suse-su-2019:1348-1
Vulnerability from csaf_suse
Published
2019-05-24 12:04
Modified
2019-05-24 12:04
Summary
Security update for xen

Notes

Title of the patch
Security update for xen
Description of the patch
This update for xen fixes the following issues: Four new speculative execution information leak issues have been identified in Intel CPUs. (bsc#1111331) - CVE-2018-12126: Microarchitectural Store Buffer Data Sampling (MSBDS) - CVE-2018-12127: Microarchitectural Fill Buffer Data Sampling (MFBDS) - CVE-2018-12130: Microarchitectural Load Port Data Sampling (MLPDS) - CVE-2019-11091: Microarchitectural Data Sampling Uncacheable Memory (MDSUM) These updates contain the XEN Hypervisor adjustments, that additionally also use CPU Microcode updates. The mitigation can be controlled via the 'mds' commandline option, see the documentation. For more information on this set of vulnerabilities, check out https://www.suse.com/support/kb/doc/?id=7023736 Other fixes: - CVE-2018-20815: Fixed a heap buffer overflow while loading device tree blob (bsc#1130680). - Added upstream bug fix (bsc#1027519).
Patchnames
SUSE-2019-1348,SUSE-SLE-SERVER-12-2019-1348
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for xen",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for xen fixes the following issues:\n\nFour new speculative execution information leak issues have been identified in Intel CPUs. (bsc#1111331)\n\n- CVE-2018-12126: Microarchitectural Store Buffer Data Sampling (MSBDS)\n- CVE-2018-12127: Microarchitectural Fill Buffer Data Sampling (MFBDS)\n- CVE-2018-12130: Microarchitectural Load Port Data Sampling (MLPDS)\n- CVE-2019-11091: Microarchitectural Data Sampling Uncacheable Memory (MDSUM)\n\nThese updates contain the XEN Hypervisor adjustments, that additionally also use CPU Microcode updates.\n\nThe mitigation can be controlled via the \u0027mds\u0027 commandline option, see the documentation.\n\nFor more information on this set of vulnerabilities, check out https://www.suse.com/support/kb/doc/?id=7023736\n\nOther fixes:\n\n- CVE-2018-20815: Fixed a heap buffer overflow while loading device tree blob (bsc#1130680).\n- Added upstream bug fix (bsc#1027519).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-2019-1348,SUSE-SLE-SERVER-12-2019-1348",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2019_1348-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2019:1348-1",
        "url": "https://www.suse.com/support/update/announcement/2019/suse-su-20191348-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2019:1348-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2019-May/005498.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1027519",
        "url": "https://bugzilla.suse.com/1027519"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1111331",
        "url": "https://bugzilla.suse.com/1111331"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1130680",
        "url": "https://bugzilla.suse.com/1130680"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-12126 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-12126/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-12127 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-12127/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-12130 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-12130/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-20815 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-20815/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-11091 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-11091/"
      }
    ],
    "title": "Security update for xen",
    "tracking": {
      "current_release_date": "2019-05-24T12:04:18Z",
      "generator": {
        "date": "2019-05-24T12:04:18Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2019:1348-1",
      "initial_release_date": "2019-05-24T12:04:18Z",
      "revision_history": [
        {
          "date": "2019-05-24T12:04:18Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "xen-4.4.4_40-22.80.1.aarch64",
                "product": {
                  "name": "xen-4.4.4_40-22.80.1.aarch64",
                  "product_id": "xen-4.4.4_40-22.80.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "xen-devel-4.4.4_40-22.80.1.aarch64",
                "product": {
                  "name": "xen-devel-4.4.4_40-22.80.1.aarch64",
                  "product_id": "xen-devel-4.4.4_40-22.80.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "xen-doc-html-4.4.4_40-22.80.1.aarch64",
                "product": {
                  "name": "xen-doc-html-4.4.4_40-22.80.1.aarch64",
                  "product_id": "xen-doc-html-4.4.4_40-22.80.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "xen-libs-4.4.4_40-22.80.1.aarch64",
                "product": {
                  "name": "xen-libs-4.4.4_40-22.80.1.aarch64",
                  "product_id": "xen-libs-4.4.4_40-22.80.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "xen-tools-4.4.4_40-22.80.1.aarch64",
                "product": {
                  "name": "xen-tools-4.4.4_40-22.80.1.aarch64",
                  "product_id": "xen-tools-4.4.4_40-22.80.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "xen-tools-domU-4.4.4_40-22.80.1.aarch64",
                "product": {
                  "name": "xen-tools-domU-4.4.4_40-22.80.1.aarch64",
                  "product_id": "xen-tools-domU-4.4.4_40-22.80.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "xen-libs-64bit-4.4.4_40-22.80.1.aarch64_ilp32",
                "product": {
                  "name": "xen-libs-64bit-4.4.4_40-22.80.1.aarch64_ilp32",
                  "product_id": "xen-libs-64bit-4.4.4_40-22.80.1.aarch64_ilp32"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64_ilp32"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "xen-devel-4.4.4_40-22.80.1.i586",
                "product": {
                  "name": "xen-devel-4.4.4_40-22.80.1.i586",
                  "product_id": "xen-devel-4.4.4_40-22.80.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "xen-libs-4.4.4_40-22.80.1.i586",
                "product": {
                  "name": "xen-libs-4.4.4_40-22.80.1.i586",
                  "product_id": "xen-libs-4.4.4_40-22.80.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "xen-tools-domU-4.4.4_40-22.80.1.i586",
                "product": {
                  "name": "xen-tools-domU-4.4.4_40-22.80.1.i586",
                  "product_id": "xen-tools-domU-4.4.4_40-22.80.1.i586"
                }
              }
            ],
            "category": "architecture",
            "name": "i586"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "xen-4.4.4_40-22.80.1.x86_64",
                "product": {
                  "name": "xen-4.4.4_40-22.80.1.x86_64",
                  "product_id": "xen-4.4.4_40-22.80.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "xen-devel-4.4.4_40-22.80.1.x86_64",
                "product": {
                  "name": "xen-devel-4.4.4_40-22.80.1.x86_64",
                  "product_id": "xen-devel-4.4.4_40-22.80.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "xen-doc-html-4.4.4_40-22.80.1.x86_64",
                "product": {
                  "name": "xen-doc-html-4.4.4_40-22.80.1.x86_64",
                  "product_id": "xen-doc-html-4.4.4_40-22.80.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "xen-kmp-default-4.4.4_40_k3.12.61_52.149-22.80.1.x86_64",
                "product": {
                  "name": "xen-kmp-default-4.4.4_40_k3.12.61_52.149-22.80.1.x86_64",
                  "product_id": "xen-kmp-default-4.4.4_40_k3.12.61_52.149-22.80.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "xen-libs-4.4.4_40-22.80.1.x86_64",
                "product": {
                  "name": "xen-libs-4.4.4_40-22.80.1.x86_64",
                  "product_id": "xen-libs-4.4.4_40-22.80.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "xen-libs-32bit-4.4.4_40-22.80.1.x86_64",
                "product": {
                  "name": "xen-libs-32bit-4.4.4_40-22.80.1.x86_64",
                  "product_id": "xen-libs-32bit-4.4.4_40-22.80.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "xen-tools-4.4.4_40-22.80.1.x86_64",
                "product": {
                  "name": "xen-tools-4.4.4_40-22.80.1.x86_64",
                  "product_id": "xen-tools-4.4.4_40-22.80.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "xen-tools-domU-4.4.4_40-22.80.1.x86_64",
                "product": {
                  "name": "xen-tools-domU-4.4.4_40-22.80.1.x86_64",
                  "product_id": "xen-tools-domU-4.4.4_40-22.80.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 12-LTSS",
                "product": {
                  "name": "SUSE Linux Enterprise Server 12-LTSS",
                  "product_id": "SUSE Linux Enterprise Server 12-LTSS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles-ltss:12"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-4.4.4_40-22.80.1.x86_64 as component of SUSE Linux Enterprise Server 12-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12-LTSS:xen-4.4.4_40-22.80.1.x86_64"
        },
        "product_reference": "xen-4.4.4_40-22.80.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-doc-html-4.4.4_40-22.80.1.x86_64 as component of SUSE Linux Enterprise Server 12-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12-LTSS:xen-doc-html-4.4.4_40-22.80.1.x86_64"
        },
        "product_reference": "xen-doc-html-4.4.4_40-22.80.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-kmp-default-4.4.4_40_k3.12.61_52.149-22.80.1.x86_64 as component of SUSE Linux Enterprise Server 12-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12-LTSS:xen-kmp-default-4.4.4_40_k3.12.61_52.149-22.80.1.x86_64"
        },
        "product_reference": "xen-kmp-default-4.4.4_40_k3.12.61_52.149-22.80.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-libs-4.4.4_40-22.80.1.x86_64 as component of SUSE Linux Enterprise Server 12-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12-LTSS:xen-libs-4.4.4_40-22.80.1.x86_64"
        },
        "product_reference": "xen-libs-4.4.4_40-22.80.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-libs-32bit-4.4.4_40-22.80.1.x86_64 as component of SUSE Linux Enterprise Server 12-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12-LTSS:xen-libs-32bit-4.4.4_40-22.80.1.x86_64"
        },
        "product_reference": "xen-libs-32bit-4.4.4_40-22.80.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-tools-4.4.4_40-22.80.1.x86_64 as component of SUSE Linux Enterprise Server 12-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12-LTSS:xen-tools-4.4.4_40-22.80.1.x86_64"
        },
        "product_reference": "xen-tools-4.4.4_40-22.80.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-tools-domU-4.4.4_40-22.80.1.x86_64 as component of SUSE Linux Enterprise Server 12-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12-LTSS:xen-tools-domU-4.4.4_40-22.80.1.x86_64"
        },
        "product_reference": "xen-tools-domU-4.4.4_40-22.80.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12-LTSS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2018-12126",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-12126"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Microarchitectural Store Buffer Data Sampling (MSBDS): Store buffers on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here: https://www.intel.com/content/dam/www/public/us/en/documents/corporate-information/SA00233-microcode-update-guidance_05132019.pdf",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12-LTSS:xen-4.4.4_40-22.80.1.x86_64",
          "SUSE Linux Enterprise Server 12-LTSS:xen-doc-html-4.4.4_40-22.80.1.x86_64",
          "SUSE Linux Enterprise Server 12-LTSS:xen-kmp-default-4.4.4_40_k3.12.61_52.149-22.80.1.x86_64",
          "SUSE Linux Enterprise Server 12-LTSS:xen-libs-32bit-4.4.4_40-22.80.1.x86_64",
          "SUSE Linux Enterprise Server 12-LTSS:xen-libs-4.4.4_40-22.80.1.x86_64",
          "SUSE Linux Enterprise Server 12-LTSS:xen-tools-4.4.4_40-22.80.1.x86_64",
          "SUSE Linux Enterprise Server 12-LTSS:xen-tools-domU-4.4.4_40-22.80.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-12126",
          "url": "https://www.suse.com/security/cve/CVE-2018-12126"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1103186 for CVE-2018-12126",
          "url": "https://bugzilla.suse.com/1103186"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1111331 for CVE-2018-12126",
          "url": "https://bugzilla.suse.com/1111331"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1132686 for CVE-2018-12126",
          "url": "https://bugzilla.suse.com/1132686"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1135409 for CVE-2018-12126",
          "url": "https://bugzilla.suse.com/1135409"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1135524 for CVE-2018-12126",
          "url": "https://bugzilla.suse.com/1135524"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1137916 for CVE-2018-12126",
          "url": "https://bugzilla.suse.com/1137916"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1138534 for CVE-2018-12126",
          "url": "https://bugzilla.suse.com/1138534"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1141977 for CVE-2018-12126",
          "url": "https://bugzilla.suse.com/1141977"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1149725 for CVE-2018-12126",
          "url": "https://bugzilla.suse.com/1149725"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1149726 for CVE-2018-12126",
          "url": "https://bugzilla.suse.com/1149726"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1149729 for CVE-2018-12126",
          "url": "https://bugzilla.suse.com/1149729"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1178658 for CVE-2018-12126",
          "url": "https://bugzilla.suse.com/1178658"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1201877 for CVE-2018-12126",
          "url": "https://bugzilla.suse.com/1201877"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12-LTSS:xen-4.4.4_40-22.80.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:xen-doc-html-4.4.4_40-22.80.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:xen-kmp-default-4.4.4_40_k3.12.61_52.149-22.80.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:xen-libs-32bit-4.4.4_40-22.80.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:xen-libs-4.4.4_40-22.80.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:xen-tools-4.4.4_40-22.80.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:xen-tools-domU-4.4.4_40-22.80.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.8,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Server 12-LTSS:xen-4.4.4_40-22.80.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:xen-doc-html-4.4.4_40-22.80.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:xen-kmp-default-4.4.4_40_k3.12.61_52.149-22.80.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:xen-libs-32bit-4.4.4_40-22.80.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:xen-libs-4.4.4_40-22.80.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:xen-tools-4.4.4_40-22.80.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:xen-tools-domU-4.4.4_40-22.80.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2019-05-24T12:04:18Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-12126"
    },
    {
      "cve": "CVE-2018-12127",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-12127"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Microarchitectural Load Port Data Sampling (MLPDS): Load ports on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here: https://www.intel.com/content/dam/www/public/us/en/documents/corporate-information/SA00233-microcode-update-guidance_05132019.pdf",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12-LTSS:xen-4.4.4_40-22.80.1.x86_64",
          "SUSE Linux Enterprise Server 12-LTSS:xen-doc-html-4.4.4_40-22.80.1.x86_64",
          "SUSE Linux Enterprise Server 12-LTSS:xen-kmp-default-4.4.4_40_k3.12.61_52.149-22.80.1.x86_64",
          "SUSE Linux Enterprise Server 12-LTSS:xen-libs-32bit-4.4.4_40-22.80.1.x86_64",
          "SUSE Linux Enterprise Server 12-LTSS:xen-libs-4.4.4_40-22.80.1.x86_64",
          "SUSE Linux Enterprise Server 12-LTSS:xen-tools-4.4.4_40-22.80.1.x86_64",
          "SUSE Linux Enterprise Server 12-LTSS:xen-tools-domU-4.4.4_40-22.80.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-12127",
          "url": "https://www.suse.com/security/cve/CVE-2018-12127"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1103186 for CVE-2018-12127",
          "url": "https://bugzilla.suse.com/1103186"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1111331 for CVE-2018-12127",
          "url": "https://bugzilla.suse.com/1111331"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1132686 for CVE-2018-12127",
          "url": "https://bugzilla.suse.com/1132686"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1135409 for CVE-2018-12127",
          "url": "https://bugzilla.suse.com/1135409"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1138534 for CVE-2018-12127",
          "url": "https://bugzilla.suse.com/1138534"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1141977 for CVE-2018-12127",
          "url": "https://bugzilla.suse.com/1141977"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1178658 for CVE-2018-12127",
          "url": "https://bugzilla.suse.com/1178658"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1201877 for CVE-2018-12127",
          "url": "https://bugzilla.suse.com/1201877"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12-LTSS:xen-4.4.4_40-22.80.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:xen-doc-html-4.4.4_40-22.80.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:xen-kmp-default-4.4.4_40_k3.12.61_52.149-22.80.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:xen-libs-32bit-4.4.4_40-22.80.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:xen-libs-4.4.4_40-22.80.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:xen-tools-4.4.4_40-22.80.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:xen-tools-domU-4.4.4_40-22.80.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.8,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Server 12-LTSS:xen-4.4.4_40-22.80.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:xen-doc-html-4.4.4_40-22.80.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:xen-kmp-default-4.4.4_40_k3.12.61_52.149-22.80.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:xen-libs-32bit-4.4.4_40-22.80.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:xen-libs-4.4.4_40-22.80.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:xen-tools-4.4.4_40-22.80.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:xen-tools-domU-4.4.4_40-22.80.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2019-05-24T12:04:18Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-12127"
    },
    {
      "cve": "CVE-2018-12130",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-12130"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Microarchitectural Fill Buffer Data Sampling (MFBDS): Fill buffers on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here: https://www.intel.com/content/dam/www/public/us/en/documents/corporate-information/SA00233-microcode-update-guidance_05132019.pdf",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12-LTSS:xen-4.4.4_40-22.80.1.x86_64",
          "SUSE Linux Enterprise Server 12-LTSS:xen-doc-html-4.4.4_40-22.80.1.x86_64",
          "SUSE Linux Enterprise Server 12-LTSS:xen-kmp-default-4.4.4_40_k3.12.61_52.149-22.80.1.x86_64",
          "SUSE Linux Enterprise Server 12-LTSS:xen-libs-32bit-4.4.4_40-22.80.1.x86_64",
          "SUSE Linux Enterprise Server 12-LTSS:xen-libs-4.4.4_40-22.80.1.x86_64",
          "SUSE Linux Enterprise Server 12-LTSS:xen-tools-4.4.4_40-22.80.1.x86_64",
          "SUSE Linux Enterprise Server 12-LTSS:xen-tools-domU-4.4.4_40-22.80.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-12130",
          "url": "https://www.suse.com/security/cve/CVE-2018-12130"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1103186 for CVE-2018-12130",
          "url": "https://bugzilla.suse.com/1103186"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1111331 for CVE-2018-12130",
          "url": "https://bugzilla.suse.com/1111331"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1132686 for CVE-2018-12130",
          "url": "https://bugzilla.suse.com/1132686"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1135409 for CVE-2018-12130",
          "url": "https://bugzilla.suse.com/1135409"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1137916 for CVE-2018-12130",
          "url": "https://bugzilla.suse.com/1137916"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1138534 for CVE-2018-12130",
          "url": "https://bugzilla.suse.com/1138534"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1141977 for CVE-2018-12130",
          "url": "https://bugzilla.suse.com/1141977"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1178658 for CVE-2018-12130",
          "url": "https://bugzilla.suse.com/1178658"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1201877 for CVE-2018-12130",
          "url": "https://bugzilla.suse.com/1201877"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12-LTSS:xen-4.4.4_40-22.80.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:xen-doc-html-4.4.4_40-22.80.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:xen-kmp-default-4.4.4_40_k3.12.61_52.149-22.80.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:xen-libs-32bit-4.4.4_40-22.80.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:xen-libs-4.4.4_40-22.80.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:xen-tools-4.4.4_40-22.80.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:xen-tools-domU-4.4.4_40-22.80.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Server 12-LTSS:xen-4.4.4_40-22.80.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:xen-doc-html-4.4.4_40-22.80.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:xen-kmp-default-4.4.4_40_k3.12.61_52.149-22.80.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:xen-libs-32bit-4.4.4_40-22.80.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:xen-libs-4.4.4_40-22.80.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:xen-tools-4.4.4_40-22.80.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:xen-tools-domU-4.4.4_40-22.80.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2019-05-24T12:04:18Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-12130"
    },
    {
      "cve": "CVE-2018-20815",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-20815"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In QEMU 3.1.0, load_device_tree in device_tree.c calls the deprecated load_image function, which has a buffer overflow risk.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12-LTSS:xen-4.4.4_40-22.80.1.x86_64",
          "SUSE Linux Enterprise Server 12-LTSS:xen-doc-html-4.4.4_40-22.80.1.x86_64",
          "SUSE Linux Enterprise Server 12-LTSS:xen-kmp-default-4.4.4_40_k3.12.61_52.149-22.80.1.x86_64",
          "SUSE Linux Enterprise Server 12-LTSS:xen-libs-32bit-4.4.4_40-22.80.1.x86_64",
          "SUSE Linux Enterprise Server 12-LTSS:xen-libs-4.4.4_40-22.80.1.x86_64",
          "SUSE Linux Enterprise Server 12-LTSS:xen-tools-4.4.4_40-22.80.1.x86_64",
          "SUSE Linux Enterprise Server 12-LTSS:xen-tools-domU-4.4.4_40-22.80.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-20815",
          "url": "https://www.suse.com/security/cve/CVE-2018-20815"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1118900 for CVE-2018-20815",
          "url": "https://bugzilla.suse.com/1118900"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1130675 for CVE-2018-20815",
          "url": "https://bugzilla.suse.com/1130675"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1130680 for CVE-2018-20815",
          "url": "https://bugzilla.suse.com/1130680"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1138043 for CVE-2018-20815",
          "url": "https://bugzilla.suse.com/1138043"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1178658 for CVE-2018-20815",
          "url": "https://bugzilla.suse.com/1178658"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12-LTSS:xen-4.4.4_40-22.80.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:xen-doc-html-4.4.4_40-22.80.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:xen-kmp-default-4.4.4_40_k3.12.61_52.149-22.80.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:xen-libs-32bit-4.4.4_40-22.80.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:xen-libs-4.4.4_40-22.80.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:xen-tools-4.4.4_40-22.80.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:xen-tools-domU-4.4.4_40-22.80.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Server 12-LTSS:xen-4.4.4_40-22.80.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:xen-doc-html-4.4.4_40-22.80.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:xen-kmp-default-4.4.4_40_k3.12.61_52.149-22.80.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:xen-libs-32bit-4.4.4_40-22.80.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:xen-libs-4.4.4_40-22.80.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:xen-tools-4.4.4_40-22.80.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:xen-tools-domU-4.4.4_40-22.80.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2019-05-24T12:04:18Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-20815"
    },
    {
      "cve": "CVE-2019-11091",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-11091"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Microarchitectural Data Sampling Uncacheable Memory (MDSUM): Uncacheable memory on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here: https://www.intel.com/content/dam/www/public/us/en/documents/corporate-information/SA00233-microcode-update-guidance_05132019.pdf",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12-LTSS:xen-4.4.4_40-22.80.1.x86_64",
          "SUSE Linux Enterprise Server 12-LTSS:xen-doc-html-4.4.4_40-22.80.1.x86_64",
          "SUSE Linux Enterprise Server 12-LTSS:xen-kmp-default-4.4.4_40_k3.12.61_52.149-22.80.1.x86_64",
          "SUSE Linux Enterprise Server 12-LTSS:xen-libs-32bit-4.4.4_40-22.80.1.x86_64",
          "SUSE Linux Enterprise Server 12-LTSS:xen-libs-4.4.4_40-22.80.1.x86_64",
          "SUSE Linux Enterprise Server 12-LTSS:xen-tools-4.4.4_40-22.80.1.x86_64",
          "SUSE Linux Enterprise Server 12-LTSS:xen-tools-domU-4.4.4_40-22.80.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-11091",
          "url": "https://www.suse.com/security/cve/CVE-2019-11091"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1103186 for CVE-2019-11091",
          "url": "https://bugzilla.suse.com/1103186"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1111331 for CVE-2019-11091",
          "url": "https://bugzilla.suse.com/1111331"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1132686 for CVE-2019-11091",
          "url": "https://bugzilla.suse.com/1132686"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1133319 for CVE-2019-11091",
          "url": "https://bugzilla.suse.com/1133319"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1135394 for CVE-2019-11091",
          "url": "https://bugzilla.suse.com/1135394"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1138043 for CVE-2019-11091",
          "url": "https://bugzilla.suse.com/1138043"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1138534 for CVE-2019-11091",
          "url": "https://bugzilla.suse.com/1138534"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1141977 for CVE-2019-11091",
          "url": "https://bugzilla.suse.com/1141977"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1178658 for CVE-2019-11091",
          "url": "https://bugzilla.suse.com/1178658"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1201877 for CVE-2019-11091",
          "url": "https://bugzilla.suse.com/1201877"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12-LTSS:xen-4.4.4_40-22.80.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:xen-doc-html-4.4.4_40-22.80.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:xen-kmp-default-4.4.4_40_k3.12.61_52.149-22.80.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:xen-libs-32bit-4.4.4_40-22.80.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:xen-libs-4.4.4_40-22.80.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:xen-tools-4.4.4_40-22.80.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:xen-tools-domU-4.4.4_40-22.80.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Server 12-LTSS:xen-4.4.4_40-22.80.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:xen-doc-html-4.4.4_40-22.80.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:xen-kmp-default-4.4.4_40_k3.12.61_52.149-22.80.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:xen-libs-32bit-4.4.4_40-22.80.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:xen-libs-4.4.4_40-22.80.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:xen-tools-4.4.4_40-22.80.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:xen-tools-domU-4.4.4_40-22.80.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2019-05-24T12:04:18Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2019-11091"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.