xen: CVE-2015-3340: Information leak through XEN_DOMCTL_gettscinfo (XSA-132)

Debian Bug report logs - #784011
xen: CVE-2015-3340: Information leak through XEN_DOMCTL_gettscinfo (XSA-132)

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: xen: CVE-2015-3340: Information leak through XEN_DOMCTL_gettscinfo (XSA-132)

Date: Sat, 02 May 2015 07:04:34 +0200

Source: xen
Version: 4.4.1-9
Severity: normal
Tags: security upstream patch fixed-upstream

Hi,

the following vulnerability was published for xen.

CVE-2015-3340[0]:
| Xen 4.2.x through 4.5.x does not initialize certain fields, which
| allows certain remote service domains to obtain sensitive information
| from memory via a (1) XEN_DOMCTL_gettscinfo or (2)
| XEN_SYSCTL_getdomaininfolist request.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2015-3340
[1] http://xenbits.xen.org/xsa/advisory-132.html

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Message #10 received at 784011@bugs.debian.org (full text, mbox, reply):

From: Bastian Blank <waldi@debian.org>

To: Salvatore Bonaccorso <carnil@debian.org>, 784011@bugs.debian.org

Subject: Re: [Pkg-xen-devel] Bug#784011: xen: CVE-2015-3340: Information leak through XEN_DOMCTL_gettscinfo (XSA-132)

Date: Sat, 2 May 2015 14:03:10 +0200

On Sat, May 02, 2015 at 07:04:34AM +0200, Salvatore Bonaccorso wrote:
> the following vulnerability was published for xen.

I consider this issue as unimportant.  Not sure how I can mark it this
way in the security tracker.

Bastian

-- 
Knowledge, sir, should be free to all!
		-- Harry Mudd, "I, Mudd", stardate 4513.3

Message #15 received at 784011@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Bastian Blank <waldi@debian.org>

Cc: 784011@bugs.debian.org

Subject: Re: [Pkg-xen-devel] Bug#784011: xen: CVE-2015-3340: Information leak through XEN_DOMCTL_gettscinfo (XSA-132)

Date: Sat, 2 May 2015 15:18:23 +0200

Hi Bastian,

On Sat, May 02, 2015 at 02:03:10PM +0200, Bastian Blank wrote:
> On Sat, May 02, 2015 at 07:04:34AM +0200, Salvatore Bonaccorso wrote:
> > the following vulnerability was published for xen.
> 
> I consider this issue as unimportant.  Not sure how I can mark it this
> way in the security tracker.

Basically the severities behind the status in brackets. But note that
in this case it was already marked low, with the meaning of severities
in
http://security-team.debian.org/security_tracker.html#severity-levels


Basically then adding (unimportant) in the line for the package, in
this case

	- xen <unfixed> (unimportant; bug #784011).

I have changed that now, refering to your comment in this bug.

Regards,
Salvatore

Message #24 received at 784011-submitter@bugs.debian.org (full text, mbox, reply):

From: Ian Campbell <ijc@debian.org>

To: control@bugs.debian.org

Cc: 784011-submitter@bugs.debian.org

Subject: closing 784011

Date: Thu, 05 Nov 2015 14:52:48 +0000

close 784011 4.5.1~rc1-1
thanks

This was fixed in the 4.5.1-rc1 release, git commit f2e08aa5b1bb upstream.

Thanks,
Ian.

Send a report that this bug log contains spam.