Re: [Full-disclosure] How to lock up a VirtualBox host machine with a guest using tracepath over virtio-net network interface

2013-06-26 Thread Źmicier Januszkiewicz
Well, I cannot reproduce the issue on 4.2.14, but there is nothing in change logs for that version that can be related to virtio-net. They might have done a silent fix for 4.1.x branch as well. Cheers, Z. 2013/6/27 Nick Boyce > On 6/21/13, Thomas Dreibholz wrote: > > > I have discovered a pro

[Full-disclosure] [SECURITY] [DSA 2715-1] puppet security update

2013-06-26 Thread Raphael Geissert
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - - Debian Security Advisory DSA-2715-1 secur...@debian.org http://www.debian.org/security/ Raphael Geissert June 26, 2013

[Full-disclosure] CVE-2013-2210

2013-06-26 Thread Cantor, Scott
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 CVE-2013-2210: Apache Santuario XML Security for C++ contains a heap overflow during XPointer evaluation Severity: Critical Vendor: The Apache Software Foundation Versions Affected: Apache Santuario XML Security for C++ library versions prior to V

Re: [Full-disclosure] How to lock up a VirtualBox host machine with a guest using tracepath over virtio-net network interface

2013-06-26 Thread Nick Boyce
On 6/21/13, Thomas Dreibholz wrote: > I have discovered a problem with the VirtualBox virtio-net network driver > that leads to a lockup of the host machine's kernel and the need for a > hard reset to make it working again. The bug had been reported to the > VirtualBox bug tracker 8 days ago > (h

[Full-disclosure] [Security-news] SA-CONTRIB-2013-054 - Fast Permissions Administration - Access Bypass

2013-06-26 Thread security-news
View online: https://drupal.org/node/2028813 * Advisory ID: DRUPAL-SA-CONTRIB-2013-054 * Project: Fast Permissions Administration [1] (third-party module) * Version: 6.x, 7.x * Date: 2013-June-26 * Security risk: Highly critical [2] * Exploitable from: Remote * Vulnerability: Access

[Full-disclosure] [Security-news] SA-CONTRIB-2012-136 - Apache Solr Search Autocomplete - Cross Site Scripting (XSS)

2013-06-26 Thread security-news
View online: https://drupal.org/node/1762734 * Advisory ID: DRUPAL-SA-CONTRIB-2012-136 * Project: Apache Solr Autocomplete [1] (third-party module) * Version: 6.x, 7.x * Date: 2012-August-29 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Si

[Full-disclosure] [ MDVSA-2013:179 ] firefox

2013-06-26 Thread security
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 ___ Mandriva Linux Security Advisory MDVSA-2013:179 http://www.mandriva.com/en/support/security/ __

[Full-disclosure] Cisco Security Advisory: Cisco ASA Next-Generation Firewall Fragmented Traffic Denial of Service Vulnerability

2013-06-26 Thread Cisco Systems Product Security Incident Response Team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Cisco Security Advisory:Cisco ASA Next-Generation Firewall Fragmented Traffic Denial of Service Vulnerability Advisory ID: cisco-sa-20130626-ngfw http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/ cisco-sa-20130626-ngfw

[Full-disclosure] Cisco Security Advisory: Multiple Vulnerabilities in Cisco Content Security Management Appliance

2013-06-26 Thread Cisco Systems Product Security Incident Response Team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Cisco Security Advisory: Multiple Vulnerabilities in Cisco Content Security Management Appliance Advisory ID: cisco-sa-20130626-sma Revision 1.0 For Public Release 2013 June 26 16:00 UTC (GMT

[Full-disclosure] Cisco Security Advisory: Multiple Vulnerabilities in Cisco Web Security Appliance

2013-06-26 Thread Cisco Systems Product Security Incident Response Team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Cisco Security Advisory: Multiple Vulnerabilities in Cisco Web Security Appliance Advisory ID: cisco-sa-20130626-wsa Revision 1.0 For Public Release 2013 June 26 16:00 UTC (GMT

[Full-disclosure] Cisco Security Advisory: Multiple Vulnerabilities in Cisco Email Security Appliance

2013-06-26 Thread Cisco Systems Product Security Incident Response Team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Cisco Security Advisory: Multiple Vulnerabilities in Cisco Email Security Appliance Advisory ID: cisco-sa-20130626-esa Revision 1.0 For Public Release 2013 June 26 16:00 UTC (GMT

[Full-disclosure] [SECURITY] [DSA 2716-1] iceweasel security update

2013-06-26 Thread Moritz Muehlenhoff
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - - Debian Security Advisory DSA-2716-1 secur...@debian.org http://www.debian.org/security/Moritz Muehlenhoff June 26, 2013

Re: [Full-disclosure] How to lock up a VirtualBox host machine with a guest using tracepath over virtio-net network interface

2013-06-26 Thread Agostino Sarubbo
On Wednesday 26 June 2013 09:09:52 Źmicier Januszkiewicz wrote: > Can someone assign a CVE for this? Looks like this can be exploited to at > least DoS other VMs on the same host. Usually oracle make the requests if needed. -- Agostino Sarubbo Gentoo Linux Developer __

Re: [Full-disclosure] How to lock up a VirtualBox host machine with a guest using tracepath over virtio-net network interface

2013-06-26 Thread Źmicier Januszkiewicz
Hi, Tested this on Windows 7 x64 host instead (no Linux box available atm); confirmed the issue (consumes CPU and kills the host network adapter). Can someone assign a CVE for this? Looks like this can be exploited to at least DoS other VMs on the same host. 2013/6/21 Thomas Dreibholz > Hi, >