Ubuntu 12.04 LTS USN-1590-1 Urgent: QEMU Crash Vulnerability Fixed

ubuntu

October 2, 2012

QEMU could be made to crash or run programs.

Summary

QEMU could be made to crash or run programs.

Software Description:

- qemu-kvm: Machine emulator and virtualizer

Details:

It was discovered that QEMU incorrectly handled certain VT100 escape

sequences. A guest user with access to an emulated character device could

use this flaw to cause QEMU to crash, or possibly execute arbitrary code on

the host.

Topics Covered

security advisory critical code execution Ubuntu crash QEMU

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.04 LTS:
  qemu-kvm                        1.0+noroms-0ubuntu14.2

Ubuntu 11.10:
  qemu-kvm                        0.14.1+noroms-0ubuntu6.5

Ubuntu 11.04:
  qemu-kvm                        0.14.0+noroms-0ubuntu4.7

Ubuntu 10.04 LTS:
  qemu-kvm                        0.12.3+noroms-0ubuntu9.20

After a standard system update you need to restart your virtual machines to
make all the necessary changes.