Univention Bugzilla – Bug 39546
qemu-kvm: multiple issues (4.0)
Last modified: 2015-11-04 17:24:47 CET
Upstream Debian package version 1.1.2+dfsg-6a+deb7u11 fixes these issues: * the QEMU model of the RTL8139 network card did not sufficiently validate inputs in the C+ mode offload emulation, allowing a malicious guest to read uninitialized memory from the QEMU process's heap (CVE-2015-5165) * A buffer overflow vulnerability was discovered in the way QEMU handles the virtio-serial device. A malicious guest could use this flaw to mount a denial of service (QEMU process crash) (CVE-2015-5745) * infinite loop when receiving packets in the NE2000 NIC emulation. A privileged guest user could use this flaw to mount a denial of service (QEMU process crash) (CVE-2015-5278) * heap buffer overflow flaw in the NE2000 NIC emulation. A privileged guest user could use this flaw to mount a denial of service (QEMU process crash), or potentially to execute arbitrary code on the host with the privileges of the hosting QEMU process (CVE-2015-5279) * infinite loop issue in the e1000 NIC emulation. A privileged guest user could use this flaw to mount a denial of service (QEMU process crash) (CVE-2015-6815) * flaw in the IDE subsystem in QEMU occurring while executing IDE's WIN_READ_NATIVE_MAX command to determine the maximum size of a drive. A privileged guest user could use this flaw to mount a denial of service (QEMU process crash) (CVE-2015-6855) +++ This bug was initially created as a clone of Bug #38744 +++
$ repo_admin.py -U -p qemu-kvm -d wheezy -r 4.0-0-0 -s errata4.0-3 r15387 | Bug #39546: qemu-kvm errata4.0-3 r15388 + r15389 | repo-ng patch merge + undo Package: qemu-kvm Version: 1.1.2+dfsg-6.48.201510271706 Branch: ucs_4.0-0 Scope: errata4.0-3 r64906 | Bug #39546: qemu-kvm errata4.0-3 2015-10-27-qemu-kvm.yaml
Tests (amd64): OK Advisory: OK
<http://errata.software-univention.de/ucs/4.0/359.html>