Red Hat Security Advisory

RHSA-2023:2757

virt:rhel and virt-devel:rhel security, bug fix, and enhancement update

Released 2023-05-16 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 8) SLOF-20210217-1.module+el8.8.0+16781+9f4724c2.noarch::virt:rhel, SLOF-20210217-1.module+el8.8.0+16781+9f4724c2.src::virt:rhel, hivex-1.3.18-23.module+el8.8.0+16781+9f4724c2.aarch64::virt:rhel +47
Red Hat Enterprise Linux CRB (v. 8) SLOF-20210217-1.module+el8.8.0+16781+9f4724c2.src::virt-devel:rhel, hivex-1.3.18-23.module+el8.8.0+16781+9f4724c2.i686::virt-devel:rhel, hivex-devel-1.3.18-23.module+el8.8.0+16781+9f4724c2.i686::virt-devel:rhel +47

Fixes 7 records

TI-2022-12918 CVE-2022-30789 · GHSA-m552-m2c9-9wj8

A crafted NTFS image can cause a heap-based buffer overflow in ntfs_check_log_client_array in NTFS-3G through 2021.8.22.

LOW 36

A crafted NTFS image can cause a heap-based buffer overflow in ntfs_check_log_client_array in NTFS-3G through 2021.8.22.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00447 Published 2022-05-26 Partial fix CWE-20

TI-2022-12917 CVE-2022-30788 · GHSA-cq26-r6qj-8656

A crafted NTFS image can cause a heap-based buffer overflow in ntfs_mft_rec_alloc in NTFS-3G through 2021.8.22.

LOW 36

A crafted NTFS image can cause a heap-based buffer overflow in ntfs_mft_rec_alloc in NTFS-3G through 2021.8.22.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00447 Published 2022-05-26 Partial fix CWE-20

TI-2022-12915 CVE-2022-30786 · GHSA-7wwc-f3r7-9qqw

A crafted NTFS image can cause a heap-based buffer overflow in ntfs_names_full_collate in NTFS-3G through 2021.8.22.

LOW 36

A crafted NTFS image can cause a heap-based buffer overflow in ntfs_names_full_collate in NTFS-3G through 2021.8.22.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00447 Published 2022-05-26 Partial fix CWE-20

TI-2022-12913 CVE-2022-30784 · GHSA-mr29-g89m-5w7h

A crafted NTFS image can cause heap exhaustion in ntfs_get_attribute_value in NTFS-3G through 2021.8.22.

LOW 36

A crafted NTFS image can cause heap exhaustion in ntfs_get_attribute_value in NTFS-3G through 2021.8.22.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00413 Published 2022-05-26 Partial fix CWE-20

TI-2021-21502 CVE-2021-46790 · GHSA-274j-jr8v-77f7

ntfsck in NTFS-3G through 2021.8.22 has a heap-based buffer overflow involving…

LOW 35

ntfsck in NTFS-3G through 2021.8.22 has a heap-based buffer overflow involving buffer+512*3-2.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00504 Published 2022-05-02 Partial fix CWE-787

TI-2023-00963 CVE-2023-1018 · GHSA-cr8w-xxqw-fm2m

TPM2.0 vulnerable to out-of-bounds read

LOW 33

An out-of-bounds read vulnerability exists in TPM2.0's Module Library allowing a 2-byte read past the end of a TPM2.0 command in the CryptParameterDecryption routine.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.05552 Published 2023-02-28 Partial fix CWE-125

TI-2022-02922 CVE-2022-3165 · GHSA-3wph-8799-87r7

Integer underflow in QEMU

LOW 32

An integer underflow issue was found in the QEMU VNC server while processing ClientCutText messages in the extended format.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01564 Published 2022-10-17 Fixed CWE-191