<?xml version="1.0" encoding="UTF-8"?>
<cvrfdoc xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:cvrf="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf" xmlns:cvrf-common="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/common" xmlns:cvssv2="http://scap.nist.gov/schema/cvss-v2/1.0" xmlns:cvssv3="https://www.first.org/cvss/cvss-v3.0.xsd" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:ns0="http://purl.org/dc/elements/1.1/" xmlns:prod="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod" xmlns:scap-core="http://scap.nist.gov/schema/scap-core/1.0" xmlns:sch="http://purl.oclc.org/dsdl/schematron" xmlns:vuln="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf">
  <DocumentTitle xml:lang="en">Security update for xen</DocumentTitle>
  <DocumentType>SUSE Patch</DocumentType>
  <DocumentPublisher Type="Vendor">
    <ContactDetails>security@suse.de</ContactDetails>
    <IssuingAuthority>SUSE Security Team</IssuingAuthority>
  </DocumentPublisher>
  <DocumentTracking>
    <Identification>
      <ID>SUSE-SU-2017:1081-1</ID>
    </Identification>
    <Status>Final</Status>
    <Version>1</Version>
    <RevisionHistory>
      <Revision>
        <Number>1</Number>
        <Date>2017-04-20T13:47:43Z</Date>
        <Description>current</Description>
      </Revision>
    </RevisionHistory>
    <InitialReleaseDate>2017-04-20T13:47:43Z</InitialReleaseDate>
    <CurrentReleaseDate>2017-04-20T13:47:43Z</CurrentReleaseDate>
    <Generator>
      <Engine>cve-database/bin/generate-cvrf.pl</Engine>
      <Date>2017-02-24T01:00:00Z</Date>
    </Generator>
  </DocumentTracking>
  <DocumentNotes>
    <Note Title="Topic" Type="Summary" Ordinal="1" xml:lang="en">Security update for xen</Note>
    <Note Title="Details" Type="General" Ordinal="2" xml:lang="en">
This update for xen fixes the following issues:

These security issues were fixed:

- CVE-2017-7228: Broken check in memory_exchange() permited PV guest breakout (bsc#1030442).
- XSA-206: Unprivileged guests issuing writes to xenstore were able to stall progress of the control domain or driver domain, possibly leading to a Denial of Service (DoS) of the entire host (bsc#1030144).
- CVE-2016-9603: A privileged user within the guest VM can cause a heap overflow in the device model process, potentially escalating their privileges to that of the device model process (bsc#1028655).
- CVE-2017-6414: Memory leak in the vcard_apdu_new function in card_7816.c in libcacard allowed local guest OS users to cause a denial of service (host memory consumption) via vectors related to allocating a new APDU object (bsc#1027570).
- CVE-2017-6505: The ohci_service_ed_list function in hw/usb/hcd-ohci.c allowed local guest OS users to cause a denial of service (infinite loop) via vectors involving the number of link endpoint list descriptors (bsc#1028235).
- CVE-2017-2633: The VNC display driver support was vulnerable to an out-of-bounds memory access issue. A user/process inside guest could use this flaw to cause DoS (bsc#1026636).

These non-security issues were fixed:

- bsc#1022555: Timeout in 'execution of /etc/xen/scripts/block add'
- bsc#1029827: Forward port xenstored
</Note>
    <Note Title="Terms of Use" Type="Legal Disclaimer" Ordinal="3" xml:lang="en">The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).</Note>
    <Note Title="Patchnames" Type="Details" Ordinal="4" xml:lang="en">sdksp4-xen-13069,slessp4-xen-13069</Note>
  </DocumentNotes>
  <DocumentDistribution xml:lang="en">Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0)</DocumentDistribution>
  <DocumentReferences>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/update/announcement/2017/suse-su-20171081-1/</URL>
      <Description>Link for SUSE-SU-2017:1081-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://lists.suse.com/pipermail/sle-security-updates/2017-April/002822.html</URL>
      <Description>E-Mail link for SUSE-SU-2017:1081-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/security/rating/</URL>
      <Description>SUSE Security Ratings</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1022555</URL>
      <Description>SUSE Bug 1022555</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1026636</URL>
      <Description>SUSE Bug 1026636</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1027519</URL>
      <Description>SUSE Bug 1027519</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1027570</URL>
      <Description>SUSE Bug 1027570</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1028235</URL>
      <Description>SUSE Bug 1028235</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1028655</URL>
      <Description>SUSE Bug 1028655</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1029827</URL>
      <Description>SUSE Bug 1029827</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1030144</URL>
      <Description>SUSE Bug 1030144</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1030442</URL>
      <Description>SUSE Bug 1030442</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2016-9603/</URL>
      <Description>SUSE CVE CVE-2016-9603 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2017-2633/</URL>
      <Description>SUSE CVE CVE-2017-2633 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2017-6414/</URL>
      <Description>SUSE CVE CVE-2017-6414 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2017-6505/</URL>
      <Description>SUSE CVE CVE-2017-6505 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2017-7228/</URL>
      <Description>SUSE CVE CVE-2017-7228 page</Description>
    </Reference>
  </DocumentReferences>
  <ProductTree xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod">
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Server 11 SP4">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Server 11 SP4">
        <FullProductName ProductID="SUSE Linux Enterprise Server 11 SP4" CPE="cpe:/o:suse:suse_sles:11:sp4">SUSE Linux Enterprise Server 11 SP4</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Server for SAP Applications 11 SP4">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Server for SAP Applications 11 SP4">
        <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 11 SP4" CPE="cpe:/o:suse:sles_sap:11:sp4">SUSE Linux Enterprise Server for SAP Applications 11 SP4</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Software Development Kit 11 SP4">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Software Development Kit 11 SP4">
        <FullProductName ProductID="SUSE Linux Enterprise Software Development Kit 11 SP4" CPE="cpe:/a:suse:sle-sdk:11:sp4">SUSE Linux Enterprise Software Development Kit 11 SP4</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Version" Name="xen-devel-4.4.4_16-54.1">
      <FullProductName ProductID="xen-devel-4.4.4_16-54.1">xen-devel-4.4.4_16-54.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="xen-4.4.4_16-54.1">
      <FullProductName ProductID="xen-4.4.4_16-54.1">xen-4.4.4_16-54.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="xen-doc-html-4.4.4_16-54.1">
      <FullProductName ProductID="xen-doc-html-4.4.4_16-54.1">xen-doc-html-4.4.4_16-54.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="xen-kmp-default-4.4.4_16_3.0.101_97-54.1">
      <FullProductName ProductID="xen-kmp-default-4.4.4_16_3.0.101_97-54.1">xen-kmp-default-4.4.4_16_3.0.101_97-54.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="xen-kmp-pae-4.4.4_16_3.0.101_97-54.1">
      <FullProductName ProductID="xen-kmp-pae-4.4.4_16_3.0.101_97-54.1">xen-kmp-pae-4.4.4_16_3.0.101_97-54.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="xen-libs-4.4.4_16-54.1">
      <FullProductName ProductID="xen-libs-4.4.4_16-54.1">xen-libs-4.4.4_16-54.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="xen-libs-32bit-4.4.4_16-54.1">
      <FullProductName ProductID="xen-libs-32bit-4.4.4_16-54.1">xen-libs-32bit-4.4.4_16-54.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="xen-tools-4.4.4_16-54.1">
      <FullProductName ProductID="xen-tools-4.4.4_16-54.1">xen-tools-4.4.4_16-54.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="xen-tools-domU-4.4.4_16-54.1">
      <FullProductName ProductID="xen-tools-domU-4.4.4_16-54.1">xen-tools-domU-4.4.4_16-54.1</FullProductName>
    </Branch>
    <Relationship ProductReference="xen-4.4.4_16-54.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 11 SP4">
      <FullProductName ProductID="SUSE Linux Enterprise Server 11 SP4:xen-4.4.4_16-54.1">xen-4.4.4_16-54.1 as a component of SUSE Linux Enterprise Server 11 SP4</FullProductName>
    </Relationship>
    <Relationship ProductReference="xen-doc-html-4.4.4_16-54.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 11 SP4">
      <FullProductName ProductID="SUSE Linux Enterprise Server 11 SP4:xen-doc-html-4.4.4_16-54.1">xen-doc-html-4.4.4_16-54.1 as a component of SUSE Linux Enterprise Server 11 SP4</FullProductName>
    </Relationship>
    <Relationship ProductReference="xen-kmp-default-4.4.4_16_3.0.101_97-54.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 11 SP4">
      <FullProductName ProductID="SUSE Linux Enterprise Server 11 SP4:xen-kmp-default-4.4.4_16_3.0.101_97-54.1">xen-kmp-default-4.4.4_16_3.0.101_97-54.1 as a component of SUSE Linux Enterprise Server 11 SP4</FullProductName>
    </Relationship>
    <Relationship ProductReference="xen-kmp-pae-4.4.4_16_3.0.101_97-54.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 11 SP4">
      <FullProductName ProductID="SUSE Linux Enterprise Server 11 SP4:xen-kmp-pae-4.4.4_16_3.0.101_97-54.1">xen-kmp-pae-4.4.4_16_3.0.101_97-54.1 as a component of SUSE Linux Enterprise Server 11 SP4</FullProductName>
    </Relationship>
    <Relationship ProductReference="xen-libs-4.4.4_16-54.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 11 SP4">
      <FullProductName ProductID="SUSE Linux Enterprise Server 11 SP4:xen-libs-4.4.4_16-54.1">xen-libs-4.4.4_16-54.1 as a component of SUSE Linux Enterprise Server 11 SP4</FullProductName>
    </Relationship>
    <Relationship ProductReference="xen-libs-32bit-4.4.4_16-54.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 11 SP4">
      <FullProductName ProductID="SUSE Linux Enterprise Server 11 SP4:xen-libs-32bit-4.4.4_16-54.1">xen-libs-32bit-4.4.4_16-54.1 as a component of SUSE Linux Enterprise Server 11 SP4</FullProductName>
    </Relationship>
    <Relationship ProductReference="xen-tools-4.4.4_16-54.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 11 SP4">
      <FullProductName ProductID="SUSE Linux Enterprise Server 11 SP4:xen-tools-4.4.4_16-54.1">xen-tools-4.4.4_16-54.1 as a component of SUSE Linux Enterprise Server 11 SP4</FullProductName>
    </Relationship>
    <Relationship ProductReference="xen-tools-domU-4.4.4_16-54.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 11 SP4">
      <FullProductName ProductID="SUSE Linux Enterprise Server 11 SP4:xen-tools-domU-4.4.4_16-54.1">xen-tools-domU-4.4.4_16-54.1 as a component of SUSE Linux Enterprise Server 11 SP4</FullProductName>
    </Relationship>
    <Relationship ProductReference="xen-4.4.4_16-54.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server for SAP Applications 11 SP4">
      <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 11 SP4:xen-4.4.4_16-54.1">xen-4.4.4_16-54.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4</FullProductName>
    </Relationship>
    <Relationship ProductReference="xen-doc-html-4.4.4_16-54.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server for SAP Applications 11 SP4">
      <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 11 SP4:xen-doc-html-4.4.4_16-54.1">xen-doc-html-4.4.4_16-54.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4</FullProductName>
    </Relationship>
    <Relationship ProductReference="xen-kmp-default-4.4.4_16_3.0.101_97-54.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server for SAP Applications 11 SP4">
      <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 11 SP4:xen-kmp-default-4.4.4_16_3.0.101_97-54.1">xen-kmp-default-4.4.4_16_3.0.101_97-54.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4</FullProductName>
    </Relationship>
    <Relationship ProductReference="xen-kmp-pae-4.4.4_16_3.0.101_97-54.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server for SAP Applications 11 SP4">
      <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 11 SP4:xen-kmp-pae-4.4.4_16_3.0.101_97-54.1">xen-kmp-pae-4.4.4_16_3.0.101_97-54.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4</FullProductName>
    </Relationship>
    <Relationship ProductReference="xen-libs-4.4.4_16-54.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server for SAP Applications 11 SP4">
      <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 11 SP4:xen-libs-4.4.4_16-54.1">xen-libs-4.4.4_16-54.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4</FullProductName>
    </Relationship>
    <Relationship ProductReference="xen-libs-32bit-4.4.4_16-54.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server for SAP Applications 11 SP4">
      <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 11 SP4:xen-libs-32bit-4.4.4_16-54.1">xen-libs-32bit-4.4.4_16-54.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4</FullProductName>
    </Relationship>
    <Relationship ProductReference="xen-tools-4.4.4_16-54.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server for SAP Applications 11 SP4">
      <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 11 SP4:xen-tools-4.4.4_16-54.1">xen-tools-4.4.4_16-54.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4</FullProductName>
    </Relationship>
    <Relationship ProductReference="xen-tools-domU-4.4.4_16-54.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server for SAP Applications 11 SP4">
      <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 11 SP4:xen-tools-domU-4.4.4_16-54.1">xen-tools-domU-4.4.4_16-54.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4</FullProductName>
    </Relationship>
    <Relationship ProductReference="xen-devel-4.4.4_16-54.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Software Development Kit 11 SP4">
      <FullProductName ProductID="SUSE Linux Enterprise Software Development Kit 11 SP4:xen-devel-4.4.4_16-54.1">xen-devel-4.4.4_16-54.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4</FullProductName>
    </Relationship>
  </ProductTree>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="1">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">A heap buffer overflow flaw was found in QEMU's Cirrus CLGD 54xx VGA emulator's VNC display driver support before 2.9; the issue could occur when a VNC client attempted to update its display after a VGA operation is performed by a guest. A privileged user/process inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process.</Note>
    </Notes>
    <CVE>CVE-2016-9603</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Linux Enterprise Server 11 SP4:xen-4.4.4_16-54.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 11 SP4:xen-doc-html-4.4.4_16-54.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 11 SP4:xen-kmp-default-4.4.4_16_3.0.101_97-54.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 11 SP4:xen-kmp-pae-4.4.4_16_3.0.101_97-54.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 11 SP4:xen-libs-32bit-4.4.4_16-54.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 11 SP4:xen-libs-4.4.4_16-54.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 11 SP4:xen-tools-4.4.4_16-54.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 11 SP4:xen-tools-domU-4.4.4_16-54.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 11 SP4:xen-4.4.4_16-54.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 11 SP4:xen-doc-html-4.4.4_16-54.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 11 SP4:xen-kmp-default-4.4.4_16_3.0.101_97-54.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 11 SP4:xen-kmp-pae-4.4.4_16_3.0.101_97-54.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 11 SP4:xen-libs-32bit-4.4.4_16-54.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 11 SP4:xen-libs-4.4.4_16-54.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 11 SP4:xen-tools-4.4.4_16-54.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 11 SP4:xen-tools-domU-4.4.4_16-54.1</ProductID>
        <ProductID>SUSE Linux Enterprise Software Development Kit 11 SP4:xen-devel-4.4.4_16-54.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>low</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>3.5</BaseScoreV2>
        <VectorV2>AV:L/AC:H/Au:S/C:P/I:P/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>9.9</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2017/suse-su-20171081-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2016-9603.html</URL>
        <Description>CVE-2016-9603</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1028655</URL>
        <Description>SUSE Bug 1028655</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1028656</URL>
        <Description>SUSE Bug 1028656</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1178658</URL>
        <Description>SUSE Bug 1178658</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="2">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">An out-of-bounds memory access issue was found in Quick Emulator (QEMU) before 1.7.2 in the VNC display driver. This flaw could occur while refreshing the VNC display surface area in the 'vnc_refresh_server_surface'. A user inside a guest could use this flaw to crash the QEMU process.</Note>
    </Notes>
    <CVE>CVE-2017-2633</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Linux Enterprise Server 11 SP4:xen-4.4.4_16-54.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 11 SP4:xen-doc-html-4.4.4_16-54.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 11 SP4:xen-kmp-default-4.4.4_16_3.0.101_97-54.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 11 SP4:xen-kmp-pae-4.4.4_16_3.0.101_97-54.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 11 SP4:xen-libs-32bit-4.4.4_16-54.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 11 SP4:xen-libs-4.4.4_16-54.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 11 SP4:xen-tools-4.4.4_16-54.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 11 SP4:xen-tools-domU-4.4.4_16-54.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 11 SP4:xen-4.4.4_16-54.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 11 SP4:xen-doc-html-4.4.4_16-54.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 11 SP4:xen-kmp-default-4.4.4_16_3.0.101_97-54.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 11 SP4:xen-kmp-pae-4.4.4_16_3.0.101_97-54.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 11 SP4:xen-libs-32bit-4.4.4_16-54.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 11 SP4:xen-libs-4.4.4_16-54.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 11 SP4:xen-tools-4.4.4_16-54.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 11 SP4:xen-tools-domU-4.4.4_16-54.1</ProductID>
        <ProductID>SUSE Linux Enterprise Software Development Kit 11 SP4:xen-devel-4.4.4_16-54.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>low</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>3</BaseScoreV2>
        <VectorV2>AV:L/AC:M/Au:S/C:N/I:P/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>6.5</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2017/suse-su-20171081-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2017-2633.html</URL>
        <Description>CVE-2017-2633</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1026612</URL>
        <Description>SUSE Bug 1026612</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1026636</URL>
        <Description>SUSE Bug 1026636</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1074701</URL>
        <Description>SUSE Bug 1074701</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="3">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">Memory leak in the vcard_apdu_new function in card_7816.c in libcacard before 2.5.3 allows local guest OS users to cause a denial of service (host memory consumption) via vectors related to allocating a new APDU object.</Note>
    </Notes>
    <CVE>CVE-2017-6414</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Linux Enterprise Server 11 SP4:xen-4.4.4_16-54.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 11 SP4:xen-doc-html-4.4.4_16-54.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 11 SP4:xen-kmp-default-4.4.4_16_3.0.101_97-54.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 11 SP4:xen-kmp-pae-4.4.4_16_3.0.101_97-54.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 11 SP4:xen-libs-32bit-4.4.4_16-54.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 11 SP4:xen-libs-4.4.4_16-54.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 11 SP4:xen-tools-4.4.4_16-54.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 11 SP4:xen-tools-domU-4.4.4_16-54.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 11 SP4:xen-4.4.4_16-54.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 11 SP4:xen-doc-html-4.4.4_16-54.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 11 SP4:xen-kmp-default-4.4.4_16_3.0.101_97-54.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 11 SP4:xen-kmp-pae-4.4.4_16_3.0.101_97-54.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 11 SP4:xen-libs-32bit-4.4.4_16-54.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 11 SP4:xen-libs-4.4.4_16-54.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 11 SP4:xen-tools-4.4.4_16-54.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 11 SP4:xen-tools-domU-4.4.4_16-54.1</ProductID>
        <ProductID>SUSE Linux Enterprise Software Development Kit 11 SP4:xen-devel-4.4.4_16-54.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>low</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>1.5</BaseScoreV2>
        <VectorV2>AV:L/AC:M/Au:S/C:N/I:N/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>6.5</BaseScoreV3>
        <VectorV3>CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2017/suse-su-20171081-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2017-6414.html</URL>
        <Description>CVE-2017-6414</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1027514</URL>
        <Description>SUSE Bug 1027514</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1027570</URL>
        <Description>SUSE Bug 1027570</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="4">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">The ohci_service_ed_list function in hw/usb/hcd-ohci.c in QEMU (aka Quick Emulator) before 2.9.0 allows local guest OS users to cause a denial of service (infinite loop) via vectors involving the number of link endpoint list descriptors, a different vulnerability than CVE-2017-9330.</Note>
    </Notes>
    <CVE>CVE-2017-6505</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Linux Enterprise Server 11 SP4:xen-4.4.4_16-54.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 11 SP4:xen-doc-html-4.4.4_16-54.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 11 SP4:xen-kmp-default-4.4.4_16_3.0.101_97-54.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 11 SP4:xen-kmp-pae-4.4.4_16_3.0.101_97-54.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 11 SP4:xen-libs-32bit-4.4.4_16-54.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 11 SP4:xen-libs-4.4.4_16-54.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 11 SP4:xen-tools-4.4.4_16-54.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 11 SP4:xen-tools-domU-4.4.4_16-54.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 11 SP4:xen-4.4.4_16-54.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 11 SP4:xen-doc-html-4.4.4_16-54.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 11 SP4:xen-kmp-default-4.4.4_16_3.0.101_97-54.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 11 SP4:xen-kmp-pae-4.4.4_16_3.0.101_97-54.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 11 SP4:xen-libs-32bit-4.4.4_16-54.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 11 SP4:xen-libs-4.4.4_16-54.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 11 SP4:xen-tools-4.4.4_16-54.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 11 SP4:xen-tools-domU-4.4.4_16-54.1</ProductID>
        <ProductID>SUSE Linux Enterprise Software Development Kit 11 SP4:xen-devel-4.4.4_16-54.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>low</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>1.5</BaseScoreV2>
        <VectorV2>AV:L/AC:M/Au:S/C:N/I:N/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>6.5</BaseScoreV3>
        <VectorV3>CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2017/suse-su-20171081-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2017-6505.html</URL>
        <Description>CVE-2017-6505</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1028184</URL>
        <Description>SUSE Bug 1028184</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1028235</URL>
        <Description>SUSE Bug 1028235</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1178658</URL>
        <Description>SUSE Bug 1178658</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="5">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">An issue (known as XSA-212) was discovered in Xen, with fixes available for 4.8.x, 4.7.x, 4.6.x, 4.5.x, and 4.4.x. The earlier XSA-29 fix introduced an insufficient check on XENMEM_exchange input, allowing the caller to drive hypervisor memory accesses outside of the guest provided input/output arrays.</Note>
    </Notes>
    <CVE>CVE-2017-7228</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Linux Enterprise Server 11 SP4:xen-4.4.4_16-54.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 11 SP4:xen-doc-html-4.4.4_16-54.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 11 SP4:xen-kmp-default-4.4.4_16_3.0.101_97-54.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 11 SP4:xen-kmp-pae-4.4.4_16_3.0.101_97-54.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 11 SP4:xen-libs-32bit-4.4.4_16-54.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 11 SP4:xen-libs-4.4.4_16-54.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 11 SP4:xen-tools-4.4.4_16-54.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 11 SP4:xen-tools-domU-4.4.4_16-54.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 11 SP4:xen-4.4.4_16-54.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 11 SP4:xen-doc-html-4.4.4_16-54.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 11 SP4:xen-kmp-default-4.4.4_16_3.0.101_97-54.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 11 SP4:xen-kmp-pae-4.4.4_16_3.0.101_97-54.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 11 SP4:xen-libs-32bit-4.4.4_16-54.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 11 SP4:xen-libs-4.4.4_16-54.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 11 SP4:xen-tools-4.4.4_16-54.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 11 SP4:xen-tools-domU-4.4.4_16-54.1</ProductID>
        <ProductID>SUSE Linux Enterprise Software Development Kit 11 SP4:xen-devel-4.4.4_16-54.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>important</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>7.2</BaseScoreV2>
        <VectorV2>AV:L/AC:L/Au:N/C:C/I:C/A:C</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>8.2</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2017/suse-su-20171081-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2017-7228.html</URL>
        <Description>CVE-2017-7228</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1030442</URL>
        <Description>SUSE Bug 1030442</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1072198</URL>
        <Description>SUSE Bug 1072198</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1072223</URL>
        <Description>SUSE Bug 1072223</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1178658</URL>
        <Description>SUSE Bug 1178658</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
</cvrfdoc>
