<?xml version="1.0" encoding="UTF-8"?>
<cvrfdoc xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:cvrf="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf" xmlns:cvrf-common="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/common" xmlns:cvssv2="http://scap.nist.gov/schema/cvss-v2/1.0" xmlns:cvssv3="https://www.first.org/cvss/cvss-v3.0.xsd" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:ns0="http://purl.org/dc/elements/1.1/" xmlns:prod="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod" xmlns:scap-core="http://scap.nist.gov/schema/scap-core/1.0" xmlns:sch="http://purl.oclc.org/dsdl/schematron" xmlns:vuln="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf">
  <DocumentTitle xml:lang="en">Security update for xen</DocumentTitle>
  <DocumentType>SUSE Patch</DocumentType>
  <DocumentPublisher Type="Vendor">
    <ContactDetails>security@suse.de</ContactDetails>
    <IssuingAuthority>SUSE Security Team</IssuingAuthority>
  </DocumentPublisher>
  <DocumentTracking>
    <Identification>
      <ID>SUSE-SU-2018:3332-1</ID>
    </Identification>
    <Status>Final</Status>
    <Version>1</Version>
    <RevisionHistory>
      <Revision>
        <Number>1</Number>
        <Date>2018-10-23T13:14:17Z</Date>
        <Description>current</Description>
      </Revision>
    </RevisionHistory>
    <InitialReleaseDate>2018-10-23T13:14:17Z</InitialReleaseDate>
    <CurrentReleaseDate>2018-10-23T13:14:17Z</CurrentReleaseDate>
    <Generator>
      <Engine>cve-database/bin/generate-cvrf.pl</Engine>
      <Date>2017-02-24T01:00:00Z</Date>
    </Generator>
  </DocumentTracking>
  <DocumentNotes>
    <Note Title="Topic" Type="Summary" Ordinal="1" xml:lang="en">Security update for xen</Note>
    <Note Title="Details" Type="General" Ordinal="2" xml:lang="en">This update for xen fixes the following issues:

- CVE-2018-17963: qemu_deliver_packet_iov accepted packet sizes greater than INT_MAX, which allows attackers to cause a denial of service or possibly have unspecified other impact. (bsc#1111014)
- CVE-2018-15468: The DEBUGCTL MSR contains several debugging features, some of which virtualise cleanly, but some do not. In particular, Branch Trace Store is not virtualised by the processor, and software has to be careful to configure it suitably not to lock up the core. As a result, it must only be available to fully trusted guests. Unfortunately, in the case that vPMU is disabled, all value checking was skipped, allowing the guest to choose any MSR_DEBUGCTL setting it likes. A malicious or buggy guest administrator (on Intel x86 HVM or PVH) could have locked up the entire host, causing a Denial of Service. (XSA-269) (bsc#1103276)

Non security issues fixed:

- Kernel oops in fs/dcache.c called by d_materialise_unique() (bsc#1094508)
  </Note>
    <Note Title="Terms of Use" Type="Legal Disclaimer" Ordinal="3" xml:lang="en">The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).</Note>
    <Note Title="Patchnames" Type="Details" Ordinal="4" xml:lang="en">SUSE-OpenStack-Cloud-7-2018-2398,SUSE-SLE-SAP-12-SP2-2018-2398,SUSE-SLE-SERVER-12-SP2-2018-2398,SUSE-SLE-SERVER-12-SP2-BCL-2018-2398,SUSE-Storage-4-2018-2398</Note>
  </DocumentNotes>
  <DocumentDistribution xml:lang="en">Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0)</DocumentDistribution>
  <DocumentReferences>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/update/announcement/2018/suse-su-20183332-1/</URL>
      <Description>Link for SUSE-SU-2018:3332-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://lists.suse.com/pipermail/sle-security-updates/2018-October/004769.html</URL>
      <Description>E-Mail link for SUSE-SU-2018:3332-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/security/rating/</URL>
      <Description>SUSE Security Ratings</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1094508</URL>
      <Description>SUSE Bug 1094508</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1103276</URL>
      <Description>SUSE Bug 1103276</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1111014</URL>
      <Description>SUSE Bug 1111014</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2018-15468/</URL>
      <Description>SUSE CVE CVE-2018-15468 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2018-17963/</URL>
      <Description>SUSE CVE CVE-2018-17963 page</Description>
    </Reference>
  </DocumentReferences>
  <ProductTree xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod">
    <Branch Type="Product Family" Name="SUSE Enterprise Storage 4">
      <Branch Type="Product Name" Name="SUSE Enterprise Storage 4">
        <FullProductName ProductID="SUSE Enterprise Storage 4" CPE="cpe:/o:suse:ses:4">SUSE Enterprise Storage 4</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Server 12 SP2-BCL">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Server 12 SP2-BCL">
        <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP2-BCL" CPE="cpe:/o:suse:sles-bcl:12:sp2">SUSE Linux Enterprise Server 12 SP2-BCL</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Server 12 SP2-LTSS">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Server 12 SP2-LTSS">
        <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP2-LTSS" CPE="cpe:/o:suse:sles-ltss:12:sp2">SUSE Linux Enterprise Server 12 SP2-LTSS</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Server for SAP Applications 12 SP2">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Server for SAP Applications 12 SP2">
        <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 12 SP2" CPE="cpe:/o:suse:sles_sap:12:sp2">SUSE Linux Enterprise Server for SAP Applications 12 SP2</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE OpenStack Cloud 7">
      <Branch Type="Product Name" Name="SUSE OpenStack Cloud 7">
        <FullProductName ProductID="SUSE OpenStack Cloud 7" CPE="cpe:/o:suse:suse-openstack-cloud:7">SUSE OpenStack Cloud 7</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Version" Name="xen-4.7.6_05-43.42.1">
      <FullProductName ProductID="xen-4.7.6_05-43.42.1">xen-4.7.6_05-43.42.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="xen-doc-html-4.7.6_05-43.42.1">
      <FullProductName ProductID="xen-doc-html-4.7.6_05-43.42.1">xen-doc-html-4.7.6_05-43.42.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="xen-libs-4.7.6_05-43.42.1">
      <FullProductName ProductID="xen-libs-4.7.6_05-43.42.1">xen-libs-4.7.6_05-43.42.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="xen-libs-32bit-4.7.6_05-43.42.1">
      <FullProductName ProductID="xen-libs-32bit-4.7.6_05-43.42.1">xen-libs-32bit-4.7.6_05-43.42.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="xen-tools-4.7.6_05-43.42.1">
      <FullProductName ProductID="xen-tools-4.7.6_05-43.42.1">xen-tools-4.7.6_05-43.42.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="xen-tools-domU-4.7.6_05-43.42.1">
      <FullProductName ProductID="xen-tools-domU-4.7.6_05-43.42.1">xen-tools-domU-4.7.6_05-43.42.1</FullProductName>
    </Branch>
    <Relationship ProductReference="xen-4.7.6_05-43.42.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Enterprise Storage 4">
      <FullProductName ProductID="SUSE Enterprise Storage 4:xen-4.7.6_05-43.42.1">xen-4.7.6_05-43.42.1 as a component of SUSE Enterprise Storage 4</FullProductName>
    </Relationship>
    <Relationship ProductReference="xen-doc-html-4.7.6_05-43.42.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Enterprise Storage 4">
      <FullProductName ProductID="SUSE Enterprise Storage 4:xen-doc-html-4.7.6_05-43.42.1">xen-doc-html-4.7.6_05-43.42.1 as a component of SUSE Enterprise Storage 4</FullProductName>
    </Relationship>
    <Relationship ProductReference="xen-libs-4.7.6_05-43.42.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Enterprise Storage 4">
      <FullProductName ProductID="SUSE Enterprise Storage 4:xen-libs-4.7.6_05-43.42.1">xen-libs-4.7.6_05-43.42.1 as a component of SUSE Enterprise Storage 4</FullProductName>
    </Relationship>
    <Relationship ProductReference="xen-libs-32bit-4.7.6_05-43.42.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Enterprise Storage 4">
      <FullProductName ProductID="SUSE Enterprise Storage 4:xen-libs-32bit-4.7.6_05-43.42.1">xen-libs-32bit-4.7.6_05-43.42.1 as a component of SUSE Enterprise Storage 4</FullProductName>
    </Relationship>
    <Relationship ProductReference="xen-tools-4.7.6_05-43.42.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Enterprise Storage 4">
      <FullProductName ProductID="SUSE Enterprise Storage 4:xen-tools-4.7.6_05-43.42.1">xen-tools-4.7.6_05-43.42.1 as a component of SUSE Enterprise Storage 4</FullProductName>
    </Relationship>
    <Relationship ProductReference="xen-tools-domU-4.7.6_05-43.42.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Enterprise Storage 4">
      <FullProductName ProductID="SUSE Enterprise Storage 4:xen-tools-domU-4.7.6_05-43.42.1">xen-tools-domU-4.7.6_05-43.42.1 as a component of SUSE Enterprise Storage 4</FullProductName>
    </Relationship>
    <Relationship ProductReference="xen-4.7.6_05-43.42.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12 SP2-BCL">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP2-BCL:xen-4.7.6_05-43.42.1">xen-4.7.6_05-43.42.1 as a component of SUSE Linux Enterprise Server 12 SP2-BCL</FullProductName>
    </Relationship>
    <Relationship ProductReference="xen-doc-html-4.7.6_05-43.42.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12 SP2-BCL">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP2-BCL:xen-doc-html-4.7.6_05-43.42.1">xen-doc-html-4.7.6_05-43.42.1 as a component of SUSE Linux Enterprise Server 12 SP2-BCL</FullProductName>
    </Relationship>
    <Relationship ProductReference="xen-libs-4.7.6_05-43.42.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12 SP2-BCL">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP2-BCL:xen-libs-4.7.6_05-43.42.1">xen-libs-4.7.6_05-43.42.1 as a component of SUSE Linux Enterprise Server 12 SP2-BCL</FullProductName>
    </Relationship>
    <Relationship ProductReference="xen-libs-32bit-4.7.6_05-43.42.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12 SP2-BCL">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP2-BCL:xen-libs-32bit-4.7.6_05-43.42.1">xen-libs-32bit-4.7.6_05-43.42.1 as a component of SUSE Linux Enterprise Server 12 SP2-BCL</FullProductName>
    </Relationship>
    <Relationship ProductReference="xen-tools-4.7.6_05-43.42.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12 SP2-BCL">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP2-BCL:xen-tools-4.7.6_05-43.42.1">xen-tools-4.7.6_05-43.42.1 as a component of SUSE Linux Enterprise Server 12 SP2-BCL</FullProductName>
    </Relationship>
    <Relationship ProductReference="xen-tools-domU-4.7.6_05-43.42.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12 SP2-BCL">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP2-BCL:xen-tools-domU-4.7.6_05-43.42.1">xen-tools-domU-4.7.6_05-43.42.1 as a component of SUSE Linux Enterprise Server 12 SP2-BCL</FullProductName>
    </Relationship>
    <Relationship ProductReference="xen-4.7.6_05-43.42.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12 SP2-LTSS">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP2-LTSS:xen-4.7.6_05-43.42.1">xen-4.7.6_05-43.42.1 as a component of SUSE Linux Enterprise Server 12 SP2-LTSS</FullProductName>
    </Relationship>
    <Relationship ProductReference="xen-doc-html-4.7.6_05-43.42.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12 SP2-LTSS">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP2-LTSS:xen-doc-html-4.7.6_05-43.42.1">xen-doc-html-4.7.6_05-43.42.1 as a component of SUSE Linux Enterprise Server 12 SP2-LTSS</FullProductName>
    </Relationship>
    <Relationship ProductReference="xen-libs-4.7.6_05-43.42.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12 SP2-LTSS">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP2-LTSS:xen-libs-4.7.6_05-43.42.1">xen-libs-4.7.6_05-43.42.1 as a component of SUSE Linux Enterprise Server 12 SP2-LTSS</FullProductName>
    </Relationship>
    <Relationship ProductReference="xen-libs-32bit-4.7.6_05-43.42.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12 SP2-LTSS">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP2-LTSS:xen-libs-32bit-4.7.6_05-43.42.1">xen-libs-32bit-4.7.6_05-43.42.1 as a component of SUSE Linux Enterprise Server 12 SP2-LTSS</FullProductName>
    </Relationship>
    <Relationship ProductReference="xen-tools-4.7.6_05-43.42.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12 SP2-LTSS">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP2-LTSS:xen-tools-4.7.6_05-43.42.1">xen-tools-4.7.6_05-43.42.1 as a component of SUSE Linux Enterprise Server 12 SP2-LTSS</FullProductName>
    </Relationship>
    <Relationship ProductReference="xen-tools-domU-4.7.6_05-43.42.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12 SP2-LTSS">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP2-LTSS:xen-tools-domU-4.7.6_05-43.42.1">xen-tools-domU-4.7.6_05-43.42.1 as a component of SUSE Linux Enterprise Server 12 SP2-LTSS</FullProductName>
    </Relationship>
    <Relationship ProductReference="xen-4.7.6_05-43.42.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server for SAP Applications 12 SP2">
      <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-4.7.6_05-43.42.1">xen-4.7.6_05-43.42.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2</FullProductName>
    </Relationship>
    <Relationship ProductReference="xen-doc-html-4.7.6_05-43.42.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server for SAP Applications 12 SP2">
      <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-doc-html-4.7.6_05-43.42.1">xen-doc-html-4.7.6_05-43.42.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2</FullProductName>
    </Relationship>
    <Relationship ProductReference="xen-libs-4.7.6_05-43.42.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server for SAP Applications 12 SP2">
      <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-4.7.6_05-43.42.1">xen-libs-4.7.6_05-43.42.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2</FullProductName>
    </Relationship>
    <Relationship ProductReference="xen-libs-32bit-4.7.6_05-43.42.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server for SAP Applications 12 SP2">
      <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-32bit-4.7.6_05-43.42.1">xen-libs-32bit-4.7.6_05-43.42.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2</FullProductName>
    </Relationship>
    <Relationship ProductReference="xen-tools-4.7.6_05-43.42.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server for SAP Applications 12 SP2">
      <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-4.7.6_05-43.42.1">xen-tools-4.7.6_05-43.42.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2</FullProductName>
    </Relationship>
    <Relationship ProductReference="xen-tools-domU-4.7.6_05-43.42.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server for SAP Applications 12 SP2">
      <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-domU-4.7.6_05-43.42.1">xen-tools-domU-4.7.6_05-43.42.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2</FullProductName>
    </Relationship>
    <Relationship ProductReference="xen-4.7.6_05-43.42.1" RelationType="Default Component Of" RelatesToProductReference="SUSE OpenStack Cloud 7">
      <FullProductName ProductID="SUSE OpenStack Cloud 7:xen-4.7.6_05-43.42.1">xen-4.7.6_05-43.42.1 as a component of SUSE OpenStack Cloud 7</FullProductName>
    </Relationship>
    <Relationship ProductReference="xen-doc-html-4.7.6_05-43.42.1" RelationType="Default Component Of" RelatesToProductReference="SUSE OpenStack Cloud 7">
      <FullProductName ProductID="SUSE OpenStack Cloud 7:xen-doc-html-4.7.6_05-43.42.1">xen-doc-html-4.7.6_05-43.42.1 as a component of SUSE OpenStack Cloud 7</FullProductName>
    </Relationship>
    <Relationship ProductReference="xen-libs-4.7.6_05-43.42.1" RelationType="Default Component Of" RelatesToProductReference="SUSE OpenStack Cloud 7">
      <FullProductName ProductID="SUSE OpenStack Cloud 7:xen-libs-4.7.6_05-43.42.1">xen-libs-4.7.6_05-43.42.1 as a component of SUSE OpenStack Cloud 7</FullProductName>
    </Relationship>
    <Relationship ProductReference="xen-libs-32bit-4.7.6_05-43.42.1" RelationType="Default Component Of" RelatesToProductReference="SUSE OpenStack Cloud 7">
      <FullProductName ProductID="SUSE OpenStack Cloud 7:xen-libs-32bit-4.7.6_05-43.42.1">xen-libs-32bit-4.7.6_05-43.42.1 as a component of SUSE OpenStack Cloud 7</FullProductName>
    </Relationship>
    <Relationship ProductReference="xen-tools-4.7.6_05-43.42.1" RelationType="Default Component Of" RelatesToProductReference="SUSE OpenStack Cloud 7">
      <FullProductName ProductID="SUSE OpenStack Cloud 7:xen-tools-4.7.6_05-43.42.1">xen-tools-4.7.6_05-43.42.1 as a component of SUSE OpenStack Cloud 7</FullProductName>
    </Relationship>
    <Relationship ProductReference="xen-tools-domU-4.7.6_05-43.42.1" RelationType="Default Component Of" RelatesToProductReference="SUSE OpenStack Cloud 7">
      <FullProductName ProductID="SUSE OpenStack Cloud 7:xen-tools-domU-4.7.6_05-43.42.1">xen-tools-domU-4.7.6_05-43.42.1 as a component of SUSE OpenStack Cloud 7</FullProductName>
    </Relationship>
  </ProductTree>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="1">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">An issue was discovered in Xen through 4.11.x. The DEBUGCTL MSR contains several debugging features, some of which virtualise cleanly, but some do not. In particular, Branch Trace Store is not virtualised by the processor, and software has to be careful to configure it suitably not to lock up the core. As a result, it must only be available to fully trusted guests. Unfortunately, in the case that vPMU is disabled, all value checking was skipped, allowing the guest to choose any MSR_DEBUGCTL setting it likes. A malicious or buggy guest administrator (on Intel x86 HVM or PVH) can lock up the entire host, causing a Denial of Service.</Note>
    </Notes>
    <CVE>CVE-2018-15468</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Enterprise Storage 4:xen-4.7.6_05-43.42.1</ProductID>
        <ProductID>SUSE Enterprise Storage 4:xen-doc-html-4.7.6_05-43.42.1</ProductID>
        <ProductID>SUSE Enterprise Storage 4:xen-libs-32bit-4.7.6_05-43.42.1</ProductID>
        <ProductID>SUSE Enterprise Storage 4:xen-libs-4.7.6_05-43.42.1</ProductID>
        <ProductID>SUSE Enterprise Storage 4:xen-tools-4.7.6_05-43.42.1</ProductID>
        <ProductID>SUSE Enterprise Storage 4:xen-tools-domU-4.7.6_05-43.42.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP2-BCL:xen-4.7.6_05-43.42.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP2-BCL:xen-doc-html-4.7.6_05-43.42.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP2-BCL:xen-libs-32bit-4.7.6_05-43.42.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP2-BCL:xen-libs-4.7.6_05-43.42.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP2-BCL:xen-tools-4.7.6_05-43.42.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP2-BCL:xen-tools-domU-4.7.6_05-43.42.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP2-LTSS:xen-4.7.6_05-43.42.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP2-LTSS:xen-doc-html-4.7.6_05-43.42.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP2-LTSS:xen-libs-32bit-4.7.6_05-43.42.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP2-LTSS:xen-libs-4.7.6_05-43.42.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP2-LTSS:xen-tools-4.7.6_05-43.42.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP2-LTSS:xen-tools-domU-4.7.6_05-43.42.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-4.7.6_05-43.42.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-doc-html-4.7.6_05-43.42.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-32bit-4.7.6_05-43.42.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-4.7.6_05-43.42.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-4.7.6_05-43.42.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-domU-4.7.6_05-43.42.1</ProductID>
        <ProductID>SUSE OpenStack Cloud 7:xen-4.7.6_05-43.42.1</ProductID>
        <ProductID>SUSE OpenStack Cloud 7:xen-doc-html-4.7.6_05-43.42.1</ProductID>
        <ProductID>SUSE OpenStack Cloud 7:xen-libs-32bit-4.7.6_05-43.42.1</ProductID>
        <ProductID>SUSE OpenStack Cloud 7:xen-libs-4.7.6_05-43.42.1</ProductID>
        <ProductID>SUSE OpenStack Cloud 7:xen-tools-4.7.6_05-43.42.1</ProductID>
        <ProductID>SUSE OpenStack Cloud 7:xen-tools-domU-4.7.6_05-43.42.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>4.9</BaseScoreV2>
        <VectorV2>AV:L/AC:L/Au:N/C:N/I:N/A:C</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>5.5</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2018/suse-su-20183332-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2018-15468.html</URL>
        <Description>CVE-2018-15468</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1103276</URL>
        <Description>SUSE Bug 1103276</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="2">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">qemu_deliver_packet_iov in net/net.c in Qemu accepts packet sizes greater than INT_MAX, which allows attackers to cause a denial of service or possibly have unspecified other impact.</Note>
    </Notes>
    <CVE>CVE-2018-17963</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Enterprise Storage 4:xen-4.7.6_05-43.42.1</ProductID>
        <ProductID>SUSE Enterprise Storage 4:xen-doc-html-4.7.6_05-43.42.1</ProductID>
        <ProductID>SUSE Enterprise Storage 4:xen-libs-32bit-4.7.6_05-43.42.1</ProductID>
        <ProductID>SUSE Enterprise Storage 4:xen-libs-4.7.6_05-43.42.1</ProductID>
        <ProductID>SUSE Enterprise Storage 4:xen-tools-4.7.6_05-43.42.1</ProductID>
        <ProductID>SUSE Enterprise Storage 4:xen-tools-domU-4.7.6_05-43.42.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP2-BCL:xen-4.7.6_05-43.42.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP2-BCL:xen-doc-html-4.7.6_05-43.42.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP2-BCL:xen-libs-32bit-4.7.6_05-43.42.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP2-BCL:xen-libs-4.7.6_05-43.42.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP2-BCL:xen-tools-4.7.6_05-43.42.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP2-BCL:xen-tools-domU-4.7.6_05-43.42.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP2-LTSS:xen-4.7.6_05-43.42.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP2-LTSS:xen-doc-html-4.7.6_05-43.42.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP2-LTSS:xen-libs-32bit-4.7.6_05-43.42.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP2-LTSS:xen-libs-4.7.6_05-43.42.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP2-LTSS:xen-tools-4.7.6_05-43.42.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP2-LTSS:xen-tools-domU-4.7.6_05-43.42.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-4.7.6_05-43.42.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-doc-html-4.7.6_05-43.42.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-32bit-4.7.6_05-43.42.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-4.7.6_05-43.42.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-4.7.6_05-43.42.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-domU-4.7.6_05-43.42.1</ProductID>
        <ProductID>SUSE OpenStack Cloud 7:xen-4.7.6_05-43.42.1</ProductID>
        <ProductID>SUSE OpenStack Cloud 7:xen-doc-html-4.7.6_05-43.42.1</ProductID>
        <ProductID>SUSE OpenStack Cloud 7:xen-libs-32bit-4.7.6_05-43.42.1</ProductID>
        <ProductID>SUSE OpenStack Cloud 7:xen-libs-4.7.6_05-43.42.1</ProductID>
        <ProductID>SUSE OpenStack Cloud 7:xen-tools-4.7.6_05-43.42.1</ProductID>
        <ProductID>SUSE OpenStack Cloud 7:xen-tools-domU-4.7.6_05-43.42.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>7.5</BaseScoreV2>
        <VectorV2>AV:N/AC:L/Au:N/C:P/I:P/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>6.5</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2018/suse-su-20183332-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2018-17963.html</URL>
        <Description>CVE-2018-17963</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1111013</URL>
        <Description>SUSE Bug 1111013</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1111014</URL>
        <Description>SUSE Bug 1111014</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1178658</URL>
        <Description>SUSE Bug 1178658</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
</cvrfdoc>
