Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
osvGoogleOSV:RLSA-2022:1759
HistoryMay 10, 2022 - 7:59 a.m.

Moderate: virt:rhel and virt-devel:rhel security, bug fix, and enhancement update

2022-05-1007:59:57
Google
osv.dev
12

8.5 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

56.4%

JSON

Kernel-based Virtual Machine (KVM) offers a full virtualization solution for Linux on numerous hardware platforms. The virt:Rocky Linux module contains packages which provide user-space components used to run virtual machines using KVM. The packages also provide APIs for managing and interacting with the virtualized systems.

The following packages have been upgraded to a later upstream version: qemu-kvm (6.2.0), libvirt (8.0.0), libvirt-python (8.0.0), perl-Sys-Virt (8.0.0), seabios (1.15.0), libtpms (0.9.1). (BZ#1997410, BZ#2012802, BZ#2012806, BZ#2012813, BZ#2018392, BZ#2027716, BZ#2029355)

Security Fix(es):

  • QEMU: virtio-net: heap use-after-free in virtio_net_receive_rcu (CVE-2021-3748)

  • ntfs-3g: Out-of-bounds heap buffer access in ntfs_get_attribute_value() due to incorrect check of bytes_in_use value in MFT records (CVE-2021-33285)

  • ntfs-3g: Heap buffer overflow triggered by a specially crafted Unicode string (CVE-2021-33286)

  • ntfs-3g: Heap buffer overflow in ntfs_attr_pread_i() triggered by specially crafted NTFS attributes (CVE-2021-33287)

  • ntfs-3g: Heap buffer overflow triggered by a specially crafted MFT section (CVE-2021-33289)

  • ntfs-3g: Heap buffer overflow triggered by a specially crafted NTFS inode pathname (CVE-2021-35266)

  • ntfs-3g: Stack buffer overflow triggered when correcting differences between MFT and MFTMirror sections (CVE-2021-35267)

  • ntfs-3g: Heap buffer overflow in ntfs_inode_real_open() triggered by a specially crafted NTFS inode (CVE-2021-35268)

  • ntfs-3g: Heap buffer overflow in ntfs_attr_setup_flag() triggered by a specially crafted NTFS attribute from MFT (CVE-2021-35269)

  • ntfs-3g: NULL pointer dereference in ntfs_extent_inode_open() (CVE-2021-39251)

  • ntfs-3g: Out-of-bounds read in ntfs_ie_lookup() (CVE-2021-39252)

  • ntfs-3g: Out-of-bounds read in ntfs_runlists_merge_i() (CVE-2021-39253)

  • ntfs-3g: Integer overflow in memmove() leading to heap buffer overflow in ntfs_attr_record_resize() (CVE-2021-39254)

  • ntfs-3g: Out-of-bounds read ntfs_attr_find_in_attrdef() triggered by an invalid attribute (CVE-2021-39255)

  • ntfs-3g: Heap buffer overflow in ntfs_inode_lookup_by_name() (CVE-2021-39256)

  • ntfs-3g: Endless recursion from ntfs_attr_pwrite() triggered by an unallocated bitmap (CVE-2021-39257)

  • ntfs-3g: Out-of-bounds reads in ntfs_attr_find() and ntfs_external_attr_find() (CVE-2021-39258)

  • ntfs-3g: Out-of-bounds access in ntfs_inode_lookup_by_name() caused by an unsanitized attribute length (CVE-2021-39259)

  • ntfs-3g: Out-of-bounds access in ntfs_inode_sync_standard_information() (CVE-2021-39260)

  • ntfs-3g: Heap buffer overflow in ntfs_compressed_pwrite() (CVE-2021-39261)

  • ntfs-3g: Out-of-bounds access in ntfs_decompress() (CVE-2021-39262)

  • ntfs-3g: Heap buffer overflow in ntfs_get_attribute_value() caused by an unsanitized attribute (CVE-2021-39263)

  • libnbd: nbdcopy: missing error handling may create corrupted destination image (CVE-2022-0485)

  • hivex: stack overflow due to recursive call of _get_children() (CVE-2021-3622)

  • nbdkit: NBD_OPT_STRUCTURED_REPLY injection on STARTTLS (CVE-2021-3716)

  • libvirt: segmentation fault during VM shutdown can lead to vdsm hang (CVE-2021-3975)

  • QEMU: NULL pointer dereference in mirror_wait_on_conflicts() in block/mirror.c (CVE-2021-4145)

  • QEMU: NULL pointer dereference in pci_write() in hw/acpi/pcihp.c (CVE-2021-4158)

  • QEMU: block: fdc: null pointer dereference may lead to guest crash (CVE-2021-20196)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.6 Release Notes linked from the References section.

References

Related

almalinux 1
osv 25
redhat 5
mageia 1
openvas 9
nessus 21
slackware 1
debian 3
altlinux 1
suse 3
oraclelinux 1
rocky 1
fedora 2
gentoo 1
ubuntucve 9
cbl_mariner 14
nvd 11
prion 11
veracode 13
cve 12
cvelist 11
debiancve 12
cnvd 10
redhatcve 10
alpinelinux 11
almalinux
almalinux
Moderate: virt:rhel and virt-devel:rhel security, bug fix, and enhancement update
2022-05-10 07:59:57
osv
osv
ntfs-3g - security update
2021-09-09 00:00:00
ntfs-3g - security update
2021-11-16 00:00:00
Moderate: virt:rhel and virt-devel:rhel security, bug fix, and enhancement update
2022-05-10 07:59:57
redhat
redhat
(RHSA-2022:1759) Moderate: virt:rhel and virt-devel:rhel security, bug fix, and enhancement update
2022-05-10 07:59:57
(RHSA-2021:3703) Moderate: virt:av and virt-devel:av security and bug fix update
2021-09-30 16:19:56
(RHSA-2021:3704) Moderate: virt:8.2 and virt-devel:8.2 security update
2021-09-30 18:28:50
mageia
mageia
Updated ntfs-3g packages fix security vulnerability
2022-01-03 10:36:40
openvas
openvas
Debian: Security Advisory (DLA-2819-1)
2021-11-18 00:00:00
Debian: Security Advisory (DSA-4971-1)
2021-09-10 00:00:00
Mageia: Security Advisory (MGASA-2022-0001)
2022-01-28 00:00:00
nessus
nessus
Rocky Linux 8 : virt:rhel and virt-devel:rhel (RLSA-2022:1759)
2023-11-06 00:00:00
RHEL 8 : virt:rhel and virt-devel:rhel (RHSA-2022:1759)
2022-05-11 00:00:00
Oracle Linux 8 : virt:ol / and / virt-devel:ol (ELSA-2022-1759)
2022-05-18 00:00:00
slackware
slackware
[slackware-security] ntfs-3g
2021-08-31 21:01:05
debian
debian
[SECURITY] [DLA 2819-1] ntfs-3g security update
2021-11-16 22:56:32
[SECURITY] [DSA 4971-1] ntfs-3g security update
2021-09-09 19:15:24
[SECURITY] [DSA 4971-1] ntfs-3g security update
2021-09-09 19:15:24
altlinux
altlinux
Security fix for the ALT Linux 9 package ntfs-3g version 2:2021.8.22-alt1
2021-09-10 00:00:00
suse
suse
Security update for ntfs-3g_ntfsprogs (important)
2021-09-09 00:00:00
Security update for ntfs-3g_ntfsprogs (important)
2021-09-07 00:00:00
Security update for qemu (low)
2022-01-25 00:00:00
oraclelinux
oraclelinux
virt:ol and virt-devel:ol security, bug fix, and enhancement update
2022-05-17 00:00:00
rocky
rocky
virt:rhel and virt-devel:rhel security, bug fix, and enhancement update
2022-05-10 07:59:57
fedora
fedora
[SECURITY] Fedora 33 Update: ntfs-3g-2021.8.22-2.fc33
2021-09-23 19:30:16
[SECURITY] Fedora 35 Update: ntfs-3g-2021.8.22-2.fc35
2021-09-24 20:50:50
gentoo
gentoo
NTFS-3G: Multiple Vulnerabilities
2023-01-11 00:00:00
ubuntucve
ubuntucve
CVE-2021-35269
2021-09-07 00:00:00
CVE-2021-39254
2021-09-07 00:00:00
CVE-2021-33286
2021-09-07 00:00:00
cbl_mariner
cbl_mariner
CVE-2021-35269 affecting package ntfs-3g for versions less than 2021.8.22-1
2022-04-26 19:57:41
CVE-2021-33287 affecting package ntfs-3g for versions less than 2021.8.22-1
2022-04-26 19:57:41
CVE-2021-39259 affecting package ntfs-3g for versions less than 2021.8.22-1
2022-04-26 19:57:41
nvd
nvd
CVE-2021-35269
2021-09-07 14:15:11
CVE-2021-39252
2021-09-07 15:15:07
CVE-2021-39262
2021-09-07 15:15:08
prion
prion
Out-of-bounds
2021-09-07 15:15:00
Heap overflow
2021-09-07 14:15:00
Heap overflow
2021-09-07 15:15:00
veracode
veracode
Denial Of Service
2021-09-08 15:35:43
Denial Of Service
2021-09-07 23:47:32
Remote Code Execution (RCE)
2021-09-07 23:47:34
cve
cve
CVE-2021-35268
2021-09-07 14:15:11
CVE-2021-39263
2021-09-07 15:15:08
CVE-2021-39254
2021-09-07 15:15:07
cvelist
cvelist
CVE-2021-39254
2021-09-07 00:00:00
CVE-2021-39259
2021-09-07 00:00:00
CVE-2021-33287
2021-09-07 00:00:00
debiancve
debiancve
CVE-2021-39259
2021-09-07 15:15:08
CVE-2021-33286
2021-09-07 15:15:07
CVE-2021-35267
2021-09-07 15:15:07
cnvd
cnvd
Tuxera NTFS-3G Buffer Overflow Vulnerability (CNVD-2021-72275)
2021-09-07 00:00:00
Tuxera NTFS-3G Buffer Overflow Vulnerability (CNVD-2021-72268)
2021-09-07 00:00:00
Tuxera NTFS-3G Buffer Overflow Vulnerability (CNVD-2021-72266)
2021-09-07 00:00:00
redhatcve
redhatcve
CVE-2021-35268
2021-09-06 15:04:53
CVE-2021-39263
2021-09-06 18:04:18
CVE-2021-35269
2021-09-06 17:22:18
alpinelinux
alpinelinux
CVE-2021-39259
2021-09-07 15:15:00
CVE-2021-33286
2021-09-07 15:15:00
CVE-2021-35266
2021-09-07 15:15:00

8.5 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

56.4%

JSON
Related for OSV:RLSA-2022:1759
almalinux1osv25redhat5mageia1openvas9nessus21slackware1debian3altlinux1suse3oraclelinux1rocky1fedora2gentoo1ubuntucve9cbl_mariner14nvd11prion11veracode13cve12cvelist11debiancve12cnvd10redhatcve10alpinelinux11