qemu-kvm security and bug fix update

1.5.3-126.el73.5 - kvm-cirrus-fix-patterncopy-checks.patch bz1420490 - kvm-Revert-cirrus-allow-zero-source-pitch-in-pattern-fil.patch bz1420490 - kvm-cirrus-add-blitisunsafe-call-to-cirrusbitbltcput.patch bz1420490 - Resolves: bz1420490 EMBARGOED CVE-2017-2620 qemu-kvm: Qemu: display: cirrus:...

Fedora 24 : xen (2017-d4ee7018c1)

memory leak when destroying guest without PT devices XSA-207 1422492 update patches for XSA-208 after upstream revision no functional change ---- Qemu: net: mcffec: infinite loop while receiving data in mcffecreceive CVE-2016-9776 Qemu: audio: memory leakage in ac97 CVE-2017-5525 1414111 Qemu:...

Updated libevent packages fix security vulnerability

The DNS code of Libevent contains an OOB read which can trigger a crash CVE-2016-10197 The libevent evutilparsesockaddrport contains a buffer overflow which can cause a segmentation fault CVE-2016-10196 The nameparse function in libevent's DNS code is vulnerable to a buffer overread CVE-2016-1019...

MGASA-2017-0066 Updated libevent packages fix security vulnerability

The DNS code of Libevent contains an OOB read which can trigger a crash CVE-2016-10197 The libevent evutilparsesockaddrport contains a buffer overflow which can cause a segmentation fault CVE-2016-10196 The nameparse function in libevent's DNS code is vulnerable to a buffer overread CVE-2016-1019...

CVE-2017-6307

An issue was discovered in tnef before 1.4.13. Two OOB Writes have been identified in src/mapiattr.c:mapiattrread. These might lead to invalid read and write operations, controlled by an attacker...

Code injection

An issue was discovered in tnef before 1.4.13. Two OOB Writes have been identified in src/mapiattr.c:mapiattrread. These might lead to invalid read and write operations, controlled by an attacker...

CVE-2017-6307

An issue was discovered in tnef before 1.4.13. Two OOB Writes have been identified in src/mapiattr.c:mapiattrread. These might lead to invalid read and write operations, controlled by an attacker...

CVE-2017-6307

CVE-2017-6307 affects the tnef project (MS-TNEF MIME unpacker). The issue is two out-of-bounds writes in mapi_attr_read() (src/mapi_attr.c) that could lead to invalid read/write operations, with the advisory stating vulnerable versions up to 1.4.13 and fixes delivered in newer releases. Fedora an...

CVE-2017-6307

An issue was discovered in tnef before 1.4.13. Two OOB Writes have been identified in src/mapiattr.c:mapiattrread. These might lead to invalid read and write operations, controlled by an attacker...

Cimetrics BACnet Explorer 4.0 XXE Injection

Cimetrics BACnet Explorer 4.0 XXE Vulnerability Vendor: Cimetrics, Inc. Product web page: https://www.cimetrics.com Affected version: 4.0.0.0 Summary: The BACnet Explorer is a BACnet client application that helps auto discover BACnet devices. Desc: BACnetExplorer suffers from an XML External Enti...

Cimetrics BACnet Explorer 4.0 - XML External Entity Injection Vulnerability

Exploit for windows platform in category local exploits Cimetrics BACnet Explorer 4.0 XXE Vulnerability Vendor: Cimetrics, Inc. Product web page: https://www.cimetrics.com Affected version: 4.0.0.0 Summary: The BACnet Explorer is a BACnet client application that helps auto discover BACnet devices...

oob access in cirrus bitblt copy

ISSUE DESCRIPTION When doing bitblt copy backwards, qemu should negate the blit width. This avoids an oob access before the start of video memory. IMPACT A malicious guest administrator can cause an out of bounds memory access, leading to information disclosure or privilege escalation. VULNERABLE...

xen-tools -- oob access in cirrus bitblt copy

The Xen Project reports: When doing bitblt copy backwards, qemu should negate the blit width. This avoids an oob access before the start of video memory. A malicious guest administrator can cause an out of bounds memory access, possibly leading to information disclosure or privilege escalation...

Fedora 24 : 2:qemu (2017-12394e2cc7)

CVE-2016-6836: vmxnet: Information leakage in vmxnet3completepacket bz 1366370 - CVE-2016-7909: pcnet: Infinite loop in pcnetrdraaddr bz 1381196 - CVE-2016-7994: virtio-gpu: memory leak in resourcecreate2d bz 1382667 - CVE-2016-8577: 9pfs: host memory leakage in v9fsread bz 1383286 -...

Truncated packet could crash via OOB read

If an SSL/TLS server or client is running on a 32-bit host, and a specific cipher is being used, then a truncated packet can cause that server or client to perform an out-of-bounds read, usually resulting in a crash. For OpenSSL 1.1.0, the crash can be triggered when using CHACHA20/POLY1305; user...

OpenSSL -- multiple vulnerabilities

The OpenSSL project reports: Truncated packet could crash via OOB read CVE-2017-3731 Bad ECDHE parameters cause a client crash CVE-2017-3730 BNmodexp may produce incorrect results on x8664 CVE-2017-3732 Montgomery multiplication may produce incorrect results CVE-2016-7055...

Fedora 25 : gd (2017-bab5698540)

Version 2.2.4 - 2017-01-18 Security - gdImageCreate doesn't check for oversized images and as such is prone to DoS vulnerabilities. CVE-2016-9317 - double-free in gdImageWebPtr CVE-2016-6912 - potential unsigned underflow in gdinterpolation.c - DOS vulnerability in gdImageCreateFromGd2Ctx Fixed -...

Android ssp_batch_ioctl Out-Of-Bounds Write Exploit

Android suffers from an out-of-bounds write in sspbatchioctl. Android: OOB write in sspbatchioctl SensorHub exposes a character device under /dev/batchio which can be used in order to send instructions to batches of running sensors. The IOCTL handler from this device has the following high-level...

CVE-2015-8817

QEMU aka Quick Emulator built to use 'addressspacetranslate' to map an address to a MemoryRegionSection is vulnerable to an OOB r/w access issue. It could occur while doing pcidmaread/write calls. Affects QEMU versions = 1.6.0 and = 2.3.1. A privileged user inside guest could use this flaw to cra...

Design/Logic Flaw

QEMU aka Quick Emulator built to use 'addressspacetranslate' to map an address to a MemoryRegionSection is vulnerable to an OOB r/w access issue. It could occur while doing pcidmaread/write calls. Affects QEMU versions = 1.6.0 and = 2.3.1. A privileged user inside guest could use this flaw to cra...