Citrix XenServer Security Update for CVE-2015-5154

Citrix XenServer Security Update for CVE-2015-5154

http://support.citrix.com/article/CTX201593

• CVE-2015-5154: QEMU heap overflow flaw while processing certain ATAPI commands

Customers that only have PV guests deployed are not at risk.

PV Guestには影響は無いようです。

Patchはでてます。

Hotfix XS65ESP1008 - For XenServer 6.5.0 Service Pack 1

https://support.citrix.com/article/CTX201637

Hotfix XS62ESP1030 - For XenServer 6.2.0 Service Pack 1

https://support.citrix.com/article/CTX201635

This reduces the VM downtime

CP-11841: 
vm-migrate downtime: plug the VIFs of the new domain before suspending the old domain
https://github.com/xapi-project/xenopsd/pull/205

This reduces the VM downtime (when both old and new domains are paused) in 0.3s
for each VIF connected to the VM.

ダウンタイムの削減。

Xen Security Advisory 137 (CVE-2015-3259) - xl command line config handling stack overflow

[Xen-announce] Xen Security Advisory 137 (CVE-2015-3259) - xl command line config handling stack overflow
http://lists.xen.org/archives/html/xen-announce/2015-07/msg00000.html

xlコマンドのoverflow不具合。
実行できる人が限定的なので、影響は少ないね。

Hotfix XS65ESP1005 - For XenServer 6.5.0 Service Pack 1

Hotfix XS65ESP1005 - For XenServer 6.5.0 Service Pack 1
http://support.citrix.com/article/CTX201514
HostをCrashさせる不具合を修正
・VBD をplug/unplug
・Netback
・Serial Console
・受信したNetworkTraffice


これまでのPatchは下記を参照

XenServer6.5 SP1 のパッチリスト

http://mada0833.blogspot.jp/2015/05/xenserver65-sp1-2015520.html