4.6 Medium
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
COMPLETE
Integrity Impact
NONE
Availability Impact
NONE
AV:L/AC:L/Au:S/C:C/I:N/A:N
0.001 Low
EPSS
Percentile
26.3%
Debian Security Advisory DSA-2543-1 [email protected]
http://www.debian.org/security/ Raphael Geissert
September 08, 2012 http://www.debian.org/security/faq
Package : xen-qemu-dm-4.0
Vulnerability : multiple
Problem type : local
Debian-specific: no
CVE ID : CVE-2012-3515 CVE-2012-4411
Multiple vulnerabilities have been discovered in xen-qemu-dm-4.0, the Xen
Qemu Device Model virtual machine hardware emulator. The Common
Vulnerabilities and Exposures project identifies the following problems:
CVE-2012-3515:
The device model for HVM domains does not properly handle VT100
escape sequences when emulating certain devices with a virtual
console backend. An attacker within a guest with access to the
vulnerable virtual console could overwrite memory of the device
model and escalate privileges to that of the device model process.
CVE-2012-4411:
The qemu monitor was enabled by default, allowing administrators of
a guest to access resources of the host, possibly escalate privileges
or access resources belonging to another guest.
For the stable distribution (squeeze), these problems have been fixed in
version 4.0.1-2+squeeze2.
The testing distribution (wheezy), and the unstable distribution (sid),
no longer contain this package.
We recommend that you upgrade your xen-qemu-dm-4.0 packages.
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: http://www.debian.org/security/
Mailing list: [email protected]
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Debian | 6 | amd64 | xen-qemu-dm-4.0 | <Â 4.0.1-2+squeeze2 | xen-qemu-dm-4.0_4.0.1-2+squeeze2_amd64.deb |
Debian | 6 | i386 | xen-qemu-dm-4.0 | <Â 4.0.1-2+squeeze2 | xen-qemu-dm-4.0_4.0.1-2+squeeze2_i386.deb |
Debian | 6 | all | xen-qemu-dm-4.0 | <Â 4.0.1-2+squeeze2 | xen-qemu-dm-4.0_4.0.1-2+squeeze2_all.deb |