FreeBSD : xen-kernel -- x86 null segments not always treated as unusable (50ac2e96-ba4d-11e6-ae1b-002590263bf5)

The Xen Project reports : The Xen x86 emulator erroneously failed to consider the unusability of segments when performing memory accesses. The intended behaviour is as follows: The user data segment %ds, %es, %fs and %gs selectors may be NULL in 32-bit to prevent access. In 64-bit, NULL has a...

Debian DLA-720-1 : xen security update

Multiple vulnerabilities have been discovered in the Xen hypervisor. The Common Vulnerabilities and Exposures project identifies the following problems : CVE-2016-9379, CVE-2016-9380 XSA-198 pygrub, the boot loader emulator, fails to quote or sanity check its results when reporting them to its...

CVE-2016-9380

The pygrub boot loader emulator in Xen, when nul-delimited output format is requested, allows local pygrub-using guest OS administrators to read or delete arbitrary files on the host via NUL bytes in the bootloader configuration file...

CVE-2016-9386

The x86 emulator in Xen does not properly treat x86 NULL segments as unusable when accessing memory, which might allow local HVM guest users to gain privileges via vectors involving "unexpected" base/limit values...

x86 null segments not always treated as unusable

ISSUE DESCRIPTION The Xen x86 emulator erroneously failed to consider the unusability of segments when performing memory accesses. The intended behaviour is as follows: The user data segment %ds, %es, %fs and %gs selectors may be NULL in 32-bit to prevent access. In 64-bit, NULL has a special...

Debian DSA-3712-1 : terminology - security update

Nicolas Braud-Santoni discovered that incorrect sanitising of character escape sequences in the Terminology terminal emulator may result in the execution of arbitrary commands. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extract...

Debian Security Advisory DSA 3712-1 (terminology - security update)

Nicolas Braud-Santoni discovered that incorrect sanitising of character escape sequences in the Terminology terminal emulator may result in the execution of arbitrary commands. OpenVAS Vulnerability Test $Id: deb3712.nasl 6608 2017-07-07 12:05:05Z cfischer $ Auto-generated from advisory DSA 3712-...

Oracle Linux 7 : qemu-kvm (ELSA-2016-2585)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-2585 advisory. - Resolves: bz1359729 CVE-2016-5403 qemu-kvm: Qemu: virtio: unbounded memory allocation on host via guest leading to DoS rhel-7.3 - Resolves: bz1340929...

Qemu: OOB access in address_space_rw leads to segmentation fault

An out-of-bounds flaw was found in the QEMU emulator built using 'addressspacetranslate' to map an address to a MemoryRegionSection. The flaw could occur while doing pcidmaread/write calls, resulting in an out-of-bounds read-write access error. A privileged user inside a guest could use this flaw...

Qemu: net: out of bounds read in net_checksum_calculate()

An out-of-bounds read-access flaw was found in the QEMU emulator built with IP checksum routines. The flaw could occur when computing a TCP/UDP packet's checksum, because a QEMU function used the packet's payload length without checking against the data buffer's size. A user inside a guest could...

ALPINE-CVE-2016-8909

The intelhdaxfer function in hw/audio/intel-hda.c in QEMU aka Quick Emulator allows local guest OS administrators to cause a denial of service infinite loop and CPU consumption via an entry with the same value for buffer length and pointer position...

DEBIAN-CVE-2016-8667

The rc4030write function in hw/dma/rc4030.c in QEMU aka Quick Emulator allows local guest OS administrators to cause a denial of service divide-by-zero error and QEMU process crash via a large interval timer reload value...

ALPINE-CVE-2016-8577

Memory leak in the v9fsread function in hw/9pfs/9p.c in QEMU aka Quick Emulator allows local guest OS administrators to cause a denial of service memory consumption via vectors related to an I/O read operation...

CVE-2016-8577

CVE-2016-8577 entry is rejected/not used; duplicates CVE-2020-2891 (CVE-2020-25707).

CVE-2016-8667

CVE-2016-8667 affects QEMU (rc4030_write in hw/dma/rc4030.c). It allows a local guest OS administrator to trigger a divide-by-zero and QEMU process crash by loading an excessively large interval timer value, causing a denial of service with partial impact on availability. The provided documents d...

CVE-2016-8909

The intelhdaxfer function in hw/audio/intel-hda.c in QEMU aka Quick Emulator allows local guest OS administrators to cause a denial of service infinite loop and CPU consumption via an entry with the same value for buffer length and pointer position...

QEMU 'hw/9pfs/9p.c' denial of service vulnerability (CNVD-2016-10619)

QEMU aka Quick Emulator is a set of simulation processor software developed by French programmer Fabrice Bellard. The software is fast and cross-platform. A denial of service vulnerability exists in 'hw/9pfs/9p.c', which can be exploited by an attacker to launch a denial of service attack...

QEMU 'hw/9pfs/9p.c' integer overflow vulnerability

QEMU aka Quick Emulator is a set of simulation processor software developed by French programmer Fabrice Bellard. The software is fast and cross-platform. QEMU 'hw/9pfs/9p.c' suffers from an integer overflow vulnerability that can be exploited by an attacker to crash the program and cause a denia...

CVE-2016-8578

The v9fsiovvunmarshal function in fsdev/9p-iov-marshal.c in QEMU aka Quick Emulator allows local guest OS administrators to cause a denial of service NULL pointer dereference and QEMU process crash by sending an empty string parameter to a 9P operation...

UBUNTU-CVE-2016-8667

The rc4030write function in hw/dma/rc4030.c in QEMU aka Quick Emulator allows local guest OS administrators to cause a denial of service divide-by-zero error and QEMU process crash via a large interval timer reload value...