Lucene search

K
debianDebianDEBIAN:DSA-2543-1:24FA9
HistorySep 08, 2012 - 9:32 p.m.

[SECURITY] [DSA 2543-1] xen-qemu-dm-4.0 security update

2012-09-0821:32:19
lists.debian.org
7

4.6 Medium

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:S/C:C/I:N/A:N

0.001 Low

EPSS

Percentile

26.3%


Debian Security Advisory DSA-2543-1 [email protected]
http://www.debian.org/security/ Raphael Geissert
September 08, 2012 http://www.debian.org/security/faq


Package : xen-qemu-dm-4.0
Vulnerability : multiple
Problem type : local
Debian-specific: no
CVE ID : CVE-2012-3515 CVE-2012-4411

Multiple vulnerabilities have been discovered in xen-qemu-dm-4.0, the Xen
Qemu Device Model virtual machine hardware emulator. The Common
Vulnerabilities and Exposures project identifies the following problems:

CVE-2012-3515:

The device model for HVM domains does not properly handle VT100
escape sequences when emulating certain devices with a virtual
console backend. An attacker within a guest with access to the
vulnerable virtual console could overwrite memory of the device
model and escalate privileges to that of the device model process.

CVE-2012-4411:

The qemu monitor was enabled by default, allowing administrators of
a guest to access resources of the host, possibly escalate privileges
or access resources belonging to another guest.

For the stable distribution (squeeze), these problems have been fixed in
version 4.0.1-2+squeeze2.

The testing distribution (wheezy), and the unstable distribution (sid),
no longer contain this package.

We recommend that you upgrade your xen-qemu-dm-4.0 packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: http://www.debian.org/security/

Mailing list: [email protected]

4.6 Medium

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:S/C:C/I:N/A:N

0.001 Low

EPSS

Percentile

26.3%

Related for DEBIAN:DSA-2543-1:24FA9