Denial of service

The xenmemaddtophysmapone function in arch/arm/mm.c in Xen 4.5.x, 4.4.x, and earlier does not limit the number of printk console messages when reporting a failure to retrieve a reference on a foreign page, which allows remote domains to cause a denial of service by leveraging permissions to map t...

phpMyAdmin Multiple Vulnerabilities -01 (Jun 2015)

phpMyAdmin is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:phpmyadmin:phpmyadmin";...

One class to rule them all

This vulnerability allows for arbitrary code execution in the context of many apps and services and results in elevation of privileges. There is a Proof-of-Concept exploit against the Google Nexus 5 device, that achieves code execution inside the highly privileged systemserver process, and then...

gpEasy CMS 4.4 Cross Site Scripting

Affected software: gpeasy cms Type of vulnerability:stored xss URL:gpeasy.com Discovered by: provensec Website: provensec.com version: gpEasy 4.4 Proof of concept goto edit layout and fill filed with xss payload " and save it javascript will execute --20cf303f64d02dcd89051578f782 Content-Type:...

[SECURITY] Fedora 22 Update: libtasn1-4.4-1.fc22

A library that provides Abstract Syntax Notation One ASN.1, as specified by the X.680 ITU-T recommendation parsing and structures management, and Distinguished Encoding Rules DER, as per X.690 encoding and decoding func tions...

CVE-2015-2751

CVE-2015-2751 affects Xen hypervisor (versions 4.3.x–4.5.x) when using toolstack disaggregation. It allows remote domains with partial management control to lock up the host via unspecified domctl operations, causing a Denial of Service. The linked advisories indicate the issue is addressed in Xe...

CVE-2015-2751

Xen 4.3.x, 4.4.x, and 4.5.x, when using toolstack disaggregation, allows remote domains with partial management control to cause a denial of service host lock via unspecified domctl operations...

Important Security-Bulletin Pre-Announcement

A TYPO3 4.5.40 release containing a security fix will be published the day after tomorrow, Thursday 19th of February at about 10:00 am CET. The TYPO3 security team has identified a critical security issue in the TYPO3 v4 Core. The following branches are affected by the vulnerability: TYPO3 4.3...

Security Advisory- Local Denial of Service Vulnerability in Huawei Ascend P7

Huawei Ascend P7 Sophia-L09 uses Android 4.4, which is the upgrade version of EMUI 3.0. The phone module crashes when a third-party app sends specific broadcast messages or enables specific UIs. Vulnerability ID: HWPSIRT-2014-1233 This vulnerability has been assigned Common Vulnerabilities and...

CVE-2015-1563

The ARM GIC distributor virtualization in Xen 4.4.x and 4.5.x allows local guests to cause a denial of service by causing a large number messages to be logged...

CVE-2015-1563

The ARM GIC distributor virtualization in Xen 4.4.x and 4.5.x allows local guests to cause a denial of service by causing a large number messages to be logged...

arm: vgic: incorrect rate limiting of guest triggered logging

ISSUE DESCRIPTION On ARM systems the code which deals with virtualising the GIC distributor would, under various circumstances, log messages on a guest accessible code path without appropriate rate limiting. IMPACT A malicious guest could cause repeated logging to the hypervisor console, leading ...

CVE-2014-6268

The evtchnfifosetpending function in Xen 4.4.x allows local guest users to cause a denial of service host crash via vectors involving an uninitialized FIFO-based event channel control block when 1 binding or 2 moving an event to a different VCPU...

Design/Logic Flaw

The evtchnfifosetpending function in Xen 4.4.x allows local guest users to cause a denial of service host crash via vectors involving an uninitialized FIFO-based event channel control block when 1 binding or 2 moving an event to a different VCPU...

CVE-2014-6268

The evtchnfifosetpending function in Xen 4.4.x allows local guest users to cause a denial of service host crash via vectors involving an uninitialized FIFO-based event channel control block when 1 binding or 2 moving an event to a different VCPU...

CVE-2014-6268

The CVE-2014-6268 issue concerns the Xen hypervisor (notably Xen 4.4.x) where evtchn_fifo_set_pending can trigger a denial-of-service host crash due to an uninitialized FIFO-based event channel control block when binding or moving an event to another VCPU. Public sources describe the vulnerabilit...

CVE-2015-0361

Use-after-free vulnerability in Xen 4.2.x, 4.3.x, and 4.4.x allows remote domains to cause a denial of service system crash via a crafted hypercall during HVM guest teardown...

CVE-2015-0361

CVE-2015-0361 : Use-after-free in Xen 4.2.x/4.3.x/4.4.x allows remote domains to crash the system via a crafted hypercall during HVM guest teardown. The initial description does not provide exploit details beyond this, and no remediation or affected patch version is stated in the provided documen...

Code injection

common/spinlock.c in Xen 4.4.x and earlier does not properly handle read and write locks, which allows local x86 guest users to cause a denial of service write denial or NMI watchdog timeout and host crash via a large number of read requests, a different vulnerability to CVE-2014-9066...

CVE-2014-9066

Xen 4.4.x and earlier, when using a large number of VCPUs, does not properly handle read and write locks, which allows local x86 guest users to cause a denial of service write denial or NMI watchdog timeout and host crash via a large number of read requests, a different vulnerability than...