Fedora: Security Advisory for libslirp (FEDORA-2020-1608d52724)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 31 Update: libslirp-4.1.0-2.fc31

A general purpose TCP-IP emulator used by virtual machine hypervisors to provide virtual networking services...

Fedora: Security Advisory for libslirp (FEDORA-2020-30c45be10c)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 32 Update: libslirp-4.2.0-2.fc32

A general purpose TCP-IP emulator used by virtual machine hypervisors to provide virtual networking services...

VMSA-2020-0008 : VMware ESXi patches address Stored Cross-Site Scripting (XSS) vulnerability

a. VMware ESXi patches address Stored Cross-Site Scripting XSS vulnerability CVE-2020-3955 Description : The VMware ESXi Host Client does not properly neutralize script-related HTML when viewing virtual machines attributes. A malicious actor with access to modify the system properties of a virtua...

LY Corporation: Spring Actuator endpoints publicly available, leading to account takeover

Due to insufficient access controls, it was possible to access the Spring Boot Actuator endpoints /heapdump and /env. The /heapdump endpoint leaks data from the Java Virtual Machine, leading to disclosure of admin credentials, user tokens and a combination of other data. This endpoint was not...

Microsoft Windows Hyper-V Remote Code Execution Vulnerability (CNVD-2020-23433)

Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation, U.S.A. Microsoft Windows is a set of operating systems for personal devices.Microsoft Windows Server is a set of server operating systems. Windows Hyper-V is one of the virtualization products that supports...

CVE-2020-11741

A flaw was found in Xenoprof in the Xen virtual machine through version 4.13.x, where it allows guest OS users, with active profiling, to obtain sensitive information about other guests, cause a denial of service, or possibly gain privileges. For guests with “active” profiling enabled by the...

The vulnerability of Xen hypervisors relates to insufficient validation of input data, allowing attackers to trigger a service failure.

The vulnerability of Xen hypervisors is related to an error in the VMX VMEntry function, which does not handle certain cases correctly. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

Linux 5.3 Insecure Root Path Handling Exploit

Linux versions 5.3 and above appear to have an issue where iouring suffers from insecure handling of the root directory for path lookups. Linux =5.3: iouring: insecure handling of root directory for path lookups When I saw today, I realized that this is not just a small correctness issue, but als...

Arbitrary Code Execution

qemu is vulnerable to arbitrary code execution. A heap overflow flaw was found in the way QEMU-KVM emulated the e1000 network interface card. A privileged guest user in a virtual machine whose network interface is configured to use the e1000 emulated driver could use this flaw to crash the host o...

Authorization Bypass

kernel is vulnerable to authorization bypass. In KVM Kernel-based Virtual Machine environments using raw format virtio disks backed by a partition or LVM volume, a privileged guest user could bypass intended restrictions and issue read and write requests and other SCSI commands on the host, and...

Arbitrary Code Execution

openjdk is vulnerable to arbitrary code execution. A flaw was found in the HotSpot component in OpenJDK. Certain bytecode instructions confused the memory management within the Java Virtual Machine JVM, which could lead to heap corruption...

Denial Of Service (DoS)

kernel is vulnerable to denial of service DoS. The vulnerability exists as a flaw was found in the way KVM Kernel-based Virtual Machine handled the reloading of fs and gs segment registers when they had invalid selectors. A privileged host user with access to "/dev/kvm" could use this flaw to cra...

Denial Of Service (DoS)

java is vulnerable to denial of service DoS. The vulenrability exists as a flaw was found in the way that the Java Virtual Machine JVM handled temporary font files. A malicious applet could use this flaw to use large amounts of disk space, causing a denial of service...

Old files are not removed after a migration of virtual machine storage in Windows 8.1 or Windows Server 2012 R2

Old files are not removed after a migration of virtual machine storage in Windows 8.1 or Windows Server 2012 R2 This article describes an issue that occurs after you perform a migration of virtual machine storage in Windows 8.1 or Windows Server 2012 R2. An update is available to resolve this...

March 2016 update for Windows Server 2012 R2 clusters to fix several issues

March 2016 update for Windows Server 2012 R2 clusters to fix several issues This article describes issues in which Data Protection Manager DPM filter driver can't track changes on Cluster Shared Volumes CSV or virtual machine VM configuration resource online fails due to invalid resource state in...

Linux kernel KVM Competitive Conditions Issue Vulnerability

Linux kernel is the kernel used by Linux, the open source operating system released by the Linux Foundation in the United States. A security vulnerability exists in the KVM's of the Linux kernel for PowerPC processors, which stems from the program's failure to properly separate the state of the...

virt:rhel security and bug fix update

An update is available for libiscsi, netcf, sgabios. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Kernel-based Virtual Machine KVM offers a full virtualizatio...

ROHNP: Key Extraction Side Channel in Multiple Crypto Libraries

Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 allows a memory-cache side-channel attack on ECDSA signatures that can be mitigated through the use of blinding during the signing process in the gcryeccecdsasign function in cipher/ecc-ecdsa.c, aka the Return Of the Hidden Number Problem or ROHNP. T...