kernel: buffer overflow with fraglist larger than MAX_SKB_FRAGS + 2 in virtio-net

A buffer overflow flaw was found in the way the Linux kernel's virtio-net subsystem handled certain fraglists when the GRO Generic Receive Offload functionality was enabled in a bridged network configuration. An attacker on the local network could potentially use this flaw to crash the system, or...

qemu: Heap overflow vulnerability in ne2000_receive() function

A heap buffer overflow flaw was found in the way QEMU's NE2000 NIC emulation implementation handled certain packets received over the network. A privileged user inside a guest could use this flaw to crash the QEMU instance denial of service or potentially execute arbitrary code on the host...

qemu: Heap overflow vulnerability in ne2000_receive() function

A heap buffer overflow flaw was found in the way QEMU's NE2000 NIC emulation implementation handled certain packets received over the network. A privileged user inside a guest could use this flaw to crash the QEMU instance denial of service or potentially execute arbitrary code on the host...

The vulnerability of the QEMU hardware emulation software allows a hacker to trigger a maintenance failure or execute arbitrary code.

The vulnerability of the ne2000receive function in the QEMU hardware emulation software is caused by a buffer overflow in the dynamic memory. Exploiting this vulnerability can allow an attacker acting locally to cause a service failure or execute arbitrary code...

DEBIAN-CVE-2015-5279

Heap-based buffer overflow in the ne2000receive function in hw/net/ne2000.c in QEMU before 2.4.0.1 allows guest OS users to cause a denial of service instance crash or possibly execute arbitrary code via vectors related to receiving packets...

UBUNTU-CVE-2015-5279

Heap-based buffer overflow in the ne2000receive function in hw/net/ne2000.c in QEMU before 2.4.0.1 allows guest OS users to cause a denial of service instance crash or possibly execute arbitrary code via vectors related to receiving packets...

PT-2015-2201 · Qemu +5 · Qemu +5

Name of the Vulnerable Software and Affected Versions: QEMU versions prior to 2.4.0.1 Description: The issue is caused by a heap-based buffer overflow in the ne2000 receive function. This can allow a local attacker to cause a denial of service or possibly execute arbitrary code via vectors relate...

UBUNTU-CVE-2015-5278

The ne2000receive function in hw/net/ne2000.c in QEMU before 2.4.0.1 allows attackers to cause a denial of service infinite loop and instance crash or possibly execute arbitrary code via vectors related to receiving packets...

Moderate: Red Hat Security Advisory: kernel security and bug fix update

Updated kernel packages that fix one security issue and several bugs are now available for Red Hat Enterprise Linux 6.5 Extended Update Support. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a...

UBUNTU-CVE-2015-5364

The 1 udprecvmsg and 2 udpv6recvmsg functions in the Linux kernel before 4.0.6 do not properly consider yielding a processor, which allows remote attackers to cause a denial of service system hang via incorrect checksums within a UDP packet flood...

PT-2015-6870 · Linux +5 · Linux Kernel +5

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 4.0.6 Description: The issue concerns the udp recvmsg and udpv6 recvmsg functions in the Linux kernel, which do not properly consider yielding a processor. This allows remote attackers to cause a denial of...

PT-2015-6383 · Linux +3 · Linux Kernel +3

Name of the Vulnerable Software and Affected Versions: Linux kernel versions through 4.0.5 Description: The issue allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted packet, related to the oz usb rx and oz usb handle ep data functions. This is due...

The vulnerability of the microprogramming software of the Cisco Unified Communications Manager allows a remote attacker to execute arbitrary code.

Buffer overflows occur when performing functions like cryptorecv when Autokey Authentication is used, ctlputdata, and configure. This allows a malicious attacker to execute arbitrary code by sending specially crafted NTP packets...

Updated ntp packages fix security vulnerabilities

Updated ntp packages fix security vulnerabilities: The symmetric-key feature in the receive function in ntpproto.c in ntpd in NTP before 4.2.8p2 requires a correct MAC only if the MAC field has a nonzero length, which makes it easier for man-in-the-middle attackers to spoof packets by omitting th...

Mandriva Linux Security Advisory : ntp (MDVSA-2015:202)

Multiple vulnerabilities has been found and corrected in ntp : The symmetric-key feature in the receive function in ntpproto.c in ntpd in NTP before 4.2.8p2 requires a correct MAC only if the MAC field has a nonzero length, which makes it easier for man-in-the-middle attackers to spoof packets by...

DEBIAN-CVE-2015-1798

The symmetric-key feature in the receive function in ntpproto.c in ntpd in NTP 4.x before 4.2.8p2 requires a correct MAC only if the MAC field has a nonzero length, which makes it easier for man-in-the-middle attackers to spoof packets by omitting the MAC...

CVE-2015-1798

The symmetric-key feature in the receive function in ntpproto.c in ntpd in NTP 4.x before 4.2.8p2 requires a correct MAC only if the MAC field has a nonzero length, which makes it easier for man-in-the-middle attackers to spoof packets by omitting the MAC...

CVE-2015-1798

The symmetric-key feature in the receive function in ntpproto.c in ntpd in NTP 4.x before 4.2.8p2 requires a correct MAC only if the MAC field has a nonzero length, which makes it easier for man-in-the-middle attackers to spoof packets by omitting the MAC...

UBUNTU-CVE-2015-1798

The symmetric-key feature in the receive function in ntpproto.c in ntpd in NTP 4.x before 4.2.8p2 requires a correct MAC only if the MAC field has a nonzero length, which makes it easier for man-in-the-middle attackers to spoof packets by omitting the MAC...

CVE-2014-9296

The receive function in ntpproto.c in ntpd in NTP before 4.2.8 continues to execute after detecting a certain authentication error, which might allow remote attackers to trigger an unintended association change via crafted packets...