DEBIAN-CVE-2023-46835

The current setup of the quarantine page tables assumes that the quarantine domain domio has been initialized with an address width of DEFAULTDOMAINADDRESSWIDTH 48 and hence 4 page table levels. However domio being a PV domain gets the AMD-Vi IOMMU page tables levels based on the maximum hot...

Code injection

The current setup of the quarantine page tables assumes that the quarantine domain domio has been initialized with an address width of DEFAULTDOMAINADDRESSWIDTH 48 and hence 4 page table levels. However domio being a PV domain gets the AMD-Vi IOMMU page tables levels based on the maximum hot...

UBUNTU-CVE-2023-46835

The current setup of the quarantine page tables assumes that the quarantine domain domio has been initialized with an address width of DEFAULTDOMAINADDRESSWIDTH 48 and hence 4 page table levels. However domio being a PV domain gets the AMD-Vi IOMMU page tables levels based on the maximum hot...

CVE-2023-46835

The current setup of the quarantine page tables assumes that the quarantine domain domio has been initialized with an address width of DEFAULTDOMAINADDRESSWIDTH 48 and hence 4 page table levels. However domio being a PV domain gets the AMD-Vi IOMMU page tables levels based on the maximum hot...

CVE-2023-46835 x86/AMD: mismatch in IOMMU quarantine page table levels

The current setup of the quarantine page tables assumes that the quarantine domain domio has been initialized with an address width of DEFAULTDOMAINADDRESSWIDTH 48 and hence 4 page table levels. However domio being a PV domain gets the AMD-Vi IOMMU page tables levels based on the maximum hot...

CVE-2023-46835

CVE-2023-46835 affects Xen on x86/AMD with a mismatch in IOMMU quarantine page table levels. The quarantine domain (dom_io) expects 4 page table levels (DEFAULT_DOMAIN_ADDRESS_WIDTH 48), but on PV domains the AMD-Vi IOMMU page tables can be configured with only 3 levels for RAM up to 512 GB. Cons...

CVE-2023-46835 x86/AMD: mismatch in IOMMU quarantine page table levels

The current setup of the quarantine page tables assumes that the quarantine domain domio has been initialized with an address width of DEFAULTDOMAINADDRESSWIDTH 48 and hence 4 page table levels. However domio being a PV domain gets the AMD-Vi IOMMU page tables levels based on the maximum hot...

CVE-2023-46835

The current setup of the quarantine page tables assumes that the quarantine domain domio has been initialized with an address width of DEFAULTDOMAINADDRESSWIDTH 48 and hence 4 page table levels. However domio being a PV domain gets the AMD-Vi IOMMU page tables levels based on the maximum hot...

SUSE SLED15: xen / xen-devel / xen-doc-html / xen-libs / xen-libs-32bit / etc (SUSE-SU-2023:4945-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4945-1 advisory. - CVE-2023-46836: Fixed BTC/SRSO fixes not fully effective bsc1216807. - CVE-2023-46835: Fixed...

Information Leak

Xen Citrix Hypervisor is vulnerable to Information Leak. The vulnerability is caused due to a quarantine page table level mismatch of the quarantine domain domio where last page table directory PDE effectively becoming a page table entry PTE causing a device in quarantine mode gaining write acces...

CVE-2023-49077

Mailcow: dockerized is an open source groupware/email suite based on docker. A Cross-Site Scripting XSS vulnerability has been identified within the Quarantine UI of the system. This vulnerability poses a significant threat to administrators who utilize the Quarantine feature. An attacker can sen...

Cross site scripting

Mailcow: dockerized is an open source groupware/email suite based on docker. A Cross-Site Scripting XSS vulnerability has been identified within the Quarantine UI of the system. This vulnerability poses a significant threat to administrators who utilize the Quarantine feature. An attacker can sen...

CVE-2023-49077

CVE-2023-49077 affects Mailcow: dockerized. A Cross-Site Scripting (XSS) vulnerability exists in the Quarantine UI, whereby an attacker could leverage a crafted email to execute malicious JavaScript in an administrator’s browser. The issue is documented across multiple sources and has been patche...

CVE-2023-49077 mailcow-dockerized XSS Vulnerability in Quarantine UI Allows Unauthorized Access and Data Manipulation

Mailcow: dockerized is an open source groupware/email suite based on docker. A Cross-Site Scripting XSS vulnerability has been identified within the Quarantine UI of the system. This vulnerability poses a significant threat to administrators who utilize the Quarantine feature. An attacker can sen...

mailcow dockerized cross-site scripting vulnerability

mailcow is a mail server suite. A cross-site scripting vulnerability exists in mailcow dockerized, which stems from a cross-site scripting XSS vulnerability in the system's Quarantine UI, which can be exploited by an attacker to send a crafted email containing malicious JavaScript code...

Fedora 38 : xen (2023-56901a79a1)

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-56901a79a1 advisory. x86/AMD: mismatch in IOMMU quarantine page table levels XSA-445, CVE-2023-46835 x86: BTC/SRSO fixes not fully effective XSA-446, CVE-2023-46836...

CVE-2023-20084

A vulnerability in the endpoint software of Cisco Secure Endpoint for Windows could allow an authenticated, local attacker to evade endpoint protection within a limited time window. This vulnerability is due to a timing issue that occurs between various software components. An attacker could...

Design/Logic Flaw

A vulnerability in the endpoint software of Cisco Secure Endpoint for Windows could allow an authenticated, local attacker to evade endpoint protection within a limited time window. This vulnerability is due to a timing issue that occurs between various software components. An attacker could...

Cisco Secure Endpoint Security Vulnerability

Cisco Secure Endpoint Cisco AMP for Endpoints is an endpoint application from Cisco that integrates static and dynamic malware analysis and threat intelligence. A security vulnerability exists in Cisco Secure Endpoint for Windows that stems from a timing issue between various software components,...

SUSE-SU-2023:4476-1 Security update for xen

This update for xen fixes the following issues: - CVE-2023-20588: AMD CPU transitional execution leak via division by zero XSA-439 bsc1215474. - CVE-2023-34322: top-level shadow reference dropped too early for 64-bit PV guests XSA-438 bsc1215145. - CVE-2023-34325: Multiple vulnerabilities in...