CVE-2015-8554

Buffer overflow in hw/pt-msi.c in Xen 4.6.x and earlier, when using the qemu-xen-traditional aka qemu-dm device model, allows local x86 HVM guest administrators to gain privileges by leveraging a system with access to a passed-through MSI-X capable physical PCI device and MSI-X table entries,...

CVE-2015-8551

The PCI backend driver in Xen, when running on an x86 system and using Linux 3.1.x through 4.3.x as the driver domain, allows local guest administrators to hit BUG conditions and cause a denial of service NULL pointer dereference and host OS crash by leveraging a system with access to a...

March 8, 2016, update for Office 2016 (KB3114514)

None None...

March 8, 2016, update for Office 2016 (KB3114705)

None None...

March 8, 2016, update for Office 2016 (KB3114849)

None None...

Fedora 23 : xen-4.5.2-6.fc23 (2015-d8253e2b1d)

paravirtualized drivers incautious about shared memory contents XSA-155, CVE-2015-8550 qemu-dm buffer overrun in MSI-X handling XSA-164, CVE-2015-8554 information leak in legacy x86 FPU/XMM initialization XSA-165, CVE-2015-8555 ioreq handling possibly susceptible to multiple read issue XSA-166 No...

OracleVM 2.2 : xen (OVMSA-2016-0012)

The remote OracleVM system is missing necessary patches to address critical security updates : - XSA-125: Limit XENDOMCTLmemorymapping hypercall to only process up to 64 GFNs or less Jan Beulich 20732412 CVE-2015-2752 - XSA-126: xen: limit guest control of PCI command register Jan Beulich 2073939...

Debian Security Advisory DSA 3471-1 (qemu - security update)

Several vulnerabilities were discovered in qemu, a full virtualization solution on x86 hardware. CVE-2015-7295 Jason Wang of Red Hat Inc. discovered that the Virtual Network Device support is vulnerable to denial-of-service, that could occur when receiving large packets. CVE-2015-7504 Qinghao Tan...

Ubuntu 14.04 LTS : QEMU vulnerabilities (USN-2891-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2891-1 advisory. Qinghao Tang discovered that QEMU incorrectly handled PCI MSI-X support. An attacker inside the guest could use this issue to cause QEMU to crash,...

OracleVM 3.3 : xen (OVMSA-2016-0007)

The remote OracleVM system is missing necessary patches to address critical security updates : - x86/VMX: prevent INVVPID failure due to non-canonical guest address While INVLPG and on SVM INVLPGA don't fault on non-canonical addresses, INVVPID fails in the 'individual address' case when passed...

openSUSE Security Update : xen (openSUSE-2016-36)

This update for xen fixes the following issues : - CVE-2015-8567,CVE-2015-8568: xen: qemu: net: vmxnet3: host memory leakage boo959387 - CVE-2015-8550: xen: paravirtualized drivers incautious about shared memory contents XSA-155, boo957988 - CVE-2015-8558: xen: qemu: usb: infinite loop in...

openSUSE Security Update : xen (openSUSE-2016-35)

This update for xen fixes the following security issues : - CVE-2015-8568 CVE-2015-8567: xen: qemu: net: vmxnet3: host memory leakage boo959387 - CVE-2015-8550: xen: paravirtualized drivers incautious about shared memory contents XSA-155, boo957988 - CVE-2015-8558: xen: qemu: usb: infinite loop i...

FreeBSD : qemu -- denial of service vulnerability in MSI-X support (3fb06284-b1b7-11e5-9728-002590263bf5)

Prasad J Pandit, Red Hat Product Security Team, reports : Qemu emulator built with the PCI MSI-X support is vulnerable to null pointer dereference issue. It occurs when the controller attempts to write to the pending bit arrayPBA memory region. Because the MSI-X MMIO support did not define the...

qemu-dm buffer overrun in MSI-X handling

ISSUE DESCRIPTION "qemu-xen-traditional" aka qemu-dm tracks state for each MSI-X table entry of a passed through device. This is used/updated on intercepted accesses to the pages containing the MSI-X table. There may be space on the final page not covered by any MSI-X table entry, but memory for...

Linux pciback missing sanity checks leading to crash

ISSUE DESCRIPTION Xen PCI backend driver does not perform proper sanity checks on the device's state. Which in turn allows the generic MSI code called by Xen PCI backend to be called incorrectly leading to hitting BUG conditions or causing NULL pointer exceptions in the MSI code. CVE-2015-8551 To...

CVE-2015-8552

The PCI backend driver in Xen, when running on an x86 system and using Linux 3.1.x through 4.3.x as the driver domain, allows local guest administrators to generate a continuous stream of WARN messages and cause a denial of service disk consumption by leveraging a system with access to a...

CVE-2015-7549

The MSI-X MMIO support in hw/pci/msix.c in QEMU aka Quick Emulator allows local guest OS privileged users to cause a denial of service NULL pointer dereference and QEMU process crash by leveraging failure to define the .write method...

Oracle: Security Advisory (ELSA-2007-0993)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

MGASA-2015-0310 Updated qemu package fixes security vulnerability

Matt Tait discovered that QEMU incorrectly handled the virtual PCNET driver. A malicious guest could use this issue to cause a denial of service, or possibly execute arbitrary code on the host as the user running the QEMU process CVE-2015-3209. Kurt Seifried discovered that QEMU incorrectly handl...

Code injection

The Windows Installer service in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a custom action scrip...