[SECURITY] [DSA 1799-1] New qemu packages fix several vulnerabilities

Type debian
Reporter Debian
Modified 2009-05-11T21:13:22


Debian Security Advisory DSA-1799-1 security@debian.org http://www.debian.org/security/ Moritz Muehlenhoff May 11, 2009 http://www.debian.org/security/faq

Package : qemu Vulnerability : several Problem-Type : local Debian-specific: no CVE ID : CVE-2008-0928 CVE-2008-4539 CVE-2008-1945

Several vulnerabilities have been discovered in the QEMU processor emulator. The Common Vulnerabilities and Exposures project identifies the following problems:


Ian Jackson discovered that range checks of file operations on 
emulated disk devices were insufficiently enforced.


It was discovered that an error in the format auto detection of
removable media could lead to the disclosure of files in the
host system.


A buffer overflow has been found in the emulation of the Cirrus
graphics adaptor.

For the old stable distribution (etch), these problems have been fixed in version 0.8.2-4etch3.

For the stable distribution (lenny), these problems have been fixed in version 0.9.1-10lenny1.

For the unstable distribution (sid), these problems have been fixed in version 0.9.1+svn20081101-1.

We recommend that you upgrade your qemu packages.

Upgrade instructions

wget url will fetch the file for you dpkg -i file.deb will install the referenced file.

If you are using the apt-get package manager, use the line for sources.list as given below:

apt-get update will update the internal database apt-get upgrade will install corrected packages

You may use an automated update by adding the resources from the footer to the proper configuration.

Debian GNU/Linux 4.0 alias etch

Oldstable updates are available for alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.

Source archives:

http://security.debian.org/pool/updates/main/q/qemu/qemu_0.8.2-4etch3.diff.gz Size/MD5 checksum: 67363 9770edb5cd197a444e9daad2f0439823 http://security.debian.org/pool/updates/main/q/qemu/qemu_0.8.2-4etch3.dsc Size/MD5 checksum: 1122 b7d65acdf5cdc3332b3a7a5100c4586d

amd64 architecture (AMD x86_64 (AMD64))

http://security.debian.org/pool/updates/main/q/qemu/qemu_0.8.2-4etch3_amd64.deb Size/MD5 checksum: 3700070 f2ba0f4f44c56f943e7f49a660284b3e

i386 architecture (Intel ia32)

http://security.debian.org/pool/updates/main/q/qemu/qemu_0.8.2-4etch3_i386.deb Size/MD5 checksum: 3676468 cf0babcf03c61381fea0d7f30a06e44f

Debian GNU/Linux 5.0 alias lenny

Stable updates are available for alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.

Source archives:

http://security.debian.org/pool/updates/main/q/qemu/qemu_0.9.1.orig.tar.gz Size/MD5 checksum: 2392515 937c34632a59e12ba7b55054419bbe7d http://security.debian.org/pool/updates/main/q/qemu/qemu_0.9.1-10lenny1.diff.gz Size/MD5 checksum: 80162 f5d593dcea9ec54a148c76a3883fa537 http://security.debian.org/pool/updates/main/q/qemu/qemu_0.9.1-10lenny1.dsc Size/MD5 checksum: 1638 1c8e6db187f4b58e5655f2b06581b56f

amd64 architecture (AMD x86_64 (AMD64))

http://security.debian.org/pool/updates/main/q/qemu/qemu_0.9.1-10lenny1_amd64.deb Size/MD5 checksum: 11030660 02d39005c7b486f1d3541875052435d0

i386 architecture (Intel ia32)

http://security.debian.org/pool/updates/main/q/qemu/qemu_0.9.1-10lenny1_i386.deb Size/MD5 checksum: 10560190 d037ea7864b2c1d2bffe0738c56b042d

powerpc architecture (PowerPC)

http://security.debian.org/pool/updates/main/q/qemu/qemu_0.9.1-10lenny1_powerpc.deb Size/MD5 checksum: 10193596 40cfcd624e20d717e4ee0ce2655e5463

sparc architecture (Sun SPARC/UltraSPARC)

http://security.debian.org/pool/updates/main/q/qemu/qemu_0.9.1-10lenny1_sparc.deb Size/MD5 checksum: 15700104 51cb77dee407b1c7ae7e3938a7e9c576

These files will probably be moved into the stable distribution on its next update.

For apt-get: deb http://security.debian.org/ stable/updates main For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main Mailing list: debian-security-announce@lists.debian.org Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>