qemu: virtio: out-of-bounds buffer write on state load with invalid config_len

Heap-based buffer overflow in the virtioload function in hw/virtio/virtio.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a crafted config length in a savevm image...

qemu: usb: insufficient sanity checking of setup_index+setup_len in post_load

The usbdevicepostload function in hw/usb/bus.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a crafted savevm image, related to a negative setuplen or setupindex value...

Qemu: usb: fix up post load checks

hw/usb/bus.c in QEMU 1.6.2 allows remote attackers to execute arbitrary code via crafted savevm data, which triggers a heap-based buffer overflow, related to "USB post load checks."...

qemu: virtio-scsi: buffer overrun on invalid state load

The virtioscsiloadrequest function in hw/scsi/scsi-bus.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a crafted savevm image, which triggers an out-of-bounds array access...

Important: Red Hat Security Advisory: kernel security and bug fix update

Updated kernel packages that fix two security issues and one bug are now available for Red Hat Enterprise Linux 6.3 Extended Update Support. The Red Hat Security Response Team has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores, which gi...

KLA10026 OAF vulnerability in Foxit

An XSS vulnerability was found in Foxit Reader, Foxit Enterprise Reader and Foxit PhantomPDF. By exploiting this vulnerability malicious users can overwrite registry entries and load malicious files. This vulnerability can be exploited locally at a point related to the Recent Documents section of...

Important: Red Hat Security Advisory: kernel security and bug fix update

Updated kernel packages that fix two security issues and one bug are now available for Red Hat Enterprise Linux 6.2 Extended Update Support. The Red Hat Security Response Team has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores, which gi...

UBUNTU-CVE-2014-3717

Xen 4.4.x does not properly validate the load address for 64-bit ARM guest kernels, which allows local users to read system memory or cause a denial of service crash via a crafted kernel, which triggers a buffer overflow...

SNMP Public Community String Zero Day in Routers Disclosed

Researchers have discovered previously unreported problems in SNMP on embedded devices where devices such as secondary market home routers and a popular enterprise-grade load balancer are leaking authentication details in plain text. The data could be extracted by gaining access to the read-only...

[oss-security] CVE request: Qemu: usb: fix up post load checks

Hello, Correct post load checks: 1. dev-setuplen == sizeofdev-databuf seems fine, no need to fail migration 2. When state is DATA, passing index len will cause memcpy with negative length, resulting in heap overflow An user able to alter the saved VM dataeither on the disk or over the wire during...

[oss-security] Re: CVE request: Qemu: usb: fix up post load checks

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 http://article.gmane.org/gmane.comp.emulators.qemu/272322 Here, it appears that the only security fix to http://git.qemu.org/?p=qemu.git;a=blob;f=hw/usb/bus.c;h=e48b19fc29bd9f831cc05990be73ddf49936d6a9;hb=HEAD is the insertion of the "dev-setupindex...

CVE-2014-1603

Multiple cross-site scripting XSS vulnerabilities in GetSimple CMS 3.3.1 allow remote attackers to inject arbitrary web script or HTML via the 1 param parameter to admin/load.php or 2 user, 3 email, or 4 name parameter in a Save Settings action to admin/settings.php...

Ian Dunn: Path Disclosure Vulnerability

Hey , I'm Jamal in this report i want to show you a Vulnerability Found It In basic-google-maps-placemarks Pugin Description: Title : Path Disclosure Vulnerability Status : Unfixed Tested on : Firefox Author : Jamal Eddine Email : [email protected] Discovered : 2014/05/04 Report it : 2014/05/04...

F5 BIG-IP Backend Cookie Disclosure

This module identifies F5 BIG-IP load balancers and leaks backend information pool name, routed domain, and backend servers' IP addresses and ports through cookies inserted by the BIG-IP systems. This module requires Metasploit: https://metasploit.com/download Current source:...

Google Chrome 34.0.1847.131 DLL Hijacking

google chrom latest Version 34.0.1847.131 m 32-bit DLL Order Hijacking Exploit Title: google chrom Version 34.0.1847.131 m 32-bit DLL Order Hijacking Date: 2014/04/25 Exploit Author: Aryan Bayaninejad Linkedin : https://www.linkedin.com/profile/view?id=276969082 Vendor Homepage:...

Yahoo!: Loadbalancer + URI XSS #3

Thank you for your submission to the Yahoo Bug Bounty program. We were able to reproduce the issue you reported and have implemented appropriate fixes. We appreciate your adherence to responsible disclosure guidelines and look forward to your future participation in the program...

Qemu: block: multiple integer overflow flaws

Multiple integer overflows in the block drivers in QEMU, possibly before 2.0.0, allow local users to cause a denial of service crash via a crafted catalog size in 1 the parallelsopen function in block/parallels.c or 2 bochsopen function in bochs.c, a large L1 table in the 3 qcow2snapshotloadtmp i...

CVE-2012-5032

The Flex-VPN load-balancing feature in the ipsec-ikev2 implementation in Cisco IOS before 15.11SY3 does not require authentication, which allows remote attackers to trigger the forwarding of VPN traffic to an attacker-controlled destination, or the discarding of this traffic, by arranging for an...

Authentication flaw

The Flex-VPN load-balancing feature in the ipsec-ikev2 implementation in Cisco IOS before 15.11SY3 does not require authentication, which allows remote attackers to trigger the forwarding of VPN traffic to an attacker-controlled destination, or the discarding of this traffic, by arranging for an...

CVE-2012-5032

The CVE-2012-5032 issue affects Cisco IOS with the Flex-VPN load-balancing feature in the ipsec-ikev2 implementation prior to 15.1(1)SY3. The root cause is that this feature does not require authentication, enabling an attacker to cause VPN traffic to be forwarded to an attacker-controlled destin...