OESA-2023-1875 qemu security update

QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed. Security Fixes: A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. This flaw allows a crafted guest driver to allocate and initialize a huge number of page tables to be used...

The vulnerability of the emulator for testing JavaScript code on the Node.js software platform, which allows attackers to carry out XSS attacks.

The vulnerability of the emulator used to test JavaScript code on the Node.js software platform exists because measures to protect the structure of web pages have not been taken. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...

NewStart CGSL MAIN 6.06 : qemu Multiple Vulnerabilities (NS-SA-2023-0132)

The remote NewStart CGSL host, running version MAIN 6.06, has qemu packages installed that are affected by multiple vulnerabilities: - In QEMU 1:4.1-1, 1:2.1+dfsg-12+deb8u6, 1:2.8+dfsg-6+deb9u8, 1:3.1+dfsg-8deb10u1, 1:3.1+dfsg-8+deb10u2, and 1:2.1+dfsg-12+deb8u12 fixed, when executing script in...

Rocky Linux 8 : container-tools:rhel8 (RLSA-2020:4694)

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2020:4694 advisory. - A vulnerability was found in all versions of containernetworking/plugins before version 0.8.6, that allows malicious containers in Kubernetes clusters...

rxvt-unicode: Arbitrary Code Execution

Background rxvt-unicode is a clone of the well known terminal emulator rxvt. Description A vulnerability has been discovered in rxvt-unicode. Please review the CVE identifiers referenced below for details. Impact in the Perl background extension, when an attacker can control the data written to t...

Mintty Security Vulnerabilities

mintty is an application software Cygwin terminal emulator that can also be used with MSYS and Msys2. A security vulnerability exists in Mintty v.3.6.4 and earlier versions that could allow a remote attacker to execute arbitrary code via a terminal via a crafted command...

[SECURITY] [DLA 3604-1] qemu security update

Debian LTS Advisory DLA-3604-1 [email protected] https://www.debian.org/lts/security/ Sean Whitton October 05, 2023 https://wiki.debian.org/LTS Package : qemu Version : 1:3.1+dfsg-8+deb10u11 CVE ID : CVE-2020-24165 CVE-2023-0330 CVE-2023-3180 Debian Bug : 1029155 Multiple issues were...

SUSE CVE-2023-42467

QEMU through 8.0.0 could trigger a division by zero in scsidiskreset in hw/scsi/scsi-disk.c because scsidiskemulatemodeselect does not prevent s-qdev.blocksize from being 256. This stops QEMU and the guest immediately...

Vulnerability of the scsi_disk_reset() function (hw/scsi/scsi-disk.c) in the QEMU hardware emulation software, which allows a malicious actor to cause a system failure.

The vulnerability of the scsidiskReset function hw/scsi/scsi-disk.c in the QEMU hardware emulation software is related to a division by zero resulting from an incorrect check on the block size. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

Oracle Linux 8 : container-tools:ol8 (ELSA-2020-4694)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-4694 advisory. - A vulnerability was found in all versions of containernetworking/plugins before version 0.8.6, that allows malicious containers in Kubernetes cluster...

Oracle Linux 7 : qemu (ELSA-2020-5576)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-5576 advisory. - iscsi: Cap block count from GET LBA STATUS CVE-2020-1711 Felipe Franciosi Orabug: 30807256 CVE-2020-1711 - scsi: lsi: exit infinite loop while...

Oracle Linux 7 : qemu (ELSA-2018-4289)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-4289 advisory. - net: ignore packet size greater than INTMAX Jason Wang Orabug: 28763782 CVE-2018-17963 - pcnet: fix possible buffer overflow Jason Wang Orabug:...

Oracle Linux 5 : ELSA-2016-0450-1: / kernel (ELSA-2016-04501)

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-04501 advisory. - Integer overflow in the fbmmap function in drivers/video/fbmem.c in the Linux kernel before 3.8.9, as used in a certain Motorola build of Android...

UBUNTU-CVE-2020-24165

An issue was discovered in TCG Accelerator in QEMU 4.2.0, allows local attackers to execute arbitrary code, escalate privileges, and cause a denial of service DoS. Note: This is disputed as a bug and not a valid security issue by multiple third parties...

AZL-28069 CVE-2022-36648 affecting package qemu for versions less than 6.2.0-17

The hardware emulation in the ofdpacmdaddl2flood of rocker device model in QEMU, as used in 7.0.0 and earlier, allows remote attackers to crash the host qemu and potentially execute code on the host via execute a malformed program in the guest OS. Note: This has been disputed by multiple third...

The vulnerability of the sdhci.c component of the hardware emulation software QEMU, which allows a hacker to trigger a service failure.

The vulnerability of the sdhci.c component of the QEMU hardware emulator is related to a single-shift error. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

The vulnerability of the lsi53c895a.c component of the hardware emulation software QEMU, which allows a hacker to trigger a service failure.

The vulnerability of the lsi53c895a.c component of the QEMU hardware emulator is related to writing beyond the buffer boundaries. Exploiting this vulnerability can allow an attacker to cause a system failure...

SUSE CVE-2023-40360

QEMU through 8.0.4 accesses a NULL pointer in nvmedirectivereceive in hw/nvme/ctrl.c because there is no check for whether an endurance group is configured before checking whether Flexible Data Placement is enabled...

QEMU Code Issue Vulnerability

QEMU Quick Emulator is a set of simulation processor software by Fabrice Bellard, a French individual developer. The software is fast and cross-platform. A security vulnerability exists in QEMU version 8.0.4 and earlier versions, which stems from the fact that it does not check whether an enduran...

QEMU Competitive Conditions Problem Vulnerability

QEMU Quick Emulator is a set of simulation processor software by Fabrice Bellard, a French individual developer. The software is fast and cross-platform. A security vulnerability exists in QEMU, which stems from a null pointer dereference issue in the vhostvdpagetvhostnet function...