CVSS: 7.4EPSS: 0%CPEs: 33EXPL: 0CVE-2012-3515 – qemu: VT100 emulation vulnerability
https://notcve.org/view.php?id=CVE-2012-3515
Qemu, as used in Xen 4.0, 4.1 and possibly other products, when emulating certain devices with a virtual console backend, allows local OS guest users to gain privileges via a crafted escape VT100 sequence that triggers the overwrite of a "device model's address space." Qemu, tal como se utiliza en Xen v4.0, v4.1 y posiblemente otros productos, al emular ciertos dispositivos con una consola virtual, permite a los usuarios locales del SO invitado obtener privilegios a través de una secuencia VT100 de escape manipulada que desencadena la sobrescritura del espacio de direcciones de un "device model's address space." • http://git.qemu.org/?p=qemu-stable-0.15.git%3Ba=log http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00003.html http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00004.html http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00005.html http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00012.html http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00016.ht • CWE-20: Improper Input Validation CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2011-3571 – OpenJDK: AtomicReferenceArray insufficient array type check (Concurrency, 7082299)
https://notcve.org/view.php?id=CVE-2011-3571
Unspecified vulnerability in the Virtual Desktop Infrastructure (VDI) component in Oracle Virtualization 3.2 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Session. NOTE: this CVE identifier was accidentally used for a Concurrency issue in Java Runtime Environment, but that issue has been reassigned to CVE-2012-0507. Una vulnerabilidad no especificada en el componente Virtual Desktop Infrastructure (VDI) en Virtualization de Oracle versión 3.2, permite a los usuarios autenticados remotos afectar la confidencialidad y la integridad por medio de vectores desconocidos relacionados a Session. NOTA: este identificador de CVE fue usado accidentalmente por un problema Concurrente en Java Runtime Environment, pero ese problema ha sido reasignado a CVE-2012-0507. • http://lists.opensuse.org/opensuse-updates/2012-10/msg00041.html http://secunia.com/advisories/48073 http://secunia.com/advisories/48074 http://secunia.com/advisories/50897 http://security.gentoo.org/glsa/glsa-201406-32.xml http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html https://access.redhat.com/security/cve/CVE-2011-3571 https://bugzilla.redhat.com/show_bug.cgi?id=788994 •