RHSA-2013:0636: Important: rhev-hypervisor6 security and bug fix update

First published: Wed Mar 13 2013(Updated: )

The rhev-hypervisor6 package provides a Red Hat Enterprise Virtualization<br>Hypervisor ISO disk image. The Red Hat Enterprise Virtualization Hypervisor<br>is a dedicated Kernel-based Virtual Machine (KVM) hypervisor. It includes<br>everything necessary to run and manage virtual machines: A subset of the<br>Red Hat Enterprise Linux operating environment and the Red Hat Enterprise<br>Virtualization Agent.<br>Note: Red Hat Enterprise Virtualization Hypervisor is only available for<br>the Intel 64 and AMD64 architectures with virtualization extensions.<br>A flaw was found in the way QEMU-KVM emulated the e1000 network interface<br>card when the host was configured to accept jumbo network frames, and a<br>guest using the e1000 emulated driver was not. A remote attacker could use<br>this flaw to crash the guest or, potentially, execute arbitrary code with<br>root privileges in the guest. (CVE-2012-6075)<br>It was discovered that GnuTLS leaked timing information when decrypting<br>TLS/SSL protocol encrypted records when CBC-mode cipher suites were used. A<br>remote attacker could possibly use this flaw to retrieve plain text from<br>the encrypted packets by using a TLS/SSL server as a padding oracle.<br>(CVE-2013-1619)<br>It was discovered that OpenSSL leaked timing information when decrypting<br>TLS/SSL and DTLS protocol encrypted records when CBC-mode cipher suites<br>were used. A remote attacker could possibly use this flaw to retrieve plain<br>text from the encrypted packets by using a TLS/SSL or DTLS server as a<br>padding oracle. (CVE-2013-0169)<br>A NULL pointer dereference flaw was found in the OCSP response verification<br>in OpenSSL. A malicious OCSP server could use this flaw to crash<br>applications performing OCSP verification by sending a specially-crafted<br>response. (CVE-2013-0166)<br>It was discovered that the TLS/SSL protocol could leak information about<br>plain text when optional compression was used. An attacker able to control<br>part of the plain text sent over an encrypted TLS/SSL connection could<br>possibly use this flaw to recover other portions of the plain text.<br>(CVE-2012-4929)<br>This updated package provides updated components that include fixes for<br>various security issues. These issues have no security impact on Red Hat<br>Enterprise Virtualization Hypervisor itself, however. The security fixes<br>included in this update address the following CVE numbers:<br>CVE-2013-0292 (dbus-glib issue)<br>CVE-2013-0228, CVE-2013-0268, and CVE-2013-0871 (kernel issues)<br>CVE-2013-0338 (libxml2 issue)<br>This update contains the builds from the following errata:<br>ovirt-node: RHBA-2013:0634<br> <a href="https://rhn.redhat.com/errata/RHBA-2013-0634.html" target="_blank">https://rhn.redhat.com/errata/RHBA-2013-0634.html</a> kernel: RHSA-2013:0630<br> <a href="https://rhn.redhat.com/errata/RHSA-2013-0630.html" target="_blank">https://rhn.redhat.com/errata/RHSA-2013-0630.html</a> dbus-glib: RHSA-2013:0568<br> <a href="https://rhn.redhat.com/errata/RHSA-2013-0568.html" target="_blank">https://rhn.redhat.com/errata/RHSA-2013-0568.html</a> libcgroup: RHBA-2013:0560<br> <a href="https://rhn.redhat.com/errata/RHBA-2013-0560.html" target="_blank">https://rhn.redhat.com/errata/RHBA-2013-0560.html</a> vdsm: RHBA-2013:0635<br> <a href="https://rhn.redhat.com/errata/RHBA-2013-0635.html" target="_blank">https://rhn.redhat.com/errata/RHBA-2013-0635.html</a> selinux-policy: RHBA-2013:0618<br> <a href="https://rhn.redhat.com/errata/RHBA-2013-0618.html" target="_blank">https://rhn.redhat.com/errata/RHBA-2013-0618.html</a> qemu-kvm-rhev: RHSA-2013:0610<br> <a href="https://rhn.redhat.com/errata/RHSA-2013-0610.html" target="_blank">https://rhn.redhat.com/errata/RHSA-2013-0610.html</a> glusterfs: RHBA-2013:0620<br> <a href="https://rhn.redhat.com/errata/RHBA-2013-0620.html" target="_blank">https://rhn.redhat.com/errata/RHBA-2013-0620.html</a> gnutls: RHSA-2013:0588<br> <a href="https://rhn.redhat.com/errata/RHSA-2013-0588.html" target="_blank">https://rhn.redhat.com/errata/RHSA-2013-0588.html</a> ipmitool: RHBA-2013:0572<br> <a href="https://rhn.redhat.com/errata/RHBA-2013-0572.html" target="_blank">https://rhn.redhat.com/errata/RHBA-2013-0572.html</a> libxml2: RHSA-2013:0581<br> <a href="https://rhn.redhat.com/errata/RHSA-2013-0581.html" target="_blank">https://rhn.redhat.com/errata/RHSA-2013-0581.html</a> openldap: RHBA-2013:0598<br> <a href="https://rhn.redhat.com/errata/RHBA-2013-0598.html" target="_blank">https://rhn.redhat.com/errata/RHBA-2013-0598.html</a> openssl: RHSA-2013:0587<br> <a href="https://rhn.redhat.com/errata/RHSA-2013-0587.html" target="_blank">https://rhn.redhat.com/errata/RHSA-2013-0587.html</a> Users of the Red Hat Enterprise Virtualization Hypervisor are advised to<br>upgrade to this updated package, which fixes these issues.<br>

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• collector/redhat-errata
• anchor-id/RHSA-2013:0636
• agent/description
• agent/event
• agent/first-publish-date
• agent/last-modified-date
• agent/references
• agent/remedy
• agent/severity
• agent/softwarecombine
• agent/tags
• agent/title
• agent/type
• agent/weakness
• package-manager/redhat