Stay Secure with the Latest Linux Advisories

security advisorybuffer overflowimportant

SUSE: 2017:0789-1 Critical: Qemu Security Flaw & Command Exploits

An update that solves two vulnerabilities and has one An update that solves two vulnerabilities and has one An update that solves two vulnerabilities and has one errata is now available. errata is now available.. SUSE Security Update: Security update for qemu ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:0459-1 Rating: important References: #954864 #956829 #957162 Cross-References: CVE-2015-7512 CVE-2015-8345 Affected Products: SUSE Linux Enterprise Server 12-SP1 SUSE Linux Enterprise Desktop 12-SP1 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update fixes the following security issues: - Enforce receive packet size, thus eliminating buffer overflow and potential security issue. (bsc#957162 CVE-2015-7512) - Infinite loop in processing command block list. CVE-2015-8345 (bsc#956829): This update also fixes a non-security bug: - Due to space restrictions in limited bios data areas, don't create mptable if vcpu count is "high" (ie more than ~19). (bsc#954864) (No supported guests are negatively impacted by this change, which is taken from upstream seabios) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 12-SP1: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2016-263=1 - SUSE Linux Enterprise Desktop 12-SP1: zypper in -t patch SUSE-SLE-DESKTOP-12-SP1-2016-263=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 12-SP1 (ppc64le s390x x86_64): qemu-2.3.1-7.7 qemu-block-curl-2.3.1-7.7 qemu-block-curl-debuginfo-2.3.1-7.7 qemu-debugsource-2.3.1-7.7 qemu-guest-agent-2.3.1-7.7 qemu-guest-agent-debuginfo-2.3.1-7.7 qemu-lang-2.3.1-7.7 qemu-tools-2.3.1-7.7 qemu-tools-debuginfo-2.3.1-7.7 - SUSE Linux Enterprise Server 12-SP1 (s390x x86_64): qemu-kvm-2.3.1-7.7 - SUSE Linux Enterprise Server 12-SP1 (ppc64le): qemu-ppc-2.3.1-7.7 qemu-ppc-debuginfo-2.3.1-7.7 - SUSE Linux Enterprise Server 12-SP1 (x86_64): qemu-block-rbd-2.3.1-7.7 qemu-block-rbd-debuginfo-2.3.1-7.7 qemu-x86-2.3.1-7.7 - SUSE Linux Enterprise Server 12-SP1 (noarch): qemu-ipxe-1.0.0-7.7 qemu-seabios-1.8.1-7.7 qemu-sgabios-8-7.7 qemu-vgabios-1.8.1-7.7 - SUSE Linux Enterprise Server 12-SP1 (s390x): qemu-s390-2.3.1-7.7 qemu-s390-debuginfo-2.3.1-7.7 - SUSE Linux Enterprise Desktop 12-SP1 (x86_64): qemu-2.3.1-7.7 qemu-block-curl-2.3.1-7.7 qemu-block-curl-debuginfo-2.3.1-7.7 qemu-debugsource-2.3.1-7.7 qemu-kvm-2.3.1-7.7 qemu-tools-2.3.1-7.7 qemu-tools-debuginfo-2.3.1-7.7 qemu-x86-2.3.1-7.7 - SUSE Linux Enterprise Desktop 12-SP1 (noarch): qemu-ipxe-1.0.0-7.7 qemu-seabios-1.8.1-7.7 qemu-sgabios-8-7.7 qemu-vgabios-1.8.1-7.7 References: https://www.suse.com/security/cve/CVE-2015-7512.html https://www.suse.com/security/cve/CVE-2015-8345.html https://bugzilla.suse.com/954864 https://bugzilla.suse.com/956829 https://bugzilla.suse.com/957162 . Ubuntu Security Update addresses critical vulnerabilities in libcurl, improving overall system integrity with vital corrections and enhancements.. SUSE Linux, Qemu Update, Security Patch, Buffer Overflow Fix, Command Issue Fix. . Severity: Important. LinuxSecurity.com Team

Feb 15, 2016 •Important SuSE