libvirt: segmentation fault during VM shutdown can lead to vdsm hang

A use-after-free flaw was found in libvirt. The qemuMonitorUnregister function in qemuProcessHandleMonitorEOF is called using multiple threads without being adequately protected by a monitor lock. This flaw could be triggered by the virConnectGetAllDomainStats API when the guest is shutting down...

PT-2022-3026

Name of the Vulnerable Software and Affected Versions Intel SSD versions affected versions not specified Intel SSD DC versions affected versions not specified Intel Optane SSD versions affected versions not specified Intel Optane SSD DC versions affected versions not specified Description The iss...

Vulnerability of the Server component: The Optimizer component of the MySQL Server database management system, which allows attackers to cause a crash or, in rare cases, an emergency shutdown.

The vulnerability of the MySQL Server component of the database management system exists due to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to cause the system to become unresponsive or, in rare cases, to crash through network packets...

Vulnerability of the MySQL Server component: The MySQL Server component of the database management system allows a hacker to cause service interruptions or unexpected shutdowns.

The vulnerability of the InnoDB component of the MySQL Database Server exists due to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to cause service failures or trigger an emergency shutdown through network packets...

Vulnerability of the Server component: The Replication function of the MySQL Server database management system, which allows attackers to trigger an emergency shutdown.

The vulnerability of the MySQL Server database management system’s replication component exists due to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to trigger an emergency shutdown through network packets...

The vulnerability of the InnoDB component of the MySQL Database Server allows a attacker to cause a service failure or trigger an emergency shutdown.

The vulnerability of the InnoDB component of the MySQL Database Server exists due to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause service failures or trigger a crash through network packets...

USN-5399-1: libvirt vulnerabilities

It was discovered that libvirt incorrectly handled certain locking operations. A local attacker could possibly use this issue to cause libvirt to stop accepting connections, resulting in a denial of service. This issue only affected Ubuntu 20.04 LTS. CVE-2021-3667 It was discovered that libvirt...

USN-5399-1 libvirt vulnerabilities

It was discovered that libvirt incorrectly handled certain locking operations. A local attacker could possibly use this issue to cause libvirt to stop accepting connections, resulting in a denial of service. This issue only affected Ubuntu 20.04 LTS. CVE-2021-3667 It was discovered that libvirt...

GHSA-678X-XFP4-R92R Apache Geronimo Application Server CSRF vulnerabilities

Multiple cross-site request forgery CSRF vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 allow remote attackers to hijack the authentication of administrators for requests that 1 change the web administration password, 2 upload application...

Apache Geronimo Application Server CSRF vulnerabilities

Multiple cross-site request forgery CSRF vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 allow remote attackers to hijack the authentication of administrators for requests that 1 change the web administration password, 2 upload application...

April 25, 2022—KB5012637 (OS Build 20348.681) Preview

None None...

GSD-2022-1001509 net: dsa: fix panic on shutdown if multi-chip tree failed to probe

net: dsa: fix panic on shutdown if multi-chip tree failed to probe This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.16.19 by commit...

GSD-2022-1001190 net: dsa: fix panic on shutdown if multi-chip tree failed to probe

net: dsa: fix panic on shutdown if multi-chip tree failed to probe This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.17.2 by commit...

PT-2022-29782

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.16.19 Description A potential issue exists in the Linux Kernel that could cause a panic on shutdown if a multi-chip tree failed to probe. The actual impact and attack plausibility have not yet been proven...

PT-2022-29463

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.17.2 Description A potential issue exists in the Linux Kernel that could cause a panic on shutdown if a multi-chip tree fails to probe. The actual impact and attack plausibility have not yet been proven...

PT-2022-30097

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.15.33 Description A potential issue exists in the Linux Kernel that could cause a panic on shutdown if a multi-chip tree fails to probe. The actual impact and attack plausibility have not yet been proven...

The vulnerability of Microsoft Teams’ corporate platform for Android, which stems from insufficient validation of input data, allows a hacker to trigger an emergency shutdown of the application.

The vulnerability of Microsoft Teams’ corporate platform for Android exists due to insufficient verification of input data. Exploiting this vulnerability can allow a malicious actor to cause the application to crash remotely...

CODESYS 安全特征问题漏洞

CODESYS is a controller development system from 3S-Smart Software Solutions, Germany. A security vulnerability exists in the CODESYS products that allows an unauthenticated, remote attacker to compromise an existing communication channel between CODESYS products by guessing a valid channel ID and...

Finn.no Podium 安全漏洞

Finn.no Podium is a library for building micro front ends from Finn.no Norway. A security vulnerability in Finn.no Podium layout prior to 4.6.110 and Podium proxy prior to 4.2.74 allows an attacker to shut down a server using the Trailer header as part of a request to the proxy endpoint...

The vulnerability of the modules related to antivirus protection software, such as Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Small Office Security, Kaspersky Security Cloud, and Kaspersky Endpoint Security, is related to vulnerabilities in access control. These vulnerabilities allow attackers to trigger an emergency shutdown of the Microsoft Windows operating system.

The vulnerability of Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Small Office Security, Kaspersky Security Cloud, and Kaspersky Endpoint Security modules is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to...