QEMU vnc set_pixel_format bits_per_pixel Null Pointer Dereference (CVE-2014-7815)

A null pointer dereference vulnerability has been found in QEMU vnc. The vulnerability is due to insufficient checking of an initialized buffer. A remote attacker could exploit this vulnerability by setting bitsperpixel to a value that is less than 8. Successful exploitation could lead to a denia...

OracleVM 2.2 : kernel (OVMSA-2013-0039)

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2013-0039 for details. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The package checks in this plugin were extracted from OracleVM Security Advisory...

OracleVM 3.1 : xen (OVMSA-2014-0002)

The remote OracleVM system is missing necessary patches to address critical security updates : - flask: restrict allocations done by hypercall interface Other than in 4.2 and newer, we're not having an overflow issue here, but uncontrolled exposure of the operations opens the host to be driven ou...

OracleVM 3.1 : xen (OVMSA-2013-0068)

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2013-0068 for details. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The package checks in this plugin were extracted from OracleVM Security Advisory...

OracleVM 3.2 : xen (OVMSA-2013-0031)

The remote OracleVM system is missing necessary patches to address critical security updates : - defer event channel bucket pointer store until after XSM checks Otherwise a dangling pointer can be left, which would cause subsequent memory corruption as soon as the space got re-allocated for some...

OracleVM 3.2 : xen (OVMSA-2014-0041) (POODLE)

The remote OracleVM system is missing necessary patches to address critical security updates : - xend: disable sslv3 due to CVE-2014-3566 - Keep the maxmem and memory same in vm.cfg Singed-off-by: Annie Li %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The package checks in this plugin were...

OracleVM 3.2 : xen (OVMSA-2013-0069)

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2013-0069 for details. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The package checks in this plugin were extracted from OracleVM Security Advisory...

Updated kernel packages fix security vulnerabilities

This kernel update is based on upstream -longterm 3.14.24 and fixes the following security issues: The WRMSR processing functionality in the KVM subsystem in the Linux kernel through 3.17.2 does not properly handle the writing of a non- canonical address to a model-specific register, which allows...

RHEL 5 : vdsm (RHSA-2010:0473)

Updated vdsm packages that fix one security issue, various bugs, and add two enhancements are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System CVSS base score, which giv...

VMware vCenter Converter 5.1.x < 5.1.2 / 5.5.x < 5.5.3 Multiple Vulnerabilities (VMSA-2014-0010) (Shellshock)

The version of VMware vCenter Converter installed on the remote Windows host is 5.1.x prior to 5.1.2 or 5.5.x prior to 5.5.3. It is, therefore, affected by the following vulnerabilities : - A command injection vulnerability exists in GNU Bash known as Shellshock, which is due to the processing of...

RHEL 6 : kernel (RHSA-2014:1843)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2014:1843 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. A race condition flaw was found in the way the Linux...

kernel: kvm: vmx: invept vm exit not handled

It was found that the Linux kernel's KVM subsystem did not handle the VM exits gracefully for the invept Invalidate Translations Derived from EPT instructions. On hosts with an Intel processor and invept VM exit support, an unprivileged guest user could use these instructions to crash the guest...

DEBIAN-CVE-2014-3690

arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel before 3.17.2 on Intel processors does not ensure that the value in the CR4 control register remains the same after a VM entry, which allows host OS users to kill arbitrary processes or cause a denial of service system disruption by...

UBUNTU-CVE-2014-3690

arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel before 3.17.2 on Intel processors does not ensure that the value in the CR4 control register remains the same after a VM entry, which allows host OS users to kill arbitrary processes or cause a denial of service system disruption by...

[SE-2014-01] Missing patches / inaccurate information regarding Oracle Oct CPU

Hello All, We've been recently informed by a 3rd party that Oracle planned to release fixes for the vulnerabilities covered by our SE-2014-01 1 project in Nov 2014. We initially thought that someone mistakenly took Oct for Nov Oracle CPU was released on Oct 14, 2014, but the credibility of the...

Failed to lock file on VM PowerOn (SureBackup\Instant Recovery)

Challenge SureBackup or Instant VM Recovery fails with an error relating to failure to power on. The SureBackup log file contains the following error: Info VimApi PowerOffVM, type "VirtualMachine", ref "vm-xxxx" Error SureBackup operation has been failed Info VimApi PowerOffVM, type...

kernel: kvm: vmx: invvpid vm exit not handled

It was found that the Linux kernel's KVM subsystem did not handle the VM exits gracefully for the invvpid Invalidate Translations Based on VPID instructions. On hosts with an Intel processor and invppid VM exit support, an unprivileged guest user could use these instructions to crash the guest...

Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2014-3082)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-3082 advisory. - ALSA: control: Don't access controls outside of protected regions Lars-Peter Clausen Orabug: 19817786 CVE-2014-4653 CVE-2014-4654 CVE-2014-4655 -...

Unbreakable Enterprise kernel security update

2.6.39-400.215.11 - ALSA: control: Don't access controls outside of protected regions Lars-Peter Clausen Orabug: 19817786 CVE-2014-4653 CVE-2014-4654 CVE-2014-4655 - ALSA: control: Fix replacing user controls Lars-Peter Clausen Orabug: 19817748 CVE-2014-4653 CVE-2014-4654 CVE-2014-4655 - kvm:...

Unbreakable Enterprise kernel Security update

kernel-uek 2.6.32-400.36.9uek - ALSA: control: Don't access controls outside of protected regions Lars-Peter Clausen Orabug: 19817787 CVE-2014-4653 CVE-2014-4654 CVE-2014-4655 - ALSA: control: Fix replacing user controls Lars-Peter Clausen Orabug: 19817749 CVE-2014-4653 CVE-2014-4654 CVE-2014-465...