So going forward, we're moving the CentOS 6 Xen packages from the custom "xen4" repos that were introduced several years ago, to repos based on its position as a sub-project of the Virt Sig. That will make things consistent between all the sigs, as well as between CentOS 6 and 7 Xen packages.
Unfortunately, XSA-156 came up rather suddenly and is a bit blocked by this transition.
So please help us test the new repository structure, so that we can with conscience push the updates to xen4 users in general.
To update to the new repository structure, install the centos-release-xen package directly from the new repo:
yum update http://mirror.centos.org/centos/6/virt/x86_64/xen/centos-release-xen-7-11.el...
This should replace the xen4 repositories with the new virt sig repositories. Now do a 'yum update':
yum update
This should pull in the Xen 4.4.3-6 package, which contains XSA-156 (and all other packages).
If everything works as planned, we'll push the new centos-release-xen to centos-extras, and then everyone else will be moved to the new repos the next time they do an update.
-George