Firefox and Edge Fall to Hackers on Day Two of Pwn2Own

Hackers took down the Mozilla Firefox and Microsoft Edge browsers on Thursday at Pwn2Own, the annual hacking conference held in tandem with CanSecWest, as the competition continued for a second day. The dynamic hacking duo of Amat Cama and Richard Zhu, which make up team Fluoroacetate, had anothe...

SUSE-SU-2019:0709-1 Security update for the Linux Kernel (Live Patch 24 for SLE 12 SP2)

This update for the Linux Kernel 4.4.121-9292 fixes several issues. The following security issues were fixed: - CVE-2019-9213: Expanddownwards in mm/mmap.c lacked a check for the mmap minimum address, which made it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP...

[SECURITY] Fedora 28 Update: xen-4.10.3-2.fc28

This package contains the XenD daemon and xm command line tools, needed to manage virtual machines running under the Xen hypervisor...

Hackers Take Down Safari, VMware and Oracle at Pwn2Own

Hackers took down Apple Safari, VMware Workstation, and Oracle VirtualBox on Wednesday, the first day of Pwn2Own, the annual hacking competition held in tandem with the CanSecWest conference in Vancouver. Contestants with the team of Fluoroacetate Amat Cama and Richard Zhu were the first to hit p...

Information disclosure

hw/ppc/spapr.c in QEMU through 3.1.0 allows Information Exposure because the hypervisor shares the /proc/device-tree/system-id and /proc/device-tree/model system attributes with a guest...

UBUNTU-CVE-2019-8934

hw/ppc/spapr.c in QEMU through 3.1.0 allows Information Exposure because the hypervisor shares the /proc/device-tree/system-id and /proc/device-tree/model system attributes with a guest...

Citrix Hypervisor Export Running VM - Export snapshot to file through CLI

...

CVE-2019-8934

hw/ppc/spapr.c in QEMU through 3.1.0 allows Information Exposure because the hypervisor shares the /proc/device-tree/system-id and /proc/device-tree/model system attributes with a guest...

Xen Project Pass-through PCI Device Guest-to-Host Privilege Escalation (XSA-285)

According to its self-reported version number, the Xen hypervisor installed on the remote host is affected by guest-to-host privilege escalation vulnerability. Only x86 systems are affected. Note that Nessus has checked the changeset versions based on the xen.git change log. Nessus did not check...

Xen Project fsgsbase CPU Feature Privilege Escalation Vulnerability (XSA-293)

According to its self-reported version number, the Xen hypervisor installed on the remote host is affected by a privilege escalation vulnerability. Only x86 systems with the fsgsbase CPU feature are affected. Note that Nessus has checked the changeset versions based on the xen.git change log...

Xen Project PCI Pass-through DMA Privilege Escalation (XSA-288)

According to its self-reported version number, the Xen hypervisor installed on the remote host is affected by a privilege escalation vulnerability. Only x86 systems are affected. Note that Nessus has checked the changeset versions based on the xen.git change log. Nessus did not check guest hardwa...

Xen Project PCI Pass-through Device Denial of Service Vulnerability (XSA-291)

According to its self-reported version number, the Xen hypervisor installed on the remote host is affected by a denial of service vulnerability. Only x86 systems are affected. Note that Nessus has checked the changeset versions based on the xen.git change log. Nessus did not check guest hardware...

[SECURITY] Fedora 29 Update: xen-4.11.1-4.fc29

This package contains the XenD daemon and xm command line tools, needed to manage virtual machines running under the Xen hypervisor...

The vulnerability of the union data structure interpretation in Xen hypervisors, related to background data corruption, allows attackers to cause service failures or increase their privileges within the system.

The vulnerability of the union data structure interpretation in Xen hypervisors is related to errors during data underpressure situations. Exploiting this vulnerability can allow attackers to cause service failures or increase their privileges within the system...

Amazon Linux 2 : kernel (ALAS-2019-1165)

A use-after-free vulnerability was found in the way the Linux kernel's KVM hypervisor implements its device control API. While creating a device via kvmioctlcreatedevice, the device holds a reference to a VM object, later this reference is transferred to the caller's file descriptor table. If suc...

Important: kernel

Issue Overview: A use-after-free vulnerability was found in the way the Linux kernel's KVM hypervisor implements its device control API. While creating a device via kvmioctlcreatedevice, the device holds a reference to a VM object, later this reference is transferred to the caller's file descript...

PT-2019-2190 · Intel +8 · Intel Microprocessors +12

Name of the Vulnerable Software and Affected Versions: Intel Microprocessors affected versions not specified vCenter Server affected versions not specified ESXi affected versions not specified Workstation affected versions not specified Fusion affected versions not specified Description: The issu...

PT-2019-2188 · Intel +7 · Intel Microprocessors +11

Name of the Vulnerable Software and Affected Versions: Intel microprocessors affected versions not specified vCenter Server affected versions not specified ESXi affected versions not specified Workstation affected versions not specified Fusion affected versions not specified Description: The issu...

Amazon Linux AMI : kernel (ALAS-2019-1165)

A use-after-free vulnerability was found in the way the Linux kernel's KVM hypervisor emulates a preemption timer for L2 guests when nested =1 virtualization is enabled. This high resolution timerhrtimer runs when a L2 guest is active. After VM exit, the syncvmcs12 timer object is stopped. The...

openSUSE Security Update : the Linux Kernel (openSUSE-2019-274)

The openSUSE Leap 42.3 kernel was updated to 4.4.175 to receive various bugfixes. The following security bugs were fixed : - CVE-2018-5391: Fixed a vulnerability, which allowed an attacker to cause a denial of service attack with low rates of packets targeting IP fragment re-assembly. bsc1103097 ...