openSUSE Security Update : libvirt (openSUSE-2018-358) (Spectre)

This update for libvirt and virt-manager fixes the following issues : Security issues fixed : - CVE-2017-5715: Fixes for speculative side channel attacks aka 'SpectreAttack' var2 bsc1079869. - CVE-2018-6764: Fixed guest executable code injection via libnssdns.so loaded by libvirtlxc before init...

kernel: Improper error handling of VM_SHARED hugetlbfs mapping in mm/hugetlb.c

A flaw was found in the Linux kernel when freeing pages in hugetlbfs. This could trigger a local denial of service by crashing the kernel...

Error: "This Operation Cannot be Performed Because a VDI is in Use by Some Other Operation"

Starting vm fail unable to find the disk OR Unable to start a VM error : "this operation cannot be performed because a VDI is in use by some other operation" OR Unable to start a VM , error : "The SR failed to complete the operation" OR Unable to start the VM , error : "This operation cannot be...

OracleVM 3.2 : xen (OVMSA-2018-0029) (Meltdown) (Spectre)

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2018-0029 for details. C Tenable Network Security, Inc. The package checks in this plugin were extracted from OracleVM Security Advisory OVMSA-2018-0029...

Design/Logic Flaw

MySQL for PCF tiles 1.7.x before 1.7.10 were discovered to log the AWS access key in plaintext. These credentials were logged to the Service Backup component logs, and not the system log, thus were not exposed outside the Service Backup VM...

Qualys Cloud Platform (VM, PC) 8.13 New Features

This new release of the Qualys Cloud Platform VM, PC, version 8.13, includes several new feature improvements across the apps such as the ability to test authentication records, as well as improvements to UDC’s and report options in Qualys Policy Compliance. Feature Highlights Qualys Cloud Platfo...

Sensitive data types in Veeam Backup & Replication and Veeam Backup for Microsoft 365 log files

Challenge When you open a support ticket, Veeam Customer Support specialists may request log files. These log files may contain information to which the terms of the data protection laws or internal company policies apply. Veeam Backup & Replication Veeam Backup & Replication log files may includ...

CVE-2018-1000095

A stored XSS vulnerability was discovered in ovirt-engine 4.2. Sanitation of HTML elements was not applied correctly to all fields, shows in the management console. An attacker with VM Admin permissions could use this vulnerability to launch XSS attacks against other VM or Cluster administrators...

oVirt Cross-Site Scripting Vulnerability

Red Hat Ovirt is the United States Red Hat Red Hat company's set of open source virtualization management platform , is the RHEV enterprise virtualization platform of the open source version of the ovirt-node client and overt-engine management end of the composition of the Web admin application i...

Python Scriptable Reverse Engineering Sandbox: PyREBox

PyREBox is a Python scriptable Reverse Engineering sandbox. It is based on QEMU, and its goal is to aid reverse engineering by providing dynamic analysis and debugging capabilities from a different perspective. PyREBox allows to inspect a running QEMU VM, modify its memory or registers, and to...

Solaris 10 (sparc) : 150817-04

VM Server for SPARC 3.1: ldmd patch. Date this patch was last updated by Sun : Dec/11/14 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'deprecatednasllevel.inc'; include'compat.inc'; if descriptio...

Solaris 10 (sparc) : 151934-01

VM Server for SPARC 3.2: ldmd patch. Date this patch was last updated by Sun : Jun/11/15 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'deprecatednasllevel.inc'; include'compat.inc'; if descriptio...

CVE-2018-1062

A vulnerability was discovered in oVirt 4.1.x before 4.1.9, where the combination of Enable Discard and Wipe After Delete flags for VM disks managed by oVirt, could cause a disk to be incompletely zeroed when removed from a VM. If the same storage blocks happen to be later allocated to a new disk...

CVE-2018-1062

A vulnerability was discovered in oVirt 4.1.x before 4.1.9, where the combination of Enable Discard and Wipe After Delete flags for VM disks managed by oVirt, could cause a disk to be incompletely zeroed when removed from a VM. If the same storage blocks happen to be later allocated to a new disk...

CVE-2018-1062

It was discovered that the combination of Enable Discard and Wipe After Delete flags for VM disks managed by oVirt, could cause a disk to be incompletely zeroed when removed from a VM. If the same storage blocks happen to be later allocated to a new disk attached to another VM, potentially...

CVE-2017-5188 OBS worker VM escape via relative symbolic links

The bsworker code in open build service before 20170320 followed relative symlinks, allowing reading of files outside of the package source directory during build, allowing leakage of private information...

Elasticsearch < 1.6.0 Arbitrary Code Execution Vulnerability

Elasticsearch is prone to an arbitrary code-execution vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

VeeamZIP licensing VMs in Full version of Veeam

Challenge VeeamZIP began using a license up in paid versions after 9.5.0.1536. Cause This was expected behavior, but the decision has been made to change this behavior in order to allow users to back up VMs with VeeamZIP without using a license. Solution This will be fully changed in future...

Can't import Gold VM into App Layering, it says "The virtual machine template cannot have any attached disks."

You are trying to import a new Gold VM to be an OS layer. The first thing you need to do is create a Connector. In the Connector, you see the field for Template, and you try to select your Gold VM there. When you test it, it fails saying one of these: "The virtual machine template cannot have any...

CVE-2018-1000026

Linux Linux kernel version at least v4.8 onwards, probably well before contains a Insufficient input validation vulnerability in bnx2x network card driver that can result in DoS: Network card firmware assertion takes card off-line. This attack appear to be exploitable via An attacker on a must pa...