Ubuntu 12.04 LTS : linux vulnerabilities (USN-2773-1)

It was discovered that virtio networking in the Linux kernel did not handle fragments correctly, leading to kernel memory corruption. A remote attacker could use this to cause a denial of service system crash or possibly execute code with administrative privileges. CVE-2015-5156 It was discovered...

USN-2776-1 linux vulnerabilities

It was discovered that the Linux kernel did not check if a new IPv6 MTU set by a user space application was valid. A remote attacker could forge a route advertisement with an invalid MTU that a user space daemon like NetworkManager would honor and apply to the kernel, causing a denial of service...

USN-2775-1: Linux kernel (Trusty HWE) vulnerabilities

It was discovered that the Linux kernel did not check if a new IPv6 MTU set by a user space application was valid. A remote attacker could forge a route advertisement with an invalid MTU that a user space daemon like NetworkManager would honor and apply to the kernel, causing a denial of service...

USN-2774-1: Linux kernel (OMAP4) vulnerabilities

It was discovered that virtio networking in the Linux kernel did not handle fragments correctly, leading to kernel memory corruption. A remote attacker could use this to cause a denial of service system crash or possibly execute code with administrative privileges. CVE-2015-5156 It was discovered...

DEBIAN-CVE-2015-5156

The virtnetprobe function in drivers/net/virtionet.c in the Linux kernel before 4.2 attempts to support a FRAGLIST feature without proper memory allocation, which allows guest OS users to cause a denial of service buffer overflow and memory corruption via a crafted sequence of fragmented packets...

MGASA-2015-0397 Updated qemu packages fixes security vulnerabilities

Qinghao Tang of QIHU 360 Inc. discovered an infinite loop issue in the NE2000 NIC emulation. A privileged guest user could use this flaw to mount a denial of service QEMU process crash. CVE-2015-5278 Qinghao Tang of QIHU 360 Inc. discovered a heap buffer overflow flaw in the NE2000 NIC emulation....

Updated qemu packages fixes security vulnerabilities

Qinghao Tang of QIHU 360 Inc. discovered an infinite loop issue in the NE2000 NIC emulation. A privileged guest user could use this flaw to mount a denial of service QEMU process crash. CVE-2015-5278 Qinghao Tang of QIHU 360 Inc. discovered a heap buffer overflow flaw in the NE2000 NIC emulation....

PT-2015-2670

Name of the Vulnerable Software and Affected Versions QEMU affected versions not specified Description The issue is related to the Virtual Network Device virtio-net support in QEMU, specifically in the hw/virtio/virtio.c module. When big or mergeable receive buffers are not supported, remote...

Oracle: Security Advisory (ELSA-2011-1849)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

qemu -- denial of service vulnerability in virtio-net support

Prasad J Pandit, Red Hat Product Security Team, reports: Qemu emulator built with the Virtual Network Devicevirtio-net support is vulnerable to a DoS issue. It could occur while receiving large packets over the tuntap/macvtap interfaces and when guest's virtio-net driver did not support...

Debian DSA-3348-1 : qemu - security update

Several vulnerabilities were discovered in qemu, a fast processor emulator. - CVE-2015-3214 Matt Tait of Google's Project Zero security team discovered a flaw in the QEMU i8254 PIT emulation. A privileged guest user in a guest with QEMU PIT emulation enabled could potentially use this flaw to...

Debian DSA-3349-1 : qemu-kvm - security update

Several vulnerabilities were discovered in qemu-kvm, a full virtualization solution on x86 hardware. - CVE-2015-5165 Donghai Zhu discovered that the QEMU model of the RTL8139 network card did not sufficiently validate inputs in the C+ mode offload emulation, allowing a malicious guest to read...

[SECURITY] [DSA 3348-1] qemu security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3348-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso September 02, 2015 https://www.debian.org/security/faq -...

Fedora 21 : qemu-2.1.3-9.fc21 (2015-13404)

Fix crash in qemuspicecreatedisplay bz 1163047 CVE-2015-3209: pcnet: multi-tmd buffer overflow in the tx path bz 1230536 CVE-2015-3214: i8254: out-of-bounds memory access bz 1243728 CVE-2015-5154: ide: atapi: heap overflow during I/O buffer memory access bz 1247141 CVE-2015-5745: buffer overflow...

Ubuntu 14.04 LTS : QEMU vulnerabilities (USN-2724-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2724-1 advisory. It was discovered that QEMU incorrectly handled a PRDT with zero complete sectors in the IDE functionality. A malicious guest could possibly use this iss...

USN-2724-1 qemu, qemu-kvm vulnerabilities

It was discovered that QEMU incorrectly handled a PRDT with zero complete sectors in the IDE functionality. A malicious guest could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. CVE-2014-9718 Donghai Zhu discovered that QEMU...

Fedora 23 : qemu-2.4.0-1.fc23 (2015-13358)

Rebased to version 2.4.0 Support for virtio-gpu, 2D only Support for virtio-based keyboard/mouse/tablet emulation x86 support for memory hot-unplug - ACPI v5.1 table support for 'virt' board CVE-2015-3209: pcnet: multi-tmd buffer overflow in the tx path bz 1230536 CVE-2015-3214: i8254: out-of-...

QEMU 'virtio-serial-bus.c' Buffer Overflow Vulnerability

QEMU is a simulation processor software developed by French programmer Fabrice Bellard. The software is fast and cross-platform. A local buffer overflow vulnerability exists in QEMU, which can be exploited by an attacker to execute arbitrary code in an affected application or cause a denial of...

Linux kernel 'virtio-net' buffer overflow vulnerability

The Linux kernel is the kernel used by the operating system Linux, released by the Linux Foundation in the United States. A buffer overflow vulnerability exists in the Linux kernel, which can be exploited by an attacker to execute arbitrary code in an affected application or cause a denial of...

PT-2015-7062

Name of the Vulnerable Software and Affected Versions QEMU versions prior to 2.4.0 Description The issue allows a guest user to cause a denial of service, resulting in the QEMU process crashing. This can be achieved by sending a crafted virtio control message. A user logged on to the guest OS can...