RHSA-2013:0636: Important: rhev-hypervisor6 security and bug fix update

The rhev-hypervisor6 package provides a Red Hat Enterprise VirtualizationHypervisor ISO disk image. The Red Hat Enterprise Virtualization Hypervisoris a dedicated Kernel-based Virtual Machine (KVM) hypervisor. It includeseverything necessary to run and manage virtual machines: A subset of theRed Hat Enterprise Linux operating environment and the Red Hat EnterpriseVirtualization Agent.Note: Red Hat Enterprise Virtualization Hypervisor is only available forthe Intel 64 and AMD64 architectures with virtualization extensions.A flaw was found in the way QEMU-KVM emulated the e1000 network interfacecard when the host was configured to accept jumbo network frames, and aguest using the e1000 emulated driver was not. A remote attacker could usethis flaw to crash the guest or, potentially, execute arbitrary code withroot privileges in the guest. (CVE-2012-6075)It was discovered that GnuTLS leaked timing information when decryptingTLS/SSL protocol encrypted records when CBC-mode cipher suites were used. Aremote attacker could possibly use this flaw to retrieve plain text fromthe encrypted packets by using a TLS/SSL server as a padding oracle.(CVE-2013-1619)It was discovered that OpenSSL leaked timing information when decryptingTLS/SSL and DTLS protocol encrypted records when CBC-mode cipher suiteswere used. A remote attacker could possibly use this flaw to retrieve plaintext from the encrypted packets by using a TLS/SSL or DTLS server as apadding oracle. (CVE-2013-0169)A NULL pointer dereference flaw was found in the OCSP response verificationin OpenSSL. A malicious OCSP server could use this flaw to crashapplications performing OCSP verification by sending a specially-craftedresponse. (CVE-2013-0166)It was discovered that the TLS/SSL protocol could leak information aboutplain text when optional compression was used. An attacker able to controlpart of the plain text sent over an encrypted TLS/SSL connection couldpossibly use this flaw to recover other portions of the plain text.(CVE-2012-4929)This updated package provides updated components that include fixes forvarious security issues. These issues have no security impact on Red HatEnterprise Virtualization Hypervisor itself, however. The security fixesincluded in this update address the following CVE numbers:CVE-2013-0292 (dbus-glib issue)CVE-2013-0228, CVE-2013-0268, and CVE-2013-0871 (kernel issues)CVE-2013-0338 (libxml2 issue)This update contains the builds from the following errata:ovirt-node: RHBA-2013:0634 https://rhn.redhat.com/errata/RHBA-2013-0634.html kernel: RHSA-2013:0630 https://rhn.redhat.com/errata/RHSA-2013-0630.html dbus-glib: RHSA-2013:0568 https://rhn.redhat.com/errata/RHSA-2013-0568.html libcgroup: RHBA-2013:0560 https://rhn.redhat.com/errata/RHBA-2013-0560.html vdsm: RHBA-2013:0635 https://rhn.redhat.com/errata/RHBA-2013-0635.html selinux-policy: RHBA-2013:0618 https://rhn.redhat.com/errata/RHBA-2013-0618.html qemu-kvm-rhev: RHSA-2013:0610 https://rhn.redhat.com/errata/RHSA-2013-0610.html glusterfs: RHBA-2013:0620 https://rhn.redhat.com/errata/RHBA-2013-0620.html gnutls: RHSA-2013:0588 https://rhn.redhat.com/errata/RHSA-2013-0588.html ipmitool: RHBA-2013:0572 https://rhn.redhat.com/errata/RHBA-2013-0572.html libxml2: RHSA-2013:0581 https://rhn.redhat.com/errata/RHSA-2013-0581.html openldap: RHBA-2013:0598 https://rhn.redhat.com/errata/RHBA-2013-0598.html openssl: RHSA-2013:0587 https://rhn.redhat.com/errata/RHSA-2013-0587.html Users of the Red Hat Enterprise Virtualization Hypervisor are advised toupgrade to this updated package, which fixes these issues.