suse-su-2019:1248-1
Vulnerability from csaf_suse
Published
2019-05-14 17:22
Modified
2019-05-14 17:22
Summary
Security update for xen

Notes

Title of the patch
Security update for xen
Description of the patch
This update for xen fixes the following issues: Four new speculative execution information leak issues have been identified in Intel CPUs. (bsc#1111331) - CVE-2018-12126: Microarchitectural Store Buffer Data Sampling (MSBDS) - CVE-2018-12127: Microarchitectural Fill Buffer Data Sampling (MFBDS) - CVE-2018-12130: Microarchitectural Load Port Data Samling (MLPDS) - CVE-2019-11091: Microarchitectural Data Sampling Uncacheable Memory (MDSUM) These updates contain the XEN Hypervisor adjustments, that additionaly also use CPU Microcode updates. The mitigation can be controlled via the 'mds' commandline option, see the documentation. For more information on this set of vulnerabilities, check out https://www.suse.com/support/kb/doc/?id=7023736 Other fixes: - Added code to change LIBXL_HOTPLUG_TIMEOUT at runtime. The included README has details about the impact of this change (bsc#1120095) - Fixes in Live migrating PV domUs An earlier change broke live migration of PV domUs without a device model. The migration would stall for 10 seconds while the domU was paused, which caused network connections to drop. Fix this by tracking the need for a device model within libxl. (bsc#1079730, bsc#1098403, bsc#1111025) - Libvirt segfault when crash triggered on top of HVM guest (bsc#1120067)
Patchnames
SUSE-2019-1248,SUSE-SLE-Module-Basesystem-15-2019-1248,SUSE-SLE-Module-Server-Applications-15-2019-1248
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for xen",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for xen fixes the following issues:\n\nFour new speculative execution information leak issues have been identified in Intel CPUs. (bsc#1111331)\n\n- CVE-2018-12126: Microarchitectural Store Buffer Data Sampling (MSBDS)\n- CVE-2018-12127: Microarchitectural Fill Buffer Data Sampling (MFBDS)\n- CVE-2018-12130: Microarchitectural Load Port Data Samling (MLPDS)\n- CVE-2019-11091: Microarchitectural Data Sampling Uncacheable Memory (MDSUM)\n\nThese updates contain the XEN Hypervisor adjustments, that additionaly also use CPU Microcode updates.\n\nThe mitigation can be controlled via the \u0027mds\u0027 commandline option, see the documentation.\n\nFor more information on this set of vulnerabilities, check out https://www.suse.com/support/kb/doc/?id=7023736\n\nOther fixes:\n\n- Added code to change LIBXL_HOTPLUG_TIMEOUT at runtime.\n\n  The included README has details about the impact of this change (bsc#1120095)\n\n- Fixes in Live migrating PV domUs\n\n  An earlier change broke live migration of PV domUs without a device\n  model. The migration would stall for 10 seconds while the domU was\n  paused, which caused network connections to drop.  Fix this by tracking\n  the need for a device model within libxl. (bsc#1079730, bsc#1098403, bsc#1111025)\n\n- Libvirt segfault when crash triggered on top of HVM guest (bsc#1120067)\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-2019-1248,SUSE-SLE-Module-Basesystem-15-2019-1248,SUSE-SLE-Module-Server-Applications-15-2019-1248",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2019_1248-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2019:1248-1",
        "url": "https://www.suse.com/support/update/announcement/2019/suse-su-20191248-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2019:1248-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2019-May/005450.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1027519",
        "url": "https://bugzilla.suse.com/1027519"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1079730",
        "url": "https://bugzilla.suse.com/1079730"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1098403",
        "url": "https://bugzilla.suse.com/1098403"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1111025",
        "url": "https://bugzilla.suse.com/1111025"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1111331",
        "url": "https://bugzilla.suse.com/1111331"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1120067",
        "url": "https://bugzilla.suse.com/1120067"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1120095",
        "url": "https://bugzilla.suse.com/1120095"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-12126 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-12126/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-12127 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-12127/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-12130 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-12130/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-11091 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-11091/"
      }
    ],
    "title": "Security update for xen",
    "tracking": {
      "current_release_date": "2019-05-14T17:22:16Z",
      "generator": {
        "date": "2019-05-14T17:22:16Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2019:1248-1",
      "initial_release_date": "2019-05-14T17:22:16Z",
      "revision_history": [
        {
          "date": "2019-05-14T17:22:16Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "xen-4.10.3_04-3.19.1.aarch64",
                "product": {
                  "name": "xen-4.10.3_04-3.19.1.aarch64",
                  "product_id": "xen-4.10.3_04-3.19.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "xen-devel-4.10.3_04-3.19.1.aarch64",
                "product": {
                  "name": "xen-devel-4.10.3_04-3.19.1.aarch64",
                  "product_id": "xen-devel-4.10.3_04-3.19.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "xen-doc-html-4.10.3_04-3.19.1.aarch64",
                "product": {
                  "name": "xen-doc-html-4.10.3_04-3.19.1.aarch64",
                  "product_id": "xen-doc-html-4.10.3_04-3.19.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "xen-libs-4.10.3_04-3.19.1.aarch64",
                "product": {
                  "name": "xen-libs-4.10.3_04-3.19.1.aarch64",
                  "product_id": "xen-libs-4.10.3_04-3.19.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "xen-tools-4.10.3_04-3.19.1.aarch64",
                "product": {
                  "name": "xen-tools-4.10.3_04-3.19.1.aarch64",
                  "product_id": "xen-tools-4.10.3_04-3.19.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "xen-tools-domU-4.10.3_04-3.19.1.aarch64",
                "product": {
                  "name": "xen-tools-domU-4.10.3_04-3.19.1.aarch64",
                  "product_id": "xen-tools-domU-4.10.3_04-3.19.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "xen-libs-64bit-4.10.3_04-3.19.1.aarch64_ilp32",
                "product": {
                  "name": "xen-libs-64bit-4.10.3_04-3.19.1.aarch64_ilp32",
                  "product_id": "xen-libs-64bit-4.10.3_04-3.19.1.aarch64_ilp32"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64_ilp32"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "xen-devel-4.10.3_04-3.19.1.i586",
                "product": {
                  "name": "xen-devel-4.10.3_04-3.19.1.i586",
                  "product_id": "xen-devel-4.10.3_04-3.19.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "xen-libs-4.10.3_04-3.19.1.i586",
                "product": {
                  "name": "xen-libs-4.10.3_04-3.19.1.i586",
                  "product_id": "xen-libs-4.10.3_04-3.19.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "xen-tools-domU-4.10.3_04-3.19.1.i586",
                "product": {
                  "name": "xen-tools-domU-4.10.3_04-3.19.1.i586",
                  "product_id": "xen-tools-domU-4.10.3_04-3.19.1.i586"
                }
              }
            ],
            "category": "architecture",
            "name": "i586"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "xen-4.10.3_04-3.19.1.x86_64",
                "product": {
                  "name": "xen-4.10.3_04-3.19.1.x86_64",
                  "product_id": "xen-4.10.3_04-3.19.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "xen-devel-4.10.3_04-3.19.1.x86_64",
                "product": {
                  "name": "xen-devel-4.10.3_04-3.19.1.x86_64",
                  "product_id": "xen-devel-4.10.3_04-3.19.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "xen-doc-html-4.10.3_04-3.19.1.x86_64",
                "product": {
                  "name": "xen-doc-html-4.10.3_04-3.19.1.x86_64",
                  "product_id": "xen-doc-html-4.10.3_04-3.19.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "xen-libs-4.10.3_04-3.19.1.x86_64",
                "product": {
                  "name": "xen-libs-4.10.3_04-3.19.1.x86_64",
                  "product_id": "xen-libs-4.10.3_04-3.19.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "xen-libs-32bit-4.10.3_04-3.19.1.x86_64",
                "product": {
                  "name": "xen-libs-32bit-4.10.3_04-3.19.1.x86_64",
                  "product_id": "xen-libs-32bit-4.10.3_04-3.19.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "xen-tools-4.10.3_04-3.19.1.x86_64",
                "product": {
                  "name": "xen-tools-4.10.3_04-3.19.1.x86_64",
                  "product_id": "xen-tools-4.10.3_04-3.19.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "xen-tools-domU-4.10.3_04-3.19.1.x86_64",
                "product": {
                  "name": "xen-tools-domU-4.10.3_04-3.19.1.x86_64",
                  "product_id": "xen-tools-domU-4.10.3_04-3.19.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Module for Basesystem 15",
                "product": {
                  "name": "SUSE Linux Enterprise Module for Basesystem 15",
                  "product_id": "SUSE Linux Enterprise Module for Basesystem 15",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-module-basesystem:15"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Module for Server Applications 15",
                "product": {
                  "name": "SUSE Linux Enterprise Module for Server Applications 15",
                  "product_id": "SUSE Linux Enterprise Module for Server Applications 15",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-module-server-applications:15"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-libs-4.10.3_04-3.19.1.x86_64 as component of SUSE Linux Enterprise Module for Basesystem 15",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15:xen-libs-4.10.3_04-3.19.1.x86_64"
        },
        "product_reference": "xen-libs-4.10.3_04-3.19.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-tools-domU-4.10.3_04-3.19.1.x86_64 as component of SUSE Linux Enterprise Module for Basesystem 15",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15:xen-tools-domU-4.10.3_04-3.19.1.x86_64"
        },
        "product_reference": "xen-tools-domU-4.10.3_04-3.19.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-4.10.3_04-3.19.1.x86_64 as component of SUSE Linux Enterprise Module for Server Applications 15",
          "product_id": "SUSE Linux Enterprise Module for Server Applications 15:xen-4.10.3_04-3.19.1.x86_64"
        },
        "product_reference": "xen-4.10.3_04-3.19.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Server Applications 15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-devel-4.10.3_04-3.19.1.x86_64 as component of SUSE Linux Enterprise Module for Server Applications 15",
          "product_id": "SUSE Linux Enterprise Module for Server Applications 15:xen-devel-4.10.3_04-3.19.1.x86_64"
        },
        "product_reference": "xen-devel-4.10.3_04-3.19.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Server Applications 15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-tools-4.10.3_04-3.19.1.x86_64 as component of SUSE Linux Enterprise Module for Server Applications 15",
          "product_id": "SUSE Linux Enterprise Module for Server Applications 15:xen-tools-4.10.3_04-3.19.1.x86_64"
        },
        "product_reference": "xen-tools-4.10.3_04-3.19.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Server Applications 15"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2018-12126",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-12126"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Microarchitectural Store Buffer Data Sampling (MSBDS): Store buffers on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here: https://www.intel.com/content/dam/www/public/us/en/documents/corporate-information/SA00233-microcode-update-guidance_05132019.pdf",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Basesystem 15:xen-libs-4.10.3_04-3.19.1.x86_64",
          "SUSE Linux Enterprise Module for Basesystem 15:xen-tools-domU-4.10.3_04-3.19.1.x86_64",
          "SUSE Linux Enterprise Module for Server Applications 15:xen-4.10.3_04-3.19.1.x86_64",
          "SUSE Linux Enterprise Module for Server Applications 15:xen-devel-4.10.3_04-3.19.1.x86_64",
          "SUSE Linux Enterprise Module for Server Applications 15:xen-tools-4.10.3_04-3.19.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-12126",
          "url": "https://www.suse.com/security/cve/CVE-2018-12126"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1103186 for CVE-2018-12126",
          "url": "https://bugzilla.suse.com/1103186"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1111331 for CVE-2018-12126",
          "url": "https://bugzilla.suse.com/1111331"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1132686 for CVE-2018-12126",
          "url": "https://bugzilla.suse.com/1132686"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1135409 for CVE-2018-12126",
          "url": "https://bugzilla.suse.com/1135409"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1135524 for CVE-2018-12126",
          "url": "https://bugzilla.suse.com/1135524"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1137916 for CVE-2018-12126",
          "url": "https://bugzilla.suse.com/1137916"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1138534 for CVE-2018-12126",
          "url": "https://bugzilla.suse.com/1138534"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1141977 for CVE-2018-12126",
          "url": "https://bugzilla.suse.com/1141977"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1149725 for CVE-2018-12126",
          "url": "https://bugzilla.suse.com/1149725"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1149726 for CVE-2018-12126",
          "url": "https://bugzilla.suse.com/1149726"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1149729 for CVE-2018-12126",
          "url": "https://bugzilla.suse.com/1149729"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1178658 for CVE-2018-12126",
          "url": "https://bugzilla.suse.com/1178658"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1201877 for CVE-2018-12126",
          "url": "https://bugzilla.suse.com/1201877"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Basesystem 15:xen-libs-4.10.3_04-3.19.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15:xen-tools-domU-4.10.3_04-3.19.1.x86_64",
            "SUSE Linux Enterprise Module for Server Applications 15:xen-4.10.3_04-3.19.1.x86_64",
            "SUSE Linux Enterprise Module for Server Applications 15:xen-devel-4.10.3_04-3.19.1.x86_64",
            "SUSE Linux Enterprise Module for Server Applications 15:xen-tools-4.10.3_04-3.19.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.8,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Module for Basesystem 15:xen-libs-4.10.3_04-3.19.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15:xen-tools-domU-4.10.3_04-3.19.1.x86_64",
            "SUSE Linux Enterprise Module for Server Applications 15:xen-4.10.3_04-3.19.1.x86_64",
            "SUSE Linux Enterprise Module for Server Applications 15:xen-devel-4.10.3_04-3.19.1.x86_64",
            "SUSE Linux Enterprise Module for Server Applications 15:xen-tools-4.10.3_04-3.19.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2019-05-14T17:22:16Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-12126"
    },
    {
      "cve": "CVE-2018-12127",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-12127"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Microarchitectural Load Port Data Sampling (MLPDS): Load ports on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here: https://www.intel.com/content/dam/www/public/us/en/documents/corporate-information/SA00233-microcode-update-guidance_05132019.pdf",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Basesystem 15:xen-libs-4.10.3_04-3.19.1.x86_64",
          "SUSE Linux Enterprise Module for Basesystem 15:xen-tools-domU-4.10.3_04-3.19.1.x86_64",
          "SUSE Linux Enterprise Module for Server Applications 15:xen-4.10.3_04-3.19.1.x86_64",
          "SUSE Linux Enterprise Module for Server Applications 15:xen-devel-4.10.3_04-3.19.1.x86_64",
          "SUSE Linux Enterprise Module for Server Applications 15:xen-tools-4.10.3_04-3.19.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-12127",
          "url": "https://www.suse.com/security/cve/CVE-2018-12127"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1103186 for CVE-2018-12127",
          "url": "https://bugzilla.suse.com/1103186"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1111331 for CVE-2018-12127",
          "url": "https://bugzilla.suse.com/1111331"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1132686 for CVE-2018-12127",
          "url": "https://bugzilla.suse.com/1132686"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1135409 for CVE-2018-12127",
          "url": "https://bugzilla.suse.com/1135409"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1138534 for CVE-2018-12127",
          "url": "https://bugzilla.suse.com/1138534"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1141977 for CVE-2018-12127",
          "url": "https://bugzilla.suse.com/1141977"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1178658 for CVE-2018-12127",
          "url": "https://bugzilla.suse.com/1178658"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1201877 for CVE-2018-12127",
          "url": "https://bugzilla.suse.com/1201877"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Basesystem 15:xen-libs-4.10.3_04-3.19.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15:xen-tools-domU-4.10.3_04-3.19.1.x86_64",
            "SUSE Linux Enterprise Module for Server Applications 15:xen-4.10.3_04-3.19.1.x86_64",
            "SUSE Linux Enterprise Module for Server Applications 15:xen-devel-4.10.3_04-3.19.1.x86_64",
            "SUSE Linux Enterprise Module for Server Applications 15:xen-tools-4.10.3_04-3.19.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.8,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Module for Basesystem 15:xen-libs-4.10.3_04-3.19.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15:xen-tools-domU-4.10.3_04-3.19.1.x86_64",
            "SUSE Linux Enterprise Module for Server Applications 15:xen-4.10.3_04-3.19.1.x86_64",
            "SUSE Linux Enterprise Module for Server Applications 15:xen-devel-4.10.3_04-3.19.1.x86_64",
            "SUSE Linux Enterprise Module for Server Applications 15:xen-tools-4.10.3_04-3.19.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2019-05-14T17:22:16Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-12127"
    },
    {
      "cve": "CVE-2018-12130",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-12130"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Microarchitectural Fill Buffer Data Sampling (MFBDS): Fill buffers on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here: https://www.intel.com/content/dam/www/public/us/en/documents/corporate-information/SA00233-microcode-update-guidance_05132019.pdf",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Basesystem 15:xen-libs-4.10.3_04-3.19.1.x86_64",
          "SUSE Linux Enterprise Module for Basesystem 15:xen-tools-domU-4.10.3_04-3.19.1.x86_64",
          "SUSE Linux Enterprise Module for Server Applications 15:xen-4.10.3_04-3.19.1.x86_64",
          "SUSE Linux Enterprise Module for Server Applications 15:xen-devel-4.10.3_04-3.19.1.x86_64",
          "SUSE Linux Enterprise Module for Server Applications 15:xen-tools-4.10.3_04-3.19.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-12130",
          "url": "https://www.suse.com/security/cve/CVE-2018-12130"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1103186 for CVE-2018-12130",
          "url": "https://bugzilla.suse.com/1103186"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1111331 for CVE-2018-12130",
          "url": "https://bugzilla.suse.com/1111331"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1132686 for CVE-2018-12130",
          "url": "https://bugzilla.suse.com/1132686"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1135409 for CVE-2018-12130",
          "url": "https://bugzilla.suse.com/1135409"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1137916 for CVE-2018-12130",
          "url": "https://bugzilla.suse.com/1137916"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1138534 for CVE-2018-12130",
          "url": "https://bugzilla.suse.com/1138534"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1141977 for CVE-2018-12130",
          "url": "https://bugzilla.suse.com/1141977"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1178658 for CVE-2018-12130",
          "url": "https://bugzilla.suse.com/1178658"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1201877 for CVE-2018-12130",
          "url": "https://bugzilla.suse.com/1201877"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Basesystem 15:xen-libs-4.10.3_04-3.19.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15:xen-tools-domU-4.10.3_04-3.19.1.x86_64",
            "SUSE Linux Enterprise Module for Server Applications 15:xen-4.10.3_04-3.19.1.x86_64",
            "SUSE Linux Enterprise Module for Server Applications 15:xen-devel-4.10.3_04-3.19.1.x86_64",
            "SUSE Linux Enterprise Module for Server Applications 15:xen-tools-4.10.3_04-3.19.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Module for Basesystem 15:xen-libs-4.10.3_04-3.19.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15:xen-tools-domU-4.10.3_04-3.19.1.x86_64",
            "SUSE Linux Enterprise Module for Server Applications 15:xen-4.10.3_04-3.19.1.x86_64",
            "SUSE Linux Enterprise Module for Server Applications 15:xen-devel-4.10.3_04-3.19.1.x86_64",
            "SUSE Linux Enterprise Module for Server Applications 15:xen-tools-4.10.3_04-3.19.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2019-05-14T17:22:16Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-12130"
    },
    {
      "cve": "CVE-2019-11091",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-11091"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Microarchitectural Data Sampling Uncacheable Memory (MDSUM): Uncacheable memory on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here: https://www.intel.com/content/dam/www/public/us/en/documents/corporate-information/SA00233-microcode-update-guidance_05132019.pdf",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Basesystem 15:xen-libs-4.10.3_04-3.19.1.x86_64",
          "SUSE Linux Enterprise Module for Basesystem 15:xen-tools-domU-4.10.3_04-3.19.1.x86_64",
          "SUSE Linux Enterprise Module for Server Applications 15:xen-4.10.3_04-3.19.1.x86_64",
          "SUSE Linux Enterprise Module for Server Applications 15:xen-devel-4.10.3_04-3.19.1.x86_64",
          "SUSE Linux Enterprise Module for Server Applications 15:xen-tools-4.10.3_04-3.19.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-11091",
          "url": "https://www.suse.com/security/cve/CVE-2019-11091"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1103186 for CVE-2019-11091",
          "url": "https://bugzilla.suse.com/1103186"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1111331 for CVE-2019-11091",
          "url": "https://bugzilla.suse.com/1111331"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1132686 for CVE-2019-11091",
          "url": "https://bugzilla.suse.com/1132686"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1133319 for CVE-2019-11091",
          "url": "https://bugzilla.suse.com/1133319"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1135394 for CVE-2019-11091",
          "url": "https://bugzilla.suse.com/1135394"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1138043 for CVE-2019-11091",
          "url": "https://bugzilla.suse.com/1138043"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1138534 for CVE-2019-11091",
          "url": "https://bugzilla.suse.com/1138534"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1141977 for CVE-2019-11091",
          "url": "https://bugzilla.suse.com/1141977"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1178658 for CVE-2019-11091",
          "url": "https://bugzilla.suse.com/1178658"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1201877 for CVE-2019-11091",
          "url": "https://bugzilla.suse.com/1201877"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Basesystem 15:xen-libs-4.10.3_04-3.19.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15:xen-tools-domU-4.10.3_04-3.19.1.x86_64",
            "SUSE Linux Enterprise Module for Server Applications 15:xen-4.10.3_04-3.19.1.x86_64",
            "SUSE Linux Enterprise Module for Server Applications 15:xen-devel-4.10.3_04-3.19.1.x86_64",
            "SUSE Linux Enterprise Module for Server Applications 15:xen-tools-4.10.3_04-3.19.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Module for Basesystem 15:xen-libs-4.10.3_04-3.19.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15:xen-tools-domU-4.10.3_04-3.19.1.x86_64",
            "SUSE Linux Enterprise Module for Server Applications 15:xen-4.10.3_04-3.19.1.x86_64",
            "SUSE Linux Enterprise Module for Server Applications 15:xen-devel-4.10.3_04-3.19.1.x86_64",
            "SUSE Linux Enterprise Module for Server Applications 15:xen-tools-4.10.3_04-3.19.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2019-05-14T17:22:16Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2019-11091"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.