Mandriva Linux Security Advisory : kernel (MDVSA-2014:230)

Multiple vulnerabilities has been found and corrected in the Linux kernel : The WRMSR processing functionality in the KVM subsystem in the Linux kernel through 3.17.2 does not properly handle the writing of a non-canonical address to a model-specific register, which allows guest OS users to cause...

USN-2418-1: Linux kernel (OMAP4) vulnerabilities

Nadav Amit reported that the KVM Kernel Virtual Machine mishandles noncanonical addresses when emulating instructions that change the rip Instruction Pointer. A guest user with access to I/O or the MMIO can use this flaw to cause a denial of service system crash of the guest. CVE-2014-3647 A flaw...

USN-2417-1: Linux kernel vulnerabilities

Nadav Amit reported that the KVM Kernel Virtual Machine mishandles noncanonical addresses when emulating instructions that change the rip Instruction Pointer. A guest user with access to I/O or the MMIO can use this flaw to cause a denial of service system crash of the guest. CVE-2014-3647 A flaw...

Ubuntu 12.04 LTS : linux vulnerabilities (USN-2417-1)

Nadav Amit reported that the KVM Kernel Virtual Machine mishandles noncanonical addresses when emulating instructions that change the rip Instruction Pointer. A guest user with access to I/O or the MMIO can use this flaw to cause a denial of service system crash of the guest. CVE-2014-3647 A flaw...

Fedora 19 : kernel-3.14.23-100.fc19 (2014-14068)

The 3.14.23 stable update contains a number of important fixes across the tree. Various security fixes for KVM and SCTP Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and...

Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2014-3088)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-3088 advisory. - net: sctp: fix panic on duplicate ASCONF chunks Daniel Borkmann Orabug: 20010591 CVE-2014-3687 Tenable has extracted the preceding description...

Unbreakable Enterprise kernel security update

2.6.39-400.215.13 - net: sctp: fix panic on duplicate ASCONF chunks Daniel Borkmann Orabug: 20010591 CVE-2014-3687 - net: sctp: fix skboverpanic when receiving malformed ASCONF chunks Daniel Borkmann Orabug: 20010578 CVE-2014-3673...

CVE-2014-3673

The SCTP implementation in the Linux kernel through 3.17.2 allows remote attackers to cause a denial of service system crash via a malformed ASCONF chunk, related to net/sctp/smmakechunk.c and net/sctp/smstatefuns.c...

CVE-2014-3673

The vulnerability CVE-2014-3673 affects the SCTP implementation in the Linux kernel up to version 3.17.2. A malformed ASCONF chunk can be sent by a remote attacker to trigger a denial of service (system crash). Affected components are net/sctp/sm_make_chunk.c and net/sctp/sm_statefuns.c. Remediat...

Debian DSA-3060-1 : linux - security update

Several vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service : - CVE-2014-3610 Lars Bull of Google and Nadav Amit reported a flaw in how KVM handles noncanonical writes to certain MSR registers. A privileged guest user can exploit this flaw to cause a deni...

Fedora 21 : kernel-3.17.2-300.fc21 (2014-14126)

Linux v3.17.2. A wide variety of fixes across the tree. Even more KVM CVE fixes CVE fixes for KVM and SCTP. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as mu...

[SECURITY] [DSA 3060-1] linux security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3060-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso October 31, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DSA 3060-1] linux security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3060-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso October 31, 2014 http://www.debian.org/security/faq -...

DSA-3060-1 linux - security update

Bulletin has no description...

Debian: Security Advisory (DSA-3060-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora Update for kernel FEDORA-2014-13558

Check the version of kernel SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.868437";...

CVE-2013-3673

CVE-2013-3673 : In FFmpeg, the gif_decode_frame function in gifdec.c (libavcodec) before 1.2.1 does not properly manage frame disposal methods, allowing remote attackers to cause a denial of service via crafted GIF data (out-of-bounds access and crash). Affected component: FFmpeg/libavcodec. Root...

CVE-2012-3673

CVE-2012-3673 : WebKit used in Apple iTunes before 10.7 is vulnerable to remote code execution or memory corruption leading to application crash when processing a crafted web site. The root cause is memory corruption in WebKit. Exploitation details, affected versions beyond “iTunes before 10.7” a...

Microsoft IE CSS竞争条件远程代码执行漏洞（MS09-072）

BUGTRAQ ID: 37212 CVE ID: CVE-2009-3673 Internet Explorer是Windows操作系统中默认捆绑的WEB浏览器。 在CSS两个元素之间快速的反复点击切换可能触发竞争条件，导致调用悬浮指针，这可以通过heap spray进一步利用。攻击者可以通过构建特制的网页来利用该漏洞，当用户查看网页时，该漏洞可能允许远程执行代码。成功利用此漏洞的攻击者可以获得与登录用户相同的用户权限。 Microsoft Internet Explorer 8.0 Microsoft Internet Explorer 7.0 临时解决方法： 将Internet...

CVE-2009-3673

Microsoft Internet Explorer 7/8 are affected by CVE-2009-3673 (Uninitialized Memory Corruption). A remote code execution vulnerability exists due to improper handling of memory for objects that are uninitialized or deleted, exploitable via a specially crafted web page and potentially via heap spr...