[SECURITY] [DSA 3067-1] qemu-kvm security update

2014-11-0615:58:59

lists.debian.org

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.891 High

EPSS

Percentile

98.7%

JSON

Debian Security Advisory DSA-3067-1 [email protected]
http://www.debian.org/security/ Salvatore Bonaccorso
November 06, 2014 http://www.debian.org/security/faq

Package : qemu-kvm
CVE ID : CVE-2014-3689 CVE-2014-7815

Several vulnerabilities were discovered in qemu-kvm, a full
virtualization solution on x86 hardware.

CVE-2014-3689

The Advanced Threat Research team at Intel Security reported that
guest provided parameter were insufficiently validated in
rectangle functions in the vmware-vga driver. A privileged guest
user could use this flaw to write into qemu address space on the
host, potentially escalating their privileges to those of the
qemu host process.

CVE-2014-7815

James Spadaro of Cisco reported insufficiently sanitized
bits_per_pixel from the client in the QEMU VNC display driver. An
attacker having access to the guest&#x27;s VNC console could use this
flaw to crash the guest.

For the stable distribution (wheezy), these problems have been fixed in
version 1.1.2+dfsg-6+deb7u5.

We recommend that you upgrade your qemu-kvm packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: [email protected]

OSVersionArchitecturePackageVersionFilename
Debian7s390xqemu-utils< 1.1.2+dfsg-6a+deb7u5qemu-utils_1.1.2+dfsg-6a+deb7u5_s390x.deb
Debian7armhfqemu-user< 1.1.2+dfsg-6a+deb7u5qemu-user_1.1.2+dfsg-6a+deb7u5_armhf.deb
Debian7amd64qemu-kvm-dbg< 1.1.2+dfsg-6+deb7u5qemu-kvm-dbg_1.1.2+dfsg-6+deb7u5_amd64.deb
Debian7amd64qemu-user-static< 1.1.2+dfsg-6a+deb7u5qemu-user-static_1.1.2+dfsg-6a+deb7u5_amd64.deb
Debian7armelqemu-system< 1.1.2+dfsg-6a+deb7u5qemu-system_1.1.2+dfsg-6a+deb7u5_armel.deb
Debian7i386qemu-user< 1.1.2+dfsg-6a+deb7u5qemu-user_1.1.2+dfsg-6a+deb7u5_i386.deb
Debian7allqemu-kvm< 1.1.2+dfsg-6+deb7u5qemu-kvm_1.1.2+dfsg-6+deb7u5_all.deb
Debian7amd64qemu-kvm< 1.1.2+dfsg-6+deb7u5qemu-kvm_1.1.2+dfsg-6+deb7u5_amd64.deb
Debian7amd64qemu-system< 1.1.2+dfsg-6a+deb7u5qemu-system_1.1.2+dfsg-6a+deb7u5_amd64.deb
Debian7i386qemu< 1.1.2+dfsg-6a+deb7u5qemu_1.1.2+dfsg-6a+deb7u5_i386.deb

OS	Version	Architecture	Package	Version	Filename
Debian	7	s390x	qemu-utils	< 1.1.2+dfsg-6a+deb7u5	qemu-utils_1.1.2+dfsg-6a+deb7u5_s390x.deb
Debian	7	armhf	qemu-user	< 1.1.2+dfsg-6a+deb7u5	qemu-user_1.1.2+dfsg-6a+deb7u5_armhf.deb
Debian	7	amd64	qemu-kvm-dbg	< 1.1.2+dfsg-6+deb7u5	qemu-kvm-dbg_1.1.2+dfsg-6+deb7u5_amd64.deb
Debian	7	amd64	qemu-user-static	< 1.1.2+dfsg-6a+deb7u5	qemu-user-static_1.1.2+dfsg-6a+deb7u5_amd64.deb
Debian	7	armel	qemu-system	< 1.1.2+dfsg-6a+deb7u5	qemu-system_1.1.2+dfsg-6a+deb7u5_armel.deb
Debian	7	i386	qemu-user	< 1.1.2+dfsg-6a+deb7u5	qemu-user_1.1.2+dfsg-6a+deb7u5_i386.deb
Debian	7	all	qemu-kvm	< 1.1.2+dfsg-6+deb7u5	qemu-kvm_1.1.2+dfsg-6+deb7u5_all.deb
Debian	7	amd64	qemu-kvm	< 1.1.2+dfsg-6+deb7u5	qemu-kvm_1.1.2+dfsg-6+deb7u5_amd64.deb
Debian	7	amd64	qemu-system	< 1.1.2+dfsg-6a+deb7u5	qemu-system_1.1.2+dfsg-6a+deb7u5_amd64.deb
Debian	7	i386	qemu	< 1.1.2+dfsg-6a+deb7u5	qemu_1.1.2+dfsg-6a+deb7u5_i386.deb