Kernel: KVM: export MSR_IA32_TSX_CTRL to guest - incomplete fix for TAA (CVE-2019-11135)

A flaw was found in the fix for CVE-2019-11135, the way Intel CPUs handle speculative execution of instructions when a TSX Asynchronous Abort TAA error occurs. When a guest is running on a host CPU affected by the TAA flaw TAANO=0, but is not affected by the MDS issue MDSNO=1, the guest was to...

Kernel: KVM: export MSR_IA32_TSX_CTRL to guest - incomplete fix for TAA (CVE-2019-11135)

A flaw was found in the fix for CVE-2019-11135, the way Intel CPUs handle speculative execution of instructions when a TSX Asynchronous Abort TAA error occurs. When a guest is running on a host CPU affected by the TAA flaw TAANO=0, but is not affected by the MDS issue MDSNO=1, the guest was to...

USN-4303-2 linux-lts-xenial, linux-aws vulnerability

USN-4303-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement HWE kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 ESM. Paulo Bonzini discovered that the KVM hypervisor implementation in the Linux kernel...

March 17, 2020—KB4541333 (OS Build 17134.1399)

None None...

VMware Workstation 15.0.x < 15.5.2 Multiple Vulnerabilities (VMSA-2020-0004)

The version of VMware Workstation installed on the remote Windows host is 15.0.x prior to 15.5.2. It is, therefore, affected by multiple vulnerabilities. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number. C Tenable Netwo...

SUSE-SU-2020:0671-1 Security update for SUSE Manager Server 4.0

This update fixes the following issues: branch-network-formula: - Update formula to include terminal naming and identification image-sync-formula: - Prevent installing xdelta3 package and disable delta functionality on SLE12 branch servers bsc1159553 mgr-osad: - Take care that osad is not disable...

EulerOS Virtualization for ARM 64 3.0.2.0 : lftp (EulerOS-SA-2020-1259)

According to the version of the lftp package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - It has been discovered that lftp up to and including version 4.8.3 does not properly sanitize remote file names, leading to ...

EulerOS Virtualization for ARM 64 3.0.2.0 : libvorbis (EulerOS-SA-2020-1247)

According to the versions of the libvorbis package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - An invalid free flaw was found in the way libvorbis handled processing of Ogg Vorbis format files. This flaw could...

EulerOS Virtualization for ARM 64 3.0.2.0 : file (EulerOS-SA-2020-1201)

According to the version of the file packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - cdfreadpropertyinfo in cdf.c in file through 5.37 does not restrict the number of CDFVECTOR elements, which allows a...

EulerOS Virtualization for ARM 64 3.0.2.0 : sssd (EulerOS-SA-2020-1209)

According to the version of the sssd packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - A flaw was found in sssd Group Policy Objects implementation. When the GPO is not readable by SSSD due to a too strict...

EulerOS Virtualization for ARM 64 3.0.2.0 : libxslt (EulerOS-SA-2020-1215)

According to the versions of the libxslt packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - numbers.c in libxslt before 1.1.29, as used in Google Chrome before 51.0.2704.63, mishandles the i format token for...

EulerOS Virtualization for ARM 64 3.0.2.0 : avahi (EulerOS-SA-2020-1228)

According to the version of the avahi packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - avahi-daemon in Avahi through 0.6.32 inadvertently responds to IPv6 unicast queries with source addresses that are not...

EulerOS Virtualization for ARM 64 3.0.2.0 : libpcap (EulerOS-SA-2020-1249)

According to the version of the libpcap package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - sf-pcapng.c in libpcap before 1.9.1 does not properly validate the PHB header length before allocating...

EulerOS Virtualization for ARM 64 3.0.2.0 : nss-softokn (EulerOS-SA-2020-1252)

According to the versions of the nss-softokn packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted...

EulerOS Virtualization for ARM 64 3.0.2.0 : freetype (EulerOS-SA-2020-1224)

According to the versions of the freetype package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - The FreeType engine is a free and portable font rendering engine, developed to provide advanced font support for a...

EulerOS Virtualization for ARM 64 3.0.2.0 : rsyslog (EulerOS-SA-2020-1218)

According to the versions of the rsyslog packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in Rsyslog v8.1908.0. contrib/pmcisconames/pmcisconames.c has a heap overflow in the parser f...

EulerOS Virtualization for ARM 64 3.0.2.0 : rsync (EulerOS-SA-2020-1257)

According to the versions of the rsync package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - The recvfiles function in receiver.c in the daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, proceeds wit...

EulerOS Virtualization for ARM 64 3.0.2.0 : cifs-utils (EulerOS-SA-2020-1253)

According to the version of the cifs-utils package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - Stack-based buffer overflow in cifskey.c or cifscreds.c in cifs-utils before 6.4, as used in pamcifscreds, allows remo...

EulerOS Virtualization for ARM 64 3.0.2.0 : binutils (EulerOS-SA-2020-1205)

According to the versions of the binutils package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - The dumprelocsinsection function in objdump.c in GNU Binutils 2.29.1 does not check for reloc count integer overflows...

EulerOS Virtualization for ARM 64 3.0.2.0 : lz4 (EulerOS-SA-2020-1262)

According to the version of the lz4 package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4write32 related to LZ4compressdestSize, affecting applications that...