search for: carnil

Source: xen Version: 4.8.1~pre.2017.01.23-1 Severity: grave Tags: security upstream Justification: user security hole Hi, the following vulnerability was published for xen. CVE-2017-7228[0]: | An issue (known as XSA-212) was discovered in Xen, with fixes available | for 4.8.x, 4.7.x, 4.6.x, 4.5.x, and 4.4.x. The earlier XSA-29 fix | introduced an insufficient check on XENMEM_exchange input,

...h a patch from Dominik Mierzejewski: https://src.fedoraproject.org/rpms/tftp/c/5e2aa55b6802a52ef480d688b3ae4751220f20e0.patch Attaching the corresponding patch for git am. Regards, Salvatore >From 9e7641bf58df9dda3bc51f381f371fa7cbce47af Mon Sep 17 00:00:00 2001 From: Salvatore Bonaccorso <carnil at debian.org> Date: Tue, 16 Jun 2020 14:06:14 +0200 Subject: [PATCH] Fix build error with GCC 10 due to multiple definition of `toplevel' GCC is stricter in handling of symbol clashes and throws: gcc-10 tftp.o main.o ../common/libcommon.a /build/tftp-hpa/lib/libxtra.a -o tftp /usr/b...

...ching the corresponding patch for git am. I'm sending the patch which was submitted a while ago to the list. Is there something you wanted to be changed to be applied? Regards, Salvatore >From 9e7641bf58df9dda3bc51f381f371fa7cbce47af Mon Sep 17 00:00:00 2001 From: Salvatore Bonaccorso <carnil at debian.org> Date: Tue, 16 Jun 2020 14:06:14 +0200 Subject: [PATCH] Fix build error with GCC 10 due to multiple definition of `toplevel' GCC is stricter in handling of symbol clashes and throws: gcc-10 tftp.o main.o ../common/libcommon.a /build/tftp-hpa/lib/libxtra.a -o tftp /usr/b...

Source: xen Version: 4.17.0+46-gaaf74a532c-1 Severity: grave Tags: security upstream X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org> Hi, The following vulnerabilities were published for xen. CVE-2022-42331[0]: | x86: speculative vulnerability in 32bit SYSCALL path Due to an | oversight in the very original Spectre/Meltdown security work | (XSA-254), one e...

On Sun, Nov 15, 2020 at 6:43 PM Salvatore Bonaccorso <carnil at debian.org> wrote: > > Hi, > > On Fri, Aug 28, 2020 at 11:28:46AM +0200, Frantisek Hrbata wrote: > > Unprivileged user can crash kernel by using DRM_IOCTL_NOUVEAU_CHANNEL_ALLOC > > ioctl. This was reported by trinity[1] fuzzer. > > > > [ 71.073906] nouvea...

Processing commands for control at bugs.debian.org: > user debian-security at lists.debian.org Setting user to debian-security at lists.debian.org (was carnil at debian.org). > usertags 776319 + tracked There were no usertags set. Usertags are now: tracked. > tags 776319 + upstream fixed-upstream Bug #776319 [src:xen] CVE-2015-0361 Added tag(s) upstream and fixed-upstream. > retitle 776319 xen: CVE-2015-0361 Bug #776319 [src:xen] CVE-2015-0361 C...

Source: xen Version: 4.17.0-1 Severity: important Tags: security upstream X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org> Hi, The following vulnerability was published for xen. CVE-2022-42330[0]: | Guests can cause Xenstore crash via soft reset When a guest issues a | "Soft Reset" (e.g. for performing a kexec) the libxl based Xen | to...

Source: xen Version: 4.17.0+24-g2f8851c37f-2 Severity: grave Tags: security upstream X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org> Hi, The following vulnerability was published for xen, filling with RC severity (for ideally fixed before bookworm release): CVE-2022-27672[0]: | When SMT is enabled, certain AMD processors may speculatively execute | instru...

Source: xen Version: 4.17.2+55-g0b56bed864-1 Severity: important Tags: security upstream X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org> Hi, The following vulnerabilities were published for xen. CVE-2023-46835[0]: | x86/AMD: mismatch in IOMMU quarantine page table levels CVE-2023-46836[1]: | x86: BTC/SRSO fixes not fully effective If you fix the vulnerabi...

...em-amd64 xen-hypervisor-4.4-arm64 xen-system-arm64 xen-hypervisor-4.4-armhf xen-system-armhf Architecture: all source Version: 4.4.1-9+deb8u5 Distribution: jessie-security Urgency: high Maintainer: Debian Xen Team <pkg-xen-devel at lists.alioth.debian.org> Changed-By: Salvatore Bonaccorso <carnil at debian.org> Description: libxen-4.4 - Public libs for Xen libxen-dev - Public headers and libs for Xen libxenstore3.0 - Xenstore communications library for Xen xen-hypervisor-4.4-amd64 - Xen Hypervisor on AMD64 xen-hypervisor-4.4-arm64 - Xen Hypervisor on ARM64 xen-hypervisor-4.4-armhf...

Source: xen Version: 4.4.1-9 Severity: normal Tags: security upstream patch fixed-upstream Hi, the following vulnerability was published for xen. CVE-2015-6654[0]: | The xenmem_add_to_physmap_one function in arch/arm/mm.c in Xen 4.5.x, | 4.4.x, and earlier does not limit the number of printk console | messages when reporting a failure to retrieve a reference on a foreign | page, which allows

...em-amd64 xen-hypervisor-4.4-arm64 xen-system-arm64 xen-hypervisor-4.4-armhf xen-system-armhf Architecture: all source Version: 4.4.1-9+deb8u5 Distribution: jessie-security Urgency: high Maintainer: Debian Xen Team <pkg-xen-devel at lists.alioth.debian.org> Changed-By: Salvatore Bonaccorso <carnil at debian.org> Description: libxen-4.4 - Public libs for Xen libxen-dev - Public headers and libs for Xen libxenstore3.0 - Xenstore communications library for Xen xen-hypervisor-4.4-amd64 - Xen Hypervisor on AMD64 xen-hypervisor-4.4-arm64 - Xen Hypervisor on ARM64 xen-hypervisor-4.4-armhf...

...em-amd64 xen-hypervisor-4.4-arm64 xen-system-arm64 xen-hypervisor-4.4-armhf xen-system-armhf Architecture: all source Version: 4.4.1-9+deb8u2 Distribution: jessie-security Urgency: high Maintainer: Debian Xen Team <pkg-xen-devel at lists.alioth.debian.org> Changed-By: Salvatore Bonaccorso <carnil at debian.org> Description: libxen-4.4 - Public libs for Xen libxen-dev - Public headers and libs for Xen libxenstore3.0 - Xenstore communications library for Xen xen-hypervisor-4.4-amd64 - Xen Hypervisor on AMD64 xen-hypervisor-4.4-arm64 - Xen Hypervisor on ARM64 xen-hypervisor-4.4-armhf...

...em-amd64 xen-hypervisor-4.4-arm64 xen-system-arm64 xen-hypervisor-4.4-armhf xen-system-armhf Architecture: all source Version: 4.4.1-9+deb8u2 Distribution: jessie-security Urgency: high Maintainer: Debian Xen Team <pkg-xen-devel at lists.alioth.debian.org> Changed-By: Salvatore Bonaccorso <carnil at debian.org> Description: libxen-4.4 - Public libs for Xen libxen-dev - Public headers and libs for Xen libxenstore3.0 - Xenstore communications library for Xen xen-hypervisor-4.4-amd64 - Xen Hypervisor on AMD64 xen-hypervisor-4.4-arm64 - Xen Hypervisor on ARM64 xen-hypervisor-4.4-armhf...

Source: xen Version: 4.3.0-1 Severity: serious Justification: FTBFS Hi New uploaded xen 4.3.0-1 FTBFS, see [1] for build log for i386. [1] https://buildd.debian.org/status/fetch.php?pkg=xen&arch=i386&ver=4.3.0-1&stamp=1378426577 Regards, Salvatore

...-x86_32p hvm-3.0-x86_64 xen_scheduler : credit xen_pagesize : 4096 platform_params : virt_start=0xffff800000000000 xen_changeset : unavailable xen_commandline : placeholder cc_compiler : gcc version 4.7.2 (Debian 4.7.2-5) cc_compile_by : carnil cc_compile_domain : debian.org cc_compile_date : Sun May 5 14:44:49 UTC 2013 xend_config_format : 4 root@xen-servidor:~# root@xen-servidor:~# df -hT S.ficheros Tipo Tamaño Usados Disp Uso% Montado en rootfs...

Source: xen Version: 4.2.2-1 Severity: important User: debian-perl at lists.debian.org Usertags: perl-5.18-transition This package FTBFS with perl 5.18 (which will soon be uploaded to unstable) owing to a stricter pod2man: pod2text man/xl.pod.1 txt/man/xl.1.txt.tmp man/xl.pod.1 around line 854: Expected text after =item, not a bullet POD document had syntax errors at /usr/bin/pod2text line 84.

...-4.1 xen-hypervisor-4.1-amd64 xen-system-amd64 xen-hypervisor-4.1-i386 xen-system-i386 Architecture: source all amd64 Version: 4.1.4-3+deb7u9 Distribution: wheezy-security Urgency: high Maintainer: Debian Xen Team <pkg-xen-devel at lists.alioth.debian.org> Changed-By: Salvatore Bonaccorso <carnil at debian.org> Description: libxen-4.1 - Public libs for Xen libxen-dev - Public headers and libs for Xen libxen-ocaml - OCaml libraries for controlling Xen libxen-ocaml-dev - OCaml libraries for controlling Xen (devel package) libxenstore3.0 - Xenstore communications library for Xen xen-...

...-4.1 xen-hypervisor-4.1-amd64 xen-system-amd64 xen-hypervisor-4.1-i386 xen-system-i386 Architecture: source all amd64 Version: 4.1.4-3+deb7u9 Distribution: wheezy-security Urgency: high Maintainer: Debian Xen Team <pkg-xen-devel at lists.alioth.debian.org> Changed-By: Salvatore Bonaccorso <carnil at debian.org> Description: libxen-4.1 - Public libs for Xen libxen-dev - Public headers and libs for Xen libxen-ocaml - OCaml libraries for controlling Xen libxen-ocaml-dev - OCaml libraries for controlling Xen (devel package) libxenstore3.0 - Xenstore communications library for Xen xen-...

Unprivileged user can crash kernel by using DRM_IOCTL_NOUVEAU_CHANNEL_ALLOC ioctl. This was reported by trinity[1] fuzzer. [ 71.073906] nouveau 0000:01:00.0: crashme[1329]: channel failed to initialise, -17 [ 71.081730] BUG: kernel NULL pointer dereference, address: 00000000000000a0 [ 71.088928] #PF: supervisor read access in kernel mode [ 71.094059] #PF: error_code(0x0000) - not-present