Debian Security Advisory

DLA-1270-1 xen -- LTS security update

Date Reported:
06 Feb 2018
Affected Packages:
xen
Vulnerable:
Yes
Security database references:
In Mitre's CVE dictionary: CVE-2016-9603, CVE-2016-9637, CVE-2017-2620.
More information:

Multiple vulnerabilities have been discovered in the Xen hypervisor, which could result in privilege escalation.

For Debian 7 Wheezy, these problems have been fixed in version 4.1.6.lts1-12.

We recommend that you upgrade your xen packages.

Please note that CVE-2017-15590 (XSA-237) will *not* be fixed in wheezy as the patches are too intrusive to backport. The vulnerability can be mitigated by not passing through physical devices to untrusted guests. More information can be found on https://xenbits.xen.org/xsa/advisory-237.html

Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS