USN-4300-1 linux, linux-aws, linux-gcp, linux-gcp-5.3, linux-gke-5.3, linux-hwe, linux-kvm, linux-oracle, linux-raspi2, linux-raspi2-5.3, linux-azure, linux-azure-5.3 vulnerabilities

It was discovered that the KVM implementation in the Linux kernel, when paravirtual TLB flushes are enabled in guests, the hypervisor in some situations could miss deferred TLB flushes or otherwise mishandle them. An attacker in a guest VM could use this to expose sensitive information read memor...

HP ThinPro 6.x / 7.x Information Disclosure

HP ThinPro - Information disclosure =============================================================================== Identifiers ------------------------------------------------- CVE-2019-16285 CVSSv3 score ------------------------------------------------- 6.1 AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N...

Important: kernel

Issue Overview: A stack buffer overflow issue was found in the getrawsocket routine of the Host kernel accelerator for virtio net vhost-net driver. It could occur while doing an ictolVHOSTNETSETBACKEND call, and retrieving socket name in a kernel stack variable via getrawsocket. A user able to...

Defying Covid-19’s Pall: Pwn2Own Goes Virtual

Covid-19 has brought the world to grinding halt, but for the hacking competition Pwn2Own, that wasn’t the case. The event, planned for CanSecWest this week in Vancouver, went virtual along with the conference itself. Faced with travel restrictions and new social-distancing guidelines, contestants...

EulerOS Virtualization 3.0.2.2 : e2fsprogs (EulerOS-SA-2020-1272)

According to the version of the e2fsprogs packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially crafted ext4...

EulerOS Virtualization 3.0.2.2 : sqlite (EulerOS-SA-2020-1280)

According to the version of the sqlite packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode function when handling invalid...

EulerOS Virtualization 3.0.2.2 : python (EulerOS-SA-2020-1275)

According to the versions of the python packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The email modu...

EulerOS Virtualization 3.0.2.2 : python-urllib3 (EulerOS-SA-2020-1277)

According to the version of the python-urllib3 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request...

EulerOS Virtualization 3.0.2.2 : curl (EulerOS-SA-2020-1271)

According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through...

EulerOS Virtualization 3.0.2.2 : kernel (EulerOS-SA-2020-1269)

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - In the tun subsystem in the Linux kernel before 4.13.14, devgetvalidname is not called before registernetdevice. This allows loca...

EulerOS Virtualization 3.0.2.2 : dhcp (EulerOS-SA-2020-1273)

According to the version of the dhcp packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - There had existed in one of the ISC BIND libraries a bug in a function that was used by dhcpd when operating in DHCPv6 mode. There was...

EulerOS Virtualization 3.0.2.2 : rsyslog (EulerOS-SA-2020-1276)

According to the versions of the rsyslog packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in Rsyslog v8.1908.0. contrib/pmcisconames/pmcisconames.c has a heap overflow in the parser for Cisco lo...

EulerOS Virtualization 3.0.2.2 : curl-openssl (EulerOS-SA-2020-1278)

According to the versions of the curl-openssl package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4...

EulerOS Virtualization 3.0.2.2 : libssh2 (EulerOS-SA-2020-1282)

According to the version of the libssh2 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - In libssh2 v1.9.0 and earlier versions, the SSHMSGDISCONNECT logic in packet.c has an integer overflow in a bounds check, enabling a...

EulerOS Virtualization 3.0.2.2 : dhcp-noddns (EulerOS-SA-2020-1267)

According to the version of the dhcp-noddns packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - There had existed in one of the ISC BIND libraries a bug in a function that was used by dhcpd when operating in DHCPv6 mode...

EulerOS Virtualization 3.0.2.2 : libxml2 (EulerOS-SA-2020-1268)

According to the versions of the libxml2 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictAddString function in dict.c...

EulerOS Virtualization 3.0.2.2 : wget (EulerOS-SA-2020-1281)

According to the version of the wget package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - A CRLF injection flaw was found in the way wget handled URLs. A remote attacker could use this flaw to inject arbitrary HTTP headers in...

EulerOS Virtualization 3.0.2.2 : sudo (EulerOS-SA-2020-1279)

According to the version of the sudo package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM...

Huawei EulerOS: Security Advisory for sqlite (EulerOS-SA-2020-1280)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Kernel: KVM: export MSR_IA32_TSX_CTRL to guest - incomplete fix for TAA (CVE-2019-11135)

A flaw was found in the fix for CVE-2019-11135, the way Intel CPUs handle speculative execution of instructions when a TSX Asynchronous Abort TAA error occurs. When a guest is running on a host CPU affected by the TAA flaw TAANO=0, but is not affected by the MDS issue MDSNO=1, the guest was to...