Unbreakable Enterprise kernel security update

4.1.12-124.43.4 - kvm: fix kvmioctlcreatedevice reference counting CVE-2019-6974 Jann Horn Orabug: 29434845 CVE-2019-6974 - KVM: nVMX: unconditionally cancel preemption timer in freenested CVE-2019-7221 Peter Shier Orabug: 29434898 CVE-2019-7221 - KVM: x86: work around leak of uninitialized stack...

openSUSE Security Update : dpdk (openSUSE-2020-1599)

This update for dpdk fixes the following issues : - dpdk was updated to 19.11.4 - CVE-2020-14374,CVE-2020-14375,CVE-2020-14376,CVE-2020-14 377,CVE-2020-14378: Fixed multiple issues where a malicious guest could harm the host using vhost crypto, including executing code in host VM Escape, reading...

openSUSE Security Update : dpdk (openSUSE-2020-1593)

This update for dpdk fixes the following issues : - dpdk was updated to 18.11.9. For a list of fixes check : - CVE-2020-14374,CVE-2020-14375,CVE-2020-14376,CVE-2020-14 377,CVE-2020-14378: Fixed multiple issues where a malicious guest could harm the host using vhost crypto, including executing cod...

openSUSE: Security Advisory for dpdk (openSUSE-SU-2020:1593-1)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

DEBIAN-CVE-2020-14374

A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. A flawed bounds checking in the copydata function leads to a buffer overflow allowing an attacker in a virtual machine to write arbitrary data to any address in the vhostcrypto application. The highest threat from this...

DEBIAN-CVE-2020-14375

A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. Virtio ring descriptors, and the data they describe are in a region of memory accessible by from both the virtual machine and the host. An attacker in a VM can change the contents of the memory after vhostcrypto has validate...

Updated firefox packages fix security vulnerabilities

Mozilla developer Jason Kratzer reported memory safety bugs present in Firefox ESR 78.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code CVE-2020-15673. Firefox sometimes ran the onload...

kernel: memory leak in the crypto_report() function in crypto/crypto_user_base.c allows for DoS

A flaw was found in the Linux kernel. The cryptoreport function mishandles resource cleanup on error. A local attacker able to induce the error conditions could use this flaw to crash the system. The highest threat from this vulnerability is to system availability...

EulerOS Virtualization for ARM 64 3.0.6.0 : python-crypto (EulerOS-SA-2020-1996)

According to the versions of the python-crypto package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - Heap-based buffer overflow in the ALGnew function in blocktemplace.c in Python Cryptography Toolkit aka pycrypto...

Huawei EulerOS: Security Advisory for python-crypto (EulerOS-SA-2020-1996)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-4550-1: DPDK vulnerabilities

Ryan Hall discovered that DPDK incorrectly handled vhost crypto. An attacker inside a guest could use these issues to perform multiple attacks, including denial of service attacks, obtaining sensitive information from the host, and possibly executing arbitrary code on the host...

USN-4550-1 dpdk vulnerabilities

Ryan Hall discovered that DPDK incorrectly handled vhost crypto. An attacker inside a guest could use these issues to perform multiple attacks, including denial of service attacks, obtaining sensitive information from the host, and possibly executing arbitrary code on the host...

UBUNTU-CVE-2020-14378

An integer underflow in dpdk versions before 18.11.10 and before 19.11.5 in the movedesc function can lead to large amounts of CPU cycles being eaten up in a long running loop. An attacker could cause movedesc to get stuck in a 4,294,967,295-count iteration loop. Depending on how vhostcrypto is...

UBUNTU-CVE-2020-14374

A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. A flawed bounds checking in the copydata function leads to a buffer overflow allowing an attacker in a virtual machine to write arbitrary data to any address in the vhostcrypto application. The highest threat from this...

UBUNTU-CVE-2020-14375

A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. Virtio ring descriptors, and the data they describe are in a region of memory accessible by from both the virtual machine and the host. An attacker in a VM can change the contents of the memory after vhostcrypto has validate...

KuCoin crypto exchange loses $150m after hackers drain its hot wallets

By Waqas Hackers have stolen a whopping $150 million worth of cryptocurrency from KuCoin, a major crypto exchange based in Singapore. This is a post from HackRead.com Read the original post: KuCoin crypto exchange loses $150m after hackers drain its hot wallets...

Integer overflow in hw/virtio/virtio-crypto.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (QEMU process crash) or possibly execute arbitrary code on the host via a crafted virtio-crypto request which triggers a heap-based buffer overflow.

...

Moderate: Red Hat Security Advisory: OpenShift Container Platform 4.3.38 container image security update

An update for openshift-enterprise-hyperkube-container and sriov-dp-admission-controller-container is now available for Red Hat OpenShift Container Platform 4.3. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base...

U.S. Dept Of Defense: RXSS Via URI Path - https://██████████/

Hello All I Found RXSS in your OWN Website Steps To Reproduce Go to This Link https://██████/Orders/A%22onerror='alert%60xElkomy%60'testabcd/Login.aspx?ReturnUrl=/Orders Browsers I test them on Firefox and Google Chrome. Fix:- Filter input on arrival Encode data on output Use appropriate response...

Out-of-bounds

In decrypt and decrypt12 of CryptoPlugin.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-9...