HTTPS Opens Door to Paid Pinterest Bug Bounty

Pinterest’s journey toward becoming a fully HTTPS website opened a lot of doors, including a potentially profitable one for hackers. The social networking site this week announced that it would begin paying cash rewards through its bug bounty program, upping the stakes from the T-shirt it...

libcacard, qemu security update

CentOS Errata and Security Advisory CESA-2015:0349 Updated qemu-kvm packages that fix multiple security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Important security impact. Common...

ecryptfs-utils: hard-coded passphrase salt

eCryptfs uses a default salt to encrypt the mount passphrase, which makes it easier for attackers to obtain user passwords via a brute force attack. By default, the wrapping key is hashed with the default fixed salt 0x0011223344556677. This update introduces the version 2 wrapped-passphrase file...

ipa security, bug fix, and enhancement update

4.1.0-18.0.1 - Replace login-screen-logo.png 20362818 - Drop subscription-manager requires for OL7 - Drop redhat-access-plugin-ipa requires for OL7 - Blank out header-logo.png product-name.png 4.1.0-18 - Fix ipa-pwd-extop global configuration caching 1187342 - group-detach does not add correct...

RHEL 7 : qemu-kvm-rhev (RHSA-2015:0624)

Updated qemu-kvm-rhev packages that fix multiple security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Virtualization Hypervisor 7. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring Syste...

RedHat Update for qemu-kvm RHSA-2015:0349-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Kernel: missing check during hugepage migration

A flaw was found in the way Linux kernel's Transparent Huge Pages THP implementation handled non-huge page migration. A local, unprivileged user could use this flaw to crash the kernel by migrating transparent hugepages...

qemu: insufficient parameter validation during ram load

It was found that certain values that were read when loading RAM during migration were not validated. A user able to alter the savevm data either on the disk or over the wire during migration could use either of these flaws to corrupt QEMU process memory on the destination host, which could...

Important: Red Hat Security Advisory: qemu-kvm security, bug fix, and enhancement update

Updated qemu-kvm packages that fix multiple security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores, which...

qemu: insufficient parameter validation during ram load

It was found that certain values that were read when loading RAM during migration were not validated. A user able to alter the savevm data either on the disk or over the wire during migration could use either of these flaws to corrupt QEMU process memory on the destination host, which could...

libvirt: local denial of service in qemu/qemu_driver.c

It was found that QEMU's qemuDomainMigratePerform and qemuDomainMigrateFinish2 functions did not correctly perform a domain unlock on a failed ACL check. A remote attacker able to establish a connection to libvirtd could use this flaw to lock a domain of a more privileged user, causing a denial o...

SUSE-RU-2015:0611-1 Recommended update for SUSE Manager Server 2.1

This collective update for SUSE Manager Server 2.1 provides the following new features: Connect SUSE Manager to the SUSE Customer Center. Manage SLE12 systems. ISS: export/import information about cloned channels to support Service Pack migration on ISS slaves. FATE317789 New API calls:...

SuSE 11.3 Security Update : kvm and libvirt (SAT Patch Number 10222)

This collective update for KVM and libvirt provides fixes for security and non-security issues. kvm : - Fix NULL pointer dereference because of uninitialized UDP socket. bsc897654, CVE-2014-3640 - Fix performance degradation after migration. bsc878350 - Fix potential image corruption due to missi...

openSUSE Security Update : xen (openSUSE-2015-129)

The XEN virtualization was updated to fix bugs and security issues : Security issues fixed: CVE-2015-0361: XSA-116: xen: xen crash due to use after free on hvm guest teardown CVE-2014-9065, CVE-2014-9066: XSA-114: xen: p2m lock starvation CVE-2014-9030: XSA-113: Guest effectable page reference le...

SUSE-SU-2015:0349-1 Security update for qemu

QEMU was updated to fix various bugs and security issues. Following security issues were fixed: CVE-2014-8106: Heap-based buffer overflow in the Cirrus VGA emulator hw/display/cirrusvga.c in QEMU allowed local guest users to execute arbitrary code via vectors related to blit regions. CVE-2014-784...

DSA-3148-1 chromium-browser - end of life

Bulletin has no description...

DEBIAN-CVE-2014-8136

The 1 qemuDomainMigratePerform and 2 qemuDomainMigrateFinish2 functions in qemu/qemudriver.c in libvirt do not unlock the domain when an ACL check fails, which allow local users to cause a denial of service via unspecified vectors...

Ubuntu 14.04 LTS : QEMU vulnerabilities (USN-2439-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2439-1 advisory. Michael S. Tsirkin discovered that QEMU incorrectly handled certain parameters during ram load while performing a migration. An attacker able to manipula...

Mandriva Linux Security Advisory : qemu (MDVSA-2014:249)

Updated qemu packages fix security vulnerabilities : During migration, the values read from migration stream during ram load are not validated. Especially offset in hostfromstreamoffset and also the length of the writes in the callers of the said function. A user able to alter the savevm data...

Updated qemu packages fix security vulnerabilities

Updated qemu packages fix security vulnerabilities: During migration, the values read from migration stream during ram load are not validated. Especially offset in hostfromstreamoffset and also the length of the writes in the callers of the said function. A user able to alter the savevm data eith...