rpm package
suse/xen&distro=SUSE Linux Enterprise Server for SAP Applications 12
pkg:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012
Vulnerabilities (187)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2016-9381 | Hig | 7.5 | < 4.4.4_05-22.25.1 | 4.4.4_05-22.25.1 | Jan 23, 2017 | Race condition in QEMU in Xen allows local x86 HVM guest OS administrators to gain privileges by changing certain data on shared rings, aka a "double fetch" vulnerability. | |
| CVE-2016-9380 | Hig | 7.5 | < 4.4.4_05-22.25.1 | 4.4.4_05-22.25.1 | Jan 23, 2017 | The pygrub boot loader emulator in Xen, when nul-delimited output format is requested, allows local pygrub-using guest OS administrators to read or delete arbitrary files on the host via NUL bytes in the bootloader configuration file. | |
| CVE-2016-9379 | Hig | 7.9 | < 4.4.4_05-22.25.1 | 4.4.4_05-22.25.1 | Jan 23, 2017 | The pygrub boot loader emulator in Xen, when S-expression output format is requested, allows local pygrub-using guest OS administrators to read or delete arbitrary files on the host via string quotes and S-expressions in the bootloader configuration file. | |
| CVE-2016-9776 | Med | 5.5 | < 4.4.4_14-22.33.1 | 4.4.4_14-22.33.1 | Dec 29, 2016 | QEMU (aka Quick Emulator) built with the ColdFire Fast Ethernet Controller emulator support is vulnerable to an infinite loop issue. It could occur while receiving packets in 'mcf_fec_receive'. A privileged user/process inside guest could use this issue to crash the QEMU process | |
| CVE-2016-2198 | Med | 5.5 | < 4.4.4_02-22.19.1 | 4.4.4_02-22.19.1 | Dec 29, 2016 | QEMU (aka Quick Emulator) built with the USB EHCI emulation support is vulnerable to a null pointer dereference flaw. It could occur when an application attempts to write to EHCI capabilities registers. A privileged user inside quest could use this flaw to crash the QEMU process | |
| CVE-2016-1981 | Med | 5.5 | < 4.4.4_02-22.19.1 | 4.4.4_02-22.19.1 | Dec 29, 2016 | QEMU (aka Quick Emulator) built with the e1000 NIC emulation support is vulnerable to an infinite loop issue. It could occur while processing data via transmit or receive descriptors, provided the initial receive/transmit descriptor head (TDH/RDH) is set outside the allocated des | |
| CVE-2016-1922 | Med | 5.5 | < 4.4.4_02-22.19.1 | 4.4.4_02-22.19.1 | Dec 29, 2016 | QEMU (aka Quick Emulator) built with the TPR optimization for 32-bit Windows guests support is vulnerable to a null pointer dereference flaw. It occurs while doing I/O port write operations via hmp interface. In that, 'current_cpu' remains null, which leads to the null pointer de | |
| CVE-2015-8818 | Med | 5.5 | < 4.4.4_02-22.19.1 | 4.4.4_02-22.19.1 | Dec 29, 2016 | The cpu_physical_memory_write_rom_internal function in exec.c in QEMU (aka Quick Emulator) does not properly skip MMIO regions, which allows local privileged guest users to cause a denial of service (guest crash) via unspecified vectors. | |
| CVE-2015-8817 | Med | 5.5 | < 4.4.4_02-22.19.1 | 4.4.4_02-22.19.1 | Dec 29, 2016 | QEMU (aka Quick Emulator) built to use 'address_space_translate' to map an address to a MemoryRegionSection is vulnerable to an OOB r/w access issue. It could occur while doing pci_dma_read/write calls. Affects QEMU versions >= 1.6.0 and <= 2.3.1. A privileged user inside guest c | |
| CVE-2015-8745 | Med | 5.5 | < 4.4.4_02-22.19.1 | 4.4.4_02-22.19.1 | Dec 29, 2016 | QEMU (aka Quick Emulator) built with a VMWARE VMXNET3 paravirtual NIC emulator support is vulnerable to crash issue. It could occur while reading Interrupt Mask Registers (IMR). A privileged (CAP_SYS_RAWIO) guest user could use this flaw to crash the QEMU process instance resulti | |
| CVE-2015-8744 | Med | 5.5 | < 4.4.4_02-22.19.1 | 4.4.4_02-22.19.1 | Dec 29, 2016 | QEMU (aka Quick Emulator) built with a VMWARE VMXNET3 paravirtual NIC emulator support is vulnerable to crash issue. It occurs when a guest sends a Layer-2 packet smaller than 22 bytes. A privileged (CAP_SYS_RAWIO) guest user could use this flaw to crash the QEMU process instance | |
| CVE-2015-8743 | Hig | 7.1 | < 4.4.4_02-22.19.1 | 4.4.4_02-22.19.1 | Dec 29, 2016 | QEMU (aka Quick Emulator) built with the NE2000 device emulation support is vulnerable to an OOB r/w access issue. It could occur while performing 'ioport' r/w operations. A privileged (CAP_SYS_RAWIO) user/process could use this flaw to leak or corrupt QEMU memory bytes. | |
| CVE-2016-9921 | Med | 6.5 | < 4.4.4_14-22.33.1 | 4.4.4_14-22.33.1 | Dec 23, 2016 | Quick emulator (Qemu) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to a divide by zero issue. It could occur while copying VGA data when cirrus graphics mode was set to be VGA. A privileged user inside guest could use this flaw to crash the Qemu process inst | |
| CVE-2016-9911 | Med | 6.5 | < 4.4.4_14-22.33.1 | 4.4.4_14-22.33.1 | Dec 23, 2016 | Quick Emulator (Qemu) built with the USB EHCI Emulation support is vulnerable to a memory leakage issue. It could occur while processing packet data in 'ehci_init_transfer'. A guest user/process could use this issue to leak host memory, resulting in DoS for a host. | |
| CVE-2016-9907 | Med | 6.5 | < 4.4.4_14-22.33.1 | 4.4.4_14-22.33.1 | Dec 23, 2016 | Quick Emulator (Qemu) built with the USB redirector usb-guest support is vulnerable to a memory leakage flaw. It could occur while destroying the USB redirector in 'usbredir_handle_destroy'. A guest user/process could use this issue to leak host memory, resulting in DoS for a hos | |
| CVE-2016-6888 | Med | 4.4 | < 4.4.4_04-22.22.2 | 4.4.4_04-22.22.2 | Dec 10, 2016 | Integer overflow in the net_tx_pkt_init function in hw/net/net_tx_pkt.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (QEMU process crash) via the maximum fragmentation count, which triggers an unchecked multiplication and NULL poi | |
| CVE-2016-6836 | Med | 6.0 | < 4.4.4_04-22.22.2 | 4.4.4_04-22.22.2 | Dec 10, 2016 | The vmxnet3_complete_packet function in hw/net/vmxnet3.c in QEMU (aka Quick Emulator) allows local guest OS administrators to obtain sensitive host memory information by leveraging failure to initialize the txcq_descr object. | |
| CVE-2016-6835 | Med | 6.0 | < 4.4.4_04-22.22.2 | 4.4.4_04-22.22.2 | Dec 10, 2016 | The vmxnet_tx_pkt_parse_headers function in hw/net/vmxnet_tx_pkt.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (buffer over-read) by leveraging failure to check IP header length. | |
| CVE-2016-6834 | Med | 4.4 | < 4.4.4_04-22.22.2 | 4.4.4_04-22.22.2 | Dec 10, 2016 | The net_tx_pkt_do_sw_fragmentation function in hw/net/net_tx_pkt.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via a zero length for the current fragment length. | |
| CVE-2016-6833 | Med | 4.4 | < 4.4.4_04-22.22.2 | 4.4.4_04-22.22.2 | Dec 10, 2016 | Use-after-free vulnerability in the vmxnet3_io_bar0_write function in hw/net/vmxnet3.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (QEMU instance crash) by leveraging failure to check if the device is active. |
- affected < 4.4.4_05-22.25.1fixed 4.4.4_05-22.25.1
Race condition in QEMU in Xen allows local x86 HVM guest OS administrators to gain privileges by changing certain data on shared rings, aka a "double fetch" vulnerability.
- affected < 4.4.4_05-22.25.1fixed 4.4.4_05-22.25.1
The pygrub boot loader emulator in Xen, when nul-delimited output format is requested, allows local pygrub-using guest OS administrators to read or delete arbitrary files on the host via NUL bytes in the bootloader configuration file.
- affected < 4.4.4_05-22.25.1fixed 4.4.4_05-22.25.1
The pygrub boot loader emulator in Xen, when S-expression output format is requested, allows local pygrub-using guest OS administrators to read or delete arbitrary files on the host via string quotes and S-expressions in the bootloader configuration file.
- affected < 4.4.4_14-22.33.1fixed 4.4.4_14-22.33.1
QEMU (aka Quick Emulator) built with the ColdFire Fast Ethernet Controller emulator support is vulnerable to an infinite loop issue. It could occur while receiving packets in 'mcf_fec_receive'. A privileged user/process inside guest could use this issue to crash the QEMU process
- affected < 4.4.4_02-22.19.1fixed 4.4.4_02-22.19.1
QEMU (aka Quick Emulator) built with the USB EHCI emulation support is vulnerable to a null pointer dereference flaw. It could occur when an application attempts to write to EHCI capabilities registers. A privileged user inside quest could use this flaw to crash the QEMU process
- affected < 4.4.4_02-22.19.1fixed 4.4.4_02-22.19.1
QEMU (aka Quick Emulator) built with the e1000 NIC emulation support is vulnerable to an infinite loop issue. It could occur while processing data via transmit or receive descriptors, provided the initial receive/transmit descriptor head (TDH/RDH) is set outside the allocated des
- affected < 4.4.4_02-22.19.1fixed 4.4.4_02-22.19.1
QEMU (aka Quick Emulator) built with the TPR optimization for 32-bit Windows guests support is vulnerable to a null pointer dereference flaw. It occurs while doing I/O port write operations via hmp interface. In that, 'current_cpu' remains null, which leads to the null pointer de
- affected < 4.4.4_02-22.19.1fixed 4.4.4_02-22.19.1
The cpu_physical_memory_write_rom_internal function in exec.c in QEMU (aka Quick Emulator) does not properly skip MMIO regions, which allows local privileged guest users to cause a denial of service (guest crash) via unspecified vectors.
- affected < 4.4.4_02-22.19.1fixed 4.4.4_02-22.19.1
QEMU (aka Quick Emulator) built to use 'address_space_translate' to map an address to a MemoryRegionSection is vulnerable to an OOB r/w access issue. It could occur while doing pci_dma_read/write calls. Affects QEMU versions >= 1.6.0 and <= 2.3.1. A privileged user inside guest c
- affected < 4.4.4_02-22.19.1fixed 4.4.4_02-22.19.1
QEMU (aka Quick Emulator) built with a VMWARE VMXNET3 paravirtual NIC emulator support is vulnerable to crash issue. It could occur while reading Interrupt Mask Registers (IMR). A privileged (CAP_SYS_RAWIO) guest user could use this flaw to crash the QEMU process instance resulti
- affected < 4.4.4_02-22.19.1fixed 4.4.4_02-22.19.1
QEMU (aka Quick Emulator) built with a VMWARE VMXNET3 paravirtual NIC emulator support is vulnerable to crash issue. It occurs when a guest sends a Layer-2 packet smaller than 22 bytes. A privileged (CAP_SYS_RAWIO) guest user could use this flaw to crash the QEMU process instance
- affected < 4.4.4_02-22.19.1fixed 4.4.4_02-22.19.1
QEMU (aka Quick Emulator) built with the NE2000 device emulation support is vulnerable to an OOB r/w access issue. It could occur while performing 'ioport' r/w operations. A privileged (CAP_SYS_RAWIO) user/process could use this flaw to leak or corrupt QEMU memory bytes.
- affected < 4.4.4_14-22.33.1fixed 4.4.4_14-22.33.1
Quick emulator (Qemu) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to a divide by zero issue. It could occur while copying VGA data when cirrus graphics mode was set to be VGA. A privileged user inside guest could use this flaw to crash the Qemu process inst
- affected < 4.4.4_14-22.33.1fixed 4.4.4_14-22.33.1
Quick Emulator (Qemu) built with the USB EHCI Emulation support is vulnerable to a memory leakage issue. It could occur while processing packet data in 'ehci_init_transfer'. A guest user/process could use this issue to leak host memory, resulting in DoS for a host.
- affected < 4.4.4_14-22.33.1fixed 4.4.4_14-22.33.1
Quick Emulator (Qemu) built with the USB redirector usb-guest support is vulnerable to a memory leakage flaw. It could occur while destroying the USB redirector in 'usbredir_handle_destroy'. A guest user/process could use this issue to leak host memory, resulting in DoS for a hos
- affected < 4.4.4_04-22.22.2fixed 4.4.4_04-22.22.2
Integer overflow in the net_tx_pkt_init function in hw/net/net_tx_pkt.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (QEMU process crash) via the maximum fragmentation count, which triggers an unchecked multiplication and NULL poi
- affected < 4.4.4_04-22.22.2fixed 4.4.4_04-22.22.2
The vmxnet3_complete_packet function in hw/net/vmxnet3.c in QEMU (aka Quick Emulator) allows local guest OS administrators to obtain sensitive host memory information by leveraging failure to initialize the txcq_descr object.
- affected < 4.4.4_04-22.22.2fixed 4.4.4_04-22.22.2
The vmxnet_tx_pkt_parse_headers function in hw/net/vmxnet_tx_pkt.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (buffer over-read) by leveraging failure to check IP header length.
- affected < 4.4.4_04-22.22.2fixed 4.4.4_04-22.22.2
The net_tx_pkt_do_sw_fragmentation function in hw/net/net_tx_pkt.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via a zero length for the current fragment length.
- affected < 4.4.4_04-22.22.2fixed 4.4.4_04-22.22.2
Use-after-free vulnerability in the vmxnet3_io_bar0_write function in hw/net/vmxnet3.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (QEMU instance crash) by leveraging failure to check if the device is active.
Page 4 of 10