openSUSE Security Update : libXfixes (openSUSE-2016-1429)

This update for libXfixes fixes a security issue : - insufficient validation of data from the X server could cause an integer overflow on 32 bit architectures boo1002995, CVE-2016-7944. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin wer...

Debian DSA-3729-1 : xen - security update

Multiple vulnerabilities have been discovered in the Xen hypervisor. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2016-7777 XSA-190 Jan Beulich from SUSE discovered that Xen does not properly honor CR0.TS and CR0.EM for x86 HVM guests, potentially...

Microsoft Edge - CBase­Scriptable::Private­Query­Interface Memory Corruption (MS16-068) Vulnerabilit

Exploit for windows platform in category dos / poc Source: http://blog.skylined.nl/20161205001.html Synopsis A specially crafted web-page can trigger a memory corruption vulnerability in Microsoft Edge. I did not investigate this vulnerability thoroughly, so I cannot speculate on the potential...

SUSE SLES11 Security Update : kernel (SUSE-SU-2016:2976-1)

The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes. For the PowerPC64 a new 'bigmem' flavor has been added to support big Power machines. FATE319026 The following security bugs were fixed : - CVE-2016-7042: The prockeysshow function in security/keys/proc....

FreeBSD : xen-kernel -- guest 32-bit ELF symbol table load leaking host data (5555120d-ba4d-11e6-ae1b-002590263bf5)

The Xen Project reports : Along with their main kernel binary, unprivileged guests may arrange to have their Xen environment load kernel symbol tables for their use. The ELF image metadata created for this purpose has a few unused bytes when the symbol table binary is in 32-bit ELF format. These...

FreeBSD : xen-kernel -- x86: Disallow L3 recursive pagetable for 32-bit PV guests (45ca25b5-ba4d-11e6-ae1b-002590263bf5)

The Xen Project reports : On real hardware, a 32-bit PAE guest must leave the USER and RW bit clear in L3 pagetable entries, but the pagetable walk behaves as if they were set. The L3 entries are cached in processor registers, and don't actually form part of the pagewalk. When running a 32-bit PV...

Fedora 24 : xen (2016-95c104a4c6)

xen : various security flaws 1397383 x86 null segments not always treated as unusable XSA-191, CVE-2016-9386 x86 task switch to VM86 mode mis-handled XSA-192, CVE-2016-9382 x86 segment base write emulation lacking canonical address checks XSA-193, CVE-2016-9385 x86 64-bit bit test instruction...

Ubuntu 16.10 : linux vulnerabilities (USN-3147-1)

Andreas Gruenbacher and Jan Kara discovered that the filesystem implementation in the Linux kernel did not clear the setgid bit during a setxattr call. A local attacker could use this to possibly elevate group privileges. CVE-2016-7097 Marco Grassi discovered that the driver for Areca RAID...

USN-3147-1: Linux kernel vulnerabilities

Andreas Gruenbacher and Jan Kara discovered that the filesystem implementation in the Linux kernel did not clear the setgid bit during a setxattr call. A local attacker could use this to possibly elevate group privileges. CVE-2016-7097 Marco Grassi discovered that the driver for Areca RAID...

PT-2017-2404

Name of the Vulnerable Software and Affected Versions Xen affected versions not specified Description The issue allows local x86 guest OS users to modify arbitrary memory, obtain sensitive information, cause a denial of service host crash, or execute arbitrary code on the host. This is due to...

Linux/x86-64 - /bin/sh -c reboot Shellcode (89 bytes)

Name: "Linux reboot bin/sh -c reboot shellcode" 89 bytes Platform: Linux 32 and 64 bit Author: Ashiyane Digital Security Team MALWaRE43 Contact: usertester123546 at gmail.com Tested on: Linux javadkhof 4.4.0-47-generic 68-Ubuntu SMP Wed Oct 26 19:39:52 UTC 2016 x8664 x8664 x8664 GNU/Linux Linux...

Linux Kernel 4.6.3 Netfilter Privilege Escalation

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require "msf/core" class MetasploitModule 'Linux Kernel 4.6.3 Netfilter Privilege Escalation', 'Description' = %q This module attempts to exploit a netfilter bug on Linux...

LibTIFF tools/tiffcrop.c integer overflow vulnerability

Silicon Graphics LibTIFF is a library for reading and writing TIFF Tagged Image File Format files from Silicon Graphics, USA. The library contains a number of command-line tools for processing TIFF files. A security vulnerability exists in libtiff version 4.0.6 in tools/tiffcrop.c, which can be...

CVE-2016-9383

Xen, when running on a 64-bit hypervisor, allows local x86 guest OS users to modify arbitrary memory and consequently obtain sensitive information, cause a denial of service host crash, or execute arbitrary code on the host by leveraging broken emulation of bit test instructions...

guest 32-bit ELF symbol table load leaking host data

ISSUE DESCRIPTION Along with their main kernel binary, unprivileged guests may arrange to have their Xen environment load kernel symbol tables for their use. The ELF image metadata created for this purpose has a few unused bytes when the symbol table binary is in 32-bit ELF format. These unused...

x86 task switch to VM86 mode mis-handled

ISSUE DESCRIPTION LDTR, just like TR, is purely a protected mode facility. Hence even when switching to a VM86 mode task, LDTR loading needs to follow protected mode semantics. This was violated by the code. IMPACT On SVM AMD hardware: a malicious unprivileged guest process can escalate its...

xen-kernel -- x86 null segments not always treated as unusable

The Xen Project reports: The Xen x86 emulator erroneously failed to consider the unusability of segments when performing memory accesses. The intended behaviour is as follows: The user data segment %ds, %es, %fs and %gs selectors may be NULL in 32-bit to prevent access. In 64-bit, NULL has a...

xen-kernel -- x86 64-bit bit test instruction emulation broken

The Xen Project reports: The x86 instructions BT, BTC, BTR, and BTS, when used with a destination memory operand and a source register rather than an immediate operand, access a memory location offset from that specified by the memory operand as specified by the high bits of the register source. ...

Microsoft Edge - 'CText­Extractor::Get­Block­Text' Out-of-Bounds Read (MS16-104)

::first-letter border: 0; white-space: pre-line; Aalert;&x­D;&x­D;B Description Though I did not investigate thoroughly, I did find out the following: The root cause appears to be an integer underflow in a 32-bit variable used in CText­Extractor..Get­Block­Text as an index to read a WCHAR in a...

Mozilla Firefox Denial of Service Vulnerability (CNVD-2016-11414)

Mozilla Firefox is an open source web browser developed by the Mozilla Foundation in the United States. A denial-of-service vulnerability exists in versions of Mozilla Firefox prior to 50 on 64-bit Windows-based platforms, which stems from a failure of the 64-bit NPAPI plug-in to enable sandboxin...