Bug 39546 - qemu-kvm: multiple issues (4.0)
qemu-kvm: multiple issues (4.0)
Status: CLOSED FIXED
Product: UCS
Classification: Unclassified
Component: Security updates
UCS 4.0
Other Linux
: P3 normal (vote)
: UCS 4.0-3-errata
Assigned To: Philipp Hahn
Janek Walkenhorst
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2015-10-14 19:24 CEST by Arvid Requate
Modified: 2015-11-04 17:24 CET (History)
2 users (show)

See Also:
What kind of report is it?: ---
What type of bug is this?: ---
Who will be affected by this bug?: ---
How will those affected feel about the bug?: ---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional): Security
Max CVSS v3 score:
requate: Patch_Available+


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Arvid Requate univentionstaff 2015-10-14 19:24:03 CEST
Upstream Debian package version 1.1.2+dfsg-6a+deb7u11 fixes these issues:

* the QEMU model of the RTL8139 network card did not sufficiently validate inputs in the C+ mode offload emulation, allowing a malicious guest to read uninitialized memory from the QEMU process's heap (CVE-2015-5165)

* A buffer overflow vulnerability was discovered in the way QEMU handles the virtio-serial device. A malicious guest could use this flaw to mount a denial of service (QEMU process crash) (CVE-2015-5745)

* infinite loop when receiving packets in the NE2000 NIC emulation. A privileged guest user could use this flaw to mount a denial of service (QEMU process crash) (CVE-2015-5278)

* heap buffer overflow flaw in the NE2000 NIC emulation. A privileged guest user could use this flaw to mount a denial of service (QEMU process crash), or potentially to execute arbitrary code on the host with the privileges of the hosting QEMU process (CVE-2015-5279)

* infinite loop issue in the e1000 NIC emulation. A privileged guest user could use this flaw to mount a denial of service (QEMU process crash) (CVE-2015-6815)

* flaw in the IDE subsystem in QEMU occurring while executing IDE's WIN_READ_NATIVE_MAX command to determine the maximum size of a drive. A privileged guest user could use this flaw to mount a denial of service (QEMU process crash) (CVE-2015-6855)

+++ This bug was initially created as a clone of Bug #38744 +++
Comment 1 Philipp Hahn univentionstaff 2015-10-27 17:42:08 CET
$ repo_admin.py -U -p qemu-kvm -d wheezy -r 4.0-0-0 -s errata4.0-3

r15387 | Bug #39546: qemu-kvm errata4.0-3
r15388 + r15389 | repo-ng patch merge + undo

Package: qemu-kvm
Version: 1.1.2+dfsg-6.48.201510271706
Branch: ucs_4.0-0
Scope: errata4.0-3

r64906 | Bug #39546: qemu-kvm errata4.0-3
 2015-10-27-qemu-kvm.yaml
Comment 2 Janek Walkenhorst univentionstaff 2015-11-04 13:55:53 CET
Tests (amd64): OK
Advisory: OK
Comment 3 Janek Walkenhorst univentionstaff 2015-11-04 17:24:47 CET
<http://errata.software-univention.de/ucs/4.0/359.html>