RHSA-2007:0323: Important: xen security update

The Xen package contains the tools for managing the virtual machine monitorin Red Hat Enterprise Linux virtualization.The following security flaws are fixed in the updated Xen package:Joris van Rantwijk found a flaw in the Pygrub utility which is used as aboot loader for guest domains. A malicious local administrator of a guestdomain could create a carefully crafted grub.conf file which would triggerthe execution of arbitrary code outside of that domain. (CVE-2007-4993)Tavis Ormandy discovered a heap overflow flaw during video-to-video copyoperations in the Cirrus VGA extension code used in Xen. A malicious localadministrator of a guest domain could potentially trigger this flaw andexecute arbitrary code outside of the domain. (CVE-2007-1320)Tavis Ormandy discovered insufficient input validation leading to a heapoverflow in the Xen NE2000 network driver. If the driver is in use, amalicious local administrator of a guest domain could potentially triggerthis flaw and execute arbitrary code outside of the domain. Xen does notuse this driver by default. (CVE-2007-1321)Users of Xen should update to these erratum packages containing backportedpatches which correct these issues.