Debian Security Advisory DSA 3470-1 (qemu-kvm - security update)

Several vulnerabilities were discovered in qemu-kvm, a full virtualization solution on x86 hardware. CVE-2015-7295 Jason Wang of Red Hat Inc. discovered that the Virtual Network Device support is vulnerable to denial-of-service via resource exhaustion, that could occur when receiving large packet...

Debian Security Advisory DSA 3471-1 (qemu - security update)

Several vulnerabilities were discovered in qemu, a full virtualization solution on x86 hardware. CVE-2015-7295 Jason Wang of Red Hat Inc. discovered that the Virtual Network Device support is vulnerable to denial-of-service, that could occur when receiving large packets. CVE-2015-7504 Qinghao Tan...

DSA-3469-1 qemu - security update

Bulletin has no description...

DEBIAN-CVE-2016-1570

The PV superpage functionality in arch/x86/mm.c in Xen 3.4.0, 3.4.1, and 4.1.x through 4.6.x allows local PV guests to obtain sensitive information, cause a denial of service, gain privileges, or have unspecified other impact via a crafted page identifier MFN to the 1 MMUEXTMARKSUPER or 2...

CVE-2016-1570

The PV superpage functionality in arch/x86/mm.c in Xen 3.4.0, 3.4.1, and 4.1.x through 4.6.x allows local PV guests to obtain sensitive information, cause a denial of service, gain privileges, or have unspecified other impact via a crafted page identifier MFN to the 1 MMUEXTMARKSUPER or 2...

UBUNTU-CVE-2016-1570

The PV superpage functionality in arch/x86/mm.c in Xen 3.4.0, 3.4.1, and 4.1.x through 4.6.x allows local PV guests to obtain sensitive information, cause a denial of service, gain privileges, or have unspecified other impact via a crafted page identifier MFN to the 1 MMUEXTMARKSUPER or 2...

CVE-2016-1570

CVE-2016-1570 affects Xen PV (PV superpage) in arch/x86/mm.c across Xen 3.4.0/3.4.1 and 4.1.x–4.6.x. A crafted MFN page identifier can be used by local PV guests to leak sensitive information, cause a denial of service, escalate privileges, or impact page-table updates via (1) MMUEXT_MARK_SUPER, ...

CVE-2016-1570

The PV superpage functionality in arch/x86/mm.c in Xen 3.4.0, 3.4.1, and 4.1.x through 4.6.x allows local PV guests to obtain sensitive information, cause a denial of service, gain privileges, or have unspecified other impact via a crafted page identifier MFN to the 1 MMUEXTMARKSUPER or 2...

PT-2016-4864

Name of the Vulnerable Software and Affected Versions Xen versions 3.4.0 through 3.4.1 Xen versions 4.1.x through 4.6.x Description The issue allows local PV guests to obtain sensitive information, cause a denial of service, gain privileges, or have unspecified other impact. This is achieved via ...

PV superpage functionality missing sanity checks

ISSUE DESCRIPTION The PV superpage functionality lacks certain validity checks on data being passed to the hypervisor by guests. This is the case for the page identifier MFN passed to MMUEXTMARKSUPER and MMUEXTUNMARKSUPER sub-ops of the HYPERVISORmmuextop hypercall as well as for various forms of...

CVE-2016-1922

QEMU aka Quick Emulator built with the TPR optimization for 32-bit Windows guests support is vulnerable to a null pointer dereference flaw. It occurs while doing I/O port write operations via hmp interface. In that, 'currentcpu' remains null, which leads to the null pointer dereference. A user or...

PT-2016-4923

Name of the Vulnerable Software and Affected Versions QEMU affected versions not specified Description A null pointer dereference flaw exists in QEMU when built with the TPR optimization for 32-bit Windows guests support. The issue occurs during I/O port write operations via the hmp interface,...

UBUNTU-CVE-2016-1922

QEMU aka Quick Emulator built with the TPR optimization for 32-bit Windows guests support is vulnerable to a null pointer dereference flaw. It occurs while doing I/O port write operations via hmp interface. In that, 'currentcpu' remains null, which leads to the null pointer dereference. A user or...

SUSE-SU-2015:2399-1 Security update for grub2

This update for grub2 provides the following fixes and enhancements: Security issue fixed: - Fix buffer overflows when reading username and password. bsc956631, CVE-2015-8370 Non security issues fixed: - Expand list of grub.cfg search path in PV Xen guests for systems installed on btrfs snapshots...

SUSE SLED11 / SLES11 Security Update : grub2 (SUSE-SU-2015:2386-1)

This update for grub2 provides the following fixes : A security issues with a bufferoverflow when reading username and password was fixed bsc956631, CVE-2015-8370 Bugs fixed : - Expand list of grub.cfg search path in PV Xen guests for systems installed on btrfs snapshots. bsc946148, bsc952539 - A...

SUSE-SU-2015:2385-1 Security update for grub2

This update for grub2 provides the following fixes: A security issues with a bufferoverflow when reading username and password was fixed bsc956631, CVE-2015-8370 Also following bugs were fixed: - Fix buffer overflows when reading username and password. bsc956631, CVE-2015-8370 - Expand list of...

Scientific Linux Security Update : pacemaker on SL7.x x86_64 (20151119)

A flaw was found in the way pacemaker, a cluster resource manager, evaluated added nodes in certain situations. A user with read-only access could potentially assign any other existing roles to themselves and then add privileges to other users as well. CVE-2015-1867 The pacemaker packages have be...

Scientific Linux Security Update : kernel on SL7.x x86_64 (20151208)

It was found that the x86 ISA Instruction Set Architecture is prone to a denial of service attack inside a virtualized environment in the form of an infinite loop in the microcode due to the way sequential delivering of benign exceptions such as AC alignment check exception and DB debug exception...

DEBIAN-CVE-2015-8338

Xen 4.6.x and earlier does not properly enforce limits on page order inputs for the 1 XENMEMincreasereservation, 2 XENMEMpopulatephysmap, 3 XENMEMexchange, and possibly other HYPERVISORmemoryop suboperations, which allows ARM guest OS administrators to cause a denial of service CPU consumption,...

UBUNTU-CVE-2015-8338

Xen 4.6.x and earlier does not properly enforce limits on page order inputs for the 1 XENMEMincreasereservation, 2 XENMEMpopulatephysmap, 3 XENMEMexchange, and possibly other HYPERVISORmemoryop suboperations, which allows ARM guest OS administrators to cause a denial of service CPU consumption,...