Stay Secure with the Latest Linux Advisories

security advisorycritical issueFedora

Fedora 36: Critical Advisory FEDORA-2023-c8a60f6f80 Out-Of-Bounds Issues

ati-vga: out-of-bounds write in ati_2d_blt (CVE-2021-3638) (rhbz#1979882) qxl: qxl_phys2virt unsafe address translation (CVE-2022-4144) (rhbz#2148542) linux- user: default to -cpu max (rhbz#2121700). --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2023-c8a60f6f80 2023-01-19 13:13:04.126902 --------------------------------------------------------------------------------Name : qemu Product : Fedora 36 Version : 6.2.0 Release : 17.fc36 URL : https://www.qemu.org/ Summary : QEMU is a FAST! processor emulator Description : qemu is an open source virtualizer that provides hardware emulation for the KVM hypervisor. qemu acts as a virtual machine monitor together with the KVM kernel modules, and emulates the hardware for a full system such as a PC and its associated peripherals. --------------------------------------------------------------------------------Update Information: ati-vga: out-of-bounds write in ati_2d_blt (CVE-2021-3638) (rhbz#1979882) qxl: qxl_phys2virt unsafe address translation (CVE-2022-4144) (rhbz#2148542) linux-user: default to -cpu max (rhbz#2121700) --------------------------------------------------------------------------------ChangeLog: * Tue Jan 3 2023 Mauro Matteo Cascella - 2:6.2.0-17 - ati-vga: out-of-bounds write in ati_2d_blt (CVE-2021-3638) (rhbz#1979882) - qxl: qxl_phys2virt unsafe address translation (CVE-2022-4144) (rhbz#2148542) - linux-user: default to -cpu max (rhbz#2121700) --------------------------------------------------------------------------------References: [ 1 ] Bug #1979882 - CVE-2021-3638 qemu: ati-vga: inconsistent check in ati_2d_blt() may lead to out-of-bounds write [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1979882 [ 2 ] Bug #2121700 - qemu-x86_64-static cannot run el9 binaries by default https://bugzilla.redhat.com/show_bug.cgi?id=2121700 [ 3 ] Bug #2148542 - CVE-2022-4144 qemu: QXL: qxl_phys2virtunsafe address translation can lead to out-of-bounds read [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2148542 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2023-c8a60f6f80' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list -- This email address is being protected from spambots. You need JavaScript enabled to view it. To unsubscribe send an email to This email address is being protected from spambots. You need JavaScript enabled to view it. Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it./ Do not reply to spam, report it: . Major enhancements to QEMU in Fedora 36, focusing on crucial security vulnerabilities and improving the accuracy of device emulation.. QEMU Security, Fedora Updates, Hardware Emulation, Out-Of-Bounds Issues. . Severity: Critical. LinuxSecurity.com Team

Jan 19, 2023 •Critical Fedora