-4.11.1_02-2.3.1.aarch64",
          "SUSE Linux Enterprise Software Development Kit 12 SP4:xen-devel-4.11.1_02-2.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-19967",
          "url": "https://www.suse.com/security/cve/CVE-2018-19967"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1114988 for CVE-2018-19967",
          "url": "https://bugzilla.suse.com/1114988"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1178658 for CVE-2018-19967",
          "url": "https://bugzilla.suse.com/1178658"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-doc-html-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-tools-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-tools-domU-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-doc-html-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-tools-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-tools-domU-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP4:xen-devel-4.11.1_02-2.3.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP4:xen-devel-4.11.1_02-2.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.6,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Desktop 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Desktop 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-doc-html-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-tools-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4:xen-tools-domU-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-doc-html-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-libs-32bit-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-libs-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-tools-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-tools-domU-4.11.1_02-2.3.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP4:xen-devel-4.11.1_02-2.3.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP4:xen-devel-4.11.1_02-2.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2019-01-02T10:39:50Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-19967"
    }
  ]
}

CVE-2018-19962 (GCVE-0-2018-19962)

Vulnerability from cvelistv5

Published

2018-12-08 04:00

Modified

2024-08-05 11:51

Severity ?

CWE

Summary

An issue was discovered in Xen through 4.11.x on AMD x86 platforms, possibly allowing guest OS users to gain host OS privileges because small IOMMU mappings are unsafely combined into larger ones.

References

►

URL

Tags

	https://support.citrix.com/article/CTX239432	x_refsource_CONFIRM
	https://www.debian.org/security/2019/dsa-4369	vendor-advisory, x_refsource_DEBIAN
	http://www.securityfocus.com/bid/106182	vdb-entry, x_refsource_BID
	https://xenbits.xen.org/xsa/advisory-275.html	x_refsource_MISC
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UXC6BME7SXJI2ZIATNXCAH7RGPI4UKTT/	vendor-advisory, x_refsource_FEDORA
	http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00072.html	vendor-advisory, x_refsource_SUSE
	https://lists.debian.org/debian-lts-announce/2019/10/msg00008.html	mailing-list, x_refsource_MLIST

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T11:51:17.785Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://support.citrix.com/article/CTX239432"
          },
          {
            "name": "DSA-4369",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2019/dsa-4369"
          },
          {
            "name": "106182",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/106182"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://xenbits.xen.org/xsa/advisory-275.html"
          },
          {
            "name": "FEDORA-2019-bce6498890",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UXC6BME7SXJI2ZIATNXCAH7RGPI4UKTT/"
          },
          {
            "name": "openSUSE-SU-2019:1226",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00072.html"
          },
          {
            "name": "[debian-lts-announce] 20191008 [SECURITY] [DLA 1949-1] xen security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2019/10/msg00008.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2018-12-07T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "An issue was discovered in Xen through 4.11.x on AMD x86 platforms, possibly allowing guest OS users to gain host OS privileges because small IOMMU mappings are unsafely combined into larger ones."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-10-08T14:06:09",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://support.citrix.com/article/CTX239432"
        },
        {
          "name": "DSA-4369",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2019/dsa-4369"
        },
        {
          "name": "106182",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/106182"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://xenbits.xen.org/xsa/advisory-275.html"
        },
        {
          "name": "FEDORA-2019-bce6498890",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UXC6BME7SXJI2ZIATNXCAH7RGPI4UKTT/"
        },
        {
          "name": "openSUSE-SU-2019:1226",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00072.html"
        },
        {
          "name": "[debian-lts-announce] 20191008 [SECURITY] [DLA 1949-1] xen security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2019/10/msg00008.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2018-19962",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An issue was discovered in Xen through 4.11.x on AMD x86 platforms, possibly allowing guest OS users to gain host OS privileges because small IOMMU mappings are unsafely combined into larger ones."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://support.citrix.com/article/CTX239432",
              "refsource": "CONFIRM",
              "url": "https://support.citrix.com/article/CTX239432"
            },
            {
              "name": "DSA-4369",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2019/dsa-4369"
            },
            {
              "name": "106182",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/106182"
            },
            {
              "name": "https://xenbits.xen.org/xsa/advisory-275.html",
              "refsource": "MISC",
              "url": "https://xenbits.xen.org/xsa/advisory-275.html"
            },
            {
              "name": "FEDORA-2019-bce6498890",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UXC6BME7SXJI2ZIATNXCAH7RGPI4UKTT/"
            },
            {
              "name": "openSUSE-SU-2019:1226",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00072.html"
            },
            {
              "name": "[debian-lts-announce] 20191008 [SECURITY] [DLA 1949-1] xen security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2019/10/msg00008.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-19962",
    "datePublished": "2018-12-08T04:00:00",
    "dateReserved": "2018-12-07T00:00:00",
    "dateUpdated": "2024-08-05T11:51:17.785Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2018-19964 (GCVE-0-2018-19964)

Vulnerability from cvelistv5

Published

2018-12-08 04:00

Modified

2024-08-05 11:51

Severity ?

CWE

Summary

An issue was discovered in Xen 4.11.x allowing x86 guest OS users to cause a denial of service (host OS hang) because the p2m lock remains unavailable indefinitely in certain error conditions.

References

►

URL

Tags

	https://xenbits.xen.org/xsa/advisory-277.html	x_refsource_MISC
	http://www.securityfocus.com/bid/106182	vdb-entry, x_refsource_BID

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T11:51:17.909Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://xenbits.xen.org/xsa/advisory-277.html"
          },
          {
            "name": "106182",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/106182"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2018-12-07T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "An issue was discovered in Xen 4.11.x allowing x86 guest OS users to cause a denial of service (host OS hang) because the p2m lock remains unavailable indefinitely in certain error conditions."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-12-13T10:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://xenbits.xen.org/xsa/advisory-277.html"
        },
        {
          "name": "106182",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/106182"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2018-19964",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An issue was discovered in Xen 4.11.x allowing x86 guest OS users to cause a denial of service (host OS hang) because the p2m lock remains unavailable indefinitely in certain error conditions."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://xenbits.xen.org/xsa/advisory-277.html",
              "refsource": "MISC",
              "url": "https://xenbits.xen.org/xsa/advisory-277.html"
            },
            {
              "name": "106182",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/106182"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-19964",
    "datePublished": "2018-12-08T04:00:00",
    "dateReserved": "2018-12-07T00:00:00",
    "dateUpdated": "2024-08-05T11:51:17.909Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2018-19665 (GCVE-0-2018-19665)

Vulnerability from cvelistv5

Published

2018-12-06 23:00

Modified

2024-08-05 11:44

Severity ?

CWE

Summary

The Bluetooth subsystem in QEMU mishandles negative values for length variables, leading to memory corruption.

References

►

URL

Tags

	https://lists.gnu.org/archive/html/qemu-devel/2018-11/msg03570.html	mailing-list, x_refsource_MLIST
	http://www.securityfocus.com/bid/106050	vdb-entry, x_refsource_BID
	http://www.openwall.com/lists/oss-security/2018/11/29/1	mailing-list, x_refsource_MLIST
	http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00072.html	vendor-advisory, x_refsource_SUSE

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T11:44:19.612Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "[qemu-devel] 20181119 [PATCH v2] bt: use size_t type for length parameters instead of int",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.gnu.org/archive/html/qemu-devel/2018-11/msg03570.html"
          },
          {
            "name": "106050",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/106050"
          },
          {
            "name": "[oss-security] 20181129 CVE-2018-19665 Qemu: bt: integer overflow in Bluetooth routines allows memory corruption",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2018/11/29/1"
          },
          {
            "name": "openSUSE-SU-2019:1226",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00072.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2018-11-29T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The Bluetooth subsystem in QEMU mishandles negative values for length variables, leading to memory corruption."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-04-17T20:06:04",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "[qemu-devel] 20181119 [PATCH v2] bt: use size_t type for length parameters instead of int",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.gnu.org/archive/html/qemu-devel/2018-11/msg03570.html"
        },
        {
          "name": "106050",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/106050"
        },
        {
          "name": "[oss-security] 20181129 CVE-2018-19665 Qemu: bt: integer overflow in Bluetooth routines allows memory corruption",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2018/11/29/1"
        },
        {
          "name": "openSUSE-SU-2019:1226",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00072.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2018-19665",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Bluetooth subsystem in QEMU mishandles negative values for length variables, leading to memory corruption."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "[qemu-devel] 20181119 [PATCH v2] bt: use size_t type for length parameters instead of int",
              "refsource": "MLIST",
              "url": "https://lists.gnu.org/archive/html/qemu-devel/2018-11/msg03570.html"
            },
            {
              "name": "106050",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/106050"
            },
            {
              "name": "[oss-security] 20181129 CVE-2018-19665 Qemu: bt: integer overflow in Bluetooth routines allows memory corruption",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2018/11/29/1"
            },
            {
              "name": "openSUSE-SU-2019:1226",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00072.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-19665",
    "datePublished": "2018-12-06T23:00:00",
    "dateReserved": "2018-11-29T00:00:00",
    "dateUpdated": "2024-08-05T11:44:19.612Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2018-19967 (GCVE-0-2018-19967)

Vulnerability from cvelistv5

Published

2018-12-08 04:00

Modified

2024-08-05 11:51

Severity ?

CWE

Summary

An issue was discovered in Xen through 4.11.x on Intel x86 platforms allowing guest OS users to cause a denial of service (host OS hang) because Xen does not work around Intel's mishandling of certain HLE transactions associated with the KACQUIRE instruction prefix.

References

►

URL

Tags

	https://xenbits.xen.org/xsa/advisory-282.html	x_refsource_MISC
	https://support.citrix.com/article/CTX239432	x_refsource_CONFIRM
	https://www.debian.org/security/2019/dsa-4369	vendor-advisory, x_refsource_DEBIAN
	http://www.securityfocus.com/bid/106182	vdb-entry, x_refsource_BID
	http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00057.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00072.html	vendor-advisory, x_refsource_SUSE

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T11:51:17.772Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://xenbits.xen.org/xsa/advisory-282.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://support.citrix.com/article/CTX239432"
          },
          {
            "name": "DSA-4369",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2019/dsa-4369"
          },
          {
            "name": "106182",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/106182"
          },
          {
            "name": "openSUSE-SU-2019:1199",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00057.html"
          },
          {
            "name": "openSUSE-SU-2019:1226",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00072.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2018-12-07T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "An issue was discovered in Xen through 4.11.x on Intel x86 platforms allowing guest OS users to cause a denial of service (host OS hang) because Xen does not work around Intel\u0027s mishandling of certain HLE transactions associated with the KACQUIRE instruction prefix."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-04-17T20:06:05",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://xenbits.xen.org/xsa/advisory-282.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://support.citrix.com/article/CTX239432"
        },
        {
          "name": "DSA-4369",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2019/dsa-4369"
        },
        {
          "name": "106182",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/106182"
        },
        {
          "name": "openSUSE-SU-2019:1199",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00057.html"
        },
        {
          "name": "openSUSE-SU-2019:1226",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00072.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2018-19967",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An issue was discovered in Xen through 4.11.x on Intel x86 platforms allowing guest OS users to cause a denial of service (host OS hang) because Xen does not work around Intel\u0027s mishandling of certain HLE transactions associated with the KACQUIRE instruction prefix."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://xenbits.xen.org/xsa/advisory-282.html",
              "refsource": "MISC",
              "url": "https://xenbits.xen.org/xsa/advisory-282.html"
            },
            {
              "name": "https://support.citrix.com/article/CTX239432",
              "refsource": "CONFIRM",
              "url": "https://support.citrix.com/article/CTX239432"
            },
            {
              "name": "DSA-4369",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2019/dsa-4369"
            },
            {
              "name": "106182",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/106182"
            },
            {
              "name": "openSUSE-SU-2019:1199",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00057.html"
            },
            {
              "name": "openSUSE-SU-2019:1226",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00072.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-19967",
    "datePublished": "2018-12-08T04:00:00",
    "dateReserved": "2018-12-07T00:00:00",
    "dateUpdated": "2024-08-05T11:51:17.772Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2018-18849 (GCVE-0-2018-18849)

Vulnerability from cvelistv5

Published

2019-03-17 19:56

Modified

2024-08-05 11:23

Severity ?

CWE

Summary

In Qemu 3.0.0, lsi_do_msgin in hw/scsi/lsi53c895a.c allows out-of-bounds access by triggering an invalid msg_len value.

References

►

URL

Tags

	https://usn.ubuntu.com/3826-1/	vendor-advisory, x_refsource_UBUNTU
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LQIBTGNRDQEXGAAYHE4JIWFAYFNHZ6QP/	vendor-advisory, x_refsource_FEDORA
	http://lists.opensuse.org/opensuse-security-announce/2018-12/msg00028.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2018-12/msg00043.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2018-12/msg00004.html	vendor-advisory, x_refsource_SUSE
	http://www.openwall.com/lists/oss-security/2018/11/01/1	x_refsource_MISC
	https://lists.gnu.org/archive/html/qemu-devel/2018-10/msg06401.html	x_refsource_MISC
	https://security.netapp.com/advisory/ntap-20190411-0006/	x_refsource_CONFIRM
	https://lists.debian.org/debian-lts-announce/2019/05/msg00010.html	mailing-list, x_refsource_MLIST
	https://www.debian.org/security/2019/dsa-4454	vendor-advisory, x_refsource_DEBIAN
	https://seclists.org/bugtraq/2019/May/76	mailing-list, x_refsource_BUGTRAQ

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T11:23:08.494Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "USN-3826-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3826-1/"
          },
          {
            "name": "FEDORA-2018-87f2ace20d",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LQIBTGNRDQEXGAAYHE4JIWFAYFNHZ6QP/"
          },
          {
            "name": "openSUSE-SU-2018:4111",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2018-12/msg00028.html"
          },
          {
            "name": "openSUSE-SU-2018:4147",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2018-12/msg00043.html"
          },
          {
            "name": "openSUSE-SU-2018:4004",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2018-12/msg00004.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2018/11/01/1"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://lists.gnu.org/archive/html/qemu-devel/2018-10/msg06401.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20190411-0006/"
          },
          {
            "name": "[debian-lts-announce] 20190509 [SECURITY] [DLA 1781-1] qemu security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2019/05/msg00010.html"
          },
          {
            "name": "DSA-4454",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2019/dsa-4454"
          },
          {
            "name": "20190531 [SECURITY] [DSA 4454-1] qemu security update",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "https://seclists.org/bugtraq/2019/May/76"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In Qemu 3.0.0, lsi_do_msgin in hw/scsi/lsi53c895a.c allows out-of-bounds access by triggering an invalid msg_len value."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-05-31T13:06:05",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "USN-3826-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3826-1/"
        },
        {
          "name": "FEDORA-2018-87f2ace20d",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LQIBTGNRDQEXGAAYHE4JIWFAYFNHZ6QP/"
        },
        {
          "name": "openSUSE-SU-2018:4111",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2018-12/msg00028.html"
        },
        {
          "name": "openSUSE-SU-2018:4147",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2018-12/msg00043.html"
        },
        {
          "name": "openSUSE-SU-2018:4004",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2018-12/msg00004.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2018/11/01/1"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://lists.gnu.org/archive/html/qemu-devel/2018-10/msg06401.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20190411-0006/"
        },
        {
          "name": "[debian-lts-announce] 20190509 [SECURITY] [DLA 1781-1] qemu security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2019/05/msg00010.html"
        },
        {
          "name": "DSA-4454",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2019/dsa-4454"
        },
        {
          "name": "20190531 [SECURITY] [DSA 4454-1] qemu security update",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "https://seclists.org/bugtraq/2019/May/76"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2018-18849",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In Qemu 3.0.0, lsi_do_msgin in hw/scsi/lsi53c895a.c allows out-of-bounds access by triggering an invalid msg_len value."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "USN-3826-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/3826-1/"
            },
            {
              "name": "FEDORA-2018-87f2ace20d",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LQIBTGNRDQEXGAAYHE4JIWFAYFNHZ6QP/"
            },
            {
              "name": "openSUSE-SU-2018:4111",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2018-12/msg00028.html"
            },
            {
              "name": "openSUSE-SU-2018:4147",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2018-12/msg00043.html"
            },
            {
              "name": "openSUSE-SU-2018:4004",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2018-12/msg00004.html"
            },
            {
              "name": "http://www.openwall.com/lists/oss-security/2018/11/01/1",
              "refsource": "MISC",
              "url": "http://www.openwall.com/lists/oss-security/2018/11/01/1"
            },
            {
              "name": "https://lists.gnu.org/archive/html/qemu-devel/2018-10/msg06401.html",
              "refsource": "MISC",
              "url": "https://lists.gnu.org/archive/html/qemu-devel/2018-10/msg06401.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20190411-0006/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20190411-0006/"
            },
            {
              "name": "[debian-lts-announce] 20190509 [SECURITY] [DLA 1781-1] qemu security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2019/05/msg00010.html"
            },
            {
              "name": "DSA-4454",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2019/dsa-4454"
            },
            {
              "name": "20190531 [SECURITY] [DSA 4454-1] qemu security update",
              "refsource": "BUGTRAQ",
              "url": "https://seclists.org/bugtraq/2019/May/76"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-18849",
    "datePublished": "2019-03-17T19:56:41",
    "dateReserved": "2018-10-30T00:00:00",
    "dateUpdated": "2024-08-05T11:23:08.494Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2018-17963 (GCVE-0-2018-17963)

Vulnerability from cvelistv5

Published

2018-10-09 22:00

Modified

2024-08-05 11:01

Severity ?

CWE

Summary

qemu_deliver_packet_iov in net/net.c in Qemu accepts packet sizes greater than INT_MAX, which allows attackers to cause a denial of service or possibly have unspecified other impact.

References

►

URL

Tags

	http://www.openwall.com/lists/oss-security/2018/10/08/1	mailing-list, x_refsource_MLIST
	https://www.debian.org/security/2018/dsa-4338	vendor-advisory, x_refsource_DEBIAN
	https://lists.gnu.org/archive/html/qemu-devel/2018-09/msg03267.html	mailing-list, x_refsource_MLIST
	https://usn.ubuntu.com/3826-1/	vendor-advisory, x_refsource_UBUNTU
	https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html	mailing-list, x_refsource_MLIST
	https://lists.gnu.org/archive/html/qemu-devel/2018-11/msg06054.html	x_refsource_MISC
	https://access.redhat.com/errata/RHSA-2019:2166	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2019:2425	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2019:2553	vendor-advisory, x_refsource_REDHAT

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T11:01:14.685Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "[oss-security] 20181008 Qemu: integer overflow issues",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2018/10/08/1"
          },
          {
            "name": "DSA-4338",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2018/dsa-4338"
          },
          {
            "name": "[qemu-devel] 20180926 [PULL 24/25] net: ignore packet size greater than INT_MAX",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.gnu.org/archive/html/qemu-devel/2018-09/msg03267.html"
          },
          {
            "name": "USN-3826-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3826-1/"
          },
          {
            "name": "[debian-lts-announce] 20181130 [SECURITY] [DLA 1599-1] qemu security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://lists.gnu.org/archive/html/qemu-devel/2018-11/msg06054.html"
          },
          {
            "name": "RHSA-2019:2166",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:2166"
          },
          {
            "name": "RHSA-2019:2425",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:2425"
          },
          {
            "name": "RHSA-2019:2553",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:2553"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2018-09-26T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "qemu_deliver_packet_iov in net/net.c in Qemu accepts packet sizes greater than INT_MAX, which allows attackers to cause a denial of service or possibly have unspecified other impact."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-02-27T04:32:05",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "[oss-security] 20181008 Qemu: integer overflow issues",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2018/10/08/1"
        },
        {
          "name": "DSA-4338",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2018/dsa-4338"
        },
        {
          "name": "[qemu-devel] 20180926 [PULL 24/25] net: ignore packet size greater than INT_MAX",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.gnu.org/archive/html/qemu-devel/2018-09/msg03267.html"
        },
        {
          "name": "USN-3826-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3826-1/"
        },
        {
          "name": "[debian-lts-announce] 20181130 [SECURITY] [DLA 1599-1] qemu security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://lists.gnu.org/archive/html/qemu-devel/2018-11/msg06054.html"
        },
        {
          "name": "RHSA-2019:2166",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:2166"
        },
        {
          "name": "RHSA-2019:2425",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:2425"
        },
        {
          "name": "RHSA-2019:2553",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:2553"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2018-17963",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "qemu_deliver_packet_iov in net/net.c in Qemu accepts packet sizes greater than INT_MAX, which allows attackers to cause a denial of service or possibly have unspecified other impact."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "[oss-security] 20181008 Qemu: integer overflow issues",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2018/10/08/1"
            },
            {
              "name": "DSA-4338",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2018/dsa-4338"
            },
            {
              "name": "[qemu-devel] 20180926 [PULL 24/25] net: ignore packet size greater than INT_MAX",
              "refsource": "MLIST",
              "url": "https://lists.gnu.org/archive/html/qemu-devel/2018-09/msg03267.html"
            },
            {
              "name": "USN-3826-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/3826-1/"
            },
            {
              "name": "[debian-lts-announce] 20181130 [SECURITY] [DLA 1599-1] qemu security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html"
            },
            {
              "name": "https://lists.gnu.org/archive/html/qemu-devel/2018-11/msg06054.html",
              "refsource": "MISC",
              "url": "https://lists.gnu.org/archive/html/qemu-devel/2018-11/msg06054.html"
            },
            {
              "name": "RHSA-2019:2166",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:2166"
            },
            {
              "name": "RHSA-2019:2425",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:2425"
            },
            {
              "name": "RHSA-2019:2553",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:2553"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-17963",
    "datePublished": "2018-10-09T22:00:00",
    "dateReserved": "2018-10-03T00:00:00",
    "dateUpdated": "2024-08-05T11:01:14.685Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2018-19966 (GCVE-0-2018-19966)

Vulnerability from cvelistv5

Published

2018-12-08 04:00

Modified

2024-08-05 11:51

Severity ?

CWE

Summary

An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service (host OS crash) or possibly gain host OS privileges because of an interpretation conflict for a union data structure associated with shadow paging. NOTE: this issue exists because of an incorrect fix for CVE-2017-15595.

References

►

URL

Tags

	https://www.debian.org/security/2019/dsa-4369	vendor-advisory, x_refsource_DEBIAN
	https://xenbits.xen.org/xsa/advisory-280.html	x_refsource_MISC
	http://www.securityfocus.com/bid/106182	vdb-entry, x_refsource_BID
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UXC6BME7SXJI2ZIATNXCAH7RGPI4UKTT/	vendor-advisory, x_refsource_FEDORA
	http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00072.html	vendor-advisory, x_refsource_SUSE
	https://lists.debian.org/debian-lts-announce/2019/10/msg00008.html	mailing-list, x_refsource_MLIST

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T11:51:17.776Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "DSA-4369",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2019/dsa-4369"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://xenbits.xen.org/xsa/advisory-280.html"
          },
          {
            "name": "106182",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/106182"
          },
          {
            "name": "FEDORA-2019-bce6498890",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UXC6BME7SXJI2ZIATNXCAH7RGPI4UKTT/"
          },
          {
            "name": "openSUSE-SU-2019:1226",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00072.html"
          },
          {
            "name": "[debian-lts-announce] 20191008 [SECURITY] [DLA 1949-1] xen security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2019/10/msg00008.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2018-12-07T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service (host OS crash) or possibly gain host OS privileges because of an interpretation conflict for a union data structure associated with shadow paging. NOTE: this issue exists because of an incorrect fix for CVE-2017-15595."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-10-08T14:06:09",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "DSA-4369",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2019/dsa-4369"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://xenbits.xen.org/xsa/advisory-280.html"
        },
        {
          "name": "106182",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/106182"
        },
        {
          "name": "FEDORA-2019-bce6498890",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UXC6BME7SXJI2ZIATNXCAH7RGPI4UKTT/"
        },
        {
          "name": "openSUSE-SU-2019:1226",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00072.html"
        },
        {
          "name": "[debian-lts-announce] 20191008 [SECURITY] [DLA 1949-1] xen security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2019/10/msg00008.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2018-19966",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service (host OS crash) or possibly gain host OS privileges because of an interpretation conflict for a union data structure associated with shadow paging. NOTE: this issue exists because of an incorrect fix for CVE-2017-15595."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "DSA-4369",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2019/dsa-4369"
            },
            {
              "name": "https://xenbits.xen.org/xsa/advisory-280.html",
              "refsource": "MISC",
              "url": "https://xenbits.xen.org/xsa/advisory-280.html"
            },
            {
              "name": "106182",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/106182"
            },
            {
              "name": "FEDORA-2019-bce6498890",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UXC6BME7SXJI2ZIATNXCAH7RGPI4UKTT/"
            },
            {
              "name": "openSUSE-SU-2019:1226",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00072.html"
            },
            {
              "name": "[debian-lts-announce] 20191008 [SECURITY] [DLA 1949-1] xen security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2019/10/msg00008.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-19966",
    "datePublished": "2018-12-08T04:00:00",
    "dateReserved": "2018-12-07T00:00:00",
    "dateUpdated": "2024-08-05T11:51:17.776Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2018-19961 (GCVE-0-2018-19961)

Vulnerability from cvelistv5

Published

2018-12-08 04:00

Modified

2024-08-05 11:51

Severity ?

CWE

Summary

An issue was discovered in Xen through 4.11.x on AMD x86 platforms, possibly allowing guest OS users to gain host OS privileges because TLB flushes do not always occur after IOMMU mapping changes.

References

►

URL

Tags

	https://support.citrix.com/article/CTX239432	x_refsource_CONFIRM
	https://www.debian.org/security/2019/dsa-4369	vendor-advisory, x_refsource_DEBIAN
	http://www.securityfocus.com/bid/106182	vdb-entry, x_refsource_BID
	https://xenbits.xen.org/xsa/advisory-275.html	x_refsource_MISC
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UXC6BME7SXJI2ZIATNXCAH7RGPI4UKTT/	vendor-advisory, x_refsource_FEDORA
	http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00072.html	vendor-advisory, x_refsource_SUSE
	https://lists.debian.org/debian-lts-announce/2019/10/msg00008.html	mailing-list, x_refsource_MLIST

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T11:51:17.944Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://support.citrix.com/article/CTX239432"
          },
          {
            "name": "DSA-4369",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2019/dsa-4369"
          },
          {
            "name": "106182",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/106182"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://xenbits.xen.org/xsa/advisory-275.html"
          },
          {
            "name": "FEDORA-2019-bce6498890",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UXC6BME7SXJI2ZIATNXCAH7RGPI4UKTT/"
          },
          {
            "name": "openSUSE-SU-2019:1226",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00072.html"
          },
          {
            "name": "[debian-lts-announce] 20191008 [SECURITY] [DLA 1949-1] xen security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2019/10/msg00008.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2018-12-07T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "An issue was discovered in Xen through 4.11.x on AMD x86 platforms, possibly allowing guest OS users to gain host OS privileges because TLB flushes do not always occur after IOMMU mapping changes."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-10-08T14:06:08",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://support.citrix.com/article/CTX239432"
        },
        {
          "name": "DSA-4369",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2019/dsa-4369"
        },
        {
          "name": "106182",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/106182"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://xenbits.xen.org/xsa/advisory-275.html"
        },
        {
          "name": "FEDORA-2019-bce6498890",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UXC6BME7SXJI2ZIATNXCAH7RGPI4UKTT/"
        },
        {
          "name": "openSUSE-SU-2019:1226",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00072.html"
        },
        {
          "name": "[debian-lts-announce] 20191008 [SECURITY] [DLA 1949-1] xen security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2019/10/msg00008.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2018-19961",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An issue was discovered in Xen through 4.11.x on AMD x86 platforms, possibly allowing guest OS users to gain host OS privileges because TLB flushes do not always occur after IOMMU mapping changes."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://support.citrix.com/article/CTX239432",
              "refsource": "CONFIRM",
              "url": "https://support.citrix.com/article/CTX239432"
            },
            {
              "name": "DSA-4369",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2019/dsa-4369"
            },
            {
              "name": "106182",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/106182"
            },
            {
              "name": "https://xenbits.xen.org/xsa/advisory-275.html",
              "refsource": "MISC",
              "url": "https://xenbits.xen.org/xsa/advisory-275.html"
            },
            {
              "name": "FEDORA-2019-bce6498890",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UXC6BME7SXJI2ZIATNXCAH7RGPI4UKTT/"
            },
            {
              "name": "openSUSE-SU-2019:1226",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00072.html"
            },
            {
              "name": "[debian-lts-announce] 20191008 [SECURITY] [DLA 1949-1] xen security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2019/10/msg00008.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-19961",
    "datePublished": "2018-12-08T04:00:00",
    "dateReserved": "2018-12-07T00:00:00",
    "dateUpdated": "2024-08-05T11:51:17.944Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2018-18883 (GCVE-0-2018-18883)

Vulnerability from cvelistv5

Published

2018-11-01 00:00

Modified

2024-08-05 11:23

Severity ?

CWE

Summary

An issue was discovered in Xen 4.9.x through 4.11.x, on Intel x86 platforms, allowing x86 HVM and PVH guests to cause a host OS denial of service (NULL pointer dereference) or possibly have unspecified other impact because nested VT-x is not properly restricted.

References

►

URL

Tags

	https://xenbits.xen.org/xsa/advisory-278.html	x_refsource_MISC
	http://www.securitytracker.com/id/1042021	vdb-entry, x_refsource_SECTRACK
	http://www.securityfocus.com/bid/105817	vdb-entry, x_refsource_BID

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T11:23:08.479Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://xenbits.xen.org/xsa/advisory-278.html"
          },
          {
            "name": "1042021",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1042021"
          },
          {
            "name": "105817",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/105817"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2018-10-31T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "An issue was discovered in Xen 4.9.x through 4.11.x, on Intel x86 platforms, allowing x86 HVM and PVH guests to cause a host OS denial of service (NULL pointer dereference) or possibly have unspecified other impact because nested VT-x is not properly restricted."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-11-06T10:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://xenbits.xen.org/xsa/advisory-278.html"
        },
        {
          "name": "1042021",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1042021"
        },
        {
          "name": "105817",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/105817"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2018-18883",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An issue was discovered in Xen 4.9.x through 4.11.x, on Intel x86 platforms, allowing x86 HVM and PVH guests to cause a host OS denial of service (NULL pointer dereference) or possibly have unspecified other impact because nested VT-x is not properly restricted."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://xenbits.xen.org/xsa/advisory-278.html",
              "refsource": "MISC",
              "url": "https://xenbits.xen.org/xsa/advisory-278.html"
            },
            {
              "name": "1042021",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1042021"
            },
            {
              "name": "105817",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/105817"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-18883",
    "datePublished": "2018-11-01T00:00:00",
    "dateReserved": "2018-10-31T00:00:00",
    "dateUpdated": "2024-08-05T11:23:08.479Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2018-19963 (GCVE-0-2018-19963)

Vulnerability from cvelistv5

Published

2018-12-08 04:00

Modified

2024-08-05 11:51

Severity ?

CWE

Summary

An issue was discovered in Xen 4.11 allowing HVM guest OS users to cause a denial of service (host OS crash) or possibly gain host OS privileges because x86 IOREQ server resource accounting (for external emulators) was mishandled.

References

►

URL

Tags

	https://xenbits.xen.org/xsa/advisory-276.html	x_refsource_MISC
	http://www.securityfocus.com/bid/106182	vdb-entry, x_refsource_BID

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T11:51:17.938Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://xenbits.xen.org/xsa/advisory-276.html"
          },
          {
            "name": "106182",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/106182"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2018-12-07T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "An issue was discovered in Xen 4.11 allowing HVM guest OS users to cause a denial of service (host OS crash) or possibly gain host OS privileges because x86 IOREQ server resource accounting (for external emulators) was mishandled."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-12-13T10:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://xenbits.xen.org/xsa/advisory-276.html"
        },
        {
          "name": "106182",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/106182"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2018-19963",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An issue was discovered in Xen 4.11 allowing HVM guest OS users to cause a denial of service (host OS crash) or possibly gain host OS privileges because x86 IOREQ server resource accounting (for external emulators) was mishandled."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://xenbits.xen.org/xsa/advisory-276.html",
              "refsource": "MISC",
              "url": "https://xenbits.xen.org/xsa/advisory-276.html"
            },
            {
              "name": "106182",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/106182"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-19963",
    "datePublished": "2018-12-08T04:00:00",
    "dateReserved": "2018-12-07T00:00:00",
    "dateUpdated": "2024-08-05T11:51:17.938Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2018-19965 (GCVE-0-2018-19965)

Vulnerability from cvelistv5

Published

2018-12-08 04:00

Modified

2024-08-05 11:51

Severity ?

CWE

Summary

An issue was discovered in Xen through 4.11.x allowing 64-bit PV guest OS users to cause a denial of service (host OS crash) because #GP[0] can occur after a non-canonical address is passed to the TLB flushing code. NOTE: this issue exists because of an incorrect CVE-2017-5754 (aka Meltdown) mitigation.

References

►

URL

Tags

	https://support.citrix.com/article/CTX239432	x_refsource_CONFIRM
	https://xenbits.xen.org/xsa/advisory-279.html	x_refsource_MISC
	https://www.debian.org/security/2019/dsa-4369	vendor-advisory, x_refsource_DEBIAN
	http://www.securityfocus.com/bid/106182	vdb-entry, x_refsource_BID
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UXC6BME7SXJI2ZIATNXCAH7RGPI4UKTT/	vendor-advisory, x_refsource_FEDORA
	http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00072.html	vendor-advisory, x_refsource_SUSE

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T11:51:17.815Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://support.citrix.com/article/CTX239432"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://xenbits.xen.org/xsa/advisory-279.html"
          },
          {
            "name": "DSA-4369",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2019/dsa-4369"
          },
          {
            "name": "106182",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/106182"
          },
          {
            "name": "FEDORA-2019-bce6498890",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UXC6BME7SXJI2ZIATNXCAH7RGPI4UKTT/"
          },
          {
            "name": "openSUSE-SU-2019:1226",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00072.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2018-12-07T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "An issue was discovered in Xen through 4.11.x allowing 64-bit PV guest OS users to cause a denial of service (host OS crash) because #GP[0] can occur after a non-canonical address is passed to the TLB flushing code. NOTE: this issue exists because of an incorrect CVE-2017-5754 (aka Meltdown) mitigation."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-04-17T20:06:04",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://support.citrix.com/article/CTX239432"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://xenbits.xen.org/xsa/advisory-279.html"
        },
        {
          "name": "DSA-4369",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2019/dsa-4369"
        },
        {
          "name": "106182",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/106182"
        },
        {
          "name": "FEDORA-2019-bce6498890",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UXC6BME7SXJI2ZIATNXCAH7RGPI4UKTT/"
        },
        {
          "name": "openSUSE-SU-2019:1226",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00072.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2018-19965",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An issue was discovered in Xen through 4.11.x allowing 64-bit PV guest OS users to cause a denial of service (host OS crash) because #GP[0] can occur after a non-canonical address is passed to the TLB flushing code. NOTE: this issue exists because of an incorrect CVE-2017-5754 (aka Meltdown) mitigation."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://support.citrix.com/article/CTX239432",
              "refsource": "CONFIRM",
              "url": "https://support.citrix.com/article/CTX239432"
            },
            {
              "name": "https://xenbits.xen.org/xsa/advisory-279.html",
              "refsource": "MISC",
              "url": "https://xenbits.xen.org/xsa/advisory-279.html"
            },
            {
              "name": "DSA-4369",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2019/dsa-4369"
            },
            {
              "name": "106182",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/106182"
            },
            {
              "name": "FEDORA-2019-bce6498890",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UXC6BME7SXJI2ZIATNXCAH7RGPI4UKTT/"
            },
            {
              "name": "openSUSE-SU-2019:1226",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00072.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-19965",
    "datePublished": "2018-12-08T04:00:00",
    "dateReserved": "2018-12-07T00:00:00",
    "dateUpdated": "2024-08-05T11:51:17.815Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

suse-su-2019:0003-1

Vulnerability from csaf_suse

CVE-2018-19962 (GCVE-0-2018-19962)

Vulnerability from cvelistv5

CVE-2018-19964 (GCVE-0-2018-19964)

Vulnerability from cvelistv5

CVE-2018-19665 (GCVE-0-2018-19665)

Vulnerability from cvelistv5

CVE-2018-19967 (GCVE-0-2018-19967)

Vulnerability from cvelistv5

CVE-2018-18849 (GCVE-0-2018-18849)

Vulnerability from cvelistv5

CVE-2018-17963 (GCVE-0-2018-17963)

Vulnerability from cvelistv5

CVE-2018-19966 (GCVE-0-2018-19966)

Vulnerability from cvelistv5

CVE-2018-19961 (GCVE-0-2018-19961)

Vulnerability from cvelistv5

CVE-2018-18883 (GCVE-0-2018-18883)

Vulnerability from cvelistv5

CVE-2018-19963 (GCVE-0-2018-19963)

Vulnerability from cvelistv5

CVE-2018-19965 (GCVE-0-2018-19965)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature