PT-2017-10898

Name of the Vulnerable Software and Affected Versions tcmu-runner versions 1.0.5 through 1.2.0 Description The issue is related to a dbus triggered NULL pointer dereference in the on unregister handler function of the tcmu-runner daemon, resulting in denial of service. Recommendations For version...

tcmu-runner denial of service vulnerability

tcmu-runner is a daemon for handling user space for LIO TCM user backend storage. A security vulnerability exists in tcmu-runner versions 1.0.5 through 1.2.0. An attacker can exploit the vulnerability to cause a denial of service...

tcmu-runner Information Disclosure Vulnerability

tcmu-runner is a daemon for handling the userspace side of the LIO TCM-User backstore. An information disclosure vulnerability exists in handlerqcow.so in tcmu-runner versions 0.91-1.2.0. An attacker can exploit this vulnerability to inspect any file with root privileges...

CVE-2017-1000201: Improper Input Validation

The tcmu-runner daemon in tcmu-runner version 1.0.5 to 1.2.0 is vulnerable to a local denial of service attack...

CVE-2017-1000199: Exposure of Sensitive Information to an Unauthorized Actor

tcmu-runner version 0.91 up to 1.20 is vulnerable to information disclosure in handlerqcow.so resulting in non-privileged users being able to check for existence of any file with root privileges...

CVE-2017-1000198: Improper Restriction of Operations within the Bounds of a Memory Buffer

tcmu-runner daemon version 0.9.0 to 1.2.0 is vulnerable to invalid memory references in the handlerglfs.so handler resulting in denial of service...

tcmu-runner invalid memory reference vulnerability

tcmu-runner is a daemon for handling the userspace side of the LIO TCM-User backstore. An invalid memory reference vulnerability exists in the handlerglfs.so handler in tcmu-runner versions 0.9.0-1.2.0. An attacker can exploit this vulnerability to cause a denial of service...

SUSE SLES12 Security Update : tcmu-runner (SUSE-SU-2017:2601-1)

This update for tcmu-runner fixes the following issues: Security issues fixed : - CVE-2017-1000198: The glfs handler allowed local DoS via crafted CheckConfig strings bsc1049485 - CVE-2017-1000199: The qcow handler leaked information via the CheckConfig D-Bus method bsc1049491 Note that Tenable...

SUSE-SU-2017:2601-1 Security update for tcmu-runner

This update for tcmu-runner fixes the following issues: Security issues fixed: - CVE-2017-1000198: The glfs handler allowed local DoS via crafted CheckConfig strings bsc1049485 - CVE-2017-1000199: The qcow handler leaked information via the CheckConfig D-Bus method bsc1049491...

PT-2017-10895

Name of the Vulnerable Software and Affected Versions tcmu-runner versions 0.9.0 through 1.2.0 Description The issue is related to invalid memory references in the handler glfs.so handler, which can result in denial of service. Recommendations For versions 0.9.0 through 1.2.0, update to a version...

PT-2017-10896

Name of the Vulnerable Software and Affected Versions tcmu-runner versions 0.91 through 1.20 Description The issue allows non-privileged users to check for the existence of any file with root privileges due to information disclosure in handler qcow.so. Recommendations For versions 0.91 through...

CVE-2017-1000201

A NULL pointer dereference flaw was found in the UnregisterHandler method implemented in the tcmu-runner daemon. A local, non-root user with access to the D-Bus system bus could call UnregisterHandler method with non-existing tcmu handler as paramater to trigger DoS...

openSUSE Security Update : tcmu-runner (openSUSE-2017-919)

This update for tcmu-runner fixes the following issues : - qcow handler opens up an information leak via the CheckConfig D-Bus method bsc1049491 - glfs handler allows local DoS via crafted CheckConfig strings bsc1049485 - UnregisterHandler dbus method in tcmu-runner daemon for non-existing handle...

Security update for tcmu-runner (important)

This update for tcmu-runner fixes the following issues: - qcow handler opens up an information leak via the CheckConfig D-Bus method bsc1049491 - glfs handler allows local DoS via crafted CheckConfig strings bsc1049485 - UnregisterHandler dbus method in tcmu-runner daemon for non-existing handler...

openSUSE: Security Advisory for tcmu-runner (openSUSE-SU-2017:2155-1)

The remote host is missing an update for the Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

SUSE SLES12 Security Update : tcmu-runner (SUSE-SU-2017:2109-1)

This update for tcmu-runner fixes the following issues : - qcow handler opens up an information leak via the CheckConfig D-Bus method bsc1049491 - glfs handler allows local DoS via crafted CheckConfig strings bsc1049485 - UnregisterHandler dbus method in tcmu-runner daemon for non-existing handle...

SUSE-SU-2017:2109-1 Security update for tcmu-runner

This update for tcmu-runner fixes the following issues: - qcow handler opens up an information leak via the CheckConfig D-Bus method bsc1049491 - glfs handler allows local DoS via crafted CheckConfig strings bsc1049485 - UnregisterHandler dbus method in tcmu-runner daemon for non-existing handler...

PT-2017-19388

Name of the Vulnerable Software and Affected Versions tcmu-runner affected versions not specified Description The issue concerns several problems in tcmu-runner, including an information leak via the CheckConfig D-Bus method in the qcow handler, a local denial of service DoS vulnerability in the...

SUSE-SU-2017:0475-1 Security update for susestudio

This update provides SUSE Studio Runner 1.3.14, which brings fixes for the following issues: - bsc968797: 11 SP3 appliance gets invalid distribution upgrade from SLMS. - bsc947225: Second build of appliance will not register to SLMS, wrong product name. - bsc983404: UEFI boot missing for SLE11 SP...

LINE WIND runner - Customized SSL, Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application LINE WIND runner published at the 'play' market has multiple vulnerabilities...