EulerOS Virtualization 2.10.0 : expat (EulerOS-SA-2023-1919)

According to the versions of the expat package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XMLExternalEntityParserCrea...

EulerOS Virtualization 2.10.0 : pixman (EulerOS-SA-2023-1926)

According to the versions of the pixman package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - In libpixman in Pixman before 0.42.2, there is an out-of-bounds write aka heap-based buffer overflow in rasterizeedges8 due to an...

EulerOS Virtualization 2.10.1 : pixman (EulerOS-SA-2023-1895)

According to the versions of the pixman package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - In libpixman in Pixman before 0.42.2, there is an out-of-bounds write aka heap-based buffer overflow in rasterizeedges8 due to an...

EulerOS Virtualization 2.10.1 : httpd (EulerOS-SA-2023-1901)

According to the versions of the httpd packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A carefully crafted If: request header can cause a memory read, or write of a single zero byte, in a pool heap memory location...

EulerOS Virtualization 2.10.1 : emacs (EulerOS-SA-2023-1887)

According to the versions of the emacs package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because...

EulerOS Virtualization 2.10.1 : libarchive (EulerOS-SA-2023-1890)

According to the versions of the libarchive package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - In libarchive before 3.6.2, the software does not check for an error after calling calloc function that can return with a NULL...

EulerOS Virtualization 2.10.0 : dbus (EulerOS-SA-2023-1916)

According to the versions of the dbus packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attack...

Advisory ROSA-SA-2023-2164

Software: unbound 1.16.2 OS: ROSA Virtualization 2.1 packageevrstring: unbound-1.16.2-2.rv3.src.rpm CVE-ID: CVE-2019-25038 BDU-ID: None CVE-Crit: CRITICAL CVE-DESC: Unbound before version 1.9.5 allows integer overflow on size calculation in dnscrypt/dnscrypt.c. CVE-STATUS: Fixed CVE-REV: Run the...

Advisory ROSA-SA-2023-2163

Software: unbound 1.16.2 OS: ROSA Virtualization 2.1 packageevrstring: unbound-1.16.2-2.rv3.src.rpm CVE-ID: CVE-2019-25032 BDU-ID: None CVE-Crit: CRITICAL CVE-DESC: Unbound before 1.9.5 allows integer overflow in the regional allocator via regionalalloc. CVE-STATUS: Fixed CVE-REV: Run the yum...

EulerOS Virtualization 2.10.0 : curl (EulerOS-SA-2023-1931)

According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - When doing HTTPS transfers, libcurl might erroneously use the read callback CURLOPTREADFUNCTION to ask for data to send, even when...

EulerOS Virtualization 2.10.0 : libX11 (EulerOS-SA-2023-1923)

According to the versions of the libX11 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further...

EulerOS Virtualization 2.10.0 : edk2 (EulerOS-SA-2023-1945)

According to the versions of the edk2 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - Existing CommBuffer checks in SmmEntryPoint will not catch underflow when computing BufferSize. CVE-2021-38578 Note that Tenable...

EulerOS Virtualization 2.10.0 : qemu (EulerOS-SA-2023-1944)

According to the versions of the qemu package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - An off-by-one read/write issue was found in the SDHCI device of QEMU. It occurs when reading/writing the Buffer Data Port Register i...

EulerOS Virtualization 2.10.0 : python-setuptools (EulerOS-SA-2023-1940)

According to the versions of the python-setuptools packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - Python Packaging Authority PyPA setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML...

App-V Privilege Escalation Command Execution

The vulnerability of the App-V software service for virtualizing and delivering Citrix Virtual Apps and Desktops formerly XenApp and XenDesktop on Windows operating systems is related to the lack of measures taken to neutralize special elements used in the operating system’s command set. Exploiti...

CVE-2022-23818

Insufficient input validation on the model specific register: VMHSAVEPA may potentially lead to loss of SEV-SNP guest memory integrity...

CVE-2021-26406

Insufficient validation in parsing Owner's Certificate Authority OCA certificates in SEV AMD Secure Encrypted Virtualization and SEV-ES user application can lead to a host crash potentially resulting in denial of service...

Moderate: Red Hat Security Advisory: qemu-kvm security, bug fix, and enhancement update

An update for qemu-kvm is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

kernel: KVM: x86/xen: Initialize Xen timer only once

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/xen: Initialize Xen timer only once Add a check for existing xen timers before initializing a new one. Currently kvmxeninittimer is called on every KVMXENVCPUATTRTYPETIMER, which is causing the following ODEBUG crash whe...

kernel: KVM: nVMX: missing IBPB when exiting from nested guest can lead to Spectre v2 attacks

A flaw was found in the KVM's Intel nested virtualization feature nVMX. Since L1 and L2 shared branch prediction modes guest-user and guest-kernel, KVM did not protect indirect branches in L1 from steering by a malicious agent in L2. This could allow a malicious nested guest to carry out Spectre ...