CVE-2020-10702

A flaw was found in QEMU in the implementation of the Pointer Authentication PAuth support for ARM introduced in version 4.0 and fixed in version 5.0.0. A general failure of the signature generation process caused every PAuth-enforced pointer to be signed with the same signature. A local attacker...

keystone:fuzz_asm_arm_armbe: Use-of-uninitialized-value in llvm_ks::ARMAsmBackend::adjustFixupValue

Detailed Report: https://oss-fuzz.com/testcase?key=5712919152295936 Project: keystone Fuzzing Engine: libFuzzer Fuzz Target: fuzzasmarmarmbe Job Type: libfuzzermsankeystone Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: llvmks::ARMAsmBackend::adjustFixupValu...

Qualys Adds Cloud Agent Linux Support for AWS ARM-Based EC2 Instances

Releasing this week May 26, 2020, Qualys adds Cloud Agent Linux support for Amazon Web Services EC2 instances powered by ARM processors including the new Graviton2 processor. AWS Graviton2 processors power Amazon EC2 M6g, C6g, and R6g instances that provide up to 40% better price performance over...

UPDATE: Kali Linux 2020.2 Release

Kali Linux 2020.2 is now available. This is the second release right on time and the last release was Kali Linux 2020.1. This release improves Kali Linux support on the ARM platform. Visually, there are new key packages, icons and KDE Plasma has had a makeover. A short summary is posted in the...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : QEMU vulnerabilities (USN-4372-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4372-1 advisory. It was discovered that QEMU incorrectly handled bochs-display devices. A local attacker in a guest could use this to cause a deni...

Ubuntu: Security Advisory (USN-4372-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-4372-1 qemu vulnerabilities

It was discovered that QEMU incorrectly handled bochs-display devices. A local attacker in a guest could use this to cause a denial of service or possibly execute arbitrary code in the host. This issue only affected Ubuntu 19.10. CVE-2019-15034 It was discovered that QEMU incorrectly handled memo...

USN-4372-1: QEMU vulnerabilities

It was discovered that QEMU incorrectly handled bochs-display devices. A local attacker in a guest could use this to cause a denial of service or possibly execute arbitrary code in the host. This issue only affected Ubuntu 19.10. CVE-2019-15034 It was discovered that QEMU incorrectly handled memo...

CVE-2020-10024

The arm platform-specific code uses a signed integer comparison when validating system call numbers. An attacker who has obtained code execution within a user thread is able to elevate privileges to that of the kernel. See NCC-ZEP-001 This issue affects: zephyrproject-rtos zephyr version 1.14.0 a...

CVE-2020-10024

The arm platform-specific code uses a signed integer comparison when validating system call numbers. An attacker who has obtained code execution within a user thread is able to elevate privileges to that of the kernel. See NCC-ZEP-001 This issue affects: zephyrproject-rtos zephyr version 1.14.0 a...

Design/Logic Flaw

The arm platform-specific code uses a signed integer comparison when validating system call numbers. An attacker who has obtained code execution within a user thread is able to elevate privileges to that of the kernel. See NCC-ZEP-001 This issue affects: zephyrproject-rtos zephyr version 1.14.0 a...

CVE-2020-10024

This CVE concerns Zephyr RTOS: the ARM platform-specific code uses a signed integer comparison when validating syscall numbers. The root cause enables privilege escalation from a user thread to kernel level if code execution is obtained in user space. Affected versions are Zephyr project-rtos Zep...

CVE-2020-10024 ARM Platform Uses Signed Integer Comparison When Validating Syscall Numbers

The arm platform-specific code uses a signed integer comparison when validating system call numbers. An attacker who has obtained code execution within a user thread is able to elevate privileges to that of the kernel. See NCC-ZEP-001 This issue affects: zephyrproject-rtos zephyr version 1.14.0 a...

Important: Red Hat Security Advisory: qemu-kvm-ma security update

An update for qemu-kvm-ma is now available for Red Hat Enterprise Linux 7.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...

Microsoft Shells Out $100K for IoT Security

Microsoft has launched a bug-bounty program for its Azure Sphere offering, which is a security suite for the internet of things IoT that encompasses hardware, OS and cloud elements. The top reward will come in at $100,000. The Azure Sphere Security Research Challenge is an expansion of a program...

gcc security and bug fix update

8.3.1-5.0.3 - Fix Orabug 29838827 - provide an option to adjust the maximum depth of nested include This is the same bug as gcc upstream PR90581 from Gcc9: gcc9-pr90581.patch - Fix Orabug 29541051 - confusing error message when there is a problem with ASANOPTIONS 'ERROR: expected '='' This is the...

openssl security and bug fix update

1.1.1c-15 - add selftest of the RANDDRBG implementation 1.1.1c-14 - fix incorrect error return value from FIPSselftestdsa - S390x: properly restore SIGILL signal handler 1.1.1c-12 - additional fix for the edk2 build 1.1.1c-9 - disallow use of SHA-1 signatures in TLS in FIPS mode 1.1.1c-8 - fix...

openSUSE Security Update : xen (openSUSE-2020-599)

This update for xen fixes the following issues : Security issues fixed : - CVE-2020-11742: Bad continuation handling in GNTTABOPcopy bsc1169392. - CVE-2020-11740, CVE-2020-11741: xen: XSA-313 multiple xenoprof issues bsc1168140. - CVE-2020-11739: Missing memory barriers in read-write unlock paths...

PT-2021-7351

Name of the Vulnerable Software and Affected Versions QEMU versions up to and including 4.2.0 Description The issue is related to an out-of-bounds heap buffer access in the ARM Generic Interrupt Controller emulator of QEMU. This occurs because the interrupt ID written to the controller memory are...

EulerOS Virtualization for ARM 64 3.0.2.0 : python-pillow (EulerOS-SA-2020-1532)

According to the versions of the python-pillow package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - Integer overflow in the ImagingResampleHorizontal function in libImaging/Resample.c in Pillow before 3.1.1 allow...