USN-7428-2 linux-fips, linux-aws-fips, linux-azure-fips, linux-gcp-fips vulnerabilities

Demi Marie Obenour and Simon Gaiser discovered that several Xen para- virtualization device frontends did not properly restrict the access rights of device backends. An attacker could possibly use a malicious Xen backend to gain access to memory pages of a guest VM or cause a denial of service in...

USN-7428-2: Linux kernel (FIPS) vulnerabilities

Demi Marie Obenour and Simon Gaiser discovered that several Xen para- virtualization device frontends did not properly restrict the access rights of device backends. An attacker could possibly use a malicious Xen backend to gain access to memory pages of a guest VM or cause a denial of service in...

USN-7428-1: Linux kernel vulnerabilities

Demi Marie Obenour and Simon Gaiser discovered that several Xen para- virtualization device frontends did not properly restrict the access rights of device backends. An attacker could possibly use a malicious Xen backend to gain access to memory pages of a guest VM or cause a denial of service in...

USN-7428-1 linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-gcp, linux-gcp-4.15, linux-hwe, linux-kvm, linux-oracle vulnerabilities

Demi Marie Obenour and Simon Gaiser discovered that several Xen para- virtualization device frontends did not properly restrict the access rights of device backends. An attacker could possibly use a malicious Xen backend to gain access to memory pages of a guest VM or cause a denial of service in...

CLSA-2025-1744213128 Fix of 55 CVEs

CVE-url: https://ubuntu.com/security/CVE-2025-21858 - geneve: Fix use-after-free in genevefinddev. CVE-url: https://ubuntu.com/security/CVE-2024-36921 - wifi: iwlwifi: mvm: guard against invalid STA ID on removal CVE-url: https://ubuntu.com/security/CVE-2023-52621 - bpf: Check rcureadlocktracehel...

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security bugfixes. The following security bugs were fixed: CVE-2022-49053: scsi: target: tcmu: Fix possible page UAF bsc1237918. CVE-2022-49465: blk-throttle: Set BIOTHROTTLED when bio has been throttled bsc1238919...

KVM: x86: Reject Hyper-V's SEND_IPI hypercalls if local APIC isn't in-kernel

...

SUSE CVE-2025-22013

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Unconditionally save+flush host FPSIMD/SVE/SME state There are several problems with the way hyp code lazily saves the host's FPSIMD/SVE state, including: Host SVE being discarded unexpectedly due to inconsistent...

The vulnerability of the trusted execution environment of Virtualization-Based Security (VBS) Enclaves in Windows operating systems allows attackers to circumvent existing security restrictions.

The vulnerability of the trusted execution environment for Virtualization-Based Security VBS in Windows operating systems is related to insufficient verification of data authenticity. Exploiting this vulnerability can allow attackers to circumvent existing security restrictions...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : Linux kernel vulnerabilities (USN-7428-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7428-1 advisory. Demi Marie Obenour and Simon Gaiser discovered that several Xen para- virtualization device frontends did not properly restrict t...

Vulnerabilities fixed in Microsoft Azure

Microsoft has fixed vulnerabilities in several Azure products. A malicious person could exploit the vulnerabilities to grant themselves elevated privileges and gain access to sensitive data. The vulnerability with reference CVE-2025-27489 allows the malicious party, by loading a non-Microsoft DLL...

CVE-2025-27735

Insufficient verification of data authenticity in Windows Virtualization-Based Security VBS Enclave allows an authorized attacker to bypass a security feature locally...

CVE-2025-27735

Insufficient verification of data authenticity in Windows Virtualization-Based Security VBS Enclave allows an authorized attacker to bypass a security feature locally...

CVE-2025-27735 Windows Virtualization-Based Security (VBS) Security Feature Bypass Vulnerability

...

CVE-2025-27735

CVE-2025-27735 affects Windows Virtualization-Based Security (VBS) Enclave. The root cause is insufficient verification of data authenticity, enabling an authorized local attacker to bypass a security feature. The connected NCSC listing labels the impact as bypassing a security measure with CVSS ...

CVE-2025-27735 Windows Virtualization-Based Security (VBS) Security Feature Bypass Vulnerability

...

Security Bulletin: A Netty vulnerability affects Rational Test Virtualization Server / DevOps Virtualization and Rational Performance Test Server / DevOps Test Performance Test Server ( CVE-2024-47535 )

Summary Rational Test Virtualization Server / DevOps Virtualization and Rational Performance Test Server / DevOps Test Performance Test Server are vulnerable to a denial of service due to a vulnerability in Netty CVE-2024-47535 Vulnerability Details CVEID:CVE-2024-47535 DESCRIPTION: Netty is an...

Windows Virtualization-Based Security (VBS) Security Feature Bypass Vulnerability

Insufficient verification of data authenticity in Windows Virtualization-Based Security VBS Enclave allows an authorized attacker to bypass a security feature locally...

PT-2025-15558 · Microsoft · Windows Virtualization-Based Security (Vbs) Enclave +1

Name of the Vulnerable Software and Affected Versions: Windows Virtualization-Based Security VBS Enclave affected versions not specified Description: The issue is related to insufficient verification of data authenticity, allowing an authorized attacker to bypass a security feature locally. There...

Security Bulletin: Multiple vulnerabilities affect IBM Data Virtualization on Cloud Pak for Data (January 2025)

Summary Multiple vulnerabilities have been addressed in IBM Data Virtualization on Cloud Pak for Data. Note that IBM Data Virtualization was named Watson Query in IBM Cloud Pak for Data version 4.6, 4.7, and 4.8. Vulnerability Details CVEID:CVE-2022-46363 DESCRIPTION: Apache CXF could allow a...