rhev-m: rhev-apt service unquoted search path

Unquoted Windows search path vulnerability in the Red Hat Enterprise Virtualization Application Provisioning Tool RHEV-APT in the rhev-guest-tools-iso package 3.2 allows local users to gain privileges via a Trojan horse application...

rhevm: insufficient target domain permission check when cloning a VM from a snapshot

Red Hat Enterprise Virtualization Manager RHEVM before 3.2 does not properly check permissions for the target storage domain, which allows attackers to cause a denial of service disk space consumption by cloning a VM from a snapshot...

rhevm: spice service unquoted search path

Unquoted Windows search path vulnerability in the SPICE service, as used in Red Hat Enterprise Virtualization RHEV 3.2, allows local users to gain privileges via a crafted application in an unspecified folder...

vdsm: unfiltered guestInfo dictionary DoS

VDSM in Red Hat Enterprise Virtualization 3 and 3.2 allows privileged guest users to cause the host to become "unavailable to the managment server" via guestInfo dictionaries with "unexpected fields."...

CVE-2012-2696

The backend in Red Hat Enterprise Virtualization Manager RHEV-M before 3.1 does not properly check privileges, which allows remote authenticated users to query arbitrary information via a 1 SOAP or 2 GWT request...

rhev: vds_installer insecure /tmp use

Multiple untrusted search path vulnerabilities in Red Hat Enterprise Virtualization Manager RHEV-M before 3.1, when adding a host, allow local users to gain privileges via a Trojan horse 1 deployUtil.py or 2 vdsbootstrap.py Python module in /tmp/...

rhev: vds_installer is prone to MITM when downloading 2nd stage installer

The vdsinstaller in Red Hat Enterprise Virtualization Manager RHEV-M before 3.1, when adding a host, uses the -k curl parameter when downloading deployUtil.py and vdsbootstrap.py, which prevents SSL certificates from being validated and allows remote attackers to execute arbitrary Python code via...

rhev: backend allows unprivileged queries

The backend in Red Hat Enterprise Virtualization Manager RHEV-M before 3.1 does not properly check privileges, which allows remote authenticated users to query arbitrary information via a 1 SOAP or 2 GWT request...

Low: Red Hat Bug Fix Advisory: sanlock bug fix and enhancement update

Updated sanlock packages that fix various bugs and add various enhancements are now available for Red Hat Enterprise Virtualization. The sanlock package provides a shared storage lock manager. Hosts with shared access to a block device or file can use sanlock to synchronize their activities. VDSM...

Moderate: Red Hat Security Advisory: libvirt security and bug fix update

Updated libvirt packages that fix one security issue and multiple bugs are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

spice activex/spicec named pipe races

Race condition in the SPICE aka spice-activex plug-in for Internet Explorer in Red Hat Enterprise Virtualization RHEV Manager before 2.2.4 allows local users to create a certain named pipe, and consequently gain privileges, via vectors involving knowledge of the name of this named pipe, in...

qemu: Insufficient guest provided pointers validation

QEMU-KVM, as used in the Hypervisor aka rhev-hypervisor in Red Hat Enterprise Virtualization RHEV 2.2 and KVM 83, does not properly validate guest QXL driver pointers, which allows guest OS users to cause a denial of service invalid pointer dereference and guest OS crash or possibly gain privileg...

libspice: Relying on guest provided data structures to indicate memory allocation

libspice, as used in QEMU-KVM in the Hypervisor aka rhev-hypervisor in Red Hat Enterprise Virtualization RHEV 2.2 and qspice 0.3.0, does not properly restrict the addresses upon which memory-management actions are performed, which allows guest OS users to cause a denial of service guest OS crash ...

libspice: Insufficient guest provided pointers validation

libspice, as used in QEMU-KVM in the Hypervisor aka rhev-hypervisor in Red Hat Enterprise Virtualization RHEV 2.2 and qspice 0.3.0, does not properly validate guest QXL driver pointers, which allows guest OS users to cause a denial of service invalid pointer dereference and guest OS crash or...

vdsm: SSL accept() blocks on a non-blocking Connection

Virtual Desktop Server Manager VDSM in Red Hat Enterprise Virtualization RHEV 2.2 does not properly accept TCP connections for SSL sessions, which allows remote attackers to cause a denial of service daemon outage via crafted SSL traffic...

qemu: Insufficient guest provided pointers validation

QEMU-KVM, as used in the Hypervisor aka rhev-hypervisor in Red Hat Enterprise Virtualization RHEV 2.2 and KVM 83, does not properly validate guest QXL driver pointers, which allows guest OS users to cause a denial of service invalid pointer dereference and guest OS crash or possibly gain privileg...

kvm: vmx null pointer dereference

The Hypervisor aka rhev-hypervisor in Red Hat Enterprise Virtualization RHEV 2.2, and KVM 83, when the Intel VT-x extension is enabled, allows guest OS users to cause a denial of service NULL pointer dereference and host OS crash via vectors related to instruction emulation...

libspice: Relying on guest provided data structures to indicate memory allocation

libspice, as used in QEMU-KVM in the Hypervisor aka rhev-hypervisor in Red Hat Enterprise Virtualization RHEV 2.2 and qspice 0.3.0, does not properly restrict the addresses upon which memory-management actions are performed, which allows guest OS users to cause a denial of service guest OS crash ...

libspice: Insufficient guest provided pointers validation

libspice, as used in QEMU-KVM in the Hypervisor aka rhev-hypervisor in Red Hat Enterprise Virtualization RHEV 2.2 and qspice 0.3.0, does not properly validate guest QXL driver pointers, which allows guest OS users to cause a denial of service invalid pointer dereference and guest OS crash or...

PT-2010-2200 · Red Hat · Red Hat Enterprise Virtualization +2

Name of the Vulnerable Software and Affected Versions: Red Hat Enterprise Virtualization RHEV version 2.2 KVM version 83 Description: The issue allows guest OS users to cause a denial of service, resulting in a host OS crash due to a NULL pointer dereference. This occurs when the Intel VT-x...