[SECURITY] [DSA 3349-1] qemu-kvm security update

2015-09-0216:22:36

lists.debian.org

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

JSON

Debian Security Advisory DSA-3349-1 [email protected]
https://www.debian.org/security/ Salvatore Bonaccorso
September 02, 2015 https://www.debian.org/security/faq

Package : qemu-kvm
CVE ID : CVE-2015-5165 CVE-2015-5745

Several vulnerabilities were discovered in qemu-kvm, a full
virtualization solution on x86 hardware.

CVE-2015-5165

Donghai Zhu discovered that the QEMU model of the RTL8139 network
card did not sufficiently validate inputs in the C+ mode offload
emulation, allowing a malicious guest to read uninitialized memory
from the QEMU process&#x27;s heap.

CVE-2015-5745

A buffer overflow vulnerability was discovered in the way QEMU
handles the virtio-serial device. A malicious guest could use this
flaw to mount a denial of service (QEMU process crash).

For the oldstable distribution (wheezy), these problems have been fixed
in version 1.1.2+dfsg-6+deb7u9.

We recommend that you upgrade your qemu-kvm packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: [email protected]

OSVersionArchitecturePackageVersionFilename
Debian8ppc64elqemu-system-common< 2.1+dfsg-12+deb8u2qemu-system-common_2.1+dfsg-12+deb8u2_ppc64el.deb
Debian8powerpcqemu-user< 2.1+dfsg-12+deb8u2qemu-user_2.1+dfsg-12+deb8u2_powerpc.deb
Debian8arm64qemu-utils< 2.1+dfsg-12+deb8u2qemu-utils_2.1+dfsg-12+deb8u2_arm64.deb
Debian8i386qemu-system-common< 2.1+dfsg-12+deb8u2qemu-system-common_2.1+dfsg-12+deb8u2_i386.deb
Debian8i386qemu-system-sparc< 2.1+dfsg-12+deb8u2qemu-system-sparc_2.1+dfsg-12+deb8u2_i386.deb
Debian8ppc64elqemu-system-misc< 2.1+dfsg-12+deb8u2qemu-system-misc_2.1+dfsg-12+deb8u2_ppc64el.deb
Debian7allxen-docs-4.1< 4.1.6.1-1+deb7u1xen-docs-4.1_4.1.6.1-1+deb7u1_all.deb
Debian7i386qemu-kvm-dbg< 1.1.2+dfsg-6+deb7u9qemu-kvm-dbg_1.1.2+dfsg-6+deb7u9_i386.deb
Debian8mipselqemu-guest-agent< 2.1+dfsg-12+deb8u2qemu-guest-agent_2.1+dfsg-12+deb8u2_mipsel.deb
Debian7sparcqemu-system< 1.1.2+dfsg-6a+deb7u9qemu-system_1.1.2+dfsg-6a+deb7u9_sparc.deb

OS	Version	Architecture	Package	Version	Filename
Debian	8	ppc64el	qemu-system-common	< 2.1+dfsg-12+deb8u2	qemu-system-common_2.1+dfsg-12+deb8u2_ppc64el.deb
Debian	8	powerpc	qemu-user	< 2.1+dfsg-12+deb8u2	qemu-user_2.1+dfsg-12+deb8u2_powerpc.deb
Debian	8	arm64	qemu-utils	< 2.1+dfsg-12+deb8u2	qemu-utils_2.1+dfsg-12+deb8u2_arm64.deb
Debian	8	i386	qemu-system-common	< 2.1+dfsg-12+deb8u2	qemu-system-common_2.1+dfsg-12+deb8u2_i386.deb
Debian	8	i386	qemu-system-sparc	< 2.1+dfsg-12+deb8u2	qemu-system-sparc_2.1+dfsg-12+deb8u2_i386.deb
Debian	8	ppc64el	qemu-system-misc	< 2.1+dfsg-12+deb8u2	qemu-system-misc_2.1+dfsg-12+deb8u2_ppc64el.deb
Debian	7	all	xen-docs-4.1	< 4.1.6.1-1+deb7u1	xen-docs-4.1_4.1.6.1-1+deb7u1_all.deb
Debian	7	i386	qemu-kvm-dbg	< 1.1.2+dfsg-6+deb7u9	qemu-kvm-dbg_1.1.2+dfsg-6+deb7u9_i386.deb
Debian	8	mipsel	qemu-guest-agent	< 2.1+dfsg-12+deb8u2	qemu-guest-agent_2.1+dfsg-12+deb8u2_mipsel.deb
Debian	7	sparc	qemu-system	< 1.1.2+dfsg-6a+deb7u9	qemu-system_1.1.2+dfsg-6a+deb7u9_sparc.deb