538 matches found
Qemu: qcow1: validate image size to avoid out-of-bounds memory access
An integer overflow flaw was found in the QEMU block driver for QCOW version 1 disk images. A user able to alter the QEMU disk image files loaded by a guest could use this flaw to corrupt QEMU process memory on the host, which could potentially result in arbitrary code execution on the host with...
Qemu: qcow1: validate L2 table size to avoid integer overflows
An integer overflow flaw was found in the QEMU block driver for QCOW version 1 disk images. A user able to alter the QEMU disk image files loaded by a guest could use this flaw to corrupt QEMU process memory on the host, which could potentially result in arbitrary code execution on the host with...
Qemu: qcow1: validate image size to avoid out-of-bounds memory access
An integer overflow flaw was found in the QEMU block driver for QCOW version 1 disk images. A user able to alter the QEMU disk image files loaded by a guest could use this flaw to corrupt QEMU process memory on the host, which could potentially result in arbitrary code execution on the host with...
Qemu: qcow1: validate L2 table size to avoid integer overflows
An integer overflow flaw was found in the QEMU block driver for QCOW version 1 disk images. A user able to alter the QEMU disk image files loaded by a guest could use this flaw to corrupt QEMU process memory on the host, which could potentially result in arbitrary code execution on the host with...
Qemu: qcow1: validate L2 table size to avoid integer overflows
An integer overflow flaw was found in the QEMU block driver for QCOW version 1 disk images. A user able to alter the QEMU disk image files loaded by a guest could use this flaw to corrupt QEMU process memory on the host, which could potentially result in arbitrary code execution on the host with...
Qemu: qcow1: validate image size to avoid out-of-bounds memory access
An integer overflow flaw was found in the QEMU block driver for QCOW version 1 disk images. A user able to alter the QEMU disk image files loaded by a guest could use this flaw to corrupt QEMU process memory on the host, which could potentially result in arbitrary code execution on the host with...
qemu: virtio: insufficient validation of num_sg when mapping
An user able to alter the savevm data either on the disk or over the wire during migration could use this flaw to to corrupt QEMU process memory on the destination host, which could potentially result in arbitrary code execution on the host with the privileges of the QEMU process...
Qemu: qcow1: validate image size to avoid out-of-bounds memory access
An integer overflow flaw was found in the QEMU block driver for QCOW version 1 disk images. A user able to alter the QEMU disk image files loaded by a guest could use this flaw to corrupt QEMU process memory on the host, which could potentially result in arbitrary code execution on the host with...
kernel: kvm: out-of-bounds access in ioapic indirect register reads
The ioapicreadindirect function in virt/kvm/ioapic.c in the Linux kernel through 3.8.4 does not properly handle a certain combination of invalid IOAPICREGSELECT and IOAPICREGWINDOW operations, which allows guest OS users to obtain sensitive information from host OS memory or cause a denial of...
kernel: kvm: buffer overflow in handling of MSR_KVM_SYSTEM_TIME
The kvmsetmsrcommon function in arch/x86/kvm/x86.c in the Linux kernel through 3.8.4 does not ensure a required timepage alignment during an MSRKVMSYSTEMTIME operation, which allows guest OS users to cause a denial of service buffer overflow and host OS memory corruption or possibly have...
kernel: kvm: out-of-bounds access in ioapic indirect register reads
The ioapicreadindirect function in virt/kvm/ioapic.c in the Linux kernel through 3.8.4 does not properly handle a certain combination of invalid IOAPICREGSELECT and IOAPICREGWINDOW operations, which allows guest OS users to obtain sensitive information from host OS memory or cause a denial of...
kernel: kvm: after free issue with the handling of MSR_KVM_SYSTEM_TIME
Use-after-free vulnerability in arch/x86/kvm/x86.c in the Linux kernel through 3.8.4 allows guest OS users to cause a denial of service host OS memory corruption or possibly have unspecified other impact via a crafted application that triggers use of a guest physical address GPA in 1 movable or 2...
kernel: kvm: out-of-bounds access in ioapic indirect register reads
The ioapicreadindirect function in virt/kvm/ioapic.c in the Linux kernel through 3.8.4 does not properly handle a certain combination of invalid IOAPICREGSELECT and IOAPICREGWINDOW operations, which allows guest OS users to obtain sensitive information from host OS memory or cause a denial of...
kernel: kvm: out-of-bounds access in ioapic indirect register reads
The ioapicreadindirect function in virt/kvm/ioapic.c in the Linux kernel through 3.8.4 does not properly handle a certain combination of invalid IOAPICREGSELECT and IOAPICREGWINDOW operations, which allows guest OS users to obtain sensitive information from host OS memory or cause a denial of...
UBUNTU-CVE-2013-1798
The ioapicreadindirect function in virt/kvm/ioapic.c in the Linux kernel through 3.8.4 does not properly handle a certain combination of invalid IOAPICREGSELECT and IOAPICREGWINDOW operations, which allows guest OS users to obtain sensitive information from host OS memory or cause a denial of...
CVE-2013-0152
Memory leak in Xen 4.2 and unstable allows local HVM guests to cause a denial of service host memory consumption by performing nested virtualization in a way that triggers errors that are not properly handled...
CVE-2013-0152
Memory leak in Xen 4.2 and unstable allows local HVM guests to cause a denial of service host memory consumption by performing nested virtualization in a way that triggers errors that are not properly handled...
Passport PC To Host Memory Corruption
Exploit Title: Passport PC To Host Malformed .zws file Memory Corruption Date: 3-3-12 Author: Silent Dream Software Link: http://www.zephyrcorp.com/terminal-emulation/ Version: Latest 2011-506-S Tested on: Windows XP SP3 my $file = "passportpwn.zws"; my $head = "Connection\nHost="; my $junk = "a"...