Qiuhao Li

The issue is related to the lack of message length and attributes length checks when handling STUN packets, leading to a controllable heap-over-flow. This can be exploited by attackers to achieve remote code execution through heap grooming or other methods. The bug was introduced 16 years ago and users are advised to upgrade. There are no known workarounds for this vulnerability.

The issue is related to a crash in the OPUS protocol dissector, which allows for denial of service via packet injection or crafted capture file. This can be exploited by injecting packets or using a specially crafted capture file.

The issue is related to a NULL pointer dereference flaw in the Linux kernel's KVM module. This flaw can lead to a denial of service in the `x86 emulate insn` function in `arch/x86/kvm/emulate.c`. The flaw occurs when an illegal instruction is executed in a guest on an Intel CPU.

The issue is related to a NULL pointer dereference in the KVM subsystem of the Linux kernel, specifically in the `kvm dirty ring push` function. This flaw can be exploited by an unprivileged local attacker on the host to cause a denial of service by issuing specific ioctl calls, resulting in a kernel oops condition.

A flaw was found in the Kernel-based Virtual Machine (KVM) subsystem of the Linux kernel. The issue is related to the `get user pages fast()` function and involves writing data outside the buffer in memory. This flaw allows unprivileged local users on the host to write outside the userspace region and potentially corrupt the kernel, resulting in a denial of service condition. The `vaddr` and `vm pgoff` variables are controllable by user-mode processes, which can be exploited to cause the issue.

The issue is related to a buffer overflow in the Core component of Oracle VM VirtualBox, which can be exploited by a high-privileged attacker with logon access to the infrastructure where Oracle VM VirtualBox executes. Successful attacks can result in unauthorized ability to cause a hang or frequently repeatable crash of Oracle VM VirtualBox, leading to a denial of service.

A DMA reentrancy issue was found in the NVM Express Controller (NVME) emulation. This issue can lead to a use-after-free problem when a malicious guest triggers the reset function `nvme ctrl reset()`, causing data structs to be freed. As a result, a malicious guest could crash the QEMU process on the host, leading to a denial of service condition, or potentially execute arbitrary code within the context of the QEMU process on the host.

The issue is related to a buffer over-read in the ncsi.c component of the libslirp TCP-IP emulator. This occurs because the component attempts to read a certain amount of header data even if it exceeds the total packet length. Exploitation of this issue may allow a remote attacker to access confidential data.

The issue is related to a buffer over-read in the slirp.c component of the libslirp TCP-IP emulator. This occurs because the component attempts to read a certain amount of header data, even if it exceeds the total packet length. Exploitation of this issue could allow a remote attacker to access confidential data.

The issue is related to pointer dereference errors in the Linux kernel. It allows an attacker to access confidential data, compromise its integrity, and cause a denial of service. Specifically, with shadow paging enabled, the INVPCID instruction results in a call to `kvm mmu invpcid gva`. If INVPCID is executed with CR0.PG=0, the `invlpg` callback is not set, leading to a NULL pointer dereference.