virtualization_host Archives - CVE Vulnerability

CVE-2018-5968

Sun, 26 Feb 2023 06:50:31 +0000

FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 and CVE-2017-17485 deserialization flaws. This is exploitable via two different gadgets that bypass a blacklist.

The post CVE-2018-5968 appeared first on CVE Vulnerability.

CVE-2018-18559

Sun, 26 Feb 2023 06:47:50 +0000

In the Linux kernel through 4.19, a use-after-free can occur due to a race condition between fanout_add from setsockopt and bind on an AF_PACKET socket. This issue exists because of the 15fe076edea787807a7cdc168df832544b58eba6 incomplete fix for a race condition. The code mishandles a certain multithreaded case involving a packet_do_bind unregister action followed by a packet_notifier register action. Later, packet_release operates on only one of the two applicable linked lists. The attacker can achieve Program Counter control.

The post CVE-2018-18559 appeared first on CVE Vulnerability.

CVE-2018-14661

Sun, 26 Feb 2023 06:46:24 +0000

It was found that usage of snprintf function in feature/locks translator of glusterfs server 3.8.4, as shipped with Red Hat Gluster Storage, was vulnerable to a format string attack. A remote, authenticated attacker could use this flaw to cause remote denial of service.

The post CVE-2018-14661 appeared first on CVE Vulnerability.

CVE-2018-1118

Sun, 26 Feb 2023 06:45:08 +0000

Linux kernel vhost since version 4.8 does not properly initialize memory in messages passed between virtual guests and the host operating system in the vhost/vhost.c:vhost_new_msg() function. This can allow local privileged users to read some kernel memory contents when reading from the /dev/vhost-net device file.

The post CVE-2018-1118 appeared first on CVE Vulnerability.

CVE-2018-1088

Sun, 26 Feb 2023 06:45:02 +0000

A privilege escalation flaw was found in gluster 3.x snapshot scheduler. Any gluster client allowed to mount gluster volumes could also mount shared gluster storage volume and escalate privileges by scheduling malicious cronjob via symlink.

The post CVE-2018-1088 appeared first on CVE Vulnerability.

CVE-2018-10874

Sun, 26 Feb 2023 06:45:01 +0000

In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker’s control, allowing to run arbitrary code as a result.

The post CVE-2018-10874 appeared first on CVE Vulnerability.

CVE-2018-1068

Sun, 26 Feb 2023 06:44:58 +0000

A flaw was found in the Linux 4.x kernel’s implementation of 32-bit syscall interface for bridging. This allowed a privileged user to arbitrarily write to a limited range of kernel memory.

The post CVE-2018-1068 appeared first on CVE Vulnerability.

CVE-2018-10675

Sun, 26 Feb 2023 06:44:57 +0000

The do_get_mempolicy function in mm/mempolicy.c in the Linux kernel before 4.12.9 allows local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted system calls.

The post CVE-2018-10675 appeared first on CVE Vulnerability.

CVE-2020-25717

Sun, 26 Feb 2023 06:39:48 +0000

A flaw was found in the way Samba maps domain users to local users. An authenticated attacker could use this flaw to cause possible privilege escalation.

The post CVE-2020-25717 appeared first on CVE Vulnerability.

CVE-2019-14821

Sun, 26 Feb 2023 06:30:42 +0000

An out-of-bounds access issue was found in the Linux kernel, all versions through 5.3, in the way Linux kernel’s KVM hypervisor implements the Coalesced MMIO write operation. It operates on an MMIO ring buffer ‘struct kvm_coalesced_mmio’ object, wherein write indices ‘ring->first’ and ‘ring->last’ value could be supplied by a host user-space process. An unprivileged host user or process with access to ‘/dev/kvm’ device could use this flaw to crash the host kernel, resulting in a denial of service or potentially escalating privileges on the system.

The post CVE-2019-14821 appeared first on CVE Vulnerability.