The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2019:3403 advisory.

  - The containers/image library used by the container tools Podman, Buildah, and Skopeo in Red Hat Enterprise     Linux version 8 and CRI-O in OpenShift Container Platform, does not enforce TLS connections to the     container registry authorization service. An attacker could use this vulnerability to launch a MiTM attack     and steal login credentials or bearer tokens. (CVE-2019-10214)

  - ip_reass in ip_input.c in libslirp 4.0.0 has a heap-based buffer overflow via a large packet because it     mishandles a case involving the first fragment. (CVE-2019-14378)

  - Cloud Native Computing Foundation (CNCF) CNI (Container Networking Interface) 0.7.4 has a network firewall     misconfiguration which affects Kubernetes. The CNI 'portmap' plugin, used to setup HostPorts for CNI,     inserts rules at the front of the iptables nat chains; which take precedence over the KUBE- SERVICES     chain. Because of this, the HostPort/portmap rule could match incoming traffic even if there were better     fitting, more specific service definition rules like NodePorts later in the chain. The issue is fixed in     CNI 0.7.5 and Kubernetes 1.11.9, 1.12.7, 1.13.5, and 1.14.0. (CVE-2019-9946)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for xen to version 4.11.2 fixes the following issues :

Security issues fixed :

CVE-2019-15890: Fixed a use-after-free in SLiRP networking implementation of QEMU emulator which could have led to Denial of Service (bsc#1149813).

CVE-2019-12068: Fixed an issue in lsi which could lead to an infinite loop and denial of service (bsc#1146874).

CVE-2019-14378: Fixed a heap buffer overflow in SLiRp networking implementation of QEMU emulator which could have led to execution of arbitrary code with privileges of the QEMU process (bsc#1143797).

Other issues fixed: Fixed an HPS bug which did not allow to install Windows Server 2016 with 2 CPUs setting or above (bsc#1137717).

Fixed a segmentation fault in Libvrtd during live migration to a VM (bsc#1145774).

Fixed an issue where libxenlight could not create new domain (bsc#1131811).

Fixed an issue where attached pci devices were lost after reboot (bsc#1129642).

Fixed an issue where Xen could not pre-allocate 1 shadow page (bsc#1145240).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:3787 advisory.

    KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on a variety of     architectures. The qemu-kvm-rhev packages provide the user-space component for running virtual machines     that use KVM in environments managed by Red Hat products.

    Security Fix(es):

    * QEMU: slirp: heap buffer overflow during packet reassembly (CVE-2019-14378)

    * QEMU: qxl: null pointer dereference while releasing spice resources (CVE-2019-12155)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:0366 advisory.

  - TSX Asynchronous Abort condition on some CPUs utilizing speculative execution may allow an authenticated     user to potentially enable information disclosure via a side channel with local access. (CVE-2019-11135)

  - ip_reass in ip_input.c in libslirp 4.0.0 has a heap-based buffer overflow via a large packet because it     mishandles a case involving the first fragment. (CVE-2019-14378)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ip_reass in ip_input.c in libslirp 4.0.0 has a heap-based buffer overflow via a large packet because it mishandles a case involving the first fragment. (CVE-2019-14378)

This update for qemu fixes the following issues :

Security issues fixed :

  - CVE-2019-14378: Security fix for heap overflow in     ip_reass on big packet input (bsc#1143794).

  - CVE-2019-12155: Security fix for NULL pointer     dereference while releasing spice resources     (bsc#1135902).

  - CVE-2019-13164: Security fix for qemu-bridge-helper ACL     can be bypassed when names are too long (bsc#1140402).

  - CVE-2019-5008: Fix DoS (NULL pointer dereference) in     sparc64 virtual machine possible through guest device     driver (bsc#1133031).

Bug fixes and enhancements :

  - Upstream tweaked SnowRidge-Server vcpu model to now be     simply Snowridge (jsc#SLE-4883)

  - Add SnowRidge-Server vcpu model (jsc#SLE-4883)

  - Add in documentation about md-clear feature     (bsc#1138534)

  - Fix SEV issue where older machine type is not processed     correctly (bsc#1144087)

  - Fix case of a bad pointer in Xen PV usb support code     (bsc#1128106)

  - Further refine arch-capabilities handling to help with     security and performance in Intel hosts (bsc#1134883,     bsc#1135210) (fate#327764)

  - Add support for one more security/performance related     vcpu feature (bsc#1136778) (fate#327796)

  - Ignore csske for expanding the cpu model (bsc#1136540)

This update was imported from the SUSE:SLE-15-SP1:Update update project.

Several vulnerabilities were found in QEMU, a fast processor emulator (notably used in KVM and Xen HVM virtualization).

CVE-2016-5126

Heap-based buffer overflow in the iscsi_aio_ioctl function in block/iscsi.c in QEMU allows local guest OS users to cause a denial of service (QEMU process crash) or possibly execute arbitrary code via a crafted iSCSI asynchronous I/O ioctl call.

CVE-2016-5403

The virtqueue_pop function in hw/virtio/virtio.c in QEMU allows local guest OS administrators to cause a denial of service (memory consumption and QEMU process crash) by submitting requests without waiting for completion.

CVE-2017-9375

QEMU, when built with USB xHCI controller emulator support, allows local guest OS privileged users to cause a denial of service (infinite recursive call) via vectors involving control transfer descriptors sequencing.

CVE-2019-12068

QEMU scsi disk backend: lsi: exit infinite loop while executing script

CVE-2019-12155

interface_release_resource in hw/display/qxl.c in QEMU has a NULL pointer dereference.

CVE-2019-13164

qemu-bridge-helper.c in QEMU does not ensure that a network interface name (obtained from bridge.conf or a --br=bridge option) is limited to the IFNAMSIZ size, which can lead to an ACL bypass.

CVE-2019-14378

ip_reass in ip_input.c in libslirp 4.0.0 has a heap-based buffer overflow via a large packet because it mishandles a case involving the first fragment.

CVE-2019-15890

libslirp 4.0.0, as used in QEMU, has a use-after-free in ip_reass in ip_input.c.

For Debian 8 'Jessie', these problems have been fixed in version 1:2.1+dfsg-12+deb8u12.

We recommend that you upgrade your qemu packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for qemu fixes the following issues :

Security issues fixed :

CVE-2019-14378: Security fix for heap overflow in ip_reass on big packet input (bsc#1143794).

CVE-2019-12155: Security fix for NULL pointer dereference while releasing spice resources (bsc#1135902).

CVE-2019-13164: Security fix for qemu-bridge-helper ACL can be bypassed when names are too long (bsc#1140402).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote SUSE Linux SLES11 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2019:14199-1 advisory.

  - The ahci_commit_buf function in ide/ahci.c in QEMU allows attackers to cause a denial of service (NULL     dereference) when the command header 'ad->cur_cmd' is null. (CVE-2019-12067)

  - In QEMU 1:4.1-1, 1:2.1+dfsg-12+deb8u6, 1:2.8+dfsg-6+deb9u8, 1:3.1+dfsg-8~deb10u1, 1:3.1+dfsg-8+deb10u2,     and 1:2.1+dfsg-12+deb8u12 (fixed), when executing script in lsi_execute_script(), the LSI scsi adapter     emulator advances 's->dsp' index to read next opcode. This can lead to an infinite loop if the next opcode     is empty. Move the existing loop exit after 10k iterations so that it covers no-op opcodes as well.
    (CVE-2019-12068)

  - interface_release_resource in hw/display/qxl.c in QEMU 3.1.x through 4.0.0 has a NULL pointer dereference.
    (CVE-2019-12155)

  - ip_reass in ip_input.c in libslirp 4.0.0 has a heap-based buffer overflow via a large packet because it     mishandles a case involving the first fragment. (CVE-2019-14378)

  - libslirp 4.0.0, as used in QEMU 4.1.0, has a use-after-free in ip_reass in ip_input.c. (CVE-2019-15890)

  - An issue was discovered in Xen through 4.11.x allowing x86 guest OS users to cause a denial of service or     gain privileges because grant-table transfer requests are mishandled. (CVE-2019-17340)

  - An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service     or gain privileges by leveraging a page-writability race condition during addition of a passed-through PCI     device. (CVE-2019-17341)

  - An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service     or gain privileges by leveraging a race condition that arose when XENMEM_exchange was introduced.
    (CVE-2019-17342)

  - An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service     or gain privileges by leveraging incorrect use of the HVM physmap concept for PV domains. (CVE-2019-17343)

  - An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service     by leveraging a long-running operation that exists to support restartability of PTE updates.
    (CVE-2019-17344)

  - An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service     or gain privileges because of an incompatibility between Process Context Identifiers (PCID) and TLB     flushes. (CVE-2019-17346)

  - An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service     or gain privileges because a guest can manipulate its virtualised %cr4 in a way that is incompatible with     Linux (and possibly other guest kernels). (CVE-2019-17347)

  - An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service     because of an incompatibility between Process Context Identifiers (PCID) and shadow-pagetable switching.
    (CVE-2019-17348)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
184867	Rocky Linux 8 : container-tools:rhel8 (RLSA-2019:3403)	Nessus	Rocky Linux Local Security Checks	11/7/2023	11/7/2023	high
130197	SUSE SLED12 / SLES12 Security Update : xen (SUSE-SU-2019:2753-1) (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout)	Nessus	SuSE Local Security Checks	10/24/2019	12/5/2022	high
194159	RHEL 7 : qemu-kvm-rhev (RHSA-2019:3787)	Nessus	Red Hat Local Security Checks	4/28/2024	11/7/2024	high
133507	CentOS 7 : qemu-kvm (RHSA-2020:0366)	Nessus	CentOS Local Security Checks	2/6/2020	10/9/2024	high
134329	Amazon Linux 2 : qemu (ALAS-2020-1401)	Nessus	Amazon Linux Local Security Checks	3/9/2020	3/25/2024	high
128457	openSUSE Security Update : qemu (openSUSE-2019-2041)	Nessus	SuSE Local Security Checks	9/3/2019	4/30/2024	high
129105	Debian DLA-1927-1 : qemu security update	Nessus	Debian Local Security Checks	9/23/2019	4/24/2024	high
128301	SUSE SLES12 Security Update : qemu (SUSE-SU-2019:2221-1)	Nessus	SuSE Local Security Checks	8/28/2019	4/30/2024	high
150593	SUSE SLES11 Security Update : xen (SUSE-SU-2019:14199-1)	Nessus	SuSE Local Security Checks	6/10/2021	1/21/2022	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

high