FreeBSD : xen-kernel -- x86 segment base write emulation lacking canonical address checks (53dbd096-ba4d-11e6-ae1b-002590263bf5)

The Xen Project reports : Both writes to the FS and GS register base MSRs as well as the WRFSBASE and WRGSBASE instructions require their input values to be canonical, or a GP fault will be raised. When the use of those instructions by the hypervisor was enabled, the previous guard against GP...

CVE-2016-9385

The x86 segment base write emulation functionality in Xen 4.4.x through 4.7.x allows local x86 PV guest OS administrators to cause a denial of service host crash by leveraging lack of canonical address checks...

x86 segment base write emulation lacking canonical address checks

ISSUE DESCRIPTION Both writes to the FS and GS register base MSRs as well as the WRFSBASE and WRGSBASE instructions require their input values to be canonical, or a GP fault will be raised. When the use of those instructions by the hypervisor was enabled, the previous guard against GP faults havi...

x86 null segments not always treated as unusable

ISSUE DESCRIPTION The Xen x86 emulator erroneously failed to consider the unusability of segments when performing memory accesses. The intended behaviour is as follows: The user data segment %ds, %es, %fs and %gs selectors may be NULL in 32-bit to prevent access. In 64-bit, NULL has a special...

xen-kernel -- x86 segment base write emulation lacking canonical address checks

The Xen Project reports: Both writes to the FS and GS register base MSRs as well as the WRFSBASE and WRGSBASE instructions require their input values to be canonical, or a GP fault will be raised. When the use of those instructions by the hypervisor was enabled, the previous guard against GP faul...

Mozilla Firefox Same-Origin Policy Bypass Vulnerability (CNVD-2016-08178)

Mozilla Firefox is an open source web browser. A vulnerability in Mozilla Firefox's handling of segment identifiers in the SRC attribute of the IFRAME element allows remote attackers to build malicious web pages that can be exploited to trick users into parsing them, which can be used to bypass t...

CVE-2015-8099

CVE-2015-8099 affects F5 BIG-IP products (multiple modules) where software SYN cookies are configured on virtual servers. Under limited conditions, an invalid TCP segment can cause a DoS (High-Speed Bridge hang) in the data plane via virtual servers. The vulnerability impacts various BIG-IP relea...

Multiple F5 BIG-IP and BIG-IQ Denial of Service Vulnerabilities

F5 BIG-IP LTM, etc. are all products of F5 USA.LTM is a local traffic manager; BIG-IQ is a software-based cloud management solution.GTM is a wide-area traffic manager; WebAccelerator is an application gas pedal. A security vulnerability exists in several F5 BIG-IP and BIG-IQ products, which can b...

Through the ELF dynamic loading of the structure ROP chain Return-to-dl-resolve-the vulnerability warning-the black bar safety net

Play CTF game stick have know that PWN type of vulnerability topic will generally provide an executable program, and provide program run dynamically link the libc library. By the libc. so you can get the library function of the offset address, combined with the leak GOT the table in the libc...

The vulnerability of the Cisco IOS operating system, which allows a intruder to trigger a service failure

The vulnerability of the Wide Area Application Services Express implementation of the Cisco IOS operating system is related to resource management errors. Exploiting this vulnerability allows a malicious actor to trigger a service failure device reboot through a specially crafted TCP segment...

CVE-2016-1347

The Wide Area Application Services WAAS Express implementation in Cisco IOS 15.1 through 15.5 allows remote attackers to cause a denial of service device reload via a crafted TCP segment, aka Bug ID CSCuq59708...

CVE-2016-1347

The Wide Area Application Services WAAS Express implementation in Cisco IOS 15.1 through 15.5 allows remote attackers to cause a denial of service device reload via a crafted TCP segment, aka Bug ID CSCuq59708...

xen: hypervisor memory corruption due to x86 emulator flaw (xsa123)

It was found that the Xen hypervisor x86 CPU emulator implementation did not correctly handle certain instructions with segment overrides, potentially resulting in a memory corruption. A malicious guest user could use this flaw to read arbitrary data relating to other guests, cause a denial of...

Apple iOS dyld arbitrary code execution vulnerability (CNVD-2015-08185)

Apple iOS is an operating system developed by Apple for use in cell phones and more. A segment checksum vulnerability exists in the Apple iOS dyld handling, which allows an attacker to exploit the vulnerability to execute arbitrary code with system privileges...

CVE-2015-7079

dyld in Apple iOS before 9.2 and tvOS before 9.1 mishandles segment validation, which allows attackers to execute arbitrary code in a privileged context via a crafted app...

CVE-2015-7079

dyld in Apple iOS before 9.2 and tvOS before 9.1 mishandles segment validation, which allows attackers to execute arbitrary code in a privileged context via a crafted app...

CVE-2015-7072

dyld in Apple iOS before 9.2, tvOS before 9.1, and watchOS before 2.1 mishandles segment validation, which allows attackers to execute arbitrary code in a privileged context via a crafted app...

autofs security, bug fix and enhancement update

5.0.7-54.0.1 - add autofs-5.0.5-lookup-mounts.patch Orabug:12658280 Bert Barbe 1:5.0.7-54 - bz1263508 - Heavy program map usage can lead to a hang - fix out of order call in program map lookup. - Resolves: rhbz1263508 1:5.0.7-53 - bz1238573 - RFE: autofs MAPHASHTABLESIZE description - update...

A Different Spin on the Air War Against IS

Sunday evening 60 Minutes aired a segment titled Inside the Air War. The correspondent was David Martin, whose biography includes the fact that he served as a naval officer during the Vietnam War. The piece concluded with the following exchange and commentary: On the day we watched the B-1 strike...

F5 Networks BIG-IP : Linux kernel vulnerability (SOL16122)

arch/x86/kernel/entry64.S in the Linux kernel before 3.17.5 does not properly handle faults associated with the Stack Segment SS segment register, which allows local users to gain privileges by triggering an IRET instruction that leads to access to a GS Base address from the wrong space. C Tenabl...