Fedora 21 : libvirt-1.2.9.2-1.fc21 (2015-1892)

Rebased to version 1.2.9.2 - CVE-2014-8131: deadlock and segfault in qemuConnectGetAllDomainStats bz 1172571 - CVE-2015-0236: missing ACL check for the VIRDOMAINXMLSECURE flag in save images and snapshots objects bz 1185769 - CVE-2014-8136: local denial of service in qemu/qemudriver.c bz 1176179...

USN-2492-1: Linux kernel vulnerabilities

Andy Lutomirski discovered an information leak in the Linux kernel's Thread Local Storage TLS implementation allowing users to bypass the espfix to obtain information that could be used to bypass the Address Space Layout Randomization ASLR protection mechanism. A local user could exploit this fla...

Ubuntu: Security Advisory (USN-2492-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Unbreakable Enterprise kernel security and bugfix update

2.6.39-400.246.2 - net: sctp: fix NULL pointer dereference in af-fromaddrparam on malformed packet Daniel Borkmann Orabug: 20425333 CVE-2014-7841 2.6.39-400.246.1 - sched: Fix possible divide by zero in avgatom calculation Mateusz Guzik Orabug: 20148169 - include/linux/math64.h: add div64ul Alex...

CVE-2014-8131

The qemu implementation of virConnectGetAllDomainStats in libvirt before 1.2.11 does not properly handle locks when a domain is skipped due to ACL restrictions, which allows a remote authenticated users to cause a denial of service deadlock or segmentation fault and crash via a request to access...

DEBIAN-CVE-2014-8131

The qemu implementation of virConnectGetAllDomainStats in libvirt before 1.2.11 does not properly handle locks when a domain is skipped due to ACL restrictions, which allows a remote authenticated users to cause a denial of service deadlock or segmentation fault and crash via a request to access...

UBUNTU-CVE-2014-9527

HSLFSlideShow in Apache POI before 3.11 allows remote attackers to cause a denial of service infinite loop and deadlock via a crafted PPT file...

CVE-2014-8131

The qemu implementation of virConnectGetAllDomainStats in libvirt before 1.2.11 does not properly handle locks when a domain is skipped due to ACL restrictions, which allows a remote authenticated users to cause a denial of service deadlock or segmentation fault and crash via a request to access...

Design/Logic Flaw

HSLFSlideShow in Apache POI before 3.11 allows remote attackers to cause a denial of service infinite loop and deadlock via a crafted PPT file...

CVE-2014-8131

The qemu implementation of virConnectGetAllDomainStats in libvirt before 1.2.11 does not properly handle locks when a domain is skipped due to ACL restrictions, which allows a remote authenticated users to cause a denial of service deadlock or segmentation fault and crash via a request to access...

CVE-2014-9527

HSLFSlideShow in Apache POI before 3.11 allows remote attackers to cause a denial of service infinite loop and deadlock via a crafted PPT file...

CVE-2014-9527

HSLFSlideShow in Apache POI before 3.11 allows remote attackers to cause a denial of service infinite loop and deadlock via a crafted PPT file...

openSUSE Security Update : libvirt (openSUSE-SU-2015:0008-1)

CVE-2014-8135: libvirt: local denial of service in storage driver 87b9437f-CVE-2014-8135.patch bsc910860 - CVE-2014-8136: libvirt: local denial of service in qemu driver 2bdcd29c-CVE-2014-8136.patch bsc910862 - CVE-2014-8131: Fix possible deadlock and segfault in qemuConnectGetAllDomainStats...

OracleVM 3.3 : nss (OVMSA-2014-0023)

The remote OracleVM system is missing necessary patches to address critical security updates : nss - Added nss-vendor.patch to change vendor - Replace expired PayPal test certificate that breaks the build - Resolves: Bug 1145431 - CVE-2014-1568 - Resolves: Bug 1145431 - CVE-2014-1568 - Removed...

OracleVM 3.3 : nss (OVMSA-2014-0014)

The remote OracleVM system is missing necessary patches to address critical security updates : - Added nss-vendor.patch to change vendor - Update some patches on account of the rebase - Resolves: Bug 1099619 - Backport nss-3.12.6 upstream fix required by Firefox 31 - Resolves: Bug 1099619 - Remov...

Oracle Linux 6 : libvirt (ELSA-2014-1873)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-1873 advisory. - CVE-2014-3633: qemu: blkiotune: Use correct definition when looking up disk CVE-2014-3633 - domainconf: fix domain deadlock CVE-2014-3657 Tenable has...

libvirt: domain_conf: domain deadlock DoS

A denial of service flaw was found in the way libvirt's virConnectListAllDomains function computed the number of used domains. A remote attacker able to establish a read-only connection to libvirtd could use this flaw to make any domain operations within libvirt unresponsive...

CVE-2014-8559

The dwalk function in fs/dcache.c in the Linux kernel through 3.17.2 does not properly maintain the semantics of renamelock, which allows local users to cause a denial of service deadlock and system hang via a crafted application...

DEBIAN-CVE-2014-8559

The dwalk function in fs/dcache.c in the Linux kernel through 3.17.2 does not properly maintain the semantics of renamelock, which allows local users to cause a denial of service deadlock and system hang via a crafted application...

Design/Logic Flaw

The dwalk function in fs/dcache.c in the Linux kernel through 3.17.2 does not properly maintain the semantics of renamelock, which allows local users to cause a denial of service deadlock and system hang via a crafted application...