CentOS 8 : virt:rhel and virt-devel:rhel (CESA-2021:3061)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:3061 advisory. - QEMU: msix: OOB access during mmio operations may lead to DoS CVE-2020-13754 - QEMU: net: an assert failure via ethgetgsotype CVE-2020-27617 - qemu:...

hivex: Buffer overflow when provided invalid node key length

A flaw was found in the hivex library. It is caused due to a lack of bounds check within the hivexopen function. An attacker could input a specially crafted Windows Registry hive file which would cause hivex to read memory beyond its normal bounds or cause the program to crash. The highest threat...

QEMU: net: an assert failure via eth_get_gso_type

An assert3 failure flaw was found in the networking helper functions of QEMU. This vulnerability can occur in the ethgetgsotype routine if a packet does not have a valid networking L3 protocol ex. IPv4, IPv6 value. This flaw allows a guest user to crash the QEMU process on the host, resulting in ...

QEMU: msix: OOB access during mmio operations may lead to DoS

An out-of-bounds access flaw was found in the Message Signalled Interrupt MSI-X device support of QEMU. This issue occurs while performing MSI-X mmio operations when a guest sent address goes beyond the mmio region. A guest user or process may use this flaw to crash the QEMU process resulting in ...

QEMU: net: Infinite loop in loopback mode may lead to stack overflow

A potential stack overflow via infinite loop issue was found in various NIC emulators of QEMU. The issue occurs in loopback mode of a NIC wherein reentrant DMA checks get bypassed. A guest user/process may use this flaw to consume CPU cycles or crash the QEMU process on the host resulting in DoS...

qemu: out-of-bound heap buffer access via an interrupt ID field

An out-of-bounds heap buffer access issue was found in the ARM Generic Interrupt Controller emulator of QEMU on aarch64 platform. The issue occurs because while writing an interrupt ID to the controller memory area, it is not masked to be 4 bits wide. It may lead to the said issue while updating...

Moderate: virt:rhel and virt-devel:rhel security and bug fix update

Kernel-based Virtual Machine KVM offers a full virtualization solution for Linux on numerous hardware platforms. The virt:rhel module contains packages which provide user-space components used to run virtual machines using KVM. The packages also provide APIs for managing and interacting with the...

virt:rhel and virt-devel:rhel security and bug fix update

An update is available for libguestfs, libnbd, nbdkit, libguestfs-winsupport, supermin, libiscsi, hivex, libvirt, netcf, perl-Sys-Virt, seabios, qemu-kvm, sgabios, libvirt-dbus, libvirt-python. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a...

perl bug fix and enhancement update

Perl is a high-level programming language that is commonly used for system administration utilities and web programming. Bug Fixes and Enhancements: perl-net-ping wrong return value on failing DNS name lookup BZ1973176...

perl bug fix and enhancement update

An update is available for perl. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Perl is a high-level programming language that is commonly used for system...

OPENSUSE-SU-2021:2645-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP3 Azure kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2021-3659: Fixed a NULL pointer dereference in llseckeyalloc in net/mac802154/llsec.c bsc1188876. - CVE-2021-21781: Fixed a information disclosure...

SUSE-SU-2021:2645-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP3 Azure kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2021-3659: Fixed a NULL pointer dereference in llseckeyalloc in net/mac802154/llsec.c bsc1188876. - CVE-2021-21781: Fixed a information disclosure...

Security update for the Linux Kernel (important)

openSUSE Security Update: Security update for the Linux Kernel Announcement ID: openSUSE-SU-2021:2645-1 Rating: important References: 1065729 1085224 1094840 1113295 1152472 1152489 1153274 1154353 1155518 1156395 1170511 1176447 1176940 1179243 1180092 1180814 1183871 1184114 1184350 1184631...

RHEL 8 : perl (RHSA-2021:2792)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:2792 advisory. Perl is a high-level programming language that is commonly used for system administration utilities and web programming. Security Fixes: per...

Security update for nextcloud (important)

openSUSE Security Update: Security update for nextcloud Announcement ID: openSUSE-SU-2021:1068-1 Rating: important References: 1181445 1181803 1181804 1188247 1188248 1188249 1188250 1188251 1188252 1188253 1188254 1188255 1188256 Cross-References: CVE-2020-8293 CVE-2020-8294 CVE-2020-8295...

perl: heap-based buffer overflow in regular expression compiler leads to DoS

Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow...

perl: corruption of intermediate language state of compiled regular expression due to integer overflow leads to DoS

Perl before 5.30.3 has an integer overflow related to mishandling of a "PLregkindOPn == NOTHING" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection...

OPENSUSE-SU-2021:1068-1 Security update for nextcloud

This update for nextcloud fixes the following issues: nextcloud was updated to 20.0.11: - Fix boo1188247 - CVE-2021-32678: OCS API response ratelimits are not applied - Fix boo1188248 - CVE-2021-32679: filenames where not escaped by default in controllers using DownloadResponse - Fix boo1188249 -...

Unbreakable Enterprise kernel security update

5.4.17-2102.203.5 - rds/ib: move rdsibclearirqmiss to .h file Manjunath Patil Orabug: 33044344 5.4.17-2102.203.4 - rds/ib: recover rds connection from interrupt loss scenario Manjunath Patil Orabug: 32974199 - Revert Allow mce to reset instead of panic on UE William Roche Orabug: 32820275 - bpf:...

Unbreakable Enterprise kernel-container security update

5.4.17-2102.203.5 - rds/ib: move rdsibclearirqmiss to .h file Manjunath Patil Orabug: 33044344 5.4.17-2102.203.4 - rds/ib: recover rds connection from interrupt loss scenario Manjunath Patil Orabug: 32974199 - Revert 'Allow mce to reset instead of panic on UE' William Roche Orabug: 32820275 - bpf...