CVE-2007-1321

Integer signedness error in the NE2000 emulator in QEMU 0.8.2, as used in Xen and possibly other products, allows local users to trigger a heap-based buffer overflow via certain register values that bypass sanity checks, aka QEMU NE2000 "receive" integer signedness error. NOTE: this identifier wa...

CVE-2007-5729

The NE2000 emulator in QEMU 0.8.2 allows local users to execute arbitrary code by writing Ethernet frames with a size larger than the MTU to the EN0TCNT register, which triggers a heap-based buffer overflow in the slirp library, aka NE2000 "mtu" heap overflow. NOTE: some sources have used...

CVE-2007-5729

CVE-2007-5729 describes a local heap-based buffer overflow in the NE2000 emulator of QEMU 0.8.2 triggered by writing Ethernet frames with a size larger than the MTU to EN0_TCNT, leading to potential arbitrary code execution via the slirp library. Connected advisories link this issue to related NE...

CVE-2007-1321

CVE-2007-1321 is a local heap-based buffer overflow in the QEMU NE2000 emulator (NE2000 network device) used by Xen and possibly other products. It stems from an integer signedness error that lets crafted register values bypass sanity checks and trigger overflow. Public references indicate relate...

CVE-2007-5729

The NE2000 emulator in QEMU 0.8.2 allows local users to execute arbitrary code by writing Ethernet frames with a size larger than the MTU to the EN0TCNT register, which triggers a heap-based buffer overflow in the slirp library, aka NE2000 "mtu" heap overflow. NOTE: some sources have used...

CVE-2007-1321

Integer signedness error in the NE2000 emulator in QEMU 0.8.2, as used in Xen and possibly other products, allows local users to trigger a heap-based buffer overflow via certain register values that bypass sanity checks, aka QEMU NE2000 "receive" integer signedness error. NOTE: this identifier wa...

CVE-2007-5729: Improper Restriction of Operations within the Bounds of a Memory Buffer

The NE2000 emulator in QEMU 0.8.2 allows local users to execute arbitrary code by writing Ethernet frames with a size larger than the MTU to the EN0TCNT register, which triggers a heap-based buffer overflow in the slirp library, aka NE2000 "mtu" heap overflow. NOTE: some sources have used...

CVE-2007-1321: Undefined Security Weakness

Integer signedness error in the NE2000 emulator in QEMU 0.8.2, as used in Xen and possibly other products, allows local users to trigger a heap-based buffer overflow via certain register values that bypass sanity checks, aka QEMU NE2000 "receive" integer signedness error. NOTE: this identifier wa...

xen security update

CentOS Errata and Security Advisory CESA-2007:0323 An updated Xen package to fix multiple security issues is now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The Xen package contains the tools for...

RHEL 5 : xen (RHSA-2007:0323)

An updated Xen package to fix multiple security issues is now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The Xen package contains the tools for managing the virtual machine monitor in Red Hat...

Important: Red Hat Security Advisory: xen security update

An updated Xen package to fix multiple security issues is now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The Xen package contains the tools for managing the virtual machine monitor in Red Hat...

xen QEMU NE2000 emulation issues

Integer signedness error in the NE2000 emulator in QEMU 0.8.2, as used in Xen and possibly other products, allows local users to trigger a heap-based buffer overflow via certain register values that bypass sanity checks, aka QEMU NE2000 "receive" integer signedness error. NOTE: this identifier wa...

Important: xen security update

3.0.3-25.0.4.el5 - QEmu cirrus bitblit bounds check - CVE-2007-1320 rhbz 296271 - QEmu NE2000 overflow check - CVE-2007-1321 rhbz 296271 - Pygrub guest escape - CVE-2007-4993 rhbz 302821...

Debian DSA-1351-1 : bochs - buffer overflow

Tavis Ormandy discovered that bochs, a highly portable IA-32 PC emulator, is vulnerable to a buffer overflow in the emulated NE2000 network device driver, which may lead to privilege escalation. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

[SECURITY] [DSA 1351-] New bochs packages fix privilege escalation

-------------------------------------------------------------------------- Debian Security Advisory DSA 1351-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff August 7th, 2007 http://www.debian.org/security/faq -...

DSA-1351-1 bochs - buffer overflow

Bulletin has no description...

Heap overflow

Heap-based buffer overflow in the bxne2kc::rxframe function in iodev/ne2k.cc in the emulated NE2000 device in Bochs 2.3 allows local users of the guest operating system to write to arbitrary memory locations and gain privileges on the host operating system via vectors that cause TXCNT register...

CVE-2007-2893

Heap-based buffer overflow in the bxne2kc::rxframe function in iodev/ne2k.cc in the emulated NE2000 device in Bochs 2.3 allows local users of the guest operating system to write to arbitrary memory locations and gain privileges on the host operating system via vectors that cause TXCNT register...

CVE-2007-2893

Heap-based buffer overflow in the bxne2kc::rxframe function in iodev/ne2k.cc in the emulated NE2000 device in Bochs 2.3 allows local users of the guest operating system to write to arbitrary memory locations and gain privileges on the host operating system via vectors that cause TXCNT register...

CVE-2007-2893

Heap-based buffer overflow in the bxne2kc::rxframe function in iodev/ne2k.cc in the emulated NE2000 device in Bochs 2.3 allows local users of the guest operating system to write to arbitrary memory locations and gain privileges on the host operating system via vectors that cause TXCNT register...