Stay Secure with the Latest Linux Advisories

security advisoryimportantheap overflow

SUSE 12: SUSE-SU-2015:1519-1 Important: QEMU Heap Overflow

An update that solves two vulnerabilities and has one An update that solves two vulnerabilities and has one An update that solves two vulnerabilities and has one errata is now available. errata is now available.. SUSE Security Update: Security update for qemu ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1519-1 Rating: important References: #893892 #932267 #932770 Cross-References: CVE-2015-3209 CVE-2015-4037 Affected Products: SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: qemu was updated to fix two security issues and augments one non-security bug fix. The following vulnerabilities were fixed: * CVE-2015-3209: heap overflow in qemu pcnet controller allowing guest to host escape (XSA-135) (bsc#932770) * CVE-2015-4037: Avoid predictable directory name for smb config (bsc#932267) The fix for the following non-security bug was improved: * bsc#893892: Use improved upstream patch for display issue affecting installs of SLES 11 VMs on SLES 12 Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2015-509=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2015-509=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64): qemu-2.0.2-48.4.1 qemu-block-curl-2.0.2-48.4.1 qemu-block-curl-debuginfo-2.0.2-48.4.1 qemu-debugsource-2.0.2-48.4.1 qemu-guest-agent-2.0.2-48.4.1 qemu-guest-agent-debuginfo-2.0.2-48.4.1 qemu-lang-2.0.2-48.4.1 qemu-tools-2.0.2-48.4.1 qemu-tools-debuginfo-2.0.2-48.4.1 - SUSE Linux Enterprise Server 12 (s390x x86_64): qemu-kvm-2.0.2-48.4.1 - SUSE Linux Enterprise Server 12 (ppc64le): qemu-ppc-2.0.2-48.4.1 qemu-ppc-debuginfo-2.0.2-48.4.1 - SUSE Linux Enterprise Server 12 (noarch): qemu-ipxe-1.0.0-48.4.1 qemu-seabios-1.7.4-48.4.1 qemu-sgabios-8-48.4.1 qemu-vgabios-1.7.4-48.4.1 - SUSE Linux Enterprise Server 12 (x86_64): qemu-block-rbd-2.0.2-48.4.1 qemu-block-rbd-debuginfo-2.0.2-48.4.1 qemu-x86-2.0.2-48.4.1 qemu-x86-debuginfo-2.0.2-48.4.1 - SUSE Linux Enterprise Server 12 (s390x): qemu-s390-2.0.2-48.4.1 qemu-s390-debuginfo-2.0.2-48.4.1 - SUSE Linux Enterprise Desktop 12 (x86_64): qemu-2.0.2-48.4.1 qemu-block-curl-2.0.2-48.4.1 qemu-block-curl-debuginfo-2.0.2-48.4.1 qemu-debugsource-2.0.2-48.4.1 qemu-kvm-2.0.2-48.4.1 qemu-tools-2.0.2-48.4.1 qemu-tools-debuginfo-2.0.2-48.4.1 qemu-x86-2.0.2-48.4.1 qemu-x86-debuginfo-2.0.2-48.4.1 - SUSE Linux Enterprise Desktop 12 (noarch): qemu-ipxe-1.0.0-48.4.1 qemu-seabios-1.7.4-48.4.1 qemu-sgabios-8-48.4.1 qemu-vgabios-1.7.4-48.4.1 References: https://www.suse.com/security/cve/CVE-2015-3209.html https://www.suse.com/security/cve/CVE-2015-4037.html https://bugzilla.suse.com/show_bug.cgi?id=893892 https://bugzilla.suse.com/show_bug.cgi?id=932267 https://bugzilla.suse.com/show_bug.cgi?id=932770 . The recent patch for qemu addresses critical vulnerabilities, including buffer overflow and filename leakage concerns on SUSE systems, enhancing overall security.. SUSE Security Update,QEMU Heap Overflow Fix,SUSE Linux Enterprise Security,Patch Instructions. . Severity: Important. LinuxSecurity.com Team

Sep 09, 2015 •Important SuSE