SUSE-SU-2021:3614-1 Security update for qemu

This update for qemu fixes the following issues: Security issues fixed: - Fix out-of-bounds write in UAS USB Attached SCSI device emulation bsc1189702, CVE-2021-3713 - Fix heap use-after-free in virtionetreceivercu bsc1189938, CVE-2021-3748 - usbredir: free call on invalid pointer in bufpalloc...

SUSE-SU-2021:3613-1 Security update for qemu

This update for qemu fixes the following issues: Security issues fixed: - Fix heap use-after-free in virtionetreceivercu bsc1189938, CVE-2021-3748 - Fix out-of-bounds write in UAS USB Attached SCSI device emulation bsc1189702, CVE-2021-3713 - usbredir: free call on invalid pointer in bufpalloc...

openSUSE: Security Advisory for qemu (openSUSE-SU-2021:3604-1)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

The vulnerability in the hw/net/e1000e_core.c component of the hardware emulation software QEMU allows a hacker to induce a system failure.

The vulnerability in the hw/net/e1000ecore.c component of the hardware emulation software QEMU is related to the execution of a loop with an unreachable exit condition. Exploiting this vulnerability can allow an attacker to cause a system failure...

The vulnerability of the QEMU hardware emulation API, related to writing beyond the buffer boundaries, allows a hacker to trigger a service failure.

The vulnerability of the QEMU hardware emulation API is related to an initialization error in the memory region cache. Exploiting this vulnerability can allow an attacker to cause a system failure...

The vulnerability of the USB EHCI emulation driver in the hardware emulation software QEMU, which stems from improper resource management by external emulators, allows a malicious actor to trigger a service failure.

The vulnerability of the QEMU USB EHCI emulation software is related to an error in processing USB requests. Exploiting this vulnerability can allow a hacker to cause a system failure...

The vulnerability of the hw/ppc/spapr.c component of the QEMU hardware emulation software, related to deficiencies in access control to ports, allows a perpetrator to gain access to confidential data.

The vulnerability in the hw/ppc/spapr.c component of the QEMU hardware emulation software is related to deficiencies in access control for ports. Exploiting this vulnerability can allow an attacker to gain access to confidential data...

The vulnerability of the QEMU hardware emulation software lies in the lack of a necessary encryption step, which allows attackers to gain access to confidential data.

The vulnerability of the QEMU hardware emulation software is related to a implementation error in the handling of pointer authentication. Exploiting this vulnerability can allow an attacker to gain access to confidential data...

The vulnerability of the hw/scsi/scsi-generic.c component of the QEMU hardware emulation software, related to reading data beyond the buffer’s acceptable limits, allows a malicious actor to cause a service failure.

The vulnerability of the hw/scsi/scsi-generic.c component of the QEMU hardware emulation software is related to reading data from within acceptable buffer limits. Exploiting this vulnerability can allow an attacker to cause a system failure...

The vulnerability of the QEMU hardware emulation software, related to pointer swapping errors, allows a hacker to trigger a service failure.

The vulnerability of the QEMU hardware emulation software is related to pointer assignment errors. Exploiting this vulnerability can allow a remote attacker to cause a service failure...

The vulnerability of the driver of the QEMU hardware emulation controller arises from reading data beyond the permissible buffer limits. This allows an attacker to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the driver of the QEMU hardware emulation controller lies in reading data from within allowable buffer limits. Exploiting this vulnerability can allow an attacker to access confidential data, compromise its integrity, and cause service failures...

The vulnerability of the oss_write component of the hardware emulation software based on QEMU, which stems from the lack of protection against division by zero, allows a malicious actor to trigger a service failure.

The vulnerability of the osswrite component of the QEMU hardware emulation software is related to the lack of protection against division by zero. Exploiting this vulnerability can allow an attacker to cause a system failure...

The vulnerability in the block/iscsi.c component of the QEMU hardware emulation software involves reading data beyond the allowed buffer limits, allowing an attacker to access confidential data.

The vulnerability in the block/iscsi.c component of the QEMU hardware emulation software involves reading data from beyond the allowable buffer size. Exploiting this vulnerability can allow an attacker to access confidential data...

The vulnerability of the ati-vga hardware emulation component in QEMU, related to uncontrolled recursion, allows a hacker to trigger a service failure.

The vulnerability of the ati-vga hardware emulation component in QEMU is related to an uncontrolled recursion. Exploiting this vulnerability can allow an attacker to cause a system failure...

The vulnerability in the hw/usb/hcd-xhci.c component of the QEMU hardware emulation software arises from the use of memory after it has been freed. This allows a malicious actor to trigger a service failure.

The vulnerability in the hw/usb/hcd-xhci.c component of the QEMU hardware emulation software is related to the lack of checking for the return value of usbpacketmap. Exploiting this vulnerability could allow a attacker to cause a service failure...

The vulnerability of the sd_wp_addr component of the emulation software for hardware devices on other platforms, related to reading data beyond the buffer’s acceptable limits, allows a malicious actor to cause a service failure.

The vulnerability of the sdwpaddr component of the hardware emulation software for other platforms supported by QEMU lies in its ability to read data from beyond the allowed buffer size. Exploiting this vulnerability can allow an attacker to cause service failures...

The vulnerability of the e1000e wireless bridge in the hardware emulation software QEMU, related to the use of memory after it is freed, allows a hacker to trigger a service failure.

The vulnerability of the e1000e wireless bridge in the QEMU hardware emulation software is related to the use of memory after it is freed. Exploiting this vulnerability can allow a hacker to cause a system failure...

The vulnerability of the hw/display/ati_2d.c component in the hardware/display/ati_2d emulation software by QEMU, due to incorrect calculations, allows a hacker to trigger a service failure.

The vulnerability of the hw/display/ati2d.c component in the hardware/display/ati2d emulator of QEMU is related to incorrect calculations. Exploiting this vulnerability can allow a remote attacker to cause a service failure...

The vulnerability of the Network Block Device (NBD) emulator’s hardware emulation software, QEMU, stems from improper resource management by external emulators. This allows a malicious actor to trigger a service failure.

The vulnerability of the Network Block Device NBD emulation software from QEMU lies in the sending of a request by the client, which corresponds to a specification that is located within the maximum allowable range of request length. Exploiting this vulnerability allows an attacker who operates...

Tenacity 2.0 – Emulating Threat groups

Introduction The previous article: Tenacity – An Adversary Emulation Tool for Persistence, walked us through the working of Tenacity, techniques it supports, and how it can help organizations and individuals to validate the risk posture. As with the second installment of the series, this post wil...