OPENSUSE-SU-2021:1461-1 Security update for qemu

This update for qemu fixes the following issues: Security issues fixed: - CVE-2021-3713: Fix out-of-bounds write in UAS USB Attached SCSI device emulation bsc1189702 - CVE-2021-3748: Fix heap use-after-free in virtionetreceivercu bsc1189938 Non-security issues fixed: - Add transfer length item in...

openSUSE 15 Security Update : qemu (openSUSE-SU-2021:3604-1)

The remote SUSE Linux SUSE15 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:3604-1 advisory. - An out-of-bounds write flaw was found in the UAS USB Attached SCSI device emulation of QEMU in versions prior to 6.2.0-rc0. The device us...

openSUSE 15 Security Update : qemu (openSUSE-SU-2021:3605-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:3605-1 advisory. - An out-of-bounds write flaw was found in the UAS USB Attached SCSI device emulation of QEMU in versions prior to 6.2.0-rc0. The device us...

QEMU: virtio-net: heap use-after-free in virtio_net_receive_rcu

A use-after-free vulnerability was found in the virtio-net device of QEMU. It could occur when the descriptor's address belongs to the non direct access region, due to numbuffers being set after the virtqueue elem has been unmapped. A malicious guest could use this flaw to crash QEMU, resulting i...

Unbreakable Enterprise kernel security update

4.1.12-124.57.1 - target; fix print statement warning John Donnelly Orabug: 33495661 - enic;: fix warning on moduleparam disablevlan0, John Donnelly Orabug: 33495661 - bnx2fc: correct BNX2FCTMTIMEOUT to be 60 sec John Donnelly Orabug: 33495661 - target: Fix linux-4.1.y specific compile warning...

CVE-2021-34856

This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3 49160. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists withi...

CVE-2021-34856

This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3 49160. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists withi...

CVE-2021-34856

CVE-2021-34856 affects Parallels Desktop 16.1.3 (49160). The vulnerability is in the virtio-gpu virtual device and stems from improper validation of user-supplied data, causing a memory corruption condition that can be exploited by a local attacker to escalate privileges and execute arbitrary cod...

PT-2021-6920 · Linux +4 · Linux Kernel +4

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.16.3 Description: The issue is related to a memory leak in the Linux kernel, specifically in the drivers/bluetooth/virtio bt.c file. This memory leak occurs because socket buffers have memory allocated but not...

Virtuozzo Hybrid Server 7.5 Update 2 Hotfix 1 (7.5.2-444)

The Hotfix 1 for Virtuozzo Hybrid Server 7.5 Update 2 provides new features as well as stability and usability bug fixes. Vulnerability id: PSBM-134035 libvirtd could stop responding during VM autostart after node reboot. Vulnerability id: PSBM-134221 virtio-scsi could abort inside a guest during...

UVI-2021-1001758 virtio-net: fix pages leaking when building skb in big mode

virtio-net: fix pages leaking when building skb in big mode This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.14.9 by commit...

GSD-2021-1001758 virtio-net: fix pages leaking when building skb in big mode

virtio-net: fix pages leaking when building skb in big mode This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.14.9 by commit...

USN-5092-3: Linux kernel (Azure) regression

USN-5092-2 fixed vulnerabilities in Linux 5.11-based kernels. Unfortunately, for Linux kernels intended for use within Microsoft Azure environments, that update introduced a regression that could cause the kernel to fail to boot in large Azure instance types. This update fixes the problem. We...

USN-5106-1 linux-oem-5.10 vulnerabilities

Valentina Palmiotti discovered that the iouring subsystem in the Linux kernel could be coerced to free adjacent memory. A local attacker could use this to execute arbitrary code. CVE-2021-41073 It was discovered that the Linux kernel did not properly enforce certain types of entries in the Secure...

The vulnerability in the driver drivers/char/virtio_console.c of the Linux operating system allows a hacker to cause stack overflow.

The vulnerability in the driver drivers/char/virtioconsole.c of the Linux operating system is caused by a buffer overflow in the stack. Exploiting this vulnerability can allow an attacker to cause damage to the stack...

USN-5091-2 linux-raspi, linux-raspi-5.4 vulnerabilities

Ofek Kirzner, Adam Morrison, Benedict Schlueter, and Piotr Krysiuk discovered that the BPF verifier in the Linux kernel missed possible mispredicted branches due to type confusion, allowing a side-channel attack. An attacker could use this to expose sensitive information. CVE-2021-33624 It was...

USN-5091-2: Linux kernel (Raspberry Pi) vulnerabilities

Ofek Kirzner, Adam Morrison, Benedict Schlueter, and Piotr Krysiuk discovered that the BPF verifier in the Linux kernel missed possible mispredicted branches due to type confusion, allowing a side-channel attack. An attacker could use this to expose sensitive information. CVE-2021-33624 It was...

OESA-2021-1371 qemu security update

QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed. Security Fixes: A use-after-free vulnerability was found in the virtio-net device of QEMU. It could occur when the descriptor's address belongs to the non direct access region, due to numbuffers being se...

USN-5096-1 linux-oem-5.13 vulnerabilities

Valentina Palmiotti discovered that the iouring subsystem in the Linux kernel could be coerced to free adjacent memory. A local attacker could use this to execute arbitrary code. CVE-2021-41073 Benedict Schlueter discovered that the BPF subsystem in the Linux kernel did not properly protect again...

USN-5092-2: Linux kernel vulnerabilities

Valentina Palmiotti discovered that the iouring subsystem in the Linux kernel could be coerced to free adjacent memory. A local attacker could use this to execute arbitrary code. CVE-2021-41073 Ofek Kirzner, Adam Morrison, Benedict Schlueter, and Piotr Krysiuk discovered that the BPF verifier in...