Scientific Linux: SLSA-2015:1943-1 Moderate: qemu-kvm DoS Risk

Date: Tue, 27 Oct 2015 09:06:45 -0500
Reply-To: Pat Riehecky 
Sender: Security Errata for Scientific Linux
 
From: Pat Riehecky 
Subject: FASTBUGS for SL 7x x86_64 now available
MIME-Version: 1.0
Message-ID: <562F84F5.9030503@fnal.gov>

The following FASTBUGS have been uploaded to

x86_64:
kmod-ixgbe-4.0.3-1.el7_1.x86_64.rpm
SL_gdm_no_user_list-1.0-3.sl7.noarch.rpm
Date: Tue, 27 Oct 2015 14:28:35 +0000
Reply-To: scientific-linux-users@
Sender: Security Errata for Scientific Linux
 
From: Pat Riehecky 
Subject: Security ERRATA Moderate: qemu-kvm on SL7.x x86_64
MIME-Version: 1.0
Message-ID: <20151027142835.31408.61632@slpackages.fnal.gov>

Synopsis: Moderate: qemu-kvm security update
Advisory ID: SLSA-2015:1943-1
Issue Date: 2015-10-27
CVE Numbers: CVE-2015-1779
--

It was found that the QEMU's websocket frame decoder processed incoming
frames without limiting resources used to process the header and the
payload. An attacker able to access a guest's VNC console could use this
flaw to trigger a denial of service on the host by exhausting all
available memory and CPU. (CVE-2015-1779)

After installing this update, shut down all running virtual machines. Once
all virtual machines have shut down, start them again for this update to
take effect.
--

SL7
 x86_64
 libcacard-1.5.3-86.el7_1.8.i686.rpm
 libcacard-1.5.3-86.el7_1.8.x86_64.rpm
 qemu-img-1.5.3-86.el7_1.8.x86_64.rpm
 qemu-kvm-1.5.3-86.el7_1.8.x86_64.rpm
 qemu-kvm-common-1.5.3-86.el7_1.8.x86_64.rpm
 qemu-kvm-debuginfo-1.5.3-86.el7_1.8.i686.rpm
 qemu-kvm-debuginfo-1.5.3-86.el7_1.8.x86_64.rpm
 qemu-kvm-tools-1.5.3-86.el7_1.8.x86_64.rpm
 libcacard-devel-1.5.3-86.el7_1.8.i686.rpm
 libcacard-devel-1.5.3-86.el7_1.8.x86_64.rpm
 libcacard-tools-1.5.3-86.el7_1.8.x86_64.rpm

- Scientific Linux Development Team