Debian DSA-3259-1 : qemu - security update (Venom)

Several vulnerabilities were discovered in the qemu virtualisation solution : - CVE-2014-9718 It was discovered that the IDE controller emulation is susceptible to denial of service. - CVE-2015-1779 Daniel P. Berrange discovered a denial of service vulnerability in the VNC web socket decoder. -...

Ubuntu 14.04 LTS : QEMU vulnerabilities (USN-2608-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2608-1 advisory. Jason Geffner discovered that QEMU incorrectly handled the virtual floppy driver. This issue is known as VENOM. A malicious guest could use this issue to...

Debian Security Advisory DSA 3259-1 (qemu - security update)

Several vulnerabilities were discovered in the qemu virtualisation solution: CVE-2014-9718 It was discovered that the IDE controller emulation is susceptible to denial of service. CVE-2015-1779 Daniel P. Berrange discovered a denial of service vulnerability in the VNC web socket decoder...

DSA-3259-1 qemu - security update

Bulletin has no description...

SUSE-SU-2015:0896-1 Security update for qemu

qemu / kvm was updated to fix a security issue and some bugs. Security issue fixed: CVE-2015-3456: Fixed a buffer overflow in the floppy drive emulation, which could be used to denial of service attacks or potential code execution against the host. CVE-2015-1779: Fixed insufficient resource...

[ MDVSA-2015:210 ] qemu

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2015:210 http://www.mandriva.com/en/support/security/ Package : qemu Date : April 27, 2015 Affected: Business Server 1.0, Business Server 2.0 Problem Description: Updated qemu packages fix security vulnerabilitie...

Fedora 22 : qemu-2.3.0-0.3.rc2.fc22 (2015-5541)

Rebased to version 2.3.0-rc2 - Don't install ksm services as executable bz 1192720 - Skip hanging tests on s390 bz 1206057 - CVE-2015-1779 vnc: insufficient resource limiting in VNC websockets decoder bz 1205051, bz 1199572 Note that Tenable Network Security has extracted the preceding...

Updated qemu packages fix security vulnerabilities

Updated qemu packages fix security vulnerabilities: A denial of service flaw was found in the way QEMU handled malformed Physical Region Descriptor Table PRDT data sent to the host's IDE and/or AHCI controller emulation. A privileged guest user could use this flaw to crash the system rhbz1204919...

Fedora 21 : qemu-2.1.3-5.fc21 (2015-5482)

CVE-2015-1779 vnc: insufficient resource limiting in VNC websockets decoder bz 1205051, bz 1199572 - Qemu: PRDT overflow from guest to host bz 1204919, bz 1205322 - CVE-2014-8106: cirrus: insufficient blit region checks bz 1170612, bz 1169454 - Fix .vdi disk corruption bz 1199400 - Don't install...

Fedora Update for qemu FEDORA-2015-5482

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Memory corruption

Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1775, CVE-2014-1779, CVE-2014-1799,...

CVE-2014-1779

CVE-2014-1779 describes a memory corruption vulnerability in Microsoft Internet Explorer (IE6–IE11) that is triggered by a crafted web page. The connected document provides technical context: the issue is identified as a Use-After-Free (UAF) in the browser’s memory management, with exploitation d...

CVE-2013-1779

Cross-site scripting XSS vulnerability in the 3 slide gallery in the Fresh theme before 7.x-1.4 for Drupal allows remote authenticated users with the administer themes permission to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-1779

The vulnerability CVE-2013-1779 affects the Fresh Theme for Drupal, versions prior to 7.x-1.4. The issue arises from the 3 slide gallery not properly sanitizing user-entered content, enabling XSS by remote authenticated users with the administer themes permission to inject arbitrary script or HTM...

RedHat Update for libarchive RHSA-2011:1507-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

CVE-2011-1779

Multiple use-after-free vulnerabilities in libarchive 2.8.4 and 2.8.5 allow remote attackers to cause a denial of service application crash or possibly have unspecified other impact via a crafted 1 TAR archive or 2 ISO9660 image...

CVE-2011-1779

CVE-2011-1779 concerns libarchive 2.8.4/2.8.5, with multiple use-after-free vulnerabilities that could be triggered by crafted TAR archives or ISO9660 images. Impact per the sources: remote denial of service (application crash) and possibly other unspecified effects. The provided documents do not...

CVE-2012-1779

CVE-2012-1779 describes a cross-site scripting (XSS) vulnerability in the IDevSpot idev-BusinessDirectory 3.0. The issue arises from unescaped input in the SEARCH parameter to index.php, allowing remote attackers to inject arbitrary web script or HTML. The connected sources (NVD/NVD-derived recor...

SuSE 11 Security Update : Mozilla Firefox (SAT Patch Number 1779)

Mozilla Firefox was upgraded to 3.5.7 fixing some bugs and regressions. The following security bug has been fixed : - The nsObserverList::FillObserverArray function in xpcom/ds/nsObserverList.cpp in Mozilla Firefox before 3.5.7 allows remote attackers to cause a denial of service application cras...

CVE-2009-1779

The CVE-2009-1779 issue affects Frax.dk Php Recommend 1.3 and earlier versions, where a remote file inclusion flaw in admin.php allows an attacker to execute arbitrary PHP code via a URL parameter named form_include_template. This is exploitable by remote attackers without authentication and resu...