<?xml version="1.0" encoding="UTF-8"?>
<cvrfdoc xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:cvrf="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf" xmlns:cvrf-common="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/common" xmlns:cvssv2="http://scap.nist.gov/schema/cvss-v2/1.0" xmlns:cvssv3="https://www.first.org/cvss/cvss-v3.0.xsd" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:ns0="http://purl.org/dc/elements/1.1/" xmlns:prod="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod" xmlns:scap-core="http://scap.nist.gov/schema/scap-core/1.0" xmlns:sch="http://purl.oclc.org/dsdl/schematron" xmlns:vuln="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf">
  <DocumentTitle xml:lang="en">Security update for xen</DocumentTitle>
  <DocumentType>SUSE Patch</DocumentType>
  <DocumentPublisher Type="Vendor">
    <ContactDetails>security@suse.de</ContactDetails>
    <IssuingAuthority>SUSE Security Team</IssuingAuthority>
  </DocumentPublisher>
  <DocumentTracking>
    <Identification>
      <ID>SUSE-SU-2020:3880-1</ID>
    </Identification>
    <Status>Final</Status>
    <Version>1</Version>
    <RevisionHistory>
      <Revision>
        <Number>1</Number>
        <Date>2020-12-18T15:47:02Z</Date>
        <Description>current</Description>
      </Revision>
    </RevisionHistory>
    <InitialReleaseDate>2020-12-18T15:47:02Z</InitialReleaseDate>
    <CurrentReleaseDate>2020-12-18T15:47:02Z</CurrentReleaseDate>
    <Generator>
      <Engine>cve-database/bin/generate-cvrf.pl</Engine>
      <Date>2017-02-24T01:00:00Z</Date>
    </Generator>
  </DocumentTracking>
  <DocumentNotes>
    <Note Title="Topic" Type="Summary" Ordinal="1" xml:lang="en">Security update for xen</Note>
    <Note Title="Details" Type="General" Ordinal="2" xml:lang="en">This update for xen fixes the following issues:

- CVE-2020-29480: Fixed an issue which could have allowed leak of non-sensitive data to administrator guests (bsc#117949 XSA-115).
- CVE-2020-29481: Fixed an issue which could have allowd to new domains to inherit existing node permissions (bsc#1179498 XSA-322). 
- CVE-2020-29483: Fixed an issue where guests could disturb domain cleanup (bsc#1179502 XSA-325).
- CVE-2020-29484: Fixed an issue where guests could crash xenstored via watchs (bsc#1179501 XSA-324). 
- CVE-2020-29566: Fixed an undue recursion in x86 HVM context switch code (bsc#1179506 XSA-348).
- CVE-2020-29570: Fixed an issue where FIFO event channels control block related ordering (bsc#1179514 XSA-358).
- CVE-2020-29571: Fixed an issue where FIFO event channels control structure ordering (bsc#1179516 XSA-359).
- CVE-2020-29130: Fixed an out-of-bounds access while processing ARP packets (bsc#1179477). 
- Fixed an issue where dump-core shows missing nr_pages during core (bsc#1176782).
- Multiple other bugs (bsc#1027519)
</Note>
    <Note Title="Terms of Use" Type="Legal Disclaimer" Ordinal="3" xml:lang="en">The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).</Note>
    <Note Title="Patchnames" Type="Details" Ordinal="4" xml:lang="en">Image SLES12-SP5-EC2-BYOS-2020-3880,Image SLES12-SP5-EC2-ECS-On-Demand-2020-3880,Image SLES12-SP5-EC2-On-Demand-2020-3880,Image SLES12-SP5-EC2-SAP-BYOS-2020-3880,Image SLES12-SP5-EC2-SAP-On-Demand-2020-3880,SUSE-2020-3880,SUSE-SLE-SDK-12-SP5-2020-3880,SUSE-SLE-SERVER-12-SP5-2020-3880</Note>
  </DocumentNotes>
  <DocumentDistribution xml:lang="en">Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0)</DocumentDistribution>
  <DocumentReferences>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/update/announcement/2020/suse-su-20203880-1/</URL>
      <Description>Link for SUSE-SU-2020:3880-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://lists.suse.com/pipermail/sle-security-updates/2020-December/008094.html</URL>
      <Description>E-Mail link for SUSE-SU-2020:3880-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/security/rating/</URL>
      <Description>SUSE Security Ratings</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1027519</URL>
      <Description>SUSE Bug 1027519</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1163019</URL>
      <Description>SUSE Bug 1163019</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1176782</URL>
      <Description>SUSE Bug 1176782</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1179477</URL>
      <Description>SUSE Bug 1179477</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1179496</URL>
      <Description>SUSE Bug 1179496</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1179498</URL>
      <Description>SUSE Bug 1179498</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1179501</URL>
      <Description>SUSE Bug 1179501</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1179502</URL>
      <Description>SUSE Bug 1179502</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1179506</URL>
      <Description>SUSE Bug 1179506</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1179514</URL>
      <Description>SUSE Bug 1179514</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1179516</URL>
      <Description>SUSE Bug 1179516</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2020-29130/</URL>
      <Description>SUSE CVE CVE-2020-29130 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2020-29480/</URL>
      <Description>SUSE CVE CVE-2020-29480 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2020-29481/</URL>
      <Description>SUSE CVE CVE-2020-29481 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2020-29483/</URL>
      <Description>SUSE CVE CVE-2020-29483 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2020-29484/</URL>
      <Description>SUSE CVE CVE-2020-29484 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2020-29566/</URL>
      <Description>SUSE CVE CVE-2020-29566 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2020-29570/</URL>
      <Description>SUSE CVE CVE-2020-29570 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2020-29571/</URL>
      <Description>SUSE CVE CVE-2020-29571 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2020-8608/</URL>
      <Description>SUSE CVE CVE-2020-8608 page</Description>
    </Reference>
  </DocumentReferences>
  <ProductTree xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod">
    <Branch Type="Product Family" Name="Image SLES12-SP5-EC2-BYOS">
      <Branch Type="Product Name" Name="Image SLES12-SP5-EC2-BYOS">
        <FullProductName ProductID="Image SLES12-SP5-EC2-BYOS">Image SLES12-SP5-EC2-BYOS</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="Image SLES12-SP5-EC2-ECS-On-Demand">
      <Branch Type="Product Name" Name="Image SLES12-SP5-EC2-ECS-On-Demand">
        <FullProductName ProductID="Image SLES12-SP5-EC2-ECS-On-Demand">Image SLES12-SP5-EC2-ECS-On-Demand</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="Image SLES12-SP5-EC2-On-Demand">
      <Branch Type="Product Name" Name="Image SLES12-SP5-EC2-On-Demand">
        <FullProductName ProductID="Image SLES12-SP5-EC2-On-Demand">Image SLES12-SP5-EC2-On-Demand</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="Image SLES12-SP5-EC2-SAP-BYOS">
      <Branch Type="Product Name" Name="Image SLES12-SP5-EC2-SAP-BYOS">
        <FullProductName ProductID="Image SLES12-SP5-EC2-SAP-BYOS">Image SLES12-SP5-EC2-SAP-BYOS</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="Image SLES12-SP5-EC2-SAP-On-Demand">
      <Branch Type="Product Name" Name="Image SLES12-SP5-EC2-SAP-On-Demand">
        <FullProductName ProductID="Image SLES12-SP5-EC2-SAP-On-Demand">Image SLES12-SP5-EC2-SAP-On-Demand</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Server 12 SP5">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Server 12 SP5">
        <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP5" CPE="cpe:/o:suse:sles:12:sp5">SUSE Linux Enterprise Server 12 SP5</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Server for SAP Applications 12 SP5">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Server for SAP Applications 12 SP5">
        <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 12 SP5" CPE="cpe:/o:suse:sles_sap:12:sp5">SUSE Linux Enterprise Server for SAP Applications 12 SP5</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Software Development Kit 12 SP5">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Software Development Kit 12 SP5">
        <FullProductName ProductID="SUSE Linux Enterprise Software Development Kit 12 SP5" CPE="cpe:/o:suse:sle-sdk:12:sp5">SUSE Linux Enterprise Software Development Kit 12 SP5</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Version" Name="xen-libs-4.12.4_06-3.36.1">
      <FullProductName ProductID="xen-libs-4.12.4_06-3.36.1">xen-libs-4.12.4_06-3.36.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="xen-tools-domU-4.12.4_06-3.36.1">
      <FullProductName ProductID="xen-tools-domU-4.12.4_06-3.36.1">xen-tools-domU-4.12.4_06-3.36.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="xen-4.12.4_06-3.36.1">
      <FullProductName ProductID="xen-4.12.4_06-3.36.1">xen-4.12.4_06-3.36.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="xen-devel-4.12.4_06-3.36.1">
      <FullProductName ProductID="xen-devel-4.12.4_06-3.36.1">xen-devel-4.12.4_06-3.36.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="xen-doc-html-4.12.4_06-3.36.1">
      <FullProductName ProductID="xen-doc-html-4.12.4_06-3.36.1">xen-doc-html-4.12.4_06-3.36.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="xen-libs-32bit-4.12.4_06-3.36.1">
      <FullProductName ProductID="xen-libs-32bit-4.12.4_06-3.36.1">xen-libs-32bit-4.12.4_06-3.36.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="xen-libs-64bit-4.12.4_06-3.36.1">
      <FullProductName ProductID="xen-libs-64bit-4.12.4_06-3.36.1">xen-libs-64bit-4.12.4_06-3.36.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="xen-tools-4.12.4_06-3.36.1">
      <FullProductName ProductID="xen-tools-4.12.4_06-3.36.1">xen-tools-4.12.4_06-3.36.1</FullProductName>
    </Branch>
    <Relationship ProductReference="xen-libs-4.12.4_06-3.36.1" RelationType="Default Component Of" RelatesToProductReference="Image SLES12-SP5-EC2-BYOS">
      <FullProductName ProductID="Image SLES12-SP5-EC2-BYOS:xen-libs-4.12.4_06-3.36.1">xen-libs-4.12.4_06-3.36.1 as a component of Image SLES12-SP5-EC2-BYOS</FullProductName>
    </Relationship>
    <Relationship ProductReference="xen-tools-domU-4.12.4_06-3.36.1" RelationType="Default Component Of" RelatesToProductReference="Image SLES12-SP5-EC2-BYOS">
      <FullProductName ProductID="Image SLES12-SP5-EC2-BYOS:xen-tools-domU-4.12.4_06-3.36.1">xen-tools-domU-4.12.4_06-3.36.1 as a component of Image SLES12-SP5-EC2-BYOS</FullProductName>
    </Relationship>
    <Relationship ProductReference="xen-libs-4.12.4_06-3.36.1" RelationType="Default Component Of" RelatesToProductReference="Image SLES12-SP5-EC2-ECS-On-Demand">
      <FullProductName ProductID="Image SLES12-SP5-EC2-ECS-On-Demand:xen-libs-4.12.4_06-3.36.1">xen-libs-4.12.4_06-3.36.1 as a component of Image SLES12-SP5-EC2-ECS-On-Demand</FullProductName>
    </Relationship>
    <Relationship ProductReference="xen-tools-domU-4.12.4_06-3.36.1" RelationType="Default Component Of" RelatesToProductReference="Image SLES12-SP5-EC2-ECS-On-Demand">
      <FullProductName ProductID="Image SLES12-SP5-EC2-ECS-On-Demand:xen-tools-domU-4.12.4_06-3.36.1">xen-tools-domU-4.12.4_06-3.36.1 as a component of Image SLES12-SP5-EC2-ECS-On-Demand</FullProductName>
    </Relationship>
    <Relationship ProductReference="xen-libs-4.12.4_06-3.36.1" RelationType="Default Component Of" RelatesToProductReference="Image SLES12-SP5-EC2-On-Demand">
      <FullProductName ProductID="Image SLES12-SP5-EC2-On-Demand:xen-libs-4.12.4_06-3.36.1">xen-libs-4.12.4_06-3.36.1 as a component of Image SLES12-SP5-EC2-On-Demand</FullProductName>
    </Relationship>
    <Relationship ProductReference="xen-tools-domU-4.12.4_06-3.36.1" RelationType="Default Component Of" RelatesToProductReference="Image SLES12-SP5-EC2-On-Demand">
      <FullProductName ProductID="Image SLES12-SP5-EC2-On-Demand:xen-tools-domU-4.12.4_06-3.36.1">xen-tools-domU-4.12.4_06-3.36.1 as a component of Image SLES12-SP5-EC2-On-Demand</FullProductName>
    </Relationship>
    <Relationship ProductReference="xen-libs-4.12.4_06-3.36.1" RelationType="Default Component Of" RelatesToProductReference="Image SLES12-SP5-EC2-SAP-BYOS">
      <FullProductName ProductID="Image SLES12-SP5-EC2-SAP-BYOS:xen-libs-4.12.4_06-3.36.1">xen-libs-4.12.4_06-3.36.1 as a component of Image SLES12-SP5-EC2-SAP-BYOS</FullProductName>
    </Relationship>
    <Relationship ProductReference="xen-tools-domU-4.12.4_06-3.36.1" RelationType="Default Component Of" RelatesToProductReference="Image SLES12-SP5-EC2-SAP-BYOS">
      <FullProductName ProductID="Image SLES12-SP5-EC2-SAP-BYOS:xen-tools-domU-4.12.4_06-3.36.1">xen-tools-domU-4.12.4_06-3.36.1 as a component of Image SLES12-SP5-EC2-SAP-BYOS</FullProductName>
    </Relationship>
    <Relationship ProductReference="xen-libs-4.12.4_06-3.36.1" RelationType="Default Component Of" RelatesToProductReference="Image SLES12-SP5-EC2-SAP-On-Demand">
      <FullProductName ProductID="Image SLES12-SP5-EC2-SAP-On-Demand:xen-libs-4.12.4_06-3.36.1">xen-libs-4.12.4_06-3.36.1 as a component of Image SLES12-SP5-EC2-SAP-On-Demand</FullProductName>
    </Relationship>
    <Relationship ProductReference="xen-tools-domU-4.12.4_06-3.36.1" RelationType="Default Component Of" RelatesToProductReference="Image SLES12-SP5-EC2-SAP-On-Demand">
      <FullProductName ProductID="Image SLES12-SP5-EC2-SAP-On-Demand:xen-tools-domU-4.12.4_06-3.36.1">xen-tools-domU-4.12.4_06-3.36.1 as a component of Image SLES12-SP5-EC2-SAP-On-Demand</FullProductName>
    </Relationship>
    <Relationship ProductReference="xen-4.12.4_06-3.36.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12 SP5">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP5:xen-4.12.4_06-3.36.1">xen-4.12.4_06-3.36.1 as a component of SUSE Linux Enterprise Server 12 SP5</FullProductName>
    </Relationship>
    <Relationship ProductReference="xen-doc-html-4.12.4_06-3.36.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12 SP5">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP5:xen-doc-html-4.12.4_06-3.36.1">xen-doc-html-4.12.4_06-3.36.1 as a component of SUSE Linux Enterprise Server 12 SP5</FullProductName>
    </Relationship>
    <Relationship ProductReference="xen-libs-4.12.4_06-3.36.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12 SP5">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP5:xen-libs-4.12.4_06-3.36.1">xen-libs-4.12.4_06-3.36.1 as a component of SUSE Linux Enterprise Server 12 SP5</FullProductName>
    </Relationship>
    <Relationship ProductReference="xen-libs-32bit-4.12.4_06-3.36.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12 SP5">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP5:xen-libs-32bit-4.12.4_06-3.36.1">xen-libs-32bit-4.12.4_06-3.36.1 as a component of SUSE Linux Enterprise Server 12 SP5</FullProductName>
    </Relationship>
    <Relationship ProductReference="xen-tools-4.12.4_06-3.36.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12 SP5">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP5:xen-tools-4.12.4_06-3.36.1">xen-tools-4.12.4_06-3.36.1 as a component of SUSE Linux Enterprise Server 12 SP5</FullProductName>
    </Relationship>
    <Relationship ProductReference="xen-tools-domU-4.12.4_06-3.36.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12 SP5">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP5:xen-tools-domU-4.12.4_06-3.36.1">xen-tools-domU-4.12.4_06-3.36.1 as a component of SUSE Linux Enterprise Server 12 SP5</FullProductName>
    </Relationship>
    <Relationship ProductReference="xen-4.12.4_06-3.36.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server for SAP Applications 12 SP5">
      <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 12 SP5:xen-4.12.4_06-3.36.1">xen-4.12.4_06-3.36.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5</FullProductName>
    </Relationship>
    <Relationship ProductReference="xen-doc-html-4.12.4_06-3.36.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server for SAP Applications 12 SP5">
      <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 12 SP5:xen-doc-html-4.12.4_06-3.36.1">xen-doc-html-4.12.4_06-3.36.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5</FullProductName>
    </Relationship>
    <Relationship ProductReference="xen-libs-4.12.4_06-3.36.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server for SAP Applications 12 SP5">
      <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 12 SP5:xen-libs-4.12.4_06-3.36.1">xen-libs-4.12.4_06-3.36.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5</FullProductName>
    </Relationship>
    <Relationship ProductReference="xen-libs-32bit-4.12.4_06-3.36.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server for SAP Applications 12 SP5">
      <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 12 SP5:xen-libs-32bit-4.12.4_06-3.36.1">xen-libs-32bit-4.12.4_06-3.36.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5</FullProductName>
    </Relationship>
    <Relationship ProductReference="xen-tools-4.12.4_06-3.36.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server for SAP Applications 12 SP5">
      <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 12 SP5:xen-tools-4.12.4_06-3.36.1">xen-tools-4.12.4_06-3.36.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5</FullProductName>
    </Relationship>
    <Relationship ProductReference="xen-tools-domU-4.12.4_06-3.36.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server for SAP Applications 12 SP5">
      <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 12 SP5:xen-tools-domU-4.12.4_06-3.36.1">xen-tools-domU-4.12.4_06-3.36.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5</FullProductName>
    </Relationship>
    <Relationship ProductReference="xen-devel-4.12.4_06-3.36.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Software Development Kit 12 SP5">
      <FullProductName ProductID="SUSE Linux Enterprise Software Development Kit 12 SP5:xen-devel-4.12.4_06-3.36.1">xen-devel-4.12.4_06-3.36.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5</FullProductName>
    </Relationship>
  </ProductTree>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="1">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">slirp.c in libslirp through 4.3.1 has a buffer over-read because it tries to read a certain amount of header data even if that exceeds the total packet length.</Note>
    </Notes>
    <CVE>CVE-2020-29130</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>Image SLES12-SP5-EC2-BYOS:xen-libs-4.12.4_06-3.36.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-BYOS:xen-tools-domU-4.12.4_06-3.36.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-ECS-On-Demand:xen-libs-4.12.4_06-3.36.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-ECS-On-Demand:xen-tools-domU-4.12.4_06-3.36.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-On-Demand:xen-libs-4.12.4_06-3.36.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-On-Demand:xen-tools-domU-4.12.4_06-3.36.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-SAP-BYOS:xen-libs-4.12.4_06-3.36.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-SAP-BYOS:xen-tools-domU-4.12.4_06-3.36.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-SAP-On-Demand:xen-libs-4.12.4_06-3.36.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-SAP-On-Demand:xen-tools-domU-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP5:xen-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP5:xen-doc-html-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP5:xen-libs-32bit-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP5:xen-libs-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP5:xen-tools-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP5:xen-tools-domU-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP5:xen-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP5:xen-doc-html-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP5:xen-libs-32bit-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP5:xen-libs-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP5:xen-tools-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP5:xen-tools-domU-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Software Development Kit 12 SP5:xen-devel-4.12.4_06-3.36.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>4</BaseScoreV2>
        <VectorV2>AV:N/AC:L/Au:S/C:P/I:N/A:N</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>4.3</BaseScoreV3>
        <VectorV3>CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2020/suse-su-20203880-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2020-29130.html</URL>
        <Description>CVE-2020-29130</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1178658</URL>
        <Description>SUSE Bug 1178658</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1179467</URL>
        <Description>SUSE Bug 1179467</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1179477</URL>
        <Description>SUSE Bug 1179477</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="2">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">An issue was discovered in Xen through 4.14.x. Neither xenstore implementation does any permission checks when reporting a xenstore watch event. A guest administrator can watch the root xenstored node, which will cause notifications for every created, modified, and deleted key. A guest administrator can also use the special watches, which will cause a notification every time a domain is created and destroyed. Data may include: number, type, and domids of other VMs; existence and domids of driver domains; numbers of virtual interfaces, block devices, vcpus; existence of virtual framebuffers and their backend style (e.g., existence of VNC service); Xen VM UUIDs for other domains; timing information about domain creation and device setup; and some hints at the backend provisioning of VMs and their devices. The watch events do not contain values stored in xenstore, only key names. A guest administrator can observe non-sensitive domain and device lifecycle events relating to other guests. This information allows some insight into overall system configuration (including the number and general nature of other guests), and configuration of other guests (including the number and general nature of other guests' devices). This information might be commercially interesting or might make other attacks easier. There is not believed to be exposure of sensitive data. Specifically, there is no exposure of VNC passwords, port numbers, pathnames in host and guest filesystems, cryptographic keys, or within-guest data.</Note>
    </Notes>
    <CVE>CVE-2020-29480</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>Image SLES12-SP5-EC2-BYOS:xen-libs-4.12.4_06-3.36.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-BYOS:xen-tools-domU-4.12.4_06-3.36.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-ECS-On-Demand:xen-libs-4.12.4_06-3.36.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-ECS-On-Demand:xen-tools-domU-4.12.4_06-3.36.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-On-Demand:xen-libs-4.12.4_06-3.36.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-On-Demand:xen-tools-domU-4.12.4_06-3.36.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-SAP-BYOS:xen-libs-4.12.4_06-3.36.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-SAP-BYOS:xen-tools-domU-4.12.4_06-3.36.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-SAP-On-Demand:xen-libs-4.12.4_06-3.36.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-SAP-On-Demand:xen-tools-domU-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP5:xen-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP5:xen-doc-html-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP5:xen-libs-32bit-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP5:xen-libs-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP5:xen-tools-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP5:xen-tools-domU-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP5:xen-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP5:xen-doc-html-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP5:xen-libs-32bit-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP5:xen-libs-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP5:xen-tools-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP5:xen-tools-domU-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Software Development Kit 12 SP5:xen-devel-4.12.4_06-3.36.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>low</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>2.1</BaseScoreV2>
        <VectorV2>AV:L/AC:L/Au:N/C:P/I:N/A:N</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>3.8</BaseScoreV3>
        <VectorV3>CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2020/suse-su-20203880-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2020-29480.html</URL>
        <Description>CVE-2020-29480</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1178658</URL>
        <Description>SUSE Bug 1178658</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1179496</URL>
        <Description>SUSE Bug 1179496</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="3">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">An issue was discovered in Xen through 4.14.x. Access rights of Xenstore nodes are per domid. Unfortunately, existing granted access rights are not removed when a domain is being destroyed. This means that a new domain created with the same domid will inherit the access rights to Xenstore nodes from the previous domain(s) with the same domid. Because all Xenstore entries of a guest below /local/domain/&lt;domid&gt; are being deleted by Xen tools when a guest is destroyed, only Xenstore entries of other guests still running are affected. For example, a newly created guest domain might be able to read sensitive information that had belonged to a previously existing guest domain. Both Xenstore implementations (C and Ocaml) are vulnerable.</Note>
    </Notes>
    <CVE>CVE-2020-29481</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>Image SLES12-SP5-EC2-BYOS:xen-libs-4.12.4_06-3.36.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-BYOS:xen-tools-domU-4.12.4_06-3.36.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-ECS-On-Demand:xen-libs-4.12.4_06-3.36.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-ECS-On-Demand:xen-tools-domU-4.12.4_06-3.36.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-On-Demand:xen-libs-4.12.4_06-3.36.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-On-Demand:xen-tools-domU-4.12.4_06-3.36.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-SAP-BYOS:xen-libs-4.12.4_06-3.36.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-SAP-BYOS:xen-tools-domU-4.12.4_06-3.36.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-SAP-On-Demand:xen-libs-4.12.4_06-3.36.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-SAP-On-Demand:xen-tools-domU-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP5:xen-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP5:xen-doc-html-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP5:xen-libs-32bit-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP5:xen-libs-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP5:xen-tools-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP5:xen-tools-domU-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP5:xen-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP5:xen-doc-html-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP5:xen-libs-32bit-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP5:xen-libs-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP5:xen-tools-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP5:xen-tools-domU-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Software Development Kit 12 SP5:xen-devel-4.12.4_06-3.36.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>4.6</BaseScoreV2>
        <VectorV2>AV:L/AC:L/Au:N/C:P/I:P/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>6.5</BaseScoreV3>
        <VectorV3>CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2020/suse-su-20203880-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2020-29481.html</URL>
        <Description>CVE-2020-29481</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1176349</URL>
        <Description>SUSE Bug 1176349</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1178658</URL>
        <Description>SUSE Bug 1178658</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1179498</URL>
        <Description>SUSE Bug 1179498</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="4">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">An issue was discovered in Xen through 4.14.x. Xenstored and guests communicate via a shared memory page using a specific protocol. When a guest violates this protocol, xenstored will drop the connection to that guest. Unfortunately, this is done by just removing the guest from xenstored's internal management, resulting in the same actions as if the guest had been destroyed, including sending an @releaseDomain event. @releaseDomain events do not say that the guest has been removed. All watchers of this event must look at the states of all guests to find the guest that has been removed. When an @releaseDomain is generated due to a domain xenstored protocol violation, because the guest is still running, the watchers will not react. Later, when the guest is actually destroyed, xenstored will no longer have it stored in its internal data base, so no further @releaseDomain event will be sent. This can lead to a zombie domain; memory mappings of that guest's memory will not be removed, due to the missing event. This zombie domain will be cleaned up only after another domain is destroyed, as that will trigger another @releaseDomain event. If the device model of the guest that violated the Xenstore protocol is running in a stub-domain, a use-after-free case could happen in xenstored, after having removed the guest from its internal data base, possibly resulting in a crash of xenstored. A malicious guest can block resources of the host for a period after its own death. Guests with a stub domain device model can eventually crash xenstored, resulting in a more serious denial of service (the prevention of any further domain management operations). Only the C variant of Xenstore is affected; the Ocaml variant is not affected. Only HVM guests with a stubdom device model can cause a serious DoS.</Note>
    </Notes>
    <CVE>CVE-2020-29483</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>Image SLES12-SP5-EC2-BYOS:xen-libs-4.12.4_06-3.36.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-BYOS:xen-tools-domU-4.12.4_06-3.36.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-ECS-On-Demand:xen-libs-4.12.4_06-3.36.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-ECS-On-Demand:xen-tools-domU-4.12.4_06-3.36.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-On-Demand:xen-libs-4.12.4_06-3.36.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-On-Demand:xen-tools-domU-4.12.4_06-3.36.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-SAP-BYOS:xen-libs-4.12.4_06-3.36.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-SAP-BYOS:xen-tools-domU-4.12.4_06-3.36.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-SAP-On-Demand:xen-libs-4.12.4_06-3.36.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-SAP-On-Demand:xen-tools-domU-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP5:xen-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP5:xen-doc-html-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP5:xen-libs-32bit-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP5:xen-libs-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP5:xen-tools-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP5:xen-tools-domU-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP5:xen-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP5:xen-doc-html-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP5:xen-libs-32bit-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP5:xen-libs-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP5:xen-tools-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP5:xen-tools-domU-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Software Development Kit 12 SP5:xen-devel-4.12.4_06-3.36.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>4.9</BaseScoreV2>
        <VectorV2>AV:L/AC:L/Au:N/C:N/I:N/A:C</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>6.5</BaseScoreV3>
        <VectorV3>CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2020/suse-su-20203880-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2020-29483.html</URL>
        <Description>CVE-2020-29483</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1178658</URL>
        <Description>SUSE Bug 1178658</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1179502</URL>
        <Description>SUSE Bug 1179502</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="5">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">An issue was discovered in Xen through 4.14.x. When a Xenstore watch fires, the xenstore client that registered the watch will receive a Xenstore message containing the path of the modified Xenstore entry that triggered the watch, and the tag that was specified when registering the watch. Any communication with xenstored is done via Xenstore messages, consisting of a message header and the payload. The payload length is limited to 4096 bytes. Any request to xenstored resulting in a response with a payload longer than 4096 bytes will result in an error. When registering a watch, the payload length limit applies to the combined length of the watched path and the specified tag. Because watches for a specific path are also triggered for all nodes below that path, the payload of a watch event message can be longer than the payload needed to register the watch. A malicious guest that registers a watch using a very large tag (i.e., with a registration operation payload length close to the 4096 byte limit) can cause the generation of watch events with a payload length larger than 4096 bytes, by writing to Xenstore entries below the watched path. This will result in an error condition in xenstored. This error can result in a NULL pointer dereference, leading to a crash of xenstored. A malicious guest administrator can cause xenstored to crash, leading to a denial of service. Following a xenstored crash, domains may continue to run, but management operations will be impossible. Only C xenstored is affected, oxenstored is not affected.</Note>
    </Notes>
    <CVE>CVE-2020-29484</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>Image SLES12-SP5-EC2-BYOS:xen-libs-4.12.4_06-3.36.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-BYOS:xen-tools-domU-4.12.4_06-3.36.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-ECS-On-Demand:xen-libs-4.12.4_06-3.36.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-ECS-On-Demand:xen-tools-domU-4.12.4_06-3.36.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-On-Demand:xen-libs-4.12.4_06-3.36.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-On-Demand:xen-tools-domU-4.12.4_06-3.36.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-SAP-BYOS:xen-libs-4.12.4_06-3.36.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-SAP-BYOS:xen-tools-domU-4.12.4_06-3.36.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-SAP-On-Demand:xen-libs-4.12.4_06-3.36.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-SAP-On-Demand:xen-tools-domU-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP5:xen-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP5:xen-doc-html-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP5:xen-libs-32bit-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP5:xen-libs-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP5:xen-tools-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP5:xen-tools-domU-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP5:xen-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP5:xen-doc-html-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP5:xen-libs-32bit-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP5:xen-libs-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP5:xen-tools-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP5:xen-tools-domU-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Software Development Kit 12 SP5:xen-devel-4.12.4_06-3.36.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>4.9</BaseScoreV2>
        <VectorV2>AV:L/AC:L/Au:N/C:N/I:N/A:C</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>6.5</BaseScoreV3>
        <VectorV3>CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2020/suse-su-20203880-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2020-29484.html</URL>
        <Description>CVE-2020-29484</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1178658</URL>
        <Description>SUSE Bug 1178658</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1179501</URL>
        <Description>SUSE Bug 1179501</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="6">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">An issue was discovered in Xen through 4.14.x. When they require assistance from the device model, x86 HVM guests must be temporarily de-scheduled. The device model will signal Xen when it has completed its operation, via an event channel, so that the relevant vCPU is rescheduled. If the device model were to signal Xen without having actually completed the operation, the de-schedule / re-schedule cycle would repeat. If, in addition, Xen is resignalled very quickly, the re-schedule may occur before the de-schedule was fully complete, triggering a shortcut. This potentially repeating process uses ordinary recursive function calls, and thus could result in a stack overflow. A malicious or buggy stubdomain serving a HVM guest can cause Xen to crash, resulting in a Denial of Service (DoS) to the entire host. Only x86 systems are affected. Arm systems are not affected. Only x86 stubdomains serving HVM guests can exploit the vulnerability.</Note>
    </Notes>
    <CVE>CVE-2020-29566</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>Image SLES12-SP5-EC2-BYOS:xen-libs-4.12.4_06-3.36.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-BYOS:xen-tools-domU-4.12.4_06-3.36.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-ECS-On-Demand:xen-libs-4.12.4_06-3.36.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-ECS-On-Demand:xen-tools-domU-4.12.4_06-3.36.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-On-Demand:xen-libs-4.12.4_06-3.36.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-On-Demand:xen-tools-domU-4.12.4_06-3.36.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-SAP-BYOS:xen-libs-4.12.4_06-3.36.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-SAP-BYOS:xen-tools-domU-4.12.4_06-3.36.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-SAP-On-Demand:xen-libs-4.12.4_06-3.36.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-SAP-On-Demand:xen-tools-domU-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP5:xen-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP5:xen-doc-html-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP5:xen-libs-32bit-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP5:xen-libs-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP5:xen-tools-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP5:xen-tools-domU-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP5:xen-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP5:xen-doc-html-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP5:xen-libs-32bit-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP5:xen-libs-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP5:xen-tools-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP5:xen-tools-domU-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Software Development Kit 12 SP5:xen-devel-4.12.4_06-3.36.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>4.9</BaseScoreV2>
        <VectorV2>AV:L/AC:L/Au:N/C:N/I:N/A:C</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>6.5</BaseScoreV3>
        <VectorV3>CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2020/suse-su-20203880-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2020-29566.html</URL>
        <Description>CVE-2020-29566</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1178658</URL>
        <Description>SUSE Bug 1178658</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1179506</URL>
        <Description>SUSE Bug 1179506</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="7">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">An issue was discovered in Xen through 4.14.x. Recording of the per-vCPU control block mapping maintained by Xen and that of pointers into the control block is reversed. The consumer assumes, seeing the former initialized, that the latter are also ready for use. Malicious or buggy guest kernels can mount a Denial of Service (DoS) attack affecting the entire system.</Note>
    </Notes>
    <CVE>CVE-2020-29570</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>Image SLES12-SP5-EC2-BYOS:xen-libs-4.12.4_06-3.36.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-BYOS:xen-tools-domU-4.12.4_06-3.36.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-ECS-On-Demand:xen-libs-4.12.4_06-3.36.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-ECS-On-Demand:xen-tools-domU-4.12.4_06-3.36.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-On-Demand:xen-libs-4.12.4_06-3.36.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-On-Demand:xen-tools-domU-4.12.4_06-3.36.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-SAP-BYOS:xen-libs-4.12.4_06-3.36.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-SAP-BYOS:xen-tools-domU-4.12.4_06-3.36.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-SAP-On-Demand:xen-libs-4.12.4_06-3.36.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-SAP-On-Demand:xen-tools-domU-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP5:xen-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP5:xen-doc-html-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP5:xen-libs-32bit-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP5:xen-libs-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP5:xen-tools-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP5:xen-tools-domU-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP5:xen-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP5:xen-doc-html-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP5:xen-libs-32bit-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP5:xen-libs-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP5:xen-tools-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP5:xen-tools-domU-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Software Development Kit 12 SP5:xen-devel-4.12.4_06-3.36.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>4.9</BaseScoreV2>
        <VectorV2>AV:L/AC:L/Au:N/C:N/I:N/A:C</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>6.5</BaseScoreV3>
        <VectorV3>CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2020/suse-su-20203880-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2020-29570.html</URL>
        <Description>CVE-2020-29570</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1179514</URL>
        <Description>SUSE Bug 1179514</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="8">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">An issue was discovered in Xen through 4.14.x. A bounds check common to most operation time functions specific to FIFO event channels depends on the CPU observing consistent state. While the producer side uses appropriately ordered writes, the consumer side isn't protected against re-ordered reads, and may hence end up de-referencing a NULL pointer. Malicious or buggy guest kernels can mount a Denial of Service (DoS) attack affecting the entire system. Only Arm systems may be vulnerable. Whether a system is vulnerable depends on the specific CPU. x86 systems are not vulnerable.</Note>
    </Notes>
    <CVE>CVE-2020-29571</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>Image SLES12-SP5-EC2-BYOS:xen-libs-4.12.4_06-3.36.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-BYOS:xen-tools-domU-4.12.4_06-3.36.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-ECS-On-Demand:xen-libs-4.12.4_06-3.36.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-ECS-On-Demand:xen-tools-domU-4.12.4_06-3.36.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-On-Demand:xen-libs-4.12.4_06-3.36.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-On-Demand:xen-tools-domU-4.12.4_06-3.36.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-SAP-BYOS:xen-libs-4.12.4_06-3.36.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-SAP-BYOS:xen-tools-domU-4.12.4_06-3.36.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-SAP-On-Demand:xen-libs-4.12.4_06-3.36.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-SAP-On-Demand:xen-tools-domU-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP5:xen-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP5:xen-doc-html-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP5:xen-libs-32bit-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP5:xen-libs-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP5:xen-tools-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP5:xen-tools-domU-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP5:xen-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP5:xen-doc-html-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP5:xen-libs-32bit-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP5:xen-libs-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP5:xen-tools-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP5:xen-tools-domU-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Software Development Kit 12 SP5:xen-devel-4.12.4_06-3.36.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>4.9</BaseScoreV2>
        <VectorV2>AV:L/AC:L/Au:N/C:N/I:N/A:C</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>6.5</BaseScoreV3>
        <VectorV3>CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2020/suse-su-20203880-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2020-29571.html</URL>
        <Description>CVE-2020-29571</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1179516</URL>
        <Description>SUSE Bug 1179516</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="9">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">In libslirp 4.1.0, as used in QEMU 4.2.0, tcp_subr.c misuses snprintf return values, leading to a buffer overflow in later code.</Note>
    </Notes>
    <CVE>CVE-2020-8608</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>Image SLES12-SP5-EC2-BYOS:xen-libs-4.12.4_06-3.36.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-BYOS:xen-tools-domU-4.12.4_06-3.36.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-ECS-On-Demand:xen-libs-4.12.4_06-3.36.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-ECS-On-Demand:xen-tools-domU-4.12.4_06-3.36.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-On-Demand:xen-libs-4.12.4_06-3.36.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-On-Demand:xen-tools-domU-4.12.4_06-3.36.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-SAP-BYOS:xen-libs-4.12.4_06-3.36.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-SAP-BYOS:xen-tools-domU-4.12.4_06-3.36.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-SAP-On-Demand:xen-libs-4.12.4_06-3.36.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-SAP-On-Demand:xen-tools-domU-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP5:xen-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP5:xen-doc-html-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP5:xen-libs-32bit-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP5:xen-libs-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP5:xen-tools-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP5:xen-tools-domU-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP5:xen-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP5:xen-doc-html-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP5:xen-libs-32bit-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP5:xen-libs-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP5:xen-tools-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP5:xen-tools-domU-4.12.4_06-3.36.1</ProductID>
        <ProductID>SUSE Linux Enterprise Software Development Kit 12 SP5:xen-devel-4.12.4_06-3.36.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>6.8</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:N/C:P/I:P/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>7</BaseScoreV3>
        <VectorV3>CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2020/suse-su-20203880-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2020-8608.html</URL>
        <Description>CVE-2020-8608</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1163018</URL>
        <Description>SUSE Bug 1163018</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1163019</URL>
        <Description>SUSE Bug 1163019</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
</cvrfdoc>
