EulerOS Virtualization 2.9.1 : curl (EulerOS-SA-2023-1633)

According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - When doing HTTPS transfers, libcurl might erroneously use the read callback CURLOPTREADFUNCTION to ask for data to send, even when...

EulerOS Virtualization 2.9.0 : qemu-kvm (EulerOS-SA-2023-1685)

According to the versions of the qemu-kvm package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - An off-by-one read/write issue was found in the SDHCI device of QEMU. It occurs when reading/writing the Buffer Data Port Regist...

EulerOS Virtualization 2.9.0 : libXpm (EulerOS-SA-2023-1676)

According to the versions of the libXpm package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A flaw was found in libXpm. When processing a file with width of 0 and a very large height, some parser functions will be called...

EulerOS Virtualization 2.9.1 : libXpm (EulerOS-SA-2023-1642)

According to the versions of the libXpm package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A flaw was found in libXpm. When processing a file with width of 0 and a very large height, some parser functions will be called...

EulerOS Virtualization 2.9.0 : python-pillow (EulerOS-SA-2023-1681)

According to the versions of the python-pillow packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - Pillow before 9.2.0 performs Improper Handling of Highly Compressed GIF Data Data Amplification. CVE-2022-45198 - Pillow...

EulerOS Virtualization 2.9.0 : edk2 (EulerOS-SA-2023-1686)

According to the versions of the edk2 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - Existing CommBuffer checks in SmmEntryPoint will not catch underflow when computing BufferSize. CVE-2021-38578 Note that Tenable...

CVE-2023-20869

VMware Workstation 17.x and VMware Fusion 13.x contain a stack-based buffer-overflow vulnerability that exists in the functionality for sharing host Bluetooth devices with the virtual machine...

Advisory ROSA-SA-2023-2160

Software: httpd 2.4.37 OS: ROSA Virtualization 2.1 packageevrstring: 2.4.37 CVE-ID: CVE-2021-36160 BDU-ID: 2021-06099 CVE-Crit: HIGH CVE-DESC: A vulnerability in the modproxyuwsgi function of the Apache HTTP Server web server is related to reading data outside of the specified buffer. Exploitatio...

Advisory ROSA-SA-2023-2159

Software: httpd 2.4.37 OS: ROSA Virtualization 2.1 packageevrstring: 2.4.37 CVE-ID: CVE-2006-20001 BDU-ID: 2023-01105 CVE-Crit: HIGH CVE-DESC: A vulnerability in the moddav module of the Apache HTTP Server web server is related to an operation exceeding buffer boundaries. Exploitation of the...

Xen 代码问题漏洞

Xen is an open source virtual machine monitor product from the University of Cambridge, UK. The product enables different and incompatible operating systems to run on the same computer and supports runtime migration to ensure uptime and avoid downtime. Xen has a security vulnerability that stems...

New All-in-One "EvilExtractor" Stealer for Windows Systems Surfaces on the Dark Web

A new "all-in-one" stealer malware named EvilExtractor also spelled Evil Extractor is being marketed for sale for other threat actors to steal data and files from Windows systems. "It includes several modules that all work via an FTP service," Fortinet FortiGuard Labs researcher Cara Lin said. "I...

Information Disclosure

virtualbox is vulnerable to Information Disclosure. The vulnerability allows a high privileged attacker with logon to the infrastructure to compromise the application, which leads to unauthorized read access, resulting in disclosure of sensitive information...

PT-2023-6809 · Nvidia · Nvidia Vgpu

Name of the Vulnerable Software and Affected Versions: NVIDIA vGPU software for Windows and Linux affected versions not specified Description: The issue is related to a vulnerability in the Virtual GPU Manager vGPU plugin of the NVIDIA vGPU software, where a malicious user in the guest VM can cau...

CVE-2023-30456

A flaw was found in the KVM's Intel nested virtualization feature nVMX. The effective values of the guest CR0 and CR4 registers could differ from those included in the VMCS12. In rare circumstances i.e., kvmintel module loaded with parameters nested=1 and ept=0 this could allow a malicious guest ...

The vulnerability of the RDMA emulator hardware component in QEMU allows a hacker to trigger a service failure.

The vulnerability of the RDMA hardware emulation component of QEMU is related to the allocation and initialization of a large number of page tables, which will be used as descriptors for CQ and asynchronous events. Exploiting this vulnerability can allow an attacker to cause a service failure...

Command Execution Vulnerability in Tianyi Application Virtualization System of Xi'an Ruiyou Information Technology Information Co.

Skywing Application Virtualization System is a virtualization platform based on application server architecture. Xi'an Ruiyou Information Technology Information Co., Ltd Skywing Application Virtualization System has a command execution vulnerability that can be exploited by attackers to execute...

Oracle Patch Tuesday April 2023 Security Update Review

Oracle has released the second quarterly edition of Critical Patch Update, which contains a group of patches for 433 security vulnerabilities. Some of the vulnerabilities addressed this month impact various products. These patches address vulnerabilities in Oracle code and third-party components...

Oracle VM VirtualBox <6.1.44, < 7.0.8 (April 2023 CPU)

The version of VirtualBox installed on the remote host is prior to 6.144 or 7.0.8. It is, therefore, affected by multiple vulnerabilities as referenced in the April 2023 CPU advisory: - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. Supported versions...

CVE-2023-22000

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. Supported versions that are affected are Prior to 6.1.44 and Prior to 7.0.8. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox...

CVE-2023-21999

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. Supported versions that are affected are Prior to 6.1.44 and Prior to 7.0.8. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox...