Ubuntu 18.04 LTS / 20.04 LTS : Apache HTTP Server vulnerabilities (USN-5333-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5333-1 advisory. Chamal De Silva discovered that the Apache HTTP Server modlua module incorrectly handled certain crafted request bodies. A remote attacker...

RHEL 8 : virt:av and virt-devel:av (RHSA-2022:0949)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:0949 advisory. The Advanced Virtualization module provides the user-space component for running virtual machines that use KVM in environments managed by Re...

libnbd: nbdcopy: missing error handling may create corrupted destination image

A flaw was found in the copying tool nbdcopy of libnbd. When performing multi-threaded copies using asynchronous nbd calls, nbdcopy was blindly treating the completion of an asynchronous command as successful, rather than checking the error parameter. This could result in the silent creation of a...

QEMU: virtiofsd: potential privilege escalation via CVE-2018-13405

A flaw was found in the QEMU virtio-fs shared file system daemon virtiofsd implementation. This flaw is strictly related to CVE-2018-13405. A local guest user can create files in the directories shared by virtio-fs with unintended group ownership in a scenario where a directory is SGID to a certa...

Oracle Linux 8 : virt:ol / and / virt-devel:rhel (ELSA-2022-0886)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-0886 advisory. qemu-kvm 4.2.0-59.el85.2 - kvm-virtiofsd-Drop-membership-of-all-supplementary-group.patch bz2048627 - Resolves: bz2048627 CVE-2022-0358 virt:rhel/qemu-kvm: QEMU...

glibc: Stack-based buffer overflow in sunrpc clnt_create via a long pathname

A stack based buffer-overflow vulnerability was found in the deprecated compatibility function clntcreate in the sunrpc's clntgen.c module of the GNU C Library aka glibc through 2.34. This vulnerability copies its hostname argument onto the stack without validating its length, which may result in...

glibc: Stack-based buffer overflow in svcunix_create via long pathnames

A stack based buffer-overflow vulnerability was found in the deprecated compatibility function svcunixcreate in the sunrpc's svcunix.c module of the GNU C Library aka glibc through 2.34. This vulnerability copies its path argument onto the stack without validating its length, which may result in ...

QEMU: virtiofsd: potential privilege escalation via CVE-2018-13405

A flaw was found in the QEMU virtio-fs shared file system daemon virtiofsd implementation. This flaw is strictly related to CVE-2018-13405. A local guest user can create files in the directories shared by virtio-fs with unintended group ownership in a scenario where a directory is SGID to a certa...

virt:rhel and virt-devel:rhel security update

An update is available for libguestfs, libnbd, nbdkit, libguestfs-winsupport, supermin, libiscsi, hivex, libvirt, netcf, perl-Sys-Virt, seabios, qemu-kvm, sgabios, libvirt-dbus, libvirt-python. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a...

Moderate: virt:rhel and virt-devel:rhel security update

Kernel-based Virtual Machine KVM offers a full virtualization solution for Linux on numerous hardware platforms. The virt:rhel module contains packages which provide user-space components used to run virtual machines using KVM. The packages also provide APIs for managing and interacting with the...

RHEL 8 : virt:rhel and virt-devel:rhel (RHSA-2022:0886)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:0886 advisory. Kernel-based Virtual Machine KVM offers a full virtualization solution for Linux on numerous hardware platforms. The virt:rhel module contains packag...

CentOS 8 : virt:rhel and virt-devel:rhel (CESA-2022:0886)

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2022:0886 advisory. - QEMU: virtiofsd: potential privilege escalation via CVE-2018-13405 CVE-2022-0358 Note that Nessus has not tested for this issue but has instead relied only on...

SUSE SLES15 Security Update : glibc (SUSE-SU-2022:0832-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0832-1 advisory. - The popfailstack function in the GNU C Library aka glibc or libc6 allows context-dependent attackers to cause a denial of service...

AlmaLinux 8 : virt:rhel and virt-devel:rhel (ALSA-2021:4191)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2021:4191 advisory. QEMU: net: e1000e: use-after-free while sending packets CVE-2020-15859 QEMU: slirp: invalid pointer initialization may lead to information disclosure boot...

AlmaLinux 8 : virt:rhel and virt-devel:rhel (ALSA-2021:5238)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2021:5238 advisory. QEMU: off-by-one error in modesensepage in hw/scsi/scsi-disk.c CVE-2021-3930 QEMU: net: e1000: infinite loop while processing transmit descriptors...

SUSE: Security Advisory (SUSE-SU-2022:0770-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

QEMU: virtiofsd: potential privilege escalation via CVE-2018-13405

A flaw was found in the QEMU virtio-fs shared file system daemon virtiofsd implementation. This flaw is strictly related to CVE-2018-13405. A local guest user can create files in the directories shared by virtio-fs with unintended group ownership in a scenario where a directory is SGID to a certa...

RHEL 8 : virt:rhel and virt-devel:rhel (RHSA-2022:0759)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:0759 advisory. Kernel-based Virtual Machine KVM offers a full virtualization solution for Linux on numerous hardware platforms. The virt:rhel module contains packag...

OPENSUSE-SU-2022:23018-1 Security update for conmon, libcontainers-common, libseccomp, podman

This update for conmon, libcontainers-common, libseccomp, podman fixes the following issues: podman was updated to 3.4.4. Security issues fixed: - fix CVE-2021-41190 bsc1193273, opencontainers: OCI manifest and index parsing confusion - fix CVE-2021-4024 bsc1193166, podman machine spawns gvproxy...

Security update for conmon, libcontainers-common, libseccomp, podman (moderate)

openSUSE Security Update: Security update for conmon, libcontainers-common, libseccomp, podman Announcement ID: openSUSE-SU-2022:23018-1 Rating: moderate References: 1176804 1177598 1181640 1182998 1188520 1188914 1193166 1193273 SLE-22714 Cross-References: CVE-2020-14370 CVE-2020-15157...