PyXML: Hash table collisions CPU usage Denial of Service
Michal Skrivanek of Red Hat reports:
If vdsm is run with -spice disable-ticketing and a VM is suspended and then restored any remote user will be allowed to connect without authentication.
Last updated 24 July 2024
Izik Eidus found a bug in QEMU that allows priviledged guest user to control the address Cairo library uses to map it's memory and and therefore the guest can read/write into the whole QEMU address space.