[SECURITY] [DLA 249-1] qemu-kvm security update

2015-06-1915:19:48

lists.debian.org

7.7 High

CVSS2

Access Vector

ADJACENT_NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:A/AC:L/Au:S/C:C/I:C/A:C

0.001 Low

EPSS

Percentile

40.1%

JSON

Package : qemu-kvm
Version : 0.12.5+dfsg-5+squeeze11
CVE ID : CVE-2015-3456

A vulnerability was discovered in the qemu virtualisation solution:

CVE-2015-3456

Jason Geffner discovered a buffer overflow in the emulated floppy
disk drive, resulting in the potential execution of arbitrary code.

Despite the end-of-life of qemu-kvm support in the old-oldstable
distribution (squeeze-lts), this problem has been fixed in version
0.12.5+dfsg-5+squeeze11 of the qemu-kvm source package due to its
severity (the so-called VENOM vulnerability).

Further problems may still be present in the qemu-kvm package in the
old-oldstable distribution (squeeze-lts) and users who need to rely on
qemu-kvm are encouraged to upgrade to a newer version of Debian.

We recommend that you upgrade your qemu-kvm packages.
Attachment:
signature.asc
Description: Digital signature

OSVersionArchitecturePackageVersionFilename
Debian6i386virtualbox-ose-fuse< 3.2.10-dfsg-1+squeeze4virtualbox-ose-fuse_3.2.10-dfsg-1+squeeze4_i386.deb
Debian7i386qemu-user-static< 1.1.2+dfsg-6a+deb7u7qemu-user-static_1.1.2+dfsg-6a+deb7u7_i386.deb
Debian6i386virtualbox-ose< 3.2.10-dfsg-1+squeeze4virtualbox-ose_3.2.10-dfsg-1+squeeze4_i386.deb
Debian8armhfqemu-system-x86< 1:2.1+dfsg-12qemu-system-x86_1:2.1+dfsg-12_armhf.deb
Debian7i386qemu-kvm-dbg< 1.1.2+dfsg-6+deb7u7qemu-kvm-dbg_1.1.2+dfsg-6+deb7u7_i386.deb
Debian8armhfqemu< 1:2.1+dfsg-12qemu_1:2.1+dfsg-12_armhf.deb
Debian6amd64qemu-user< 0.12.5+dfsg-3squeeze5qemu-user_0.12.5+dfsg-3squeeze5_amd64.deb
Debian7mipsqemu-user-static< 1.1.2+dfsg-6a+deb7u7qemu-user-static_1.1.2+dfsg-6a+deb7u7_mips.deb
Debian7allqemu-keymaps< 1.1.2+dfsg-6a+deb7u7qemu-keymaps_1.1.2+dfsg-6a+deb7u7_all.deb
Debian8mipselqemu-user< 1:2.1+dfsg-12qemu-user_1:2.1+dfsg-12_mipsel.deb

OS	Version	Architecture	Package	Version	Filename
Debian	6	i386	virtualbox-ose-fuse	< 3.2.10-dfsg-1+squeeze4	virtualbox-ose-fuse_3.2.10-dfsg-1+squeeze4_i386.deb
Debian	7	i386	qemu-user-static	< 1.1.2+dfsg-6a+deb7u7	qemu-user-static_1.1.2+dfsg-6a+deb7u7_i386.deb
Debian	6	i386	virtualbox-ose	< 3.2.10-dfsg-1+squeeze4	virtualbox-ose_3.2.10-dfsg-1+squeeze4_i386.deb
Debian	8	armhf	qemu-system-x86	< 1:2.1+dfsg-12	qemu-system-x86_1:2.1+dfsg-12_armhf.deb
Debian	7	i386	qemu-kvm-dbg	< 1.1.2+dfsg-6+deb7u7	qemu-kvm-dbg_1.1.2+dfsg-6+deb7u7_i386.deb
Debian	8	armhf	qemu	< 1:2.1+dfsg-12	qemu_1:2.1+dfsg-12_armhf.deb
Debian	6	amd64	qemu-user	< 0.12.5+dfsg-3squeeze5	qemu-user_0.12.5+dfsg-3squeeze5_amd64.deb
Debian	7	mips	qemu-user-static	< 1.1.2+dfsg-6a+deb7u7	qemu-user-static_1.1.2+dfsg-6a+deb7u7_mips.deb
Debian	7	all	qemu-keymaps	< 1.1.2+dfsg-6a+deb7u7	qemu-keymaps_1.1.2+dfsg-6a+deb7u7_all.deb
Debian	8	mipsel	qemu-user	< 1:2.1+dfsg-12	qemu-user_1:2.1+dfsg-12_mipsel.deb