Security update for xen SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2018:2436-1 Final 1 1 2018-08-19T08:11:32Z current 2018-08-19T08:11:32Z 2018-08-19T08:11:32Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for xen This update for xen fixes the following security issues: - CVE-2018-3646: Systems with microprocessors utilizing speculative execution and address translations may have allowed unauthorized disclosure of information residing in the L1 data cache to an attacker with local user access with guest OS privilege via a terminal page fault and a side-channel analysis (bsc#1091107, bsc#1027519). - Incorrect MSR_DEBUGCTL handling let guests enable BTS allowing a malicious or buggy guest administrator can lock up the entire host (bsc#1103276) This update was imported from the SUSE:SLE-15:Update update project. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) http://lists.opensuse.org/opensuse-security-announce/2018-08/msg00068.html E-Mail link for openSUSE-SU-2018:2436-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings openSUSE Leap 15.0 xen-4.10.1_08-lp150.2.9.1 xen-devel-4.10.1_08-lp150.2.9.1 xen-doc-html-4.10.1_08-lp150.2.9.1 xen-libs-4.10.1_08-lp150.2.9.1 xen-libs-32bit-4.10.1_08-lp150.2.9.1 xen-tools-4.10.1_08-lp150.2.9.1 xen-tools-domU-4.10.1_08-lp150.2.9.1 xen-4.10.1_08-lp150.2.9.1 as a component of openSUSE Leap 15.0 xen-devel-4.10.1_08-lp150.2.9.1 as a component of openSUSE Leap 15.0 xen-doc-html-4.10.1_08-lp150.2.9.1 as a component of openSUSE Leap 15.0 xen-libs-4.10.1_08-lp150.2.9.1 as a component of openSUSE Leap 15.0 xen-libs-32bit-4.10.1_08-lp150.2.9.1 as a component of openSUSE Leap 15.0 xen-tools-4.10.1_08-lp150.2.9.1 as a component of openSUSE Leap 15.0 xen-tools-domU-4.10.1_08-lp150.2.9.1 as a component of openSUSE Leap 15.0 Systems with microprocessors utilizing speculative execution and address translations may allow unauthorized disclosure of information residing in the L1 data cache to an attacker with local user access with guest OS privilege via a terminal page fault and a side-channel analysis. CVE-2018-3646 openSUSE Leap 15.0:xen-4.10.1_08-lp150.2.9.1 openSUSE Leap 15.0:xen-devel-4.10.1_08-lp150.2.9.1 openSUSE Leap 15.0:xen-doc-html-4.10.1_08-lp150.2.9.1 openSUSE Leap 15.0:xen-libs-32bit-4.10.1_08-lp150.2.9.1 openSUSE Leap 15.0:xen-libs-4.10.1_08-lp150.2.9.1 openSUSE Leap 15.0:xen-tools-4.10.1_08-lp150.2.9.1 openSUSE Leap 15.0:xen-tools-domU-4.10.1_08-lp150.2.9.1 moderate Please Install the update. http://lists.opensuse.org/opensuse-security-announce/2018-08/msg00068.html https://www.suse.com/security/cve/CVE-2018-3646.html CVE-2018-3646 https://bugzilla.suse.com/1087078 SUSE Bug 1087078 https://bugzilla.suse.com/1087081 SUSE Bug 1087081 https://bugzilla.suse.com/1089343 SUSE Bug 1089343 https://bugzilla.suse.com/1091107 SUSE Bug 1091107 https://bugzilla.suse.com/1099306 SUSE Bug 1099306 https://bugzilla.suse.com/1104365 SUSE Bug 1104365 https://bugzilla.suse.com/1104894 SUSE Bug 1104894 https://bugzilla.suse.com/1106548 SUSE Bug 1106548 https://bugzilla.suse.com/1113534 SUSE Bug 1113534