qemu-kvm security update

qemu-kvm-0.12.1.2-2.355.el64.6 - kvm-qga-cast-to-int-for-DWORD-type.patch bz980758 - kvm-qga-remove-undefined-behavior-in-gainstallservice.patch bz980758 - kvm-qga-diagnostic-output-should-go-to-stderr.patch bz980758 - kvm-qainstallservice-nest-error-paths-more-idiomatically.patch bz980758 -...

SuSE 11.2 Security Update : KVM (SAT Patch Number 7906)

This update fixes a file permission issue with qga the QEMU Guest Agent from the qemu/kvm package and includes several bug-fixes. bnc818182 CVE-2013-2007 bnc786813 bnc725008 bnc712137. bnc824340 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

CVE-2013-1943

The KVM subsystem in the Linux kernel before 3.0 does not check whether kernel addresses are specified during allocation of memory slots for use in a guest's physical address space, which allows local users to gain privileges or obtain sensitive information from kernel memory via a crafted...

CVE-2013-1935

A certain Red Hat patch to the KVM subsystem in the kernel package before 2.6.32-358.11.1.el6 on Red Hat Enterprise Linux RHEL 6 does not properly implement the PV EOI feature, which allows guest OS users to cause a denial of service host OS crash by leveraging a time window during which interrup...

Design/Logic Flaw

The KVM subsystem in the Linux kernel before 3.0 does not check whether kernel addresses are specified during allocation of memory slots for use in a guest's physical address space, which allows local users to gain privileges or obtain sensitive information from kernel memory via a crafted...

Design/Logic Flaw

A certain Red Hat patch to the KVM subsystem in the kernel package before 2.6.32-358.11.1.el6 on Red Hat Enterprise Linux RHEL 6 does not properly implement the PV EOI feature, which allows guest OS users to cause a denial of service host OS crash by leveraging a time window during which interrup...

CVE-2013-1935

A certain Red Hat patch to the KVM subsystem in the kernel package before 2.6.32-358.11.1.el6 on Red Hat Enterprise Linux RHEL 6 does not properly implement the PV EOI feature, which allows guest OS users to cause a denial of service host OS crash by leveraging a time window during which interrup...

CVE-2013-1943

CVE-2013-1943 affects the KVM subsystem of the Linux kernel prior to 3.0. It arises because memory slots in a guest’s physical address space may be allocated without validating kernel addresses, enabling local users to gain privileges or read kernel memory. Affected components: arch/x86/kvm/pagin...

CVE-2013-1935

CVE-2013-1935 describes a vulnerability in the KVM subsystem patch for Red Hat Enterprise Linux 6 prior to kernel 2.6.32-358.11.1.el6, where PV EOI is not properly implemented. This can allow a guest OS user to cause a denial of service by exploiting a window where interrupts are disabled but cop...

CVE-2013-1935

A certain Red Hat patch to the KVM subsystem in the kernel package before 2.6.32-358.11.1.el6 on Red Hat Enterprise Linux RHEL 6 does not properly implement the PV EOI feature, which allows guest OS users to cause a denial of service host OS crash by leveraging a time window during which interrup...

CVE-2013-1943

The KVM subsystem in the Linux kernel before 3.0 does not check whether kernel addresses are specified during allocation of memory slots for use in a guest's physical address space, which allows local users to gain privileges or obtain sensitive information from kernel memory via a crafted...

CVE-2013-1935

A certain Red Hat patch to the KVM subsystem in the kernel package before 2.6.32-358.11.1.el6 on Red Hat Enterprise Linux RHEL 6 does not properly implement the PV EOI feature, which allows guest OS users to cause a denial of service host OS crash by leveraging a time window during which interrup...

CVE-2013-1943

The KVM subsystem in the Linux kernel before 3.0 does not check whether kernel addresses are specified during allocation of memory slots for use in a guest's physical address space, which allows local users to gain privileges or obtain sensitive information from kernel memory via a crafted...

CVE-2013-1943

The KVM subsystem in the Linux kernel before 3.0 does not check whether kernel addresses are specified during allocation of memory slots for use in a guest's physical address space, which allows local users to gain privileges or obtain sensitive information from kernel memory via a crafted...

kernel security and bug fix update

2.6.32-358.14.1 - x86 apic: Add probe for apicflat Prarit Bhargava 975086 953342 2.6.32-358.13.1 - wireless b43: stop format string leaking into error msgs John Linville 971387 971389 CVE-2013-2852 - pci make sriov work with hotplug remove Takahiro MUNEDA 973555 965002 - net rtnl: fix info leak o...

Oracle Linux 5 : kvm (ELSA-2009-1659)

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2009-1659 advisory. - Resolves: bz541164 CVE-2009-4031 kernel: KVM: x86 emulator: limit instructions to 15 bytes rhel-5.4.z Tenable has extracted the preceding description block...

Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2012-2022)

Description of changes: Avoid bug caused by corrupted Ext4 filesystem. When mounting an ext4 filesystem, the kernel was not checking for zero length extents. This would cause a BUGON assertion failure in the log. NULL pointer dereference in the SCSI subsystem. A NULL dereference may occur if a SC...

Oracle Linux 5 : kvm (ELSA-2012-0676)

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2012-0676 advisory. - CVE: CVE-2012-2121 - Resolves: bz814151 CVE-2012-2121 kvm: device assignment page leak rhel-5.8 - Resolves: bz808205 CVE-2012-1601 kernel: kvm:...

Oracle Linux 5 : kvm (ELSA-2010-0898)

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2010-0898 advisory. - Related: bz639886 CVE-2010-3698 kvm: invalid selector in fs/gs causes kernel panic rhel-5.5.z - Resolves: bz639886 CVE-2010-3698 kvm: invalid selector in fs/g...

Oracle Linux 5 : qspice (ELSA-2010-0633)

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2010-0633 advisory. 0.3.0-54.el55.2 - Fix unsafe accesses + spice: drop libpng from windows components 537849 + libspice: fix unsafe guest data accessing Resolves: 568719 ...