qemu -- code execution on host machine

Petr Matousek of Red Hat Inc. reports: Due converting PIO to the new memory read/write api we no longer provide separate I/O region lenghts for read and write operations. As a result, reading from PIT Mode/Command register will end with accessing pit-channels with invalid index and potentially...

Debian DSA-3285-1 : qemu-kvm - security update

Several vulnerabilities were discovered in qemu-kvm, a full virtualization solution on x86 hardware. - CVE-2015-3209 Matt Tait of Google's Project Zero security team discovered a flaw in the way QEMU's AMD PCnet Ethernet emulation handles multi-TMD packets with a length above 4096 bytes. A...

Debian Security Advisory DSA 3284-1 (qemu - security update)

Several vulnerabilities were discovered in qemu, a fast processor emulator. CVE-2015-3209 Matt Tait of Google OpenVAS Vulnerability Test $Id: deb3284.nasl 6609 2017-07-07 12:05:59Z cfischer $ Auto-generated from advisory DSA 3284-1 using nvtgen 1.0 Script version: 1.0 Author: Greenbone Networks...

[SECURITY] Fedora 22 Update: qemu-2.3.0-5.fc22

QEMU is a generic and open source processor emulator which achieves a good emulation speed by using dynamic translation. QEMU has two operating modes: Full system emulation. In this mode, QEMU emulates a full system for example a PC, including a processor and various peripherials. It can be used ...

Important: Red Hat Security Advisory: qemu-kvm-rhev security update

Updated qemu-kvm-rhev packages that fix one security issue are now available for Red Hat Enterprise Linux OpenStack Platform 5.0 for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System CVSS base scor...

qemu: pcnet: multi-tmd buffer overflow in the tx path

A flaw was found in the way QEMU's AMD PCnet Ethernet emulation handled multi-TMD packets with a length above 4096 bytes. A privileged guest user in a guest with an AMD PCNet ethernet card enabled could potentially use this flaw to execute arbitrary code on the host with the privileges of the...

qemu security update

CentOS Errata and Security Advisory CESA-2015:1087 Updated qemu-kvm packages that fix one security issue are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System CVSS base score, whi...

qemu: pcnet: multi-tmd buffer overflow in the tx path

A flaw was found in the way QEMU's AMD PCnet Ethernet emulation handled multi-TMD packets with a length above 4096 bytes. A privileged guest user in a guest with an AMD PCNet ethernet card enabled could potentially use this flaw to execute arbitrary code on the host with the privileges of the...

qemu: pcnet: multi-tmd buffer overflow in the tx path

A flaw was found in the way QEMU's AMD PCnet Ethernet emulation handled multi-TMD packets with a length above 4096 bytes. A privileged guest user in a guest with an AMD PCNet ethernet card enabled could potentially use this flaw to execute arbitrary code on the host with the privileges of the...

UBUNTU-CVE-2015-4106

QEMU does not properly restrict write access to the PCI config space for certain PCI pass-through devices, which might allow local x86 HVM guests to gain privileges, cause a denial of service host crash, obtain sensitive information, or possibly have other unspecified impact via unknown vectors...

openSUSE Security Update : xen (openSUSE-2015-391) (Venom)

The XEN hypervisor was updated to fix two security issues : - Fixed a buffer overflow in the floppy drive emulation, which could be used to denial of service attacks or potential code execution against the host. CVE-2015-3456 - Xen did not initialize certain fields, which allowed certain remote...

Realtek SDK Miniigd UPnP SOAP Command Execution Exploit

Exploit for linux platform in category remote exploits This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Realtek SDK Miniigd UPnP SOAP Command Execution', 'Description' = %q Differen...

Wavelink Terminal Emulation 'LicenseServer.exe' Remote Code Execution Vulnerability

Wavelink Emulation ConnectPro TermProxy is a product from Wavelink that provides a stable connection environment for Wavelink Terminal Emulation TE, Terminal Emulation. A remote code execution vulnerability exists in Wavelink Terminal Emulation 'LicenseServer.exe', which allows attackers to explo...

Realtek SDK - Miniigd UPnP SOAP Command Execution (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Realtek SDK Miniigd UPnP SOAP Command Execution', 'Description' = %q Different devices using the Realtek SDK with the miniigd daemon...

Wavelink Emulation ConnectPro TermProxy Remote Code Execution Vulnerability

Wavelink Emulation ConnectPro TermProxy is a product from Wavelink that provides a stable connection environment for Wavelink Terminal Emulation TE, Terminal Emulation. A remote code execution vulnerability exists in Wavelink Emulation ConnectPro TermProxy, which stems from the program failing to...

CVE-2015-4059

Heap-based buffer overflow in the License Server LicenseServer.exe in Wavelink Terminal Emulation TE allows remote attackers to execute arbitrary code via a large HTTP header...

CVE-2015-4059

Heap-based buffer overflow in the License Server LicenseServer.exe in Wavelink Terminal Emulation TE allows remote attackers to execute arbitrary code via a large HTTP header...

CVE-2015-4059

Affected software: Wavelink Emulation License Server (LicenseServer.exe). Vulnerability type and root cause: Heap-based buffer overflow caused by unsafe handling when parsing HTTP headers, leading to a heap corruption due to an unsafe memory block copy operation. Impact and exploitability: Remote...

CVE-2015-4059: Improper Restriction of Operations within the Bounds of a Memory Buffer

Heap-based buffer overflow in the License Server LicenseServer.exe in Wavelink Terminal Emulation TE allows remote attackers to execute arbitrary code via a large HTTP header...

(0Day) Wavelink Emulation License Server LicenseServer.exe HTTP Request Headers Remote Code Execution Vulnerability

This vulnerability allows attackers to execute arbitrary code on vulnerable installations of Wavelink Emulation License Server. User interaction is not required to exploit this vulnerability. The specific flaw exists in the parsing of HTTP requests in LicenseServer.exe listening by default on por...