CVE-2020-8873

CVE-2020-8873 affects Parallels Desktop 15.1.2-47123. A local attacker can escalate privileges via the xHCI component due to a lack of proper locking when performing operations on an object, enabling code execution in the hypervisor context. Connected documents confirm the vulnerability and its r...

CVE-2020-8873

This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.2-47123. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists withi...

CVE-2020-8872

CVE-2020-8872 affects Parallels Desktop (xHCI component). The flaw is a boundary check failure that can read past the end of an allocated buffer, enabling local disclosure of sensitive information. The vulnerability requires local privileged code execution on the guest to exploit, and the impact ...

CVE-2020-8873: Time-of-check Time-of-use (TOCTOU) Race Condition

This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.2-47123. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists withi...

CVE-2020-8874: Integer Overflow or Wraparound

This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.2-47123. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists withi...

CVE-2020-8872: Out-of-bounds Read

This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.1-47117. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw...

Parallels Desktop xHCI Component Buffer Overflow Vulnerability

Corel Parallels Desktop is a suite of virtual machine software for the macOS platform from Corel Canada. A buffer overflow vulnerability exists in the xHCI component in Parallels Desktop. The vulnerability originates when a networked system or product performs an operation in memory without...

Parallels Desktop xHCI Component Competitive Conditions Issue Vulnerability

Corel Parallels Desktop is a suite of virtual machine software for the macOS platform from Corel Canada. A competitive condition issue vulnerability exists in the xHCI component in Corel Parallels Desktop version 15.1.2-47123. An attacker could exploit the vulnerability to elevate privileges and...

Parallels Desktop xHCI Time-Of-Check Time-Of-Use Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the xHCI...

Parallels Desktop xHCI Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within...

Parallels Desktop xHCI Integer Overflow Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the xHCI...

Oracle VirtualBox xHCI Time-Of-Check Time-Of-Use Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Oracle VirtualBox. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the xHCI...

Oracle VirtualBox xHCI Time-Of-Check Time-Of-Use Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Oracle VirtualBox. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the xHCI...

Oracle VirtualBox xHCI Time-Of-Check Time-Of-Use Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Oracle VirtualBox. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the xHCI...

NewStart CGSL CORE 5.05 / MAIN 5.05 : ovmf Multiple Vulnerabilities (NS-SA-2019-0239)

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has ovmf packages installed that are affected by multiple vulnerabilities: - Buffer overflow in system firmware for EDK II may allow unauthenticated user to potentially enable escalation of privilege and/or denial of service vi...

Debian DLA-1927-1 : qemu security update

Several vulnerabilities were found in QEMU, a fast processor emulator notably used in KVM and Xen HVM virtualization. CVE-2016-5126 Heap-based buffer overflow in the iscsiaioioctl function in block/iscsi.c in QEMU allows local guest OS users to cause a denial of service QEMU process crash or...

Debian: Security Advisory (DLA-1927-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

FreeBSD : FreeBSD -- Bhyve out-of-bounds read in XHCI device (edf064fb-b30b-11e9-a87f-a4badb2f4699)

The pcixhcidevicedoorbell function does not validate the 'epid' and 'streamid' provided by the guest, leading to an out-of-bounds read. Impact : A misbehaving bhyve guest could crash the system or access memory that it should not be able to. C Tenable Network Security, Inc. The descriptive text a...

Denial Of Service (DoS)

edk2 is vulnerable to denial of service DoS. It is due to stack overflow in XHCI causing denial of service...

CVE-2019-5604

In FreeBSD 12.0-STABLE before r350246, 12.0-RELEASE before 12.0-RELEASE-p8, 11.3-STABLE before r350247, 11.3-RELEASE before 11.3-RELEASE-p1, and 11.2-RELEASE before 11.2-RELEASE-p12, the emulated XHCI device included with the bhyve hypervisor did not properly validate data provided by the guest,...