SUSE-SU-2019:2246-1 Security update for qemu

This update for qemu fixes the following issues: Security issues fixed: - CVE-2019-14378: Security fix for heap overflow in ipreass on big packet input bsc1143794. - CVE-2019-12155: Security fix for null pointer dereference while releasing spice resources bsc1135902. - CVE-2019-13164: Security fi...

Unable to start VMs in new Hosts - An emulator required to run this VM failed to start

Unable to start VM with vGPOU assigned on HOST with NVIDIA Card. Getting error: vm-start failed: "An emulator required to run this VM failed to start" Internal LOG: Dec 6 09:10:13 localhost vgpu-211384: demuinitialize: PLUGIN CONFIG: /usr/share/nvidia/vgx/gridp40-1b.conf,gpu-pci-id=0000:d8:00.0De...

Code injection

Lack of root file system integrity checking in Fortinet FortiManager VM application images of 6.2.0, 6.0.6 and below may allow an attacker to implant third-party programs by recreating the image through specific methods...

CVE-2019-6695

Lack of root file system integrity checking in Fortinet FortiManager VM application images of 6.2.0, 6.0.6 and below may allow an attacker to implant third-party programs by recreating the image through specific methods...

Microsoft Windows and Windows Server Denial of Service Vulnerabilities

Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation.Microsoft Windows is an operating system for personal devices.Microsoft Windows Server is a server operating system. A denial-of-service vulnerability exists in Microsoft Windows that originates from the...

CVE-2019-6695: Insufficient Verification of Data Authenticity

Lack of root file system integrity checking in Fortinet FortiManager VM application images of 6.2.0, 6.0.6 and below may allow an attacker to implant third-party programs by recreating the image through specific methods...

Microsoft Windows and Windows Server Denial of Service Vulnerability (CNVD-2019-34586)

Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation.Microsoft Windows is an operating system for personal devices.Microsoft Windows Server is a server operating system. A denial-of-service vulnerability exists in Microsoft Windows, which arises from the failu...

Information Disclosure

cfme-gemset is vulnerable to information disclosure. Improper authorization in the migration log controller allows any user to access VM migration logs...

CB TAU Threat Intelligence Notification – Karagany Malware

Secureworks recently reported in regards to an update of Karagany malware last month. The malware is used by the IRON LIBERTY threat group also known as DragonFly2.0 and Energetic Bear, targeting energy companies and organizations. Carbon Black Threat Analysis Unit TAU provides the product rules ...

Linux - Use-After-Free Reads in show_numa_stats()

/ On NUMA systems, the Linux fair scheduler tracks information related to NUMA faults in taskstruct::numafaults and taskstruct::numagroup. Both of these have broken object lifetimes. Since commit 82727018b0d3 "sched/numa: Call tasknumafree from doexecve", first in v3.13, -numafaults is freed not...

Virtuozzo 6 : parallels-kernel-modules / etc (VZA-2019-063)

According to the version of the parallels-kernel-modules / etc packages installed, the Virtuozzo installation on the remote host is affected by the following vulnerability : - Fixed possible corruption of VM configuration after restoration from backup by means of third-party solutions. The built-...

RHEL 7 : qemu-kvm-rhev (RHSA-2019:1968)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:1968 advisory. KVM Kernel-based Virtual Machine is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-rhev packages provi...

Product update: Virtuozzo 6.0 Update 12 Hotfix 44 (6.0.12-3746)

The Hotfix 44 for Virtuozzo 6.0.12 fixes a security issue. Vulnerability id: PSBM-96909 Fixed possible corruption of VM configuration after restoration from backup by means of third-party solutions. The built-in backup restoration tool 'prlctl restore' is not affected. User data inside restored V...

Commando VM v2.0 - The First Full Windows-based Penetration Testing Virtual Machine Distribution

Welcome to CommandoVM - a fully customizable, Windows-based security distribution for penetration testing and red teaming. For detailed install instructions or more information please see our blog Installation Install Script Requirements Windows 7 Service Pack 1 or Windows 10 60 GB Hard Drive 2 G...

kernel: use-after-free Read in vhost_transport_send_pkt

A flaw was found where an attacker may be able to have an uncontrolled read to kernel-memory from within a vm guest. A race condition between connect and close function may allow an attacker using the AFVSOCK protocol to gather a 4 byte information leak or possibly impersonate AFVSOCK messages...

PT-2019-3083 · Cisco · Cisco Enterprise Nfv Infrastructure

Name of the Vulnerable Software and Affected Versions: Cisco Enterprise NFV Infrastructure Software NFVIS affected versions not specified Description: A vulnerability in the web-based management interface of Cisco Enterprise NFV Infrastructure Software NFVIS could allow an unauthenticated, remote...

Commando VM 2.0: Customization, Containers, and Kali, Oh My!

The Complete Mandiant Offensive Virtual Machine “Commando VM” swept the penetration testing community by storm when it debuted in early 2019 at Black Hat Asia Arsenal. Our 1.0 release made headway featuring more than 140 tools. Well now we are back again for another spectacular release, this time...

Security Bulletin: Multiple vulnerabilities in IBM® Java SDK affects IBM WebSphere Application Server for IBM Cloud Private VM Quickstarter April 2019 CPU

Summary There are multiple vulnerabiltities in the IBM® SDK Java™ Technology Edition that is shipped with IBM WebSphere Application Server. These issues were disclosed in the IBM Java SDK updates in April 2019. These may affect some configurations of IBM WebSphere Application Server for IBM Cloud...

The vulnerability of the Core component of the Oracle VM VirtualBox software allows a hacker to gain full control over the application.

The vulnerability of the Core component of the Oracle VM VirtualBox software is related to lack of access control. Exploiting this vulnerability can allow an attacker to gain full control over the application...

The vulnerability of the Core component of the Oracle VM VirtualBox software allows a hacker to cause partial service failure.

The vulnerability of the Core component of the Oracle VM VirtualBox software is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to cause a partial service outage...