similar to: XSA-172

I have the following packages going through the CBS: * A CentOS 7 xen-4.6.1-2, with XSAs 170 and 154 * A CentOS 6 xen-4.6.1-2, with XSAs 170 and 154 * A CentOS 6 xen-4.4.3-11, with XSAs 170 All these should show up in mirrors hopefully sometime later today. As usual, please report any problems here. Xen 4.4 only has XSA 170 because at the time the embargo was lifted, I didn't have a suitable

OK Guys and Gals, We have just kicked off a build of the 4.9.34-29 xen kernel on the Community Build Service for both EL6 and EL7. This kernel has some important things in it. 1. It has a patch for the stack guard issue (CVE-2017-1000364). Also the patch for Xen Security fix XSA-216. See these upstream changelogs for ALL kernel commits from 4.9.31 to 4.9.34:

Thanks to work from Johnny, linux 3.18.12 with all the x4c blktap goodness have been built and are now in the virt6-testing repo. I've also uploaded libvirt 1.2.15. As you may have seen earlier today, virt6-testing also includes an updated 4.4.2 package with the latest security update (XSA-133). The kernel has had some basic testing (by myself, Johnny, and another community member), but

Hi list, Are the recent Xen XSA's (199-204) updates going to be released soon? http://xenbits.xen.org/xsa/ -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.centos.org/pipermail/centos-virt/attachments/20170102/575997f6/attachment.html>

On Wed, Nov 18, 2015 at 1:31 PM, Pasi K?rkk?inen <pasik at iki.fi> wrote: > On Wed, Nov 18, 2015 at 02:20:49PM +0200, Manuel Wolfshant wrote: >> On 11/18/2015 02:08 PM, Pasi K?rkk?inen wrote: >> >Hello, >> > >> >On Sun, Nov 15, 2015 at 06:42:18PM +0200, Pasi K?rkk?inen wrote: >> >>On Sun, Nov 15, 2015 at 02:04:58PM +0200, Pasi K?rkk?inen wrote:

I've built & tagged packages for CentOS 6 and 7 4.6.6-9, with XPTI "stage 1" Meltdown mitigation. This will allow 64-bit PV guests to run safely (with a few caveats), but incurs a fairly significant slowdown for 64-bit PV guests on Intel boxes (including domain 0). If you prefer using Vixen / Comet, you can turn it off by adding 'xpti=0' to your Xen command-line.

On 01/02/2017 11:05 AM, Brandon Shoemaker wrote: > Hi list, > > > > Are the recent Xen XSA?s (199-204) updates going to be released soon? > > > > http://xenbits.xen.org/xsa/ They are in the testing repo .. waiting on feedback that they work. http://buildlogs.centos.org/centos/7/virt/ (or /6/ as well) -------------- next part -------------- A non-text

On 01/03/2017 02:29 AM, Johnny Hughes wrote: > On 01/02/2017 11:05 AM, Brandon Shoemaker wrote: >> Hi list, >> >> >> >> Are the recent Xen XSA?s (199-204) updates going to be released soon? >> >> >> >> http://xenbits.xen.org/xsa/ > > They are in the testing repo .. waiting on feedback that they work. > > >

Moritz M?hlenhoff writes ("Re: Updated Xen packages for XSA 216..225"): > Since the queue was already quite big and this update was ready > I went ahead and released what we had for now. Yes, sorry, I should have been explicit that that's what I expected you to do... Ian.

On Sat, May 16, 2015 at 2:08 PM, Johnny Hughes <johnny at centos.org> wrote: > On 05/13/2015 01:14 PM, George Dunlap wrote: >> Thanks to work from Johnny, linux 3.18.12 with all the x4c blktap >> goodness have been built and are now in the virt6-testing repo. I've >> also uploaded libvirt 1.2.15. As you may have seen earlier today, >> virt6-testing also

XSA 169 is out, but is low-priority and has a work-around, so I'm going to batch it together with XSAs 167-168 and release a new 4.4.3 package when the embargo is lifted next Wednesday. This will be the last XSA update for the 4.4.3 packages. Today or tomorrow I will push the Xen 4.6.0 packages to buildlogs for testing; and sometime after the final 4.4.3 packages are released, I will push

I've got Xen 4.4.2 in virt6-testing. I haven't had a chance to test it, and won't for another week or two; but if some volunteers can put it through its paces, I can ask Johnny to push it to the public repo sometome early next week. Thanks, -George

There is now a kernel-3.18.25-18 that fixes CVE-2016-0728 (and upgrades to the lastest 3.18 LTS kernel) for Xen4CentOS users. This kernel can be tested from here: http://cbs.centos.org/repos/virt6-xen-common-testing/x86_64/os/Packages/ (CentOS-6) and here: http://cbs.centos.org/repos/virt7-xen-common-testing/x86_64/os/Packages/ (CentOS-7) Once we get several tested installs we can move this

Given the circumstances, might it make sense to offer formal advisories of some type for these to indicate when the packages going to live are for security or other reasons? On 02/17/2017 09:51 AM, Johnny Hughes wrote: > These updates have now been pushed to mirror.centos.org and you can get > them from the main repos. > > On 02/15/2017 08:27 AM, Johnny Hughes wrote: >> There

Ian Jackson writes ("64bit PV guest breakout [XSA-213]"): > Source: xen > Version: 4.4.1-9 > Severity: important > Tags: security upstream fixed-upstream > > See > https://xenbits.xen.org/xsa/advisory-213.html Ian Jackson writes ("grant transfer allows PV guest to elevate privileges [XSA-214]"): > Source: xen > Version: 4.4.1-9 > Severity:

Dear Security Team, I have prepared a new upload addressing a number of open security issues in Xen. Due to the complexity of the patches that address XSA-273 [0] the packages have been built from upstream's staging-4.8 / staging-4.10 branch again as recommended in that advisory. Commits on those branches are restricted to those that address the following XSAs (cf. [1]): - XSA-273

Hello, Are XSA-289 and XSA-274/CVE-2018-14678 fixed with Xen recent 4.8, 4.10 and kernel 4.9.177 packages ? Thank you

On Fri, Apr 24, 2015 at 4:32 AM, Pasi K?rkk?inen <pasik at iki.fi> wrote: > On Thu, Apr 23, 2015 at 05:09:56PM +0100, George Dunlap wrote: > > I've got Xen 4.4.2 in virt6-testing. I haven't had a chance to test > > it, and won't for another week or two; but if some volunteers can put > > it through its paces, I can ask Johnny to push it to the public repo

On 11/18/2015 02:08 PM, Pasi K?rkk?inen wrote: > Hello, > > On Sun, Nov 15, 2015 at 06:42:18PM +0200, Pasi K?rkk?inen wrote: >> On Sun, Nov 15, 2015 at 02:04:58PM +0200, Pasi K?rkk?inen wrote: >>> On Thu, Nov 12, 2015 at 02:00:27PM +0000, George Dunlap wrote: >>>> So going forward, we're moving the CentOS 6 Xen packages from the >>>> custom

Salvatore Bonaccorso writes ("Re: Updated Xen packages for XSA 216..225"): > On Tue, Jul 11, 2017 at 11:34:38PM +0200, Moritz Muehlenhoff wrote: > > On Mon, Jul 03, 2017 at 12:33:54PM +0100, Ian Jackson wrote: > > > Moritz M?hlenhoff writes ("Re: Updated Xen packages for XSA 216..225"): > > > > Sorry for the late reply, was on vacation for a week.