qemu security update

15:3.0.0-1.el7 - net: ignore packet size greater than INTMAX Jason Wang Orabug: 28763782 CVE-2018-17963 - pcnet: fix possible buffer overflow Jason Wang Orabug: 28763774 CVE-2018-17962 - rtl8139: fix possible out of bound access Jason Wang Orabug: 28763765 CVE-2018-17958 - ne2000: fix possible ou...

CVE-2018-8112

CVE-2018-8112 is a security feature bypass affecting Microsoft Edge, caused by improper handling of cross-origin requests. The vulnerability is documented in multiple sources (NVD and CNVD entries) as a Microsoft Edge issue labeled the “Microsoft Edge Security Feature Bypass Vulnerability.” The c...

Microsoft Windows Multiple Vulnerabilities (KB4103723)

This host is missing a critical security update according to Microsoft KB4103723 SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Microsoft Windows Multiple Vulnerabilities (KB4103731)

This host is missing a critical security update according to Microsoft KB4103731 SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE SLES12 Security Update : qemu (SUSE-SU-2017:2969-1)

This update for qemu fixes several issues. These security issues were fixed : - CVE-2017-15289: The mode4and5 write functions allowed local OS guest privileged users to cause a denial of service out-of-bounds write access and Qemu process crash via vectors related to dst calculation bsc1063122 -...

SUSE SLES12 Security Update : qemu (SUSE-SU-2017:2946-1)

This update for qemu fixes several issues. These security issues were fixed : - CVE-2017-10911: The makeresponse function in the Linux kernel allowed guest OS users to obtain sensitive information from host OS or other guest OS kernel memory by leveraging the copying of uninitialized padding fiel...

Ubuntu 14.04 LTS / 16.04 LTS : QEMU vulnerabilities (USN-3414-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3414-1 advisory. Leo Gaspard discovered that QEMU incorrectly handled VirtFS access control. A guest attacker could use this issue to elevate privileges insid...

Fedora 25 : 2:qemu (2017-f941184db1)

CVE-2017-7718: cirrus: OOB read access issue bz 1443443 - CVE-2016-9603: cirrus: heap buffer overflow via vnc connection bz 1432040 - CVE-2017-7377: 9pfs: fix file descriptor leak bz 1437872 - CVE-2017-7980: cirrus: OOB r/w access issues in bitblt bz 1444372 - CVE-2017-8112: vmwpvscsi: infinite...

Security update for qemu (important)

This update for qemu fixes several issues. These security issues were fixed: - CVE-2017-9330: USB OHCI Emulation in qemu allowed local guest OS users to cause a denial of service infinite loop by leveraging an incorrect return value bsc1042159. - CVE-2017-8379: Memory leak in the keyboard input...

SUSE SLED12 / SLES12 Security Update : qemu (SUSE-SU-2017:1774-1)

This update for qemu fixes several issues. These security issues were fixed : - CVE-2017-9330: USB OHCI Emulation in qemu allowed local guest OS users to cause a denial of service infinite loop by leveraging an incorrect return value bsc1042159. - CVE-2017-8379: Memory leak in the keyboard input...

CVE-2017-8112

CVE-2017-8112 affects QEMU (hw/scsi/vmw_pvscsi.c). The vulnerability allows a local guest OS user with privileges to trigger an infinite loop in the message ring page count, causing a denial of service (CPU exhaustion). The provided documents do not specify a vendor/version scope or a remediation...

CVE-2017-8112

hw/scsi/vmwpvscsi.c in QEMU aka Quick Emulator allows local guest OS privileged users to cause a denial of service infinite loop and CPU consumption via the message ring page count...

Oracle: Security Advisory (ELSA-2015-0416)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 22 : 389-ds-base-1.3.3.9-1.fc22 (2015-3368)

Release 1.3.3.9 with security bug fixes Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL...

Important: 389-ds-base

Issue Overview: An information disclosure flaw was found in the way the 389 Directory Server stored information in the Changelog that is exposed via the 'cn=changelog' LDAP sub-tree. An unauthenticated user could in certain cases use this flaw to read data from the Changelog, which could include...

CVE-2014-8112

389 Directory Server 1.3.1.x, 1.3.2.x before 1.3.2.27, and 1.3.3.x before 1.3.3.9 stores "unhashed" passwords even when the nsslapd-unhashed-pw-switch option is set to off, which allows remote authenticated users to obtain sensitive information by reading the Changelog...

DEBIAN-CVE-2014-8112

389 Directory Server 1.3.1.x, 1.3.2.x before 1.3.2.27, and 1.3.3.x before 1.3.3.9 stores "unhashed" passwords even when the nsslapd-unhashed-pw-switch option is set to off, which allows remote authenticated users to obtain sensitive information by reading the Changelog...

CVE-2014-8112

389 Directory Server 1.3.1.x, 1.3.2.x before 1.3.2.27, and 1.3.3.x before 1.3.3.9 stores "unhashed" passwords even when the nsslapd-unhashed-pw-switch option is set to off, which allows remote authenticated users to obtain sensitive information by reading the Changelog...

CVE-2014-8112

389 Directory Server 1.3.1.x, 1.3.2.x before 1.3.2.27, and 1.3.3.x before 1.3.3.9 stores "unhashed" passwords even when the nsslapd-unhashed-pw-switch option is set to off, which allows remote authenticated users to obtain sensitive information by reading the Changelog...

CVE-2014-8112

389-ds-base (389 Directory Server) is affected: for 1.3.2.x prior to 1.3.2.27 and 1.3.3.x prior to 1.3.3.9, unhashed passwords can be written to the Changelog when nsslapd-unhashed-pw-switch is off, enabling read access to sensitive data by a remote authenticated user. The connected advisories in...