Debian: DLA-2753-1 Critical Qemu Security Flaws and Fixes

An out-of-bounds write flaw was found in the UAS (USB Attached SCSI) device
emulation of QEMU. The device uses the guest supplied stream number
unchecked, which can lead to out-of-bounds access to the UASDevice->data3
and UASDevice->status3 fields. A malicious guest user could use this flaw
to crash QEMU or potentially achieve code execution with the privileges of
the QEMU process on the host.

CVE-2021-3682

A flaw was found in the USB redirector device emulation of QEMU. It occurs
when dropping packets during a bulk transfer from a SPICE client due to the
packet queue being full. A malicious SPICE client could use this flaw to
make QEMU call free() with faked heap chunk metadata, resulting in a crash
of QEMU or potential code execution with the privileges of the QEMU process
on the host.

CVE-2021-3527

A flaw was found in the USB redirector device (usb-redir) of QEMU. Small
USB packets are combined into a single, large transfer request, to reduce