Multiple security issues were discovered in QEMU, a fast processor emulator, which could result in denial of service. For the stable distribution (buster), these problems have been fixed in . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-4728-1
Several vulnerabilities were fixed in qemu, a fast processor emulator. CVE-2020-1983 . Package : qemu Version : 1:2.1+dfsg-12+deb8u15 CVE ID : CVE-2020-1983 CVE-2020-13361 CVE-2020-13362 CVE-2020-13765 Debian Bug : Several vulnerabilities were fixed in qemu, a fast processor emulator. CVE-2020-1983 slirp: Fix use-after-free in ip_reass(). CVE-2020-13361 es1370_transfer_audio in hw/audio/es1370.c allowed guest OS users to trigger an out-of-bounds access during an es1370_write() operation. CVE-2020-13362 megasas_lookup_frame in hw/scsi/megasas.c had an out-of-bounds read via a crafted reply_queue_head field from a guest OS user. CVE-2020-13765 hw/core/loader: Fix possible crash in rom_copy(). For Debian 8 "Jessie", these problems have been fixed in version 1:2.1+dfsg-12+deb8u15. We recommend that you upgrade your qemu packages. Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS . Numerous flaws identified in libvirt rectified, promoting safety and dependability for Ubuntu users with urgent patches advised.. Debian LTS, QEMU Update, Processor Emulator, Security Fixes. . Severity: Critical. LinuxSecurity.com Team
Multiple vulnerabilities were discovered in qemu, a fast processor emulator. The Common Vulnerabilities and Exposures project identifies the following problems: . Package : qemu Version : 1.1.2+dfsg-6+deb7u24 CVE ID : CVE-2017-14167 CVE-2017-15038 Multiple vulnerabilities were discovered in qemu, a fast processor emulator. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2017-14167 Incorrect validation of multiboot headers could result in the execution of arbitrary code. CVE-2017-15038 When using 9pfs qemu-kvm is vulnerable to an information disclosure issue. It could occur while accessing extended attributes of a file due to a race condition. This could be used to disclose heap memory contents of the host. For Debian 7 "Wheezy", these problems have been fixed in version 1.1.2+dfsg-6+deb7u24. We recommend that you upgrade your qemu packages. Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS . Debian LTS security patch for qemu tackles several vulnerabilities such as arbitrary command execution and data leakage.. Debian QEMU Security Fix, Processor Emulator Update, LTS Security Advisory. . Severity: Critical. LinuxSecurity.com Team
* CVE-2015-6815: net: e1000: infinite loop issue (bz #1260225) * CVE-2015-6855: ide: divide by zero issue (bz #1261793) * CVE-2015-5278: Infinite loop in ne2000_receive() (bz #1263284) * CVE-2015-5279: Heap overflow vulnerability in ne2000_receive() (bz #1263287) ---- Fix emulation of various instructions, required by libm in F22 ppc64 guests.. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2015-16370 2015-09-24 05:06:55.811095 -------------------------------------------------------------------------------- Name : qemu Product : Fedora 23 Version : 2.4.0 Release : 4.fc23 URL : https://www.qemu.org/ Summary : QEMU is a FAST! processor emulator Description : QEMU is a generic and open source processor emulator which achieves a good emulation speed by using dynamic translation. QEMU has two operating modes: * Full system emulation. In this mode, QEMU emulates a full system (for example a PC), including a processor and various peripherials. It can be used to launch different Operating Systems without rebooting the PC or to debug system code. * User mode emulation. In this mode, QEMU can launch Linux processes compiled for one CPU on another CPU. As QEMU requires no host kernel patches to run, it is safe and easy to use. -------------------------------------------------------------------------------- Update Information: * CVE-2015-6815: net: e1000: infinite loop issue (bz #1260225) * CVE-2015-6855: ide: divide by zero issue (bz #1261793) * CVE-2015-5278: Infinite loop in ne2000_receive() (bz #1263284) * CVE-2015-5279: Heap overflow vulnerability in ne2000_receive() (bz #1263287) ---- Fix emulation of various instructions, required by libm in F22 ppc64 guests. -------------------------------------------------------------------------------- References: [ 1 ] Bug #1256672 - CVE-2015-5279 qemu: Heap overflow vulnerability in ne2000_receive() function https://bugzilla.redhat.com/show_bug.cgi?id=1256672 [ 2 ] Bug #1260076 - CVE-2015-6815 qemu: net: e1000: infinite loop issue https://bugzilla.redhat.com/show_bug.cgi?id=1260076 [ 3 ] Bug #1260080 - CVE-2015-6855 Qemu: ide: divide by zero issue https://bugzilla.redhat.com/show_bug.cgi?id=1260080 [ 4 ] Bug #1256661 - CVE-2015-5278 qemu: Infinite loop in ne2000_receive() function https://bugzilla.redhat.com/show_bug.cgi?id=1256661 -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update qemu' at the command line. For more information, refer to "Managing Software with yum", available at . All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list
Get the latest Linux and open source security news straight to your inbox.