Technical Description

Multiple vulnerabilities have been identified in Mandriva, which could be exploited by malicious users to execute arbitrary code. These issues are caused by errors in Xen. For additional information, see : VUPEN/ADV-2007-1597 - VUPEN/ADV-2007-3348 - VUPEN/ADV-2007-3621

Affected Products

Mandriva Linux 2007.0
Mandriva Linux 2007.1
Mandriva Corporate 4.0

Solution

Upgrade the affected packages :

Mandriva Linux 2007.0:
70b7495f9eb6597b8dcff92a6a698a28 2007.0/i586/xen-3.0.3-0.20060703.3.1mdv2007.0.i586.rpm
c939b93cb67251235a9c8f2824609702 2007.0/SRPMS/xen-3.0.3-0.20060703.3.1mdv2007.0.src.rpm

Mandriva Linux 2007.0/X86_64:
f35d3563e67a0a887c439657b2e29afb 2007.0/x86_64/xen-3.0.3-0.20060703.3.1mdv2007.0.x86_64.rpm
c939b93cb67251235a9c8f2824609702 2007.0/SRPMS/xen-3.0.3-0.20060703.3.1mdv2007.0.src.rpm

Mandriva Linux 2007.1:
183ef09d8ed8171adc894cbb606f922f 2007.1/i586/xen-3.0.3-0.20060703.5.1mdv2007.1.i586.rpm
f4a0bfc9c6d5ae01664c8a906580b873 2007.1/SRPMS/xen-3.0.3-0.20060703.5.1mdv2007.1.src.rpm

Mandriva Linux 2007.1/X86_64:
c05336d0eef357b2b2c191286c4d679e 2007.1/x86_64/xen-3.0.3-0.20060703.5.1mdv2007.1.x86_64.rpm
f4a0bfc9c6d5ae01664c8a906580b873 2007.1/SRPMS/xen-3.0.3-0.20060703.5.1mdv2007.1.src.rpm

Corporate 4.0:
ec6876abb87e57d61257f3b3c6659c22 corporate/4.0/i586/xen-3.0.1-3.1.20060mlcs4.i586.rpm
72a302b77a88766cc43276e431dabf79 corporate/4.0/SRPMS/xen-3.0.1-3.1.20060mlcs4.src.rpm

Corporate 4.0/X86_64:
894c37bcf10d4ec8973ed11a5613aeb5 corporate/4.0/x86_64/xen-3.0.1-3.1.20060mlcs4.x86_64.rpm
72a302b77a88766cc43276e431dabf79 corporate/4.0/SRPMS/xen-3.0.1-3.1.20060mlcs4.src.rpm

References

http://www.vupen.com/english/advisories/2007/3686
http://archives.mandrivalinux.com/security-announce/2007-11/msg00000.php

ChangeLog

2007-11-02 : Initial release

Vulnerability Management

Subscribe to VUPEN VNS and receive real-time e-mail and SMS alerts when new advisories or patches relevant to your systems and network configurations are available.

Feedback

If you have additional information or corrections for this security advisory please submit them via our contact form.