{"id": "SUSE_SU-2016-1560-1.NASL", "bulletinFamily": "scanner", "title": "SUSE SLED12 / SLES12 Security Update : qemu (SUSE-SU-2016:1560-1)", "description": "qemu was updated to fix 37 security issues.\n\nThese security issues were fixed :\n\n - CVE-2016-4439: Avoid OOB access in 53C9X emulation\n (bsc#980711)\n\n - CVE-2016-4441: Avoid OOB access in 53C9X emulation\n (bsc#980723)\n\n - CVE-2016-4952: Avoid OOB access in Vmware PV SCSI\n emulation (bsc#981266)\n\n - CVE-2015-8817: Avoid OOB access in PCI DMA I/O\n (bsc#969121)\n\n - CVE-2015-8818: Avoid OOB access in PCI DMA I/O\n (bsc#969122)\n\n - CVE-2016-3710: Fixed VGA emulation based OOB access with\n potential for guest escape (bsc#978158)\n\n - CVE-2016-3712: Fixed VGa emulation based DOS and OOB\n read access exploit (bsc#978160)\n\n - CVE-2016-4037: Fixed USB ehci based DOS (bsc#976109)\n\n - CVE-2016-2538: Fixed potential OOB access in USB net\n device emulation (bsc#967969)\n\n - CVE-2016-2841: Fixed OOB access / hang in ne2000\n emulation (bsc#969350)\n\n - CVE-2016-2858: Avoid potential DOS when using QEMU\n pseudo random number generator (bsc#970036)\n\n - CVE-2016-2857: Fixed OOB access when processing IP\n checksums (bsc#970037)\n\n - CVE-2016-4001: Fixed OOB access in Stellaris enet\n emulated nic (bsc#975128)\n\n - CVE-2016-4002: Fixed OOB access in MIPSnet emulated\n controller (bsc#975136)\n\n - CVE-2016-4020: Fixed possible host data leakage to guest\n from TPR access (bsc#975700)\n\n - CVE-2015-3214: Fixed OOB read in i8254 PIC (bsc#934069)\n\n - CVE-2014-9718: Fixed the handling of malformed or short\n ide PRDTs to avoid any opportunity for guest to cause\n DoS by abusing that interface (bsc#928393)\n\n - CVE-2014-3689: Fixed insufficient parameter validation\n in rectangle functions (bsc#901508)\n\n - CVE-2014-3615: The VGA emulator in QEMU allowed local\n guest users to read host memory by setting the display\n to a high resolution (bsc#895528).\n\n - CVE-2015-5239: Integer overflow in vnc_client_read() and\n protocol_client_msg() (bsc#944463).\n\n - CVE-2015-5745: Buffer overflow in virtio-serial\n (bsc#940929).\n\n - CVE-2015-7295: hw/virtio/virtio.c in the Virtual Network\n Device (virtio-net) support in QEMU, when big or\n mergeable receive buffers are not supported, allowed\n remote attackers to cause a denial of service (guest\n network consumption) via a flood of jumbo frames on the\n (1) tuntap or (2) macvtap interface (bsc#947159).\n\n - CVE-2015-7549: PCI NULL pointer dereferences\n (bsc#958917).\n\n - CVE-2015-8504: VNC floating point exception\n (bsc#958491).\n\n - CVE-2015-8558: Infinite loop in ehci_advance_state\n resulting in DoS (bsc#959005).\n\n - CVE-2015-8567: A guest repeatedly activating a vmxnet3\n device can leak host memory (bsc#959386).\n\n - CVE-2015-8568: A guest repeatedly activating a vmxnet3\n device can leak host memory (bsc#959386).\n\n - CVE-2015-8613: Wrong sized memset in megasas command\n handler (bsc#961358).\n\n - CVE-2015-8619: Potential DoS for long HMP sendkey\n command argument (bsc#960334).\n\n - CVE-2015-8743: OOB memory access in ne2000 ioport r/w\n functions (bsc#960725).\n\n - CVE-2015-8744: Incorrect l2 header validation could have\n lead to a crash via assert(2) call (bsc#960835).\n\n - CVE-2015-8745: Reading IMR registers could have lead to\n a crash via assert(2) call (bsc#960708).\n\n - CVE-2016-1568: AHCI use-after-free in aio port commands\n (bsc#961332).\n\n - CVE-2016-1714: Potential OOB memory access in processing\n firmware configuration (bsc#961691).\n\n - CVE-2016-1922: NULL pointer dereference when processing\n hmp i/o command (bsc#962320).\n\n - CVE-2016-1981: Potential DoS (infinite loop) in e1000\n device emulation by malicious privileged user within\n guest (bsc#963782).\n\n - CVE-2016-2198: Malicious privileged guest user were able\n to cause DoS by writing to read-only EHCI capabilities\n registers (bsc#964413).\n\nThis non-security issue was fixed\n\n - bsc#886378: qemu truncates vhd images in virt-rescue\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "published": "2016-06-17T00:00:00", "modified": "2016-06-17T00:00:00", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}, "href": "https://www.tenable.com/plugins/nessus/91660", "reporter": "This script is Copyright (C) 2016-2021 and is owned by Tenable, Inc. or an Affiliate thereof.", "references": ["https://bugzilla.suse.com/show_bug.cgi?id=960708", "https://bugzilla.suse.com/show_bug.cgi?id=975136", "https://bugzilla.suse.com/show_bug.cgi?id=928393", "https://bugzilla.suse.com/show_bug.cgi?id=959386", "https://www.suse.com/security/cve/CVE-2016-1981/", "https://bugzilla.suse.com/show_bug.cgi?id=901508", "http://www.nessus.org/u?e8098092", "https://bugzilla.suse.com/show_bug.cgi?id=959005", "https://bugzilla.suse.com/show_bug.cgi?id=960334", "https://bugzilla.suse.com/show_bug.cgi?id=940929", "https://bugzilla.suse.com/show_bug.cgi?id=980723", "https://bugzilla.suse.com/show_bug.cgi?id=970036", "https://www.suse.com/security/cve/CVE-2015-8619/", "https://bugzilla.suse.com/show_bug.cgi?id=975128", "https://www.suse.com/security/cve/CVE-2016-4020/", "https://www.suse.com/security/cve/CVE-2016-1714/", "https://www.suse.com/security/cve/CVE-2016-2198/", "https://bugzilla.suse.com/show_bug.cgi?id=934069", "https://www.suse.com/security/cve/CVE-2015-5239/", "https://www.suse.com/security/cve/CVE-2015-8745/", "https://bugzilla.suse.com/show_bug.cgi?id=886378", "https://bugzilla.suse.com/show_bug.cgi?id=978160", "https://bugzilla.suse.com/show_bug.cgi?id=961556", "https://www.suse.com/security/cve/CVE-2016-3712/", "https://bugzilla.suse.com/show_bug.cgi?id=895528", "https://www.suse.com/security/cve/CVE-2016-4439/", "https://www.suse.com/security/cve/CVE-2015-8558/", "https://www.suse.com/security/cve/CVE-2014-9718/", "https://bugzilla.suse.com/show_bug.cgi?id=969350", "https://bugzilla.suse.com/show_bug.cgi?id=967969", "https://bugzilla.suse.com/show_bug.cgi?id=958491", "https://bugzilla.suse.com/show_bug.cgi?id=970037", "https://www.suse.com/security/cve/CVE-2016-1922/", "https://bugzilla.suse.com/show_bug.cgi?id=976109", "https://www.suse.com/security/cve/CVE-2015-7549/", "https://www.suse.com/security/cve/CVE-2015-8817/", "https://www.suse.com/security/cve/CVE-2016-3710/", "https://bugzilla.suse.com/show_bug.cgi?id=960725", "https://www.suse.com/security/cve/CVE-2015-8568/", "https://bugzilla.suse.com/show_bug.cgi?id=962320", "https://bugzilla.suse.com/show_bug.cgi?id=980711", "https://www.suse.com/security/cve/CVE-2016-2538/", "https://www.suse.com/security/cve/CVE-2015-8504/", "https://www.suse.com/security/cve/CVE-2016-4037/", "https://www.suse.com/security/cve/CVE-2016-4441/", "https://bugzilla.suse.com/show_bug.cgi?id=978158", "https://bugzilla.suse.com/show_bug.cgi?id=969122", "https://www.suse.com/security/cve/CVE-2016-4952/", "https://bugzilla.suse.com/show_bug.cgi?id=944463", "https://www.suse.com/security/cve/CVE-2016-2841/", "https://www.suse.com/security/cve/CVE-2015-8744/", "https://www.suse.com/security/cve/CVE-2015-5745/", "https://www.suse.com/security/cve/CVE-2016-4001/", "https://www.suse.com/security/cve/CVE-2015-8818/", "https://www.suse.com/security/cve/CVE-2015-8743/", "https://www.suse.com/security/cve/CVE-2016-1568/", "https://bugzilla.suse.com/show_bug.cgi?id=960835", "https://www.suse.com/security/cve/CVE-2015-7295/", "https://bugzilla.suse.com/show_bug.cgi?id=961332", "https://www.suse.com/security/cve/CVE-2016-2858/", "https://bugzilla.suse.com/show_bug.cgi?id=961333", "https://www.suse.com/security/cve/CVE-2014-3689/", "https://bugzilla.suse.com/show_bug.cgi?id=947159", "https://bugzilla.suse.com/show_bug.cgi?id=981266", "https://www.suse.com/security/cve/CVE-2016-4002/", "https://bugzilla.suse.com/show_bug.cgi?id=963782", "https://bugzilla.suse.com/show_bug.cgi?id=975700", "https://bugzilla.suse.com/show_bug.cgi?id=961691", "https://bugzilla.suse.com/show_bug.cgi?id=969121", "https://www.suse.com/security/cve/CVE-2015-8567/", "https://bugzilla.suse.com/show_bug.cgi?id=961358", "https://www.suse.com/security/cve/CVE-2015-8613/", "https://www.suse.com/security/cve/CVE-2015-3214/", "https://bugzilla.suse.com/show_bug.cgi?id=958917", "https://www.suse.com/security/cve/CVE-2014-3615/", "https://www.suse.com/security/cve/CVE-2016-2857/", "https://bugzilla.suse.com/show_bug.cgi?id=964413"], "cvelist": ["CVE-2015-8567", "CVE-2015-3214", "CVE-2016-2858", "CVE-2014-3689", "CVE-2014-9718", "CVE-2015-8619", "CVE-2015-8558", "CVE-2015-8613", "CVE-2016-1922", "CVE-2016-4441", "CVE-2016-3712", "CVE-2015-8817", "CVE-2016-4952", "CVE-2016-3710", "CVE-2015-5745", "CVE-2015-8568", "CVE-2016-2198", "CVE-2016-4002", "CVE-2015-8744", "CVE-2016-4020", "CVE-2015-7549", "CVE-2016-2841", "CVE-2015-8743", "CVE-2016-4001", "CVE-2015-8818", "CVE-2016-1568", "CVE-2016-4037", "CVE-2015-8745", "CVE-2016-1714", "CVE-2016-2857", "CVE-2016-1981", "CVE-2015-8504", "CVE-2016-4439", "CVE-2015-5239", "CVE-2016-2538", "CVE-2014-3615", "CVE-2015-7295"], "type": "nessus", "lastseen": "2021-01-07T14:24:06", "edition": 30, "viewCount": 5, "enchantments": {"dependencies": {"references": [{"type": "openvas", "idList": ["OPENVAS:1361412562310807207", "OPENVAS:1361412562310703471", "OPENVAS:1361412562310851362", "OPENVAS:1361412562310807717", "OPENVAS:1361412562310121458", "OPENVAS:1361412562310842633", "OPENVAS:703471", "OPENVAS:1361412562310131187", "OPENVAS:1361412562310842747", "OPENVAS:1361412562310851335"]}, {"type": "suse", "idList": ["OPENSUSE-SU-2016:1750-1", "SUSE-SU-2016:1560-1", "SUSE-SU-2016:0873-1", "SUSE-SU-2016:1785-1", "SUSE-SU-2016:1698-1", "SUSE-SU-2016:1703-1"]}, {"type": "nessus", "idList": ["DEBIAN_DSA-3471.NASL", "OPENSUSE-2016-839.NASL", "UBUNTU_USN-2891-1.NASL", "SUSE_SU-2016-1698-1.NASL", "UBUNTU_USN-2974-1.NASL", "FEDORA_2016-38B20AA50F.NASL", "FEDORA_2016-42778E8C82.NASL", "SUSE_SU-2016-1785-1.NASL", "FEDORA_2016-F4504E9445.NASL", "SUSE_SU-2016-1703-1.NASL"]}, {"type": "ubuntu", "idList": ["USN-2974-1", "USN-2891-1"]}, {"type": "debian", "idList": ["DEBIAN:DSA-3471-1:91F2D", "DEBIAN:DSA-3470-1:E622E", "DEBIAN:DSA-3469-1:9C2F1"]}, {"type": "fedora", "idList": ["FEDORA:2FEAA604E478", "FEDORA:A686460350CF", "FEDORA:D3EC061CDFC5", "FEDORA:0BA3A605A0E5", "FEDORA:0C5CE60528EE", "FEDORA:9C91760D32D9", "FEDORA:068D36097257", "FEDORA:60C2562E61B8"]}, {"type": "gentoo", "idList": ["GLSA-201604-01"]}, {"type": "f5", "idList": ["F5:K04755144", "SOL04755144"]}, {"type": "cve", "idList": ["CVE-2015-7295", "CVE-2015-8817", "CVE-2016-4952", "CVE-2015-7549", "CVE-2015-8818", "CVE-2014-9718", "CVE-2015-8744", "CVE-2015-8567", "CVE-2015-8613", "CVE-2015-8568"]}], "modified": "2021-01-07T14:24:06", "rev": 2}, "score": {"value": 7.3, "vector": "NONE", "modified": "2021-01-07T14:24:06", "rev": 2}, "vulnersScore": 7.3}, "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from SUSE update advisory SUSE-SU-2016:1560-1.\n# The text itself is copyright (C) SUSE.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(91660);\n script_version(\"2.12\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2014-3615\", \"CVE-2014-3689\", \"CVE-2014-9718\", \"CVE-2015-3214\", \"CVE-2015-5239\", \"CVE-2015-5745\", \"CVE-2015-7295\", \"CVE-2015-7549\", \"CVE-2015-8504\", \"CVE-2015-8558\", \"CVE-2015-8567\", \"CVE-2015-8568\", \"CVE-2015-8613\", \"CVE-2015-8619\", \"CVE-2015-8743\", \"CVE-2015-8744\", \"CVE-2015-8745\", \"CVE-2015-8817\", \"CVE-2015-8818\", \"CVE-2016-1568\", \"CVE-2016-1714\", \"CVE-2016-1922\", \"CVE-2016-1981\", \"CVE-2016-2198\", \"CVE-2016-2538\", \"CVE-2016-2841\", \"CVE-2016-2857\", \"CVE-2016-2858\", \"CVE-2016-3710\", \"CVE-2016-3712\", \"CVE-2016-4001\", \"CVE-2016-4002\", \"CVE-2016-4020\", \"CVE-2016-4037\", \"CVE-2016-4439\", \"CVE-2016-4441\", \"CVE-2016-4952\");\n script_bugtraq_id(69654, 70997, 73316, 75273);\n\n script_name(english:\"SUSE SLED12 / SLES12 Security Update : qemu (SUSE-SU-2016:1560-1)\");\n script_summary(english:\"Checks rpm output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\"The remote SUSE host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"qemu was updated to fix 37 security issues.\n\nThese security issues were fixed :\n\n - CVE-2016-4439: Avoid OOB access in 53C9X emulation\n (bsc#980711)\n\n - CVE-2016-4441: Avoid OOB access in 53C9X emulation\n (bsc#980723)\n\n - CVE-2016-4952: Avoid OOB access in Vmware PV SCSI\n emulation (bsc#981266)\n\n - CVE-2015-8817: Avoid OOB access in PCI DMA I/O\n (bsc#969121)\n\n - CVE-2015-8818: Avoid OOB access in PCI DMA I/O\n (bsc#969122)\n\n - CVE-2016-3710: Fixed VGA emulation based OOB access with\n potential for guest escape (bsc#978158)\n\n - CVE-2016-3712: Fixed VGa emulation based DOS and OOB\n read access exploit (bsc#978160)\n\n - CVE-2016-4037: Fixed USB ehci based DOS (bsc#976109)\n\n - CVE-2016-2538: Fixed potential OOB access in USB net\n device emulation (bsc#967969)\n\n - CVE-2016-2841: Fixed OOB access / hang in ne2000\n emulation (bsc#969350)\n\n - CVE-2016-2858: Avoid potential DOS when using QEMU\n pseudo random number generator (bsc#970036)\n\n - CVE-2016-2857: Fixed OOB access when processing IP\n checksums (bsc#970037)\n\n - CVE-2016-4001: Fixed OOB access in Stellaris enet\n emulated nic (bsc#975128)\n\n - CVE-2016-4002: Fixed OOB access in MIPSnet emulated\n controller (bsc#975136)\n\n - CVE-2016-4020: Fixed possible host data leakage to guest\n from TPR access (bsc#975700)\n\n - CVE-2015-3214: Fixed OOB read in i8254 PIC (bsc#934069)\n\n - CVE-2014-9718: Fixed the handling of malformed or short\n ide PRDTs to avoid any opportunity for guest to cause\n DoS by abusing that interface (bsc#928393)\n\n - CVE-2014-3689: Fixed insufficient parameter validation\n in rectangle functions (bsc#901508)\n\n - CVE-2014-3615: The VGA emulator in QEMU allowed local\n guest users to read host memory by setting the display\n to a high resolution (bsc#895528).\n\n - CVE-2015-5239: Integer overflow in vnc_client_read() and\n protocol_client_msg() (bsc#944463).\n\n - CVE-2015-5745: Buffer overflow in virtio-serial\n (bsc#940929).\n\n - CVE-2015-7295: hw/virtio/virtio.c in the Virtual Network\n Device (virtio-net) support in QEMU, when big or\n mergeable receive buffers are not supported, allowed\n remote attackers to cause a denial of service (guest\n network consumption) via a flood of jumbo frames on the\n (1) tuntap or (2) macvtap interface (bsc#947159).\n\n - CVE-2015-7549: PCI NULL pointer dereferences\n (bsc#958917).\n\n - CVE-2015-8504: VNC floating point exception\n (bsc#958491).\n\n - CVE-2015-8558: Infinite loop in ehci_advance_state\n resulting in DoS (bsc#959005).\n\n - CVE-2015-8567: A guest repeatedly activating a vmxnet3\n device can leak host memory (bsc#959386).\n\n - CVE-2015-8568: A guest repeatedly activating a vmxnet3\n device can leak host memory (bsc#959386).\n\n - CVE-2015-8613: Wrong sized memset in megasas command\n handler (bsc#961358).\n\n - CVE-2015-8619: Potential DoS for long HMP sendkey\n command argument (bsc#960334).\n\n - CVE-2015-8743: OOB memory access in ne2000 ioport r/w\n functions (bsc#960725).\n\n - CVE-2015-8744: Incorrect l2 header validation could have\n lead to a crash via assert(2) call (bsc#960835).\n\n - CVE-2015-8745: Reading IMR registers could have lead to\n a crash via assert(2) call (bsc#960708).\n\n - CVE-2016-1568: AHCI use-after-free in aio port commands\n (bsc#961332).\n\n - CVE-2016-1714: Potential OOB memory access in processing\n firmware configuration (bsc#961691).\n\n - CVE-2016-1922: NULL pointer dereference when processing\n hmp i/o command (bsc#962320).\n\n - CVE-2016-1981: Potential DoS (infinite loop) in e1000\n device emulation by malicious privileged user within\n guest (bsc#963782).\n\n - CVE-2016-2198: Malicious privileged guest user were able\n to cause DoS by writing to read-only EHCI capabilities\n registers (bsc#964413).\n\nThis non-security issue was fixed\n\n - bsc#886378: qemu truncates vhd images in virt-rescue\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=886378\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=895528\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=901508\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=928393\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=934069\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=940929\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=944463\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=947159\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=958491\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=958917\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=959005\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=959386\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=960334\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=960708\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=960725\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=960835\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=961332\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=961333\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=961358\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=961556\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=961691\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=962320\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=963782\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=964413\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=967969\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=969121\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=969122\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=969350\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=970036\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=970037\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=975128\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=975136\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=975700\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=976109\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=978158\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=978160\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=980711\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=980723\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=981266\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2014-3615/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2014-3689/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2014-9718/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-3214/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-5239/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-5745/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-7295/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-7549/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8504/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8558/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8567/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8568/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8613/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8619/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8743/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8744/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8745/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8817/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8818/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-1568/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-1714/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-1922/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-1981/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-2198/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-2538/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-2841/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-2857/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-2858/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-3710/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-3712/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-4001/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-4002/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-4020/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-4037/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-4439/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-4441/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-4952/\"\n );\n # https://www.suse.com/support/update/announcement/2016/suse-su-20161560-1/\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?e8098092\"\n );\n script_set_attribute(\n attribute:\"solution\",\n value:\n\"To install this SUSE Security Update use YaST online_update.\nAlternatively you can run the command listed for your product :\n\nSUSE Linux Enterprise Server 12 :\n\nzypper in -t patch SUSE-SLE-SERVER-12-2016-924=1\n\nSUSE Linux Enterprise Desktop 12 :\n\nzypper in -t patch SUSE-SLE-DESKTOP-12-2016-924=1\n\nTo bring your system up-to-date, use 'zypper patch'.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:qemu\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:qemu-block-curl\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:qemu-block-curl-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:qemu-block-rbd\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:qemu-block-rbd-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:qemu-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:qemu-guest-agent\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:qemu-guest-agent-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:qemu-kvm\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:qemu-lang\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:qemu-s390\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:qemu-s390-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:qemu-tools\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:qemu-tools-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:qemu-x86\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:qemu-x86-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:12\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2014/11/01\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/06/13\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/06/17\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nos_ver = pregmatch(pattern: \"^(SLE(S|D)\\d+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"SUSE\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLED12|SLES12)$\", string:os_ver)) audit(AUDIT_OS_NOT, \"SUSE SLED12 / SLES12\", \"SUSE \" + os_ver);\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^i[3-6]86$\" && \"x86_64\" >!< cpu && \"s390x\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"SUSE \" + os_ver, cpu);\n\nsp = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(sp)) sp = \"0\";\nif (os_ver == \"SLES12\" && (! preg(pattern:\"^(0)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLES12 SP0\", os_ver + \" SP\" + sp);\nif (os_ver == \"SLED12\" && (! preg(pattern:\"^(0)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLED12 SP0\", os_ver + \" SP\" + sp);\n\n\nflag = 0;\nif (rpm_check(release:\"SLES12\", sp:\"0\", cpu:\"x86_64\", reference:\"qemu-block-rbd-2.0.2-48.19.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", cpu:\"x86_64\", reference:\"qemu-block-rbd-debuginfo-2.0.2-48.19.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", cpu:\"x86_64\", reference:\"qemu-x86-2.0.2-48.19.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", cpu:\"x86_64\", reference:\"qemu-x86-debuginfo-2.0.2-48.19.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", cpu:\"s390x\", reference:\"qemu-s390-2.0.2-48.19.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", cpu:\"s390x\", reference:\"qemu-s390-debuginfo-2.0.2-48.19.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"qemu-2.0.2-48.19.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"qemu-block-curl-2.0.2-48.19.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"qemu-block-curl-debuginfo-2.0.2-48.19.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"qemu-debugsource-2.0.2-48.19.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"qemu-guest-agent-2.0.2-48.19.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"qemu-guest-agent-debuginfo-2.0.2-48.19.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"qemu-lang-2.0.2-48.19.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"qemu-tools-2.0.2-48.19.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"qemu-tools-debuginfo-2.0.2-48.19.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"qemu-kvm-2.0.2-48.19.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"0\", cpu:\"x86_64\", reference:\"qemu-2.0.2-48.19.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"0\", cpu:\"x86_64\", reference:\"qemu-block-curl-2.0.2-48.19.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"0\", cpu:\"x86_64\", reference:\"qemu-block-curl-debuginfo-2.0.2-48.19.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"0\", cpu:\"x86_64\", reference:\"qemu-debugsource-2.0.2-48.19.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"0\", cpu:\"x86_64\", reference:\"qemu-kvm-2.0.2-48.19.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"0\", cpu:\"x86_64\", reference:\"qemu-tools-2.0.2-48.19.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"0\", cpu:\"x86_64\", reference:\"qemu-tools-debuginfo-2.0.2-48.19.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"0\", cpu:\"x86_64\", reference:\"qemu-x86-2.0.2-48.19.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"0\", cpu:\"x86_64\", reference:\"qemu-x86-debuginfo-2.0.2-48.19.1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"qemu\");\n}\n", "naslFamily": "SuSE Local Security Checks", "pluginID": "91660", "cpe": ["p-cpe:/a:novell:suse_linux:qemu-block-curl-debuginfo", "cpe:/o:novell:suse_linux:12", "p-cpe:/a:novell:suse_linux:qemu-s390-debuginfo", "p-cpe:/a:novell:suse_linux:qemu-guest-agent-debuginfo", "p-cpe:/a:novell:suse_linux:qemu-x86-debuginfo", "p-cpe:/a:novell:suse_linux:qemu-debugsource", "p-cpe:/a:novell:suse_linux:qemu-lang", "p-cpe:/a:novell:suse_linux:qemu", "p-cpe:/a:novell:suse_linux:qemu-tools", "p-cpe:/a:novell:suse_linux:qemu-guest-agent", "p-cpe:/a:novell:suse_linux:qemu-tools-debuginfo", "p-cpe:/a:novell:suse_linux:qemu-block-rbd", "p-cpe:/a:novell:suse_linux:qemu-kvm", "p-cpe:/a:novell:suse_linux:qemu-block-curl", "p-cpe:/a:novell:suse_linux:qemu-block-rbd-debuginfo", "p-cpe:/a:novell:suse_linux:qemu-s390", "p-cpe:/a:novell:suse_linux:qemu-x86"], "scheme": null, "cvss3": {"score": 9.0, "vector": "AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H"}}

{"openvas": [{"lastseen": "2020-03-14T18:57:17", "bulletinFamily": "scanner", "cvelist": ["CVE-2015-8567", "CVE-2015-3214", "CVE-2016-2858", "CVE-2014-3689", "CVE-2014-9718", "CVE-2015-8619", "CVE-2015-8558", "CVE-2015-8613", "CVE-2016-1922", "CVE-2016-4441", "CVE-2016-3712", "CVE-2015-8817", "CVE-2016-4952", "CVE-2016-3710", "CVE-2015-5745", "CVE-2015-8568", "CVE-2016-2198", "CVE-2016-4002", "CVE-2015-8744", "CVE-2016-4020", "CVE-2015-7549", "CVE-2016-2841", "CVE-2015-8743", "CVE-2016-4001", "CVE-2015-8818", "CVE-2016-1568", "CVE-2016-4037", "CVE-2015-8745", "CVE-2016-1714", "CVE-2016-2857", "CVE-2016-1981", "CVE-2015-8504", "CVE-2016-4439", "CVE-2015-5239", "CVE-2016-2538", "CVE-2014-3615", "CVE-2015-7295"], "description": "The remote host is missing an update for the ", "modified": "2020-01-31T00:00:00", "published": "2016-06-14T00:00:00", "id": "OPENVAS:1361412562310851335", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310851335", "type": "openvas", "title": "SUSE: Security Advisory for qemu (SUSE-SU-2016:1560-1)", "sourceData": "# Copyright (C) 2016 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.851335\");\n script_version(\"2020-01-31T07:58:03+0000\");\n script_tag(name:\"last_modification\", value:\"2020-01-31 07:58:03 +0000 (Fri, 31 Jan 2020)\");\n script_tag(name:\"creation_date\", value:\"2016-06-14 05:25:47 +0200 (Tue, 14 Jun 2016)\");\n script_cve_id(\"CVE-2014-3615\", \"CVE-2014-3689\", \"CVE-2014-9718\", \"CVE-2015-3214\",\n \"CVE-2015-5239\", \"CVE-2015-5745\", \"CVE-2015-7295\", \"CVE-2015-7549\",\n \"CVE-2015-8504\", \"CVE-2015-8558\", \"CVE-2015-8567\", \"CVE-2015-8568\",\n \"CVE-2015-8613\", \"CVE-2015-8619\", \"CVE-2015-8743\", \"CVE-2015-8744\",\n \"CVE-2015-8745\", \"CVE-2015-8817\", \"CVE-2015-8818\", \"CVE-2016-1568\",\n \"CVE-2016-1714\", \"CVE-2016-1922\", \"CVE-2016-1981\", \"CVE-2016-2198\",\n \"CVE-2016-2538\", \"CVE-2016-2841\", \"CVE-2016-2857\", \"CVE-2016-2858\",\n \"CVE-2016-3710\", \"CVE-2016-3712\", \"CVE-2016-4001\", \"CVE-2016-4002\",\n \"CVE-2016-4020\", \"CVE-2016-4037\", \"CVE-2016-4439\", \"CVE-2016-4441\",\n \"CVE-2016-4952\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"SUSE: Security Advisory for qemu (SUSE-SU-2016:1560-1)\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'qemu'\n package(s) announced via the referenced advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"qemu was updated to fix 37 security issues.\n\n These security issues were fixed:\n\n - CVE-2016-4439: Avoid OOB access in 53C9X emulation (bsc#980711)\n\n - CVE-2016-4441: Avoid OOB access in 53C9X emulation (bsc#980723)\n\n - CVE-2016-4952: Avoid OOB access in Vmware PV SCSI emulation (bsc#981266)\n\n - CVE-2015-8817: Avoid OOB access in PCI DMA I/O (bsc#969121)\n\n - CVE-2015-8818: Avoid OOB access in PCI DMA I/O (bsc#969122)\n\n - CVE-2016-3710: Fixed VGA emulation based OOB access with potential for\n guest escape (bsc#978158)\n\n - CVE-2016-3712: Fixed VGa emulation based DOS and OOB read access exploit\n (bsc#978160)\n\n - CVE-2016-4037: Fixed USB ehci based DOS (bsc#976109)\n\n - CVE-2016-2538: Fixed potential OOB access in USB net device emulation\n (bsc#967969)\n\n - CVE-2016-2841: Fixed OOB access / hang in ne2000 emulation (bsc#969350)\n\n - CVE-2016-2858: Avoid potential DOS when using QEMU pseudo random number\n generator (bsc#970036)\n\n - CVE-2016-2857: Fixed OOB access when processing IP checksums (bsc#970037)\n\n - CVE-2016-4001: Fixed OOB access in Stellaris enet emulated nic\n (bsc#975128)\n\n - CVE-2016-4002: Fixed OOB access in MIPSnet emulated controller\n (bsc#975136)\n\n - CVE-2016-4020: Fixed possible host data leakage to guest from TPR access\n (bsc#975700)\n\n - CVE-2015-3214: Fixed OOB read in i8254 PIC (bsc#934069)\n\n - CVE-2014-9718: Fixed the handling of malformed or short ide PRDTs to\n avoid any opportunity for guest to cause DoS by abusing that interface\n (bsc#928393)\n\n - CVE-2014-3689: Fixed insufficient parameter validation in rectangle\n functions (bsc#901508)\n\n - CVE-2014-3615: The VGA emulator in QEMU allowed local guest users to\n read host memory by setting the display to a high resolution\n (bsc#895528).\n\n - CVE-2015-5239: Integer overflow in vnc_client_read() and\n protocol_client_msg() (bsc#944463).\n\n - CVE-2015-5745: Buffer overflow in virtio-serial (bsc#940929).\n\n - CVE-2015-7295: hw/virtio/virtio.c in the Virtual Network Device\n (virtio-net) support in QEMU, when big or mergeable receive buffers are\n not supported, allowed remote attackers to cause a denial of service\n (guest network consumption) via a flood of jumbo frames on the (1)\n tuntap or (2) macvtap interface (bsc#947159).\n\n - CVE-2015-7549: PCI null pointer dereferences (bsc#958917).\n\n - CVE-2015-8504: VNC floating point exception (bsc#958491).\n\n - CVE-2015-8558: Infinite loop in ehci_advance_state resulting in DoS\n (bsc#959005).\n\n - CVE-2015-8567: A guest repeatedly activating a vmxnet3 device can leak\n host memory (bsc#959386).\n\n - CVE-2015-8568: A guest repe ...\n\n Description truncated, please see the referenced URL(s) for more information.\");\n\n script_tag(name:\"affected\", value:\"qemu on SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Desktop 12\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_xref(name:\"SUSE-SU\", value:\"2016:1560-1\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2016 Greenbone Networks GmbH\");\n script_family(\"SuSE Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/suse\", \"ssh/login/rpms\", re:\"ssh/login/release=(SLED12\\.0SP0|SLES12\\.0SP0)\");\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"SLED12.0SP0\") {\n if(!isnull(res = isrpmvuln(pkg:\"qemu\", rpm:\"qemu~2.0.2~48.19.1\", rls:\"SLED12.0SP0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"qemu-block-curl\", rpm:\"qemu-block-curl~2.0.2~48.19.1\", rls:\"SLED12.0SP0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"qemu-block-curl-debuginfo\", rpm:\"qemu-block-curl-debuginfo~2.0.2~48.19.1\", rls:\"SLED12.0SP0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"qemu-debugsource\", rpm:\"qemu-debugsource~2.0.2~48.19.1\", rls:\"SLED12.0SP0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"qemu-kvm\", rpm:\"qemu-kvm~2.0.2~48.19.1\", rls:\"SLED12.0SP0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"qemu-tools\", rpm:\"qemu-tools~2.0.2~48.19.1\", rls:\"SLED12.0SP0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"qemu-tools-debuginfo\", rpm:\"qemu-tools-debuginfo~2.0.2~48.19.1\", rls:\"SLED12.0SP0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"qemu-x86\", rpm:\"qemu-x86~2.0.2~48.19.1\", rls:\"SLED12.0SP0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"qemu-x86-debuginfo\", rpm:\"qemu-x86-debuginfo~2.0.2~48.19.1\", rls:\"SLED12.0SP0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"qemu-ipxe\", rpm:\"qemu-ipxe~1.0.0~48.19.1\", rls:\"SLED12.0SP0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"qemu-seabios\", rpm:\"qemu-seabios~1.7.4~48.19.1\", rls:\"SLED12.0SP0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"qemu-sgabios\", rpm:\"qemu-sgabios~8~48.19.1\", rls:\"SLED12.0SP0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"qemu-vgabios\", rpm:\"qemu-vgabios~1.7.4~48.19.1\", rls:\"SLED12.0SP0\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if(__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nif(release == \"SLES12.0SP0\") {\n if(!isnull(res = isrpmvuln(pkg:\"qemu\", rpm:\"qemu~2.0.2~48.19.1\", rls:\"SLES12.0SP0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"qemu-block-curl\", rpm:\"qemu-block-curl~2.0.2~48.19.1\", rls:\"SLES12.0SP0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"qemu-block-curl-debuginfo\", rpm:\"qemu-block-curl-debuginfo~2.0.2~48.19.1\", rls:\"SLES12.0SP0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"qemu-debugsource\", rpm:\"qemu-debugsource~2.0.2~48.19.1\", rls:\"SLES12.0SP0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"qemu-guest-agent\", rpm:\"qemu-guest-agent~2.0.2~48.19.1\", rls:\"SLES12.0SP0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"qemu-guest-agent-debuginfo\", rpm:\"qemu-guest-agent-debuginfo~2.0.2~48.19.1\", rls:\"SLES12.0SP0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"qemu-lang\", rpm:\"qemu-lang~2.0.2~48.19.1\", rls:\"SLES12.0SP0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"qemu-tools\", rpm:\"qemu-tools~2.0.2~48.19.1\", rls:\"SLES12.0SP0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"qemu-tools-debuginfo\", rpm:\"qemu-tools-debuginfo~2.0.2~48.19.1\", rls:\"SLES12.0SP0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"qemu-kvm\", rpm:\"qemu-kvm~2.0.2~48.19.1\", rls:\"SLES12.0SP0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"qemu-ppc\", rpm:\"qemu-ppc~2.0.2~48.19.1\", rls:\"SLES12.0SP0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"qemu-ppc-debuginfo\", rpm:\"qemu-ppc-debuginfo~2.0.2~48.19.1\", rls:\"SLES12.0SP0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"qemu-block-rbd\", rpm:\"qemu-block-rbd~2.0.2~48.19.1\", rls:\"SLES12.0SP0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"qemu-block-rbd-debuginfo\", rpm:\"qemu-block-rbd-debuginfo~2.0.2~48.19.1\", rls:\"SLES12.0SP0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"qemu-x86\", rpm:\"qemu-x86~2.0.2~48.19.1\", rls:\"SLES12.0SP0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"qemu-x86-debuginfo\", rpm:\"qemu-x86-debuginfo~2.0.2~48.19.1\", rls:\"SLES12.0SP0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"qemu-ipxe\", rpm:\"qemu-ipxe~1.0.0~48.19.1\", rls:\"SLES12.0SP0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"qemu-seabios\", rpm:\"qemu-seabios~1.7.4~48.19.1\", rls:\"SLES12.0SP0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"qemu-sgabios\", rpm:\"qemu-sgabios~8~48.19.1\", rls:\"SLES12.0SP0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"qemu-vgabios\", rpm:\"qemu-vgabios~1.7.4~48.19.1\", rls:\"SLES12.0SP0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"qemu-s390\", rpm:\"qemu-s390~2.0.2~48.19.1\", rls:\"SLES12.0SP0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"qemu-s390-debuginfo\", rpm:\"qemu-s390-debuginfo~2.0.2~48.19.1\", rls:\"SLES12.0SP0\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if(__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-03-14T18:56:47", "bulletinFamily": "scanner", "cvelist": ["CVE-2015-8567", "CVE-2016-2858", "CVE-2015-8619", "CVE-2015-8558", "CVE-2015-8613", "CVE-2016-1922", "CVE-2016-4441", "CVE-2016-3712", "CVE-2015-8817", "CVE-2016-4952", "CVE-2016-3710", "CVE-2015-5745", "CVE-2015-8568", "CVE-2016-2198", "CVE-2016-2197", "CVE-2016-4002", "CVE-2015-8744", "CVE-2016-4020", "CVE-2015-7549", "CVE-2016-2841", "CVE-2015-8743", "CVE-2016-4001", "CVE-2015-8818", "CVE-2016-1568", "CVE-2016-4037", "CVE-2015-8745", "CVE-2016-1714", "CVE-2016-2857", "CVE-2016-1981", "CVE-2015-8504", "CVE-2016-4439", "CVE-2016-2538"], "description": "The remote host is missing an update for the ", "modified": "2020-01-31T00:00:00", "published": "2016-07-07T00:00:00", "id": "OPENVAS:1361412562310851362", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310851362", "type": "openvas", "title": "openSUSE: Security Advisory for qemu (openSUSE-SU-2016:1750-1)", "sourceData": "# Copyright (C) 2016 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) of their respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.851362\");\n script_version(\"2020-01-31T08:23:39+0000\");\n script_tag(name:\"last_modification\", value:\"2020-01-31 08:23:39 +0000 (Fri, 31 Jan 2020)\");\n script_tag(name:\"creation_date\", value:\"2016-07-07 05:25:59 +0200 (Thu, 07 Jul 2016)\");\n script_cve_id(\"CVE-2015-5745\", \"CVE-2015-7549\", \"CVE-2015-8504\", \"CVE-2015-8558\",\n \"CVE-2015-8567\", \"CVE-2015-8568\", \"CVE-2015-8613\", \"CVE-2015-8619\",\n \"CVE-2015-8743\", \"CVE-2015-8744\", \"CVE-2015-8745\", \"CVE-2015-8817\",\n \"CVE-2015-8818\", \"CVE-2016-1568\", \"CVE-2016-1714\", \"CVE-2016-1922\",\n \"CVE-2016-1981\", \"CVE-2016-2197\", \"CVE-2016-2198\", \"CVE-2016-2538\",\n \"CVE-2016-2841\", \"CVE-2016-2857\", \"CVE-2016-2858\", \"CVE-2016-3710\",\n \"CVE-2016-3712\", \"CVE-2016-4001\", \"CVE-2016-4002\", \"CVE-2016-4020\",\n \"CVE-2016-4037\", \"CVE-2016-4439\", \"CVE-2016-4441\", \"CVE-2016-4952\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"openSUSE: Security Advisory for qemu (openSUSE-SU-2016:1750-1)\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'qemu'\n package(s) announced via the referenced advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"qemu was updated to fix 29 security issues.\n\n These security issues were fixed:\n\n - CVE-2016-4439: Avoid OOB access in 53C9X emulation (bsc#980711)\n\n - CVE-2016-4441: Avoid OOB access in 53C9X emulation (bsc#980723)\n\n - CVE-2016-4952: Avoid OOB access in Vmware PV SCSI emulation (bsc#981266)\n\n - CVE-2015-8817: Avoid OOB access in PCI dma I/O (bsc#969121)\n\n - CVE-2015-8818: Avoid OOB access in PCI dma I/O (bsc#969122)\n\n - CVE-2016-3710: Fixed VGA emulation based OOB access with potential for\n guest escape (bsc#978158)\n\n - CVE-2016-3712: Fixed VGa emulation based DOS and OOB read access exploit\n (bsc#978160)\n\n - CVE-2016-4037: Fixed USB ehci based DOS (bsc#976109)\n\n - CVE-2016-2538: Fixed potential OOB access in USB net device emulation\n (bsc#967969)\n\n - CVE-2016-2841: Fixed OOB access / hang in ne2000 emulation (bsc#969350)\n\n - CVE-2016-2858: Avoid potential DOS when using QEMU pseudo random number\n generator (bsc#970036)\n\n - CVE-2016-2857: Fixed OOB access when processing IP checksums (bsc#970037)\n\n - CVE-2016-4001: Fixed OOB access in Stellaris enet emulated nic\n (bsc#975128)\n\n - CVE-2016-4002: Fixed OOB access in MIPSnet emulated controller\n (bsc#975136)\n\n - CVE-2016-4020: Fixed possible host data leakage to guest from TPR access\n (bsc#975700)\n\n - CVE-2016-2197: Prevent AHCI NULL pointer dereference when using FIS CLB\n engine (bsc#964411)\n\n - CVE-2015-5745: Buffer overflow in virtio-serial (bsc#940929).\n\n - CVE-2015-7549: PCI null pointer dereferences (bsc#958917).\n\n - CVE-2015-8504: VNC floating point exception (bsc#958491).\n\n - CVE-2015-8558: Infinite loop in ehci_advance_state resulting in DoS\n (bsc#959005).\n\n - CVE-2015-8567: A guest repeatedly activating a vmxnet3 device can leak\n host memory (bsc#959386).\n\n - CVE-2015-8568: A guest repeatedly activating a vmxnet3 device can leak\n host memory (bsc#959386).\n\n - CVE-2015-8613: Wrong sized memset in megasas command handler\n (bsc#961358).\n\n - CVE-2015-8619: Potential DoS for long HMP sendkey command argument\n (bsc#960334).\n\n - CVE-2015-8743: OOB memory access in ne2000 ioport r/w functions\n (bsc#960725).\n\n - CVE-2015-8744: Incorrect l2 header validation could have lead to a crash\n via assert(2) call (bsc#960835).\n\n - CVE-2015-8745: Reading IMR registers could have lead to a crash via\n assert(2) call (bsc#960708).\n\n - CVE-2016-1568: AHCI use-after-free in aio port commands (bsc#961332).\n\n - CVE-2016-1714: Potential OOB memory access in processing firmware\n configuration (bsc#961691).\n\n - CVE-2016-1922: NULL pointer dereference when processing hmp i/o command\n (bsc#962320).\n\n - CVE-2016-1981: Potential DoS (infinite ...\n\n Description truncated, please see the referenced URL(s) for more information.\");\n\n script_tag(name:\"affected\", value:\"qemu on openSUSE Leap 42.1\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_xref(name:\"openSUSE-SU\", value:\"2016:1750-1\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2016 Greenbone Networks GmbH\");\n script_family(\"SuSE Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/suse\", \"ssh/login/rpms\", re:\"ssh/login/release=openSUSELeap42\\.1\");\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"openSUSELeap42.1\") {\n if(!isnull(res = isrpmvuln(pkg:\"qemu\", rpm:\"qemu~2.3.1~15.1\", rls:\"openSUSELeap42.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"qemu-arm\", rpm:\"qemu-arm~2.3.1~15.1\", rls:\"openSUSELeap42.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"qemu-arm-debuginfo\", rpm:\"qemu-arm-debuginfo~2.3.1~15.1\", rls:\"openSUSELeap42.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"qemu-block-curl\", rpm:\"qemu-block-curl~2.3.1~15.1\", rls:\"openSUSELeap42.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"qemu-block-curl-debuginfo\", rpm:\"qemu-block-curl-debuginfo~2.3.1~15.1\", rls:\"openSUSELeap42.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"qemu-debugsource\", rpm:\"qemu-debugsource~2.3.1~15.1\", rls:\"openSUSELeap42.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"qemu-extra\", rpm:\"qemu-extra~2.3.1~15.1\", rls:\"openSUSELeap42.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"qemu-extra-debuginfo\", rpm:\"qemu-extra-debuginfo~2.3.1~15.1\", rls:\"openSUSELeap42.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"qemu-guest-agent\", rpm:\"qemu-guest-agent~2.3.1~15.1\", rls:\"openSUSELeap42.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"qemu-guest-agent-debuginfo\", rpm:\"qemu-guest-agent-debuginfo~2.3.1~15.1\", rls:\"openSUSELeap42.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"qemu-kvm\", rpm:\"qemu-kvm~2.3.1~15.1\", rls:\"openSUSELeap42.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"qemu-lang\", rpm:\"qemu-lang~2.3.1~15.1\", rls:\"openSUSELeap42.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"qemu-linux-user\", rpm:\"qemu-linux-user~2.3.1~15.1\", rls:\"openSUSELeap42.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"qemu-linux-user-debuginfo\", rpm:\"qemu-linux-user-debuginfo~2.3.1~15.1\", rls:\"openSUSELeap42.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"qemu-linux-user-debugsource\", rpm:\"qemu-linux-user-debugsource~2.3.1~15.1\", rls:\"openSUSELeap42.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"qemu-ppc\", rpm:\"qemu-ppc~2.3.1~15.1\", rls:\"openSUSELeap42.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"qemu-ppc-debuginfo\", rpm:\"qemu-ppc-debuginfo~2.3.1~15.1\", rls:\"openSUSELeap42.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"qemu-s390\", rpm:\"qemu-s390~2.3.1~15.1\", rls:\"openSUSELeap42.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"qemu-s390-debuginfo\", rpm:\"qemu-s390-debuginfo~2.3.1~15.1\", rls:\"openSUSELeap42.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"qemu-tools\", rpm:\"qemu-tools~2.3.1~15.1\", rls:\"openSUSELeap42.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"qemu-tools-debuginfo\", rpm:\"qemu-tools-debuginfo~2.3.1~15.1\", rls:\"openSUSELeap42.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"qemu-x86\", rpm:\"qemu-x86~2.3.1~15.1\", rls:\"openSUSELeap42.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"qemu-x86-debuginfo\", rpm:\"qemu-x86-debuginfo~2.3.1~15.1\", rls:\"openSUSELeap42.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"qemu-ipxe\", rpm:\"qemu-ipxe~1.0.0~15.1\", rls:\"openSUSELeap42.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"qemu-seabios\", rpm:\"qemu-seabios~1.8.1~15.1\", rls:\"openSUSELeap42.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"qemu-sgabios\", rpm:\"qemu-sgabios~8~15.1\", rls:\"openSUSELeap42.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"qemu-vgabios\", rpm:\"qemu-vgabios~1.8.1~15.1\", rls:\"openSUSELeap42.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"qemu-block-rbd\", rpm:\"qemu-block-rbd~2.3.1~15.1\", rls:\"openSUSELeap42.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"qemu-block-rbd-debuginfo\", rpm:\"qemu-block-rbd-debuginfo~2.3.1~15.1\", rls:\"openSUSELeap42.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"qemu-testsuite\", rpm:\"qemu-testsuite~2.3.1~15.2\", rls:\"openSUSELeap42.1\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if(__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-05-29T18:35:07", "bulletinFamily": "scanner", "cvelist": ["CVE-2015-8567", "CVE-2015-8619", "CVE-2015-8558", "CVE-2015-8613", "CVE-2016-1922", "CVE-2015-8666", "CVE-2015-8550", "CVE-2015-8568", "CVE-2016-2198", "CVE-2016-2197", "CVE-2015-8744", "CVE-2015-7549", "CVE-2015-8743", "CVE-2016-1568", "CVE-2015-8745", "CVE-2016-1714", "CVE-2016-1981", "CVE-2015-8504"], "description": "The remote host is missing an update for the ", "modified": "2019-03-13T00:00:00", "published": "2016-02-05T00:00:00", "id": "OPENVAS:1361412562310842633", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310842633", "type": "openvas", "title": "Ubuntu Update for qemu USN-2891-1", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Ubuntu Update for qemu USN-2891-1\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2016 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.842633\");\n script_version(\"$Revision: 14140 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-13 13:26:09 +0100 (Wed, 13 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2016-02-05 13:14:14 +0530 (Fri, 05 Feb 2016)\");\n script_cve_id(\"CVE-2015-7549\", \"CVE-2015-8504\", \"CVE-2015-8550\", \"CVE-2015-8558\",\n \"CVE-2015-8567\", \"CVE-2015-8568\", \"CVE-2015-8613\", \"CVE-2015-8619\",\n \"CVE-2016-1922\", \"CVE-2015-8666\", \"CVE-2015-8743\", \"CVE-2015-8744\",\n \"CVE-2015-8745\", \"CVE-2016-1568\", \"CVE-2016-1714\", \"CVE-2016-1981\",\n \"CVE-2016-2197\", \"CVE-2016-2198\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"Ubuntu Update for qemu USN-2891-1\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'qemu'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"insight\", value:\"Qinghao Tang discovered that QEMU incorrectly\n handled PCI MSI-X support. An attacker inside the guest could use this issue to\n cause QEMU to crash, resulting in a denial of service. This issue only affected\n Ubuntu 14.04 LTS and Ubuntu 15.10. (CVE-2015-7549)\n\n Lian Yihan discovered that QEMU incorrectly handled the VNC server. A\n remote attacker could use this issue to cause QEMU to crash, resulting in a\n denial of service. (CVE-2015-8504)\n\n Felix Wilhelm discovered a race condition in the Xen paravirtualized\n drivers which can cause double fetch vulnerabilities. An attacker in the\n paravirtualized guest could exploit this flaw to cause a denial of service\n (crash the host) or potentially execute arbitrary code on the host.\n (CVE-2015-8550)\n\n Qinghao Tang discovered that QEMU incorrectly handled USB EHCI emulation\n support. An attacker inside the guest could use this issue to cause QEMU to\n consume resources, resulting in a denial of service. (CVE-2015-8558)\n\n Qinghao Tang discovered that QEMU incorrectly handled the vmxnet3 device.\n An attacker inside the guest could use this issue to cause QEMU to consume\n resources, resulting in a denial of service. This issue only affected\n Ubuntu 14.04 LTS and Ubuntu 15.10. (CVE-2015-8567, CVE-2015-8568)\n\n Qinghao Tang discovered that QEMU incorrectly handled SCSI MegaRAID SAS HBA\n emulation. An attacker inside the guest could use this issue to cause QEMU\n to crash, resulting in a denial of service. This issue only affected\n Ubuntu 14.04 LTS and Ubuntu 15.10. (CVE-2015-8613)\n\n Ling Liu discovered that QEMU incorrectly handled the Human Monitor\n Interface. A local attacker could use this issue to cause QEMU to crash,\n resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS\n and Ubuntu 15.10. (CVE-2015-8619, CVE-2016-1922)\n\n David Alan Gilbert discovered that QEMU incorrectly handled the Q35 chipset\n emulation when performing VM guest migrations. An attacker could use this\n issue to cause QEMU to crash, resulting in a denial of service. This issue\n only affected Ubuntu 14.04 LTS and Ubuntu 15.10. (CVE-2015-8666)\n\n Ling Liu discovered that QEMU incorrectly handled the NE2000 device. An\n attacker inside the guest could use this issue to cause QEMU to crash,\n resulting in a denial of service. (CVE-2015-8743)\n\n It was discovered that QEMU incorrectly handled the vmxnet3 device. An\n attacker inside the guest could use this issue to cause QEMU to crash,\n resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS\n and Ubuntu 15.10. (CVE-2015-8744, CVE-2015-8745)\n\n Qinghao Tang discovered that QEMU incorrect handled IDE AHCI ...\n\n Description truncated, please see the referenced URL(s) for more information.\");\n script_tag(name:\"affected\", value:\"qemu on Ubuntu 15.10,\n Ubuntu 14.04 LTS,\n Ubuntu 12.04 LTS\");\n script_tag(name:\"solution\", value:\"Please Install the Updated Packages.\");\n\n script_xref(name:\"USN\", value:\"2891-1\");\n script_xref(name:\"URL\", value:\"http://www.ubuntu.com/usn/usn-2891-1/\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2016 Greenbone Networks GmbH\");\n script_family(\"Ubuntu Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/ubuntu_linux\", \"ssh/login/packages\", re:\"ssh/login/release=UBUNTU(14\\.04 LTS|12\\.04 LTS|15\\.10)\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nrelease = dpkg_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"UBUNTU14.04 LTS\")\n{\n\n if ((res = isdpkgvuln(pkg:\"qemu-system\", ver:\"2.0.0+dfsg-2ubuntu1.22\", rls:\"UBUNTU14.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"qemu-system-aarch64\", ver:\"2.0.0+dfsg-2ubuntu1.22\", rls:\"UBUNTU14.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"qemu-system-arm\", ver:\"2.0.0+dfsg-2ubuntu1.22\", rls:\"UBUNTU14.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"qemu-system-mips\", ver:\"2.0.0+dfsg-2ubuntu1.22\", rls:\"UBUNTU14.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"qemu-system-misc\", ver:\"2.0.0+dfsg-2ubuntu1.22\", rls:\"UBUNTU14.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"qemu-system-ppc\", ver:\"2.0.0+dfsg-2ubuntu1.22\", rls:\"UBUNTU14.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"qemu-system-sparc\", ver:\"2.0.0+dfsg-2ubuntu1.22\", rls:\"UBUNTU14.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"qemu-system-x86\", ver:\"2.0.0+dfsg-2ubuntu1.22\", rls:\"UBUNTU14.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n\n\nif(release == \"UBUNTU12.04 LTS\")\n{\n\n if ((res = isdpkgvuln(pkg:\"qemu-kvm\", ver:\"1.0+noroms-0ubuntu14.27\", rls:\"UBUNTU12.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n\n\nif(release == \"UBUNTU15.10\")\n{\n\n if ((res = isdpkgvuln(pkg:\"qemu-system\", ver:\"1:2.3+dfsg-5ubuntu9.2\", rls:\"UBUNTU15.10\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"qemu-system-aarch64\", ver:\"1:2.3+dfsg-5ubuntu9.2\", rls:\"UBUNTU15.10\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"qemu-system-arm\", ver:\"1:2.3+dfsg-5ubuntu9.2\", rls:\"UBUNTU15.10\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"qemu-system-mips\", ver:\"1:2.3+dfsg-5ubuntu9.2\", rls:\"UBUNTU15.10\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"qemu-system-misc\", ver:\"1:2.3+dfsg-5ubuntu9.2\", rls:\"UBUNTU15.10\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"qemu-system-ppc\", ver:\"1:2.3+dfsg-5ubuntu9.2\", rls:\"UBUNTU15.10\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"qemu-system-sparc\", ver:\"1:2.3+dfsg-5ubuntu9.2\", rls:\"UBUNTU15.10\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"qemu-system-x86\", ver:\"1:2.3+dfsg-5ubuntu9.2\", rls:\"UBUNTU15.10\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2017-11-24T15:13:01", "bulletinFamily": "scanner", "cvelist": ["CVE-2015-8567", "CVE-2015-8619", "CVE-2015-8558", "CVE-2015-8613", "CVE-2016-1922", "CVE-2015-7504", "CVE-2015-7512", "CVE-2015-8550", "CVE-2015-8345", "CVE-2015-8568", "CVE-2015-8744", "CVE-2015-7549", "CVE-2015-8743", "CVE-2016-1568", "CVE-2015-8745", "CVE-2016-1714", "CVE-2016-1981", "CVE-2015-8504", "CVE-2015-7295"], "description": "Several vulnerabilities were discovered in\nqemu, a full virtualization solution on x86 hardware.\n\nCVE-2015-7295\nJason Wang of Red Hat Inc. discovered that the Virtual Network\nDevice support is vulnerable to denial-of-service, that could\noccur when receiving large packets.\n\nCVE-2015-7504\nQinghao Tang of Qihoo 360 Inc. and Ling Liu of Qihoo 360 Inc.\ndiscovered that the PC-Net II ethernet controller is vulnerable to\na heap-based buffer overflow that could result in\ndenial-of-service (via application crash) or arbitrary code\nexecution.\n\nCVE-2015-7512\nLing Liu of Qihoo 360 Inc. and Jason Wang of Red Hat Inc.\ndiscovered that the PC-Net II ethernet controller is vulnerable to\na buffer overflow that could result in denial-of-service (via\napplication crash) or arbitrary code execution.\n\nCVE-2015-7549\nQinghao Tang of Qihoo 360 Inc. and Ling Liu of Qihoo 360\nInc. discovered that the PCI MSI-X emulator is vulnerable to a\nnull pointer dereference issue, that could lead to\ndenial-of-service (via application crash).\n\nCVE-2015-8345\nQinghao Tang of Qihoo 360 Inc. discovered that the eepro100\nemulator contains a flaw that could lead to an infinite loop when\nprocessing Command Blocks, eventually resulting in\ndenial-of-service (via application crash).\n\nCVE-2015-8504\nLian Yihan of Qihoo 360 Inc. discovered that the VNC display\ndriver support is vulnerable to an arithmetic exception flaw that\ncould lead to denial-of-service (via application crash).\n\nCVE-2015-8550\nFelix Wilhelm of ERNW Research that the PV backend drivers are\nvulnerable to double fetch vulnerabilities, possibly resulting in\narbitrary code execution.\n\nCVE-2015-8558\nQinghao Tang of Qihoo 360 Inc. discovered that the USB EHCI\nemulation support contains a flaw that could lead to an infinite\nloop during communication between the host controller and a device\ndriver. This could lead to denial-of-service (via resource\nexhaustion).\n\nCVE-2015-8567 CVE-2015-8568\nQinghao Tang of Qihoo 360 Inc. discovered that the vmxnet3 device\nemulator could be used to intentionally leak host memory, thus\nresulting in denial-of-service.\n\nCVE-2015-8613\nQinghao Tang of Qihoo 360 Inc. discovered that the SCSI MegaRAID\nSAS HBA emulation support is vulnerable to a stack-based buffer\noverflow issue, that could lead to denial-of-service (via\napplication crash).\n\nCVE-2015-8619\nLing Liu of Qihoo 360 Inc. discovered that the Human Monitor\nInterface support is vulnerable to an out-of-bound write access\nissue that could result in denial-of-service (via application\ncrash).\n\nCVE-2015-8743\nLing Liu of Qihoo 360 Inc. discovered that the NE2000 emulator is\nvulnerable to an out-of-bound read/write access issue, potentially\nresulting in information leak or memory corruption.\n\nCVE-2015-8744\nThe vmxnet3 driver incorrectly processes small packets, which could\nresult in denial-of-service (via application crash).\n\nCVE-2015-8745\nThe vmxnet3 driver incorrectly processes Interrupt Mask Registers,\nwhich could result in denial-of-service (via application crash).\n\nCVE-2016-1568\nQinghao Tang of Qihoo 360 Inc. discovered that the IDE AHCI\nemulation support is vulnerable to a use-after-free issue, that\ncould lead to denial-of-service (via application crash) or\narbitrary code execution.\n\nCVE-2016-1714\nDonghai Zhu of Alibaba discovered that the Firmware Configuration\nemulation support is vulnerable to an out-of-bound read/write\naccess issue, that could lead to denial-of-service (via\napplication crash) or arbitrary code execution.\n\nCVE-2016-1922\nLing Liu of Qihoo 360 Inc. discovered that 32-bit Windows guests\nsupport is vulnerable to a null pointer dereference issue, that\ncould lead to denial-of-service (via application crash).\n\nCVE-2016-1981\nThe e1000 driver is vulnerable to an infinite loop issue that\ncould lead to denial-of-service (via application crash).", "modified": "2017-11-24T00:00:00", "published": "2016-02-08T00:00:00", "id": "OPENVAS:703471", "href": "http://plugins.openvas.org/nasl.php?oid=703471", "type": "openvas", "title": "Debian Security Advisory DSA 3471-1 (qemu - security update)", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_3471.nasl 7900 2017-11-24 10:35:02Z asteins $\n# Auto-generated from advisory DSA 3471-1 using nvtgen 1.0\n# Script version: 1.0\n#\n# Author:\n# Greenbone Networks\n#\n# Copyright:\n# Copyright (c) 2016 Greenbone Networks GmbH http://greenbone.net\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\n\nif(description)\n{\n script_id(703471);\n script_version(\"$Revision: 7900 $\");\n script_cve_id(\"CVE-2015-7295\", \"CVE-2015-7504\", \"CVE-2015-7512\", \"CVE-2015-7549\",\n \"CVE-2015-8345\", \"CVE-2015-8504\", \"CVE-2015-8550\", \"CVE-2015-8558\",\n \"CVE-2015-8567\", \"CVE-2015-8568\", \"CVE-2015-8613\", \"CVE-2015-8619\",\n \"CVE-2015-8743\", \"CVE-2015-8744\", \"CVE-2015-8745\", \"CVE-2016-1568\",\n \"CVE-2016-1714\", \"CVE-2016-1922\", \"CVE-2016-1981\");\n script_name(\"Debian Security Advisory DSA 3471-1 (qemu - security update)\");\n script_tag(name: \"last_modification\", value: \"$Date: 2017-11-24 11:35:02 +0100 (Fri, 24 Nov 2017) $\");\n script_tag(name: \"creation_date\", value: \"2016-02-08 00:00:00 +0100 (Mon, 08 Feb 2016)\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_tag(name: \"solution_type\", value: \"VendorFix\");\n script_tag(name: \"qod_type\", value: \"package\");\n\n script_xref(name: \"URL\", value: \"http://www.debian.org/security/2016/dsa-3471.html\");\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2016 Greenbone Networks GmbH http://greenbone.net\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\");\n script_tag(name: \"affected\", value: \"qemu on Debian Linux\");\n script_tag(name: \"insight\", value: \"QEMU is a fast processor emulator:\ncurrently the package supports ARM, CRIS, i386, M68k (ColdFire), MicroBlaze, MIPS,\nPowerPC, SH4, SPARC and x86-64 emulation. By using dynamic translation it achieves\nreasonable speed while being easy to port on new host CPUs. QEMU has\ntwo operating modes:\");\n script_tag(name: \"solution\", value: \"For the stable distribution (jessie),\nthese problems have been fixed in version 1:2.1+dfsg-12+deb8u5a.\n\nWe recommend that you upgrade your qemu packages.\");\n script_tag(name: \"summary\", value: \"Several vulnerabilities were discovered in\nqemu, a full virtualization solution on x86 hardware.\n\nCVE-2015-7295\nJason Wang of Red Hat Inc. discovered that the Virtual Network\nDevice support is vulnerable to denial-of-service, that could\noccur when receiving large packets.\n\nCVE-2015-7504\nQinghao Tang of Qihoo 360 Inc. and Ling Liu of Qihoo 360 Inc.\ndiscovered that the PC-Net II ethernet controller is vulnerable to\na heap-based buffer overflow that could result in\ndenial-of-service (via application crash) or arbitrary code\nexecution.\n\nCVE-2015-7512\nLing Liu of Qihoo 360 Inc. and Jason Wang of Red Hat Inc.\ndiscovered that the PC-Net II ethernet controller is vulnerable to\na buffer overflow that could result in denial-of-service (via\napplication crash) or arbitrary code execution.\n\nCVE-2015-7549\nQinghao Tang of Qihoo 360 Inc. and Ling Liu of Qihoo 360\nInc. discovered that the PCI MSI-X emulator is vulnerable to a\nnull pointer dereference issue, that could lead to\ndenial-of-service (via application crash).\n\nCVE-2015-8345\nQinghao Tang of Qihoo 360 Inc. discovered that the eepro100\nemulator contains a flaw that could lead to an infinite loop when\nprocessing Command Blocks, eventually resulting in\ndenial-of-service (via application crash).\n\nCVE-2015-8504\nLian Yihan of Qihoo 360 Inc. discovered that the VNC display\ndriver support is vulnerable to an arithmetic exception flaw that\ncould lead to denial-of-service (via application crash).\n\nCVE-2015-8550\nFelix Wilhelm of ERNW Research that the PV backend drivers are\nvulnerable to double fetch vulnerabilities, possibly resulting in\narbitrary code execution.\n\nCVE-2015-8558\nQinghao Tang of Qihoo 360 Inc. discovered that the USB EHCI\nemulation support contains a flaw that could lead to an infinite\nloop during communication between the host controller and a device\ndriver. This could lead to denial-of-service (via resource\nexhaustion).\n\nCVE-2015-8567 CVE-2015-8568\nQinghao Tang of Qihoo 360 Inc. discovered that the vmxnet3 device\nemulator could be used to intentionally leak host memory, thus\nresulting in denial-of-service.\n\nCVE-2015-8613\nQinghao Tang of Qihoo 360 Inc. discovered that the SCSI MegaRAID\nSAS HBA emulation support is vulnerable to a stack-based buffer\noverflow issue, that could lead to denial-of-service (via\napplication crash).\n\nCVE-2015-8619\nLing Liu of Qihoo 360 Inc. discovered that the Human Monitor\nInterface support is vulnerable to an out-of-bound write access\nissue that could result in denial-of-service (via application\ncrash).\n\nCVE-2015-8743\nLing Liu of Qihoo 360 Inc. discovered that the NE2000 emulator is\nvulnerable to an out-of-bound read/write access issue, potentially\nresulting in information leak or memory corruption.\n\nCVE-2015-8744\nThe vmxnet3 driver incorrectly processes small packets, which could\nresult in denial-of-service (via application crash).\n\nCVE-2015-8745\nThe vmxnet3 driver incorrectly processes Interrupt Mask Registers,\nwhich could result in denial-of-service (via application crash).\n\nCVE-2016-1568\nQinghao Tang of Qihoo 360 Inc. discovered that the IDE AHCI\nemulation support is vulnerable to a use-after-free issue, that\ncould lead to denial-of-service (via application crash) or\narbitrary code execution.\n\nCVE-2016-1714\nDonghai Zhu of Alibaba discovered that the Firmware Configuration\nemulation support is vulnerable to an out-of-bound read/write\naccess issue, that could lead to denial-of-service (via\napplication crash) or arbitrary code execution.\n\nCVE-2016-1922\nLing Liu of Qihoo 360 Inc. discovered that 32-bit Windows guests\nsupport is vulnerable to a null pointer dereference issue, that\ncould lead to denial-of-service (via application crash).\n\nCVE-2016-1981\nThe e1000 driver is vulnerable to an infinite loop issue that\ncould lead to denial-of-service (via application crash).\");\n script_tag(name: \"vuldetect\", value: \"This check tests the installed software\nversion using the apt package manager.\");\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isdpkgvuln(pkg:\"qemu\", ver:\"1:2.1+dfsg-12+deb8u5a\", rls_regex:\"DEB8.[0-9]+\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"qemu-guest-agent\", ver:\"1:2.1+dfsg-12+deb8u5a\", rls_regex:\"DEB8.[0-9]+\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"qemu-kvm\", ver:\"1:2.1+dfsg-12+deb8u5a\", rls_regex:\"DEB8.[0-9]+\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"qemu-system\", ver:\"1:2.1+dfsg-12+deb8u5a\", rls_regex:\"DEB8.[0-9]+\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"qemu-system-arm\", ver:\"1:2.1+dfsg-12+deb8u5a\", rls_regex:\"DEB8.[0-9]+\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"qemu-system-common\", ver:\"1:2.1+dfsg-12+deb8u5a\", rls_regex:\"DEB8.[0-9]+\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"qemu-system-mips\", ver:\"1:2.1+dfsg-12+deb8u5a\", rls_regex:\"DEB8.[0-9]+\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"qemu-system-misc\", ver:\"1:2.1+dfsg-12+deb8u5a\", rls_regex:\"DEB8.[0-9]+\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"qemu-system-ppc\", ver:\"1:2.1+dfsg-12+deb8u5a\", rls_regex:\"DEB8.[0-9]+\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"qemu-system-sparc\", ver:\"1:2.1+dfsg-12+deb8u5a\", rls_regex:\"DEB8.[0-9]+\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"qemu-system-x86\", ver:\"1:2.1+dfsg-12+deb8u5a\", rls_regex:\"DEB8.[0-9]+\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"qemu-user\", ver:\"1:2.1+dfsg-12+deb8u5a\", rls_regex:\"DEB8.[0-9]+\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"qemu-user-binfmt\", ver:\"1:2.1+dfsg-12+deb8u5a\", rls_regex:\"DEB8.[0-9]+\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"qemu-user-static\", ver:\"1:2.1+dfsg-12+deb8u5a\", rls_regex:\"DEB8.[0-9]+\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"qemu-utils\", ver:\"1:2.1+dfsg-12+deb8u5a\", rls_regex:\"DEB8.[0-9]+\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2019-05-29T18:34:55", "bulletinFamily": "scanner", "cvelist": ["CVE-2015-8567", "CVE-2015-8619", "CVE-2015-8558", "CVE-2015-8613", "CVE-2016-1922", "CVE-2015-7504", "CVE-2015-7512", "CVE-2015-8550", "CVE-2015-8345", "CVE-2015-8568", "CVE-2015-8744", "CVE-2015-7549", "CVE-2015-8743", "CVE-2016-1568", "CVE-2015-8745", "CVE-2016-1714", "CVE-2016-1981", "CVE-2015-8504", "CVE-2015-7295"], "description": "Several vulnerabilities were discovered in\nqemu, a full virtualization solution on x86 hardware.\n\nCVE-2015-7295\nJason Wang of Red Hat Inc. discovered that the Virtual Network\nDevice support is vulnerable to denial-of-service, that could\noccur when receiving large packets.\n\nCVE-2015-7504\nQinghao Tang of Qihoo 360 Inc. and Ling Liu of Qihoo 360 Inc.\ndiscovered that the PC-Net II ethernet controller is vulnerable to\na heap-based buffer overflow that could result in\ndenial-of-service (via application crash) or arbitrary code\nexecution.\n\nDescription truncated. Please see the references for more information.", "modified": "2019-03-18T00:00:00", "published": "2016-02-08T00:00:00", "id": "OPENVAS:1361412562310703471", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310703471", "type": "openvas", "title": "Debian Security Advisory DSA 3471-1 (qemu - security update)", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_3471.nasl 14279 2019-03-18 14:48:34Z cfischer $\n# Auto-generated from advisory DSA 3471-1 using nvtgen 1.0\n# Script version: 1.0\n#\n# Author:\n# Greenbone Networks\n#\n# Copyright:\n# Copyright (c) 2016 Greenbone Networks GmbH http://greenbone.net\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.703471\");\n script_version(\"$Revision: 14279 $\");\n script_cve_id(\"CVE-2015-7295\", \"CVE-2015-7504\", \"CVE-2015-7512\", \"CVE-2015-7549\",\n \"CVE-2015-8345\", \"CVE-2015-8504\", \"CVE-2015-8550\", \"CVE-2015-8558\",\n \"CVE-2015-8567\", \"CVE-2015-8568\", \"CVE-2015-8613\", \"CVE-2015-8619\",\n \"CVE-2015-8743\", \"CVE-2015-8744\", \"CVE-2015-8745\", \"CVE-2016-1568\",\n \"CVE-2016-1714\", \"CVE-2016-1922\", \"CVE-2016-1981\");\n script_name(\"Debian Security Advisory DSA 3471-1 (qemu - security update)\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-18 15:48:34 +0100 (Mon, 18 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2016-02-08 00:00:00 +0100 (Mon, 08 Feb 2016)\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n script_xref(name:\"URL\", value:\"http://www.debian.org/security/2016/dsa-3471.html\");\n\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2016 Greenbone Networks GmbH http://greenbone.net\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\", re:\"ssh/login/release=DEB8\");\n script_tag(name:\"affected\", value:\"qemu on Debian Linux\");\n script_tag(name:\"solution\", value:\"For the stable distribution (jessie),\nthese problems have been fixed in version 1:2.1+dfsg-12+deb8u5a.\n\nWe recommend that you upgrade your qemu packages.\");\n script_tag(name:\"summary\", value:\"Several vulnerabilities were discovered in\nqemu, a full virtualization solution on x86 hardware.\n\nCVE-2015-7295\nJason Wang of Red Hat Inc. discovered that the Virtual Network\nDevice support is vulnerable to denial-of-service, that could\noccur when receiving large packets.\n\nCVE-2015-7504\nQinghao Tang of Qihoo 360 Inc. and Ling Liu of Qihoo 360 Inc.\ndiscovered that the PC-Net II ethernet controller is vulnerable to\na heap-based buffer overflow that could result in\ndenial-of-service (via application crash) or arbitrary code\nexecution.\n\nDescription truncated. Please see the references for more information.\");\n script_tag(name:\"vuldetect\", value:\"This check tests the installed software\nversion using the apt package manager.\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif((res = isdpkgvuln(pkg:\"qemu\", ver:\"1:2.1+dfsg-12+deb8u5a\", rls:\"DEB8\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"qemu-guest-agent\", ver:\"1:2.1+dfsg-12+deb8u5a\", rls:\"DEB8\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"qemu-kvm\", ver:\"1:2.1+dfsg-12+deb8u5a\", rls:\"DEB8\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"qemu-system\", ver:\"1:2.1+dfsg-12+deb8u5a\", rls:\"DEB8\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"qemu-system-arm\", ver:\"1:2.1+dfsg-12+deb8u5a\", rls:\"DEB8\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"qemu-system-common\", ver:\"1:2.1+dfsg-12+deb8u5a\", rls:\"DEB8\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"qemu-system-mips\", ver:\"1:2.1+dfsg-12+deb8u5a\", rls:\"DEB8\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"qemu-system-misc\", ver:\"1:2.1+dfsg-12+deb8u5a\", rls:\"DEB8\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"qemu-system-ppc\", ver:\"1:2.1+dfsg-12+deb8u5a\", rls:\"DEB8\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"qemu-system-sparc\", ver:\"1:2.1+dfsg-12+deb8u5a\", rls:\"DEB8\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"qemu-system-x86\", ver:\"1:2.1+dfsg-12+deb8u5a\", rls:\"DEB8\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"qemu-user\", ver:\"1:2.1+dfsg-12+deb8u5a\", rls:\"DEB8\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"qemu-user-binfmt\", ver:\"1:2.1+dfsg-12+deb8u5a\", rls:\"DEB8\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"qemu-user-static\", ver:\"1:2.1+dfsg-12+deb8u5a\", rls:\"DEB8\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"qemu-utils\", ver:\"1:2.1+dfsg-12+deb8u5a\", rls:\"DEB8\")) != NULL) {\n report += res;\n}\n\nif(report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99);\n}", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-05-29T18:35:02", "bulletinFamily": "scanner", "cvelist": ["CVE-2016-2392", "CVE-2016-2858", "CVE-2015-8613", "CVE-2016-1922", "CVE-2015-8817", "CVE-2016-2391", "CVE-2016-2198", "CVE-2016-2841", "CVE-2015-8818", "CVE-2016-1714", "CVE-2016-2857", "CVE-2016-1981", "CVE-2016-2538"], "description": "The remote host is missing an update for the ", "modified": "2019-03-15T00:00:00", "published": "2016-03-20T00:00:00", "id": "OPENVAS:1361412562310807717", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310807717", "type": "openvas", "title": "Fedora Update for xen FEDORA-2016-38", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for xen FEDORA-2016-38\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2016 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.807717\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2016-03-20 06:17:30 +0100 (Sun, 20 Mar 2016)\");\n script_cve_id(\"CVE-2016-1714\", \"CVE-2016-1922\", \"CVE-2015-8613\", \"CVE-2016-1981\",\n \"CVE-2016-2198\", \"CVE-2016-2841\", \"CVE-2016-2538\", \"CVE-2016-2392\",\n \"CVE-2016-2391\", \"CVE-2016-2857\", \"CVE-2015-8817\", \"CVE-2015-8818\",\n \"CVE-2016-2858\");\n script_tag(name:\"cvss_base\", value:\"6.9\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:L/AC:M/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"Fedora Update for xen FEDORA-2016-38\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'xen'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"affected\", value:\"xen on Fedora 22\");\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n script_xref(name:\"FEDORA\", value:\"2016-38\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/pipermail/package-announce/2016-March/179057.html\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2016 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC22\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC22\")\n{\n\n if ((res = isrpmvuln(pkg:\"xen\", rpm:\"xen~4.5.2~9.fc22\", rls:\"FC22\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 6.9, "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-05-29T18:35:41", "bulletinFamily": "scanner", "cvelist": ["CVE-2016-2392", "CVE-2016-2858", "CVE-2016-3712", "CVE-2016-2391", "CVE-2016-3710", "CVE-2016-4002", "CVE-2016-4020", "CVE-2016-2841", "CVE-2016-4001", "CVE-2016-4037", "CVE-2016-2857", "CVE-2016-2538"], "description": "The remote host is missing an update for the ", "modified": "2019-03-13T00:00:00", "published": "2016-05-17T00:00:00", "id": "OPENVAS:1361412562310842747", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310842747", "type": "openvas", "title": "Ubuntu Update for qemu USN-2974-1", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Ubuntu Update for qemu USN-2974-1\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2016 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.842747\");\n script_version(\"$Revision: 14140 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-13 13:26:09 +0100 (Wed, 13 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2016-05-17 13:39:47 +0200 (Tue, 17 May 2016)\");\n script_cve_id(\"CVE-2016-2391\", \"CVE-2016-2392\", \"CVE-2016-2538\", \"CVE-2016-2841\",\n\t\t\"CVE-2016-2857\", \"CVE-2016-2858\", \"CVE-2016-3710\", \"CVE-2016-3712\",\n\t\t\"CVE-2016-4001\", \"CVE-2016-4002\", \"CVE-2016-4020\", \"CVE-2016-4037\");\n script_tag(name:\"cvss_base\", value:\"7.2\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"Ubuntu Update for qemu USN-2974-1\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'qemu'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"insight\", value:\"Zuozhi Fzz discovered that QEMU incorrectly\n handled USB OHCI emulation support. A privileged attacker inside the guest\n could use this issue to cause QEMU to crash, resulting in a denial of service.\n (CVE-2016-2391)\n\n Qinghao Tang discovered that QEMU incorrectly handled USB Net emulation\n support. A privileged attacker inside the guest could use this issue to\n cause QEMU to crash, resulting in a denial of service. (CVE-2016-2392)\n\n Qinghao Tang discovered that QEMU incorrectly handled USB Net emulation\n support. A privileged attacker inside the guest could use this issue to\n cause QEMU to crash, resulting in a denial of service, or possibly leak\n host memory bytes. (CVE-2016-2538)\n\n Hongke Yang discovered that QEMU incorrectly handled NE2000 emulation\n support. A privileged attacker inside the guest could use this issue to\n cause QEMU to crash, resulting in a denial of service. (CVE-2016-2841)\n\n Ling Liu discovered that QEMU incorrectly handled IP checksum routines. An\n attacker inside the guest could use this issue to cause QEMU to crash,\n resulting in a denial of service, or possibly leak host memory bytes.\n (CVE-2016-2857)\n\n It was discovered that QEMU incorrectly handled the PRNG back-end support.\n An attacker inside the guest could use this issue to cause QEMU to crash,\n resulting in a denial of service. This issue only applied to Ubuntu 14.04\n LTS, Ubuntu 15.10 and Ubuntu 16.04 LTS. (CVE-2016-2858)\n\n Wei Xiao and Qinghao Tang discovered that QEMU incorrectly handled access\n in the VGA module. A privileged attacker inside the guest could use this\n issue to cause QEMU to crash, resulting in a denial of service, or possibly\n execute arbitrary code on the host. In the default installation, when QEMU\n is used with libvirt, attackers would be isolated by the libvirt AppArmor\n profile. (CVE-2016-3710)\n\n Zuozhi Fzz discovered that QEMU incorrectly handled access in the VGA\n module. A privileged attacker inside the guest could use this issue to\n cause QEMU to crash, resulting in a denial of service, or possibly\n execute arbitrary code on the host. In the default installation, when QEMU\n is used with libvirt, attackers would be isolated by the libvirt AppArmor\n profile. (CVE-2016-3712)\n\n Oleksandr Bazhaniuk discovered that QEMU incorrectly handled Luminary\n Micro Stellaris ethernet controller emulation. A remote attacker could use\n this issue to cause QEMU to crash, resulting in a denial of service.\n (CVE-2016-4001)\n\n Oleksandr Bazhaniuk discovered that QEMU incorrectly handled MIPSnet\n controller emulation. A remote attacker could use this issue to cause QEMU\n to crash, resulting in a denial of ...\n\n Description truncated, please see the referenced URL(s) for more information.\");\n script_tag(name:\"affected\", value:\"qemu on Ubuntu 15.10,\n Ubuntu 14.04 LTS,\n Ubuntu 12.04 LTS\");\n script_tag(name:\"solution\", value:\"Please Install the Updated Packages.\");\n\n script_xref(name:\"USN\", value:\"2974-1\");\n script_xref(name:\"URL\", value:\"http://www.ubuntu.com/usn/usn-2974-1/\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2016 Greenbone Networks GmbH\");\n script_family(\"Ubuntu Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/ubuntu_linux\", \"ssh/login/packages\", re:\"ssh/login/release=UBUNTU(14\\.04 LTS|12\\.04 LTS|15\\.10)\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nrelease = dpkg_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"UBUNTU14.04 LTS\")\n{\n\n if ((res = isdpkgvuln(pkg:\"qemu-system\", ver:\"2.0.0+dfsg-2ubuntu1.24\", rls:\"UBUNTU14.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"qemu-system-aarch64\", ver:\"2.0.0+dfsg-2ubuntu1.24\", rls:\"UBUNTU14.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"qemu-system-arm\", ver:\"2.0.0+dfsg-2ubuntu1.24\", rls:\"UBUNTU14.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"qemu-system-mips\", ver:\"2.0.0+dfsg-2ubuntu1.24\", rls:\"UBUNTU14.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"qemu-system-misc\", ver:\"2.0.0+dfsg-2ubuntu1.24\", rls:\"UBUNTU14.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"qemu-system-ppc\", ver:\"2.0.0+dfsg-2ubuntu1.24\", rls:\"UBUNTU14.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"qemu-system-sparc\", ver:\"2.0.0+dfsg-2ubuntu1.24\", rls:\"UBUNTU14.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"qemu-system-x86\", ver:\"2.0.0+dfsg-2ubuntu1.24\", rls:\"UBUNTU14.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n\n\nif(release == \"UBUNTU12.04 LTS\")\n{\n\n if ((res = isdpkgvuln(pkg:\"qemu-kvm\", ver:\"1.0+noroms-0ubuntu14.28\", rls:\"UBUNTU12.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n\n\nif(release == \"UBUNTU15.10\")\n{\n\n if ((res = isdpkgvuln(pkg:\"qemu-system\", ver:\"1:2.3+dfsg-5ubuntu9.4\", rls:\"UBUNTU15.10\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"qemu-system-aarch64\", ver:\"1:2.3+dfsg-5ubuntu9.4\", rls:\"UBUNTU15.10\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"qemu-system-arm\", ver:\"1:2.3+dfsg-5ubuntu9.4\", rls:\"UBUNTU15.10\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"qemu-system-mips\", ver:\"1:2.3+dfsg-5ubuntu9.4\", rls:\"UBUNTU15.10\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"qemu-system-misc\", ver:\"1:2.3+dfsg-5ubuntu9.4\", rls:\"UBUNTU15.10\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"qemu-system-ppc\", ver:\"1:2.3+dfsg-5ubuntu9.4\", rls:\"UBUNTU15.10\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"qemu-system-sparc\", ver:\"1:2.3+dfsg-5ubuntu9.4\", rls:\"UBUNTU15.10\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"qemu-system-x86\", ver:\"1:2.3+dfsg-5ubuntu9.4\", rls:\"UBUNTU15.10\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-05-29T18:35:50", "bulletinFamily": "scanner", "cvelist": ["CVE-2015-8567", "CVE-2015-8619", "CVE-2015-8558", "CVE-2015-8613", "CVE-2015-8666", "CVE-2015-7504", "CVE-2015-7512", "CVE-2015-8345", "CVE-2015-8568", "CVE-2015-8744", "CVE-2015-7549", "CVE-2015-8743", "CVE-2016-1568", "CVE-2015-8745", "CVE-2016-1714", "CVE-2015-8504"], "description": "Mageia Linux Local Security Checks mgasa-2016-0023", "modified": "2019-03-14T00:00:00", "published": "2016-01-18T00:00:00", "id": "OPENVAS:1361412562310131187", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310131187", "type": "openvas", "title": "Mageia Linux Local Check: mgasa-2016-0023", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: mgasa-2016-0023.nasl 14180 2019-03-14 12:29:16Z cfischer $\n#\n# Mageia Linux security check\n#\n# Authors:\n# Eero Volotinen <eero.volotinen@solinor.com>\n#\n# Copyright:\n# Copyright (c) 2016 Eero Volotinen, http://www.solinor.com\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.131187\");\n script_version(\"$Revision: 14180 $\");\n script_tag(name:\"creation_date\", value:\"2016-01-18 07:49:19 +0200 (Mon, 18 Jan 2016)\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-14 13:29:16 +0100 (Thu, 14 Mar 2019) $\");\n script_name(\"Mageia Linux Local Check: mgasa-2016-0023\");\n script_tag(name:\"solution\", value:\"Update the affected packages to the latest available version.\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_xref(name:\"URL\", value:\"https://advisories.mageia.org/MGASA-2016-0023.html\");\n script_cve_id(\"CVE-2015-7504\", \"CVE-2015-7512\", \"CVE-2015-7549\", \"CVE-2015-8345\", \"CVE-2015-8504\", \"CVE-2015-8558\", \"CVE-2015-8567\", \"CVE-2015-8568\", \"CVE-2015-8613\", \"CVE-2015-8619\", \"CVE-2015-8666\", \"CVE-2015-8743\", \"CVE-2015-8744\", \"CVE-2015-8745\", \"CVE-2016-1568\", \"CVE-2016-1714\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/mageia_linux\", \"ssh/login/release\", re:\"ssh/login/release=MAGEIA5\");\n script_category(ACT_GATHER_INFO);\n script_tag(name:\"summary\", value:\"Mageia Linux Local Security Checks mgasa-2016-0023\");\n script_copyright(\"Eero Volotinen\");\n script_family(\"Mageia Linux Local Security Checks\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release) exit(0);\n\nres = \"\";\n\nif(release == \"MAGEIA5\")\n{\nif ((res = isrpmvuln(pkg:\"qemu\", rpm:\"qemu~2.1.3~2.11.mga5\", rls:\"MAGEIA5\")) != NULL) {\n security_message(data:res);\n exit(0);\n}\nif (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-05-29T18:35:11", "bulletinFamily": "scanner", "cvelist": ["CVE-2015-8567", "CVE-2015-8613", "CVE-2016-1922", "CVE-2015-8568", "CVE-2015-8743", "CVE-2016-1568", "CVE-2015-8701", "CVE-2015-8745"], "description": "The remote host is missing an update for the ", "modified": "2019-03-15T00:00:00", "published": "2016-01-24T00:00:00", "id": "OPENVAS:1361412562310807207", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310807207", "type": "openvas", "title": "Fedora Update for qemu FEDORA-2016-42778", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for qemu FEDORA-2016-42778\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2016 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.807207\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2016-01-24 06:14:59 +0100 (Sun, 24 Jan 2016)\");\n script_cve_id(\"CVE-2015-8745\", \"CVE-2015-8567\", \"CVE-2016-1922\", \"CVE-2015-8613\",\n \"CVE-2015-8701\", \"CVE-2015-8743\", \"CVE-2016-1568\", \"CVE-2015-8568\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"Fedora Update for qemu FEDORA-2016-42778\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'qemu'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"affected\", value:\"qemu on Fedora 23\");\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n script_xref(name:\"FEDORA\", value:\"2016-42778\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/pipermail/package-announce/2016-January/175967.html\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2016 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC23\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC23\")\n{\n\n if ((res = isrpmvuln(pkg:\"qemu\", rpm:\"qemu~2.4.1~6.fc23\", rls:\"FC23\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-05-29T18:35:38", "bulletinFamily": "scanner", "cvelist": ["CVE-2016-2392", "CVE-2016-2858", "CVE-2015-8619", "CVE-2015-8613", "CVE-2016-1922", "CVE-2016-2198", "CVE-2016-2197", "CVE-2016-1714", "CVE-2016-1981", "CVE-2016-2538"], "description": "Gentoo Linux Local Security Checks GLSA 201604-01", "modified": "2018-10-26T00:00:00", "published": "2016-04-06T00:00:00", "id": "OPENVAS:1361412562310121458", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310121458", "type": "openvas", "title": "Gentoo Security Advisory GLSA 201604-01", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: glsa-201604-01.nasl 12128 2018-10-26 13:35:25Z cfischer $\n#\n# Gentoo Linux security check\n#\n# Authors:\n# Eero Volotinen <eero.volotinen@solinor.fi>\n#\n# Copyright:\n# Copyright (c) 2016 Eero Volotinen, http://solinor.com\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.121458\");\n script_version(\"$Revision: 12128 $\");\n script_tag(name:\"creation_date\", value:\"2016-04-06 14:30:00 +0300 (Wed, 06 Apr 2016)\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-10-26 15:35:25 +0200 (Fri, 26 Oct 2018) $\");\n script_name(\"Gentoo Security Advisory GLSA 201604-01\");\n script_tag(name:\"insight\", value:\"Multiple vulnerabilities have been discovered in QEMU. Please review the CVE identifiers referenced below for details.\");\n script_tag(name:\"solution\", value:\"Update the affected packages to the latest available version.\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_xref(name:\"URL\", value:\"https://security.gentoo.org/glsa/201604-01\");\n script_cve_id(\"CVE-2015-8613\", \"CVE-2015-8619\", \"CVE-2016-1714\", \"CVE-2016-1922\", \"CVE-2016-1981\", \"CVE-2016-2197\", \"CVE-2016-2198\", \"CVE-2016-2392\", \"CVE-2016-2538\", \"CVE-2016-2858\");\n script_tag(name:\"cvss_base\", value:\"6.9\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:L/AC:M/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/gentoo\", \"ssh/login/pkg\");\n script_category(ACT_GATHER_INFO);\n script_tag(name:\"summary\", value:\"Gentoo Linux Local Security Checks GLSA 201604-01\");\n script_copyright(\"Eero Volotinen\");\n script_family(\"Gentoo Local Security Checks\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-gentoo.inc\");\n\nres = \"\";\nreport = \"\";\n\nif((res=ispkgvuln(pkg:\"app-emulation/qemu\", unaffected: make_list(\"ge 2.5.0-r2\"), vulnerable: make_list(\"lt 2.5.0-r2\"))) != NULL) {\n report += res;\n}\n\nif(report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99);\n}\n", "cvss": {"score": 6.9, "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"}}], "suse": [{"lastseen": "2016-09-04T11:57:19", "bulletinFamily": "unix", "cvelist": ["CVE-2015-8567", "CVE-2015-3214", "CVE-2016-2858", "CVE-2014-3689", "CVE-2014-9718", "CVE-2015-8619", "CVE-2015-8558", "CVE-2015-8613", "CVE-2016-1922", "CVE-2016-4441", "CVE-2016-3712", "CVE-2015-8817", "CVE-2016-4952", "CVE-2016-3710", "CVE-2015-5745", "CVE-2015-8568", "CVE-2016-2198", "CVE-2016-4002", "CVE-2015-8744", "CVE-2016-4020", "CVE-2015-7549", "CVE-2016-2841", "CVE-2015-8743", "CVE-2016-4001", "CVE-2015-8818", "CVE-2016-1568", "CVE-2016-4037", "CVE-2015-8745", "CVE-2016-1714", "CVE-2016-2857", "CVE-2016-1981", "CVE-2015-8504", "CVE-2016-4439", "CVE-2015-5239", "CVE-2016-2538", "CVE-2014-3615", "CVE-2015-7295"], "description": "qemu was updated to fix 37 security issues.\n\n These security issues were fixed:\n - CVE-2016-4439: Avoid OOB access in 53C9X emulation (bsc#980711)\n - CVE-2016-4441: Avoid OOB access in 53C9X emulation (bsc#980723)\n - CVE-2016-4952: Avoid OOB access in Vmware PV SCSI emulation (bsc#981266)\n - CVE-2015-8817: Avoid OOB access in PCI DMA I/O (bsc#969121)\n - CVE-2015-8818: Avoid OOB access in PCI DMA I/O (bsc#969122)\n - CVE-2016-3710: Fixed VGA emulation based OOB access with potential for\n guest escape (bsc#978158)\n - CVE-2016-3712: Fixed VGa emulation based DOS and OOB read access exploit\n (bsc#978160)\n - CVE-2016-4037: Fixed USB ehci based DOS (bsc#976109)\n - CVE-2016-2538: Fixed potential OOB access in USB net device emulation\n (bsc#967969)\n - CVE-2016-2841: Fixed OOB access / hang in ne2000 emulation (bsc#969350)\n - CVE-2016-2858: Avoid potential DOS when using QEMU pseudo random number\n generator (bsc#970036)\n - CVE-2016-2857: Fixed OOB access when processing IP checksums (bsc#970037)\n - CVE-2016-4001: Fixed OOB access in Stellaris enet emulated nic\n (bsc#975128)\n - CVE-2016-4002: Fixed OOB access in MIPSnet emulated controller\n (bsc#975136)\n - CVE-2016-4020: Fixed possible host data leakage to guest from TPR access\n (bsc#975700)\n - CVE-2015-3214: Fixed OOB read in i8254 PIC (bsc#934069)\n - CVE-2014-9718: Fixed the handling of malformed or short ide PRDTs to\n avoid any opportunity for guest to cause DoS by abusing that interface\n (bsc#928393)\n - CVE-2014-3689: Fixed insufficient parameter validation in rectangle\n functions (bsc#901508)\n - CVE-2014-3615: The VGA emulator in QEMU allowed local guest users to\n read host memory by setting the display to a high resolution\n (bsc#895528).\n - CVE-2015-5239: Integer overflow in vnc_client_read() and\n protocol_client_msg() (bsc#944463).\n - CVE-2015-5745: Buffer overflow in virtio-serial (bsc#940929).\n - CVE-2015-7295: hw/virtio/virtio.c in the Virtual Network Device\n (virtio-net) support in QEMU, when big or mergeable receive buffers are\n not supported, allowed remote attackers to cause a denial of service\n (guest network consumption) via a flood of jumbo frames on the (1)\n tuntap or (2) macvtap interface (bsc#947159).\n - CVE-2015-7549: PCI null pointer dereferences (bsc#958917).\n - CVE-2015-8504: VNC floating point exception (bsc#958491).\n - CVE-2015-8558: Infinite loop in ehci_advance_state resulting in DoS\n (bsc#959005).\n - CVE-2015-8567: A guest repeatedly activating a vmxnet3 device can leak\n host memory (bsc#959386).\n - CVE-2015-8568: A guest repeatedly activating a vmxnet3 device can leak\n host memory (bsc#959386).\n - CVE-2015-8613: Wrong sized memset in megasas command handler\n (bsc#961358).\n - CVE-2015-8619: Potential DoS for long HMP sendkey command argument\n (bsc#960334).\n - CVE-2015-8743: OOB memory access in ne2000 ioport r/w functions\n (bsc#960725).\n - CVE-2015-8744: Incorrect l2 header validation could have lead to a crash\n via assert(2) call (bsc#960835).\n - CVE-2015-8745: Reading IMR registers could have lead to a crash via\n assert(2) call (bsc#960708).\n - CVE-2016-1568: AHCI use-after-free in aio port commands (bsc#961332).\n - CVE-2016-1714: Potential OOB memory access in processing firmware\n configuration (bsc#961691).\n - CVE-2016-1922: NULL pointer dereference when processing hmp i/o command\n (bsc#962320).\n - CVE-2016-1981: Potential DoS (infinite loop) in e1000 device emulation\n by malicious privileged user within guest (bsc#963782).\n - CVE-2016-2198: Malicious privileged guest user were able to cause DoS by\n writing to read-only EHCI capabilities registers (bsc#964413).\n\n This non-security issue was fixed\n - bsc#886378: qemu truncates vhd images in virt-rescue\n\n", "edition": 1, "modified": "2016-06-13T13:08:26", "published": "2016-06-13T13:08:26", "id": "SUSE-SU-2016:1560-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00017.html", "title": "Security update for qemu (important)", "type": "suse", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2016-09-04T12:05:42", "bulletinFamily": "unix", "cvelist": ["CVE-2015-8567", "CVE-2016-2858", "CVE-2015-8619", "CVE-2015-8558", "CVE-2015-8613", "CVE-2016-1922", "CVE-2016-4441", "CVE-2016-3712", "CVE-2015-8817", "CVE-2016-4952", "CVE-2016-3710", "CVE-2015-5745", "CVE-2015-8568", "CVE-2016-2198", "CVE-2016-2197", "CVE-2016-4002", "CVE-2015-8744", "CVE-2016-4020", "CVE-2015-7549", "CVE-2016-2841", "CVE-2015-8743", "CVE-2016-4001", "CVE-2015-8818", "CVE-2016-1568", "CVE-2016-4037", "CVE-2015-8745", "CVE-2016-1714", "CVE-2016-2857", "CVE-2016-1981", "CVE-2015-8504", "CVE-2016-4439", "CVE-2016-2538"], "description": "qemu was updated to fix 29 security issues.\n\n These security issues were fixed:\n - CVE-2016-4439: Avoid OOB access in 53C9X emulation (bsc#980711)\n - CVE-2016-4441: Avoid OOB access in 53C9X emulation (bsc#980723)\n - CVE-2016-4952: Avoid OOB access in Vmware PV SCSI emulation (bsc#981266)\n - CVE-2015-8817: Avoid OOB access in PCI dma I/O (bsc#969121)\n - CVE-2015-8818: Avoid OOB access in PCI dma I/O (bsc#969122)\n - CVE-2016-3710: Fixed VGA emulation based OOB access with potential for\n guest escape (bsc#978158)\n - CVE-2016-3712: Fixed VGa emulation based DOS and OOB read access exploit\n (bsc#978160)\n - CVE-2016-4037: Fixed USB ehci based DOS (bsc#976109)\n - CVE-2016-2538: Fixed potential OOB access in USB net device emulation\n (bsc#967969)\n - CVE-2016-2841: Fixed OOB access / hang in ne2000 emulation (bsc#969350)\n - CVE-2016-2858: Avoid potential DOS when using QEMU pseudo random number\n generator (bsc#970036)\n - CVE-2016-2857: Fixed OOB access when processing IP checksums (bsc#970037)\n - CVE-2016-4001: Fixed OOB access in Stellaris enet emulated nic\n (bsc#975128)\n - CVE-2016-4002: Fixed OOB access in MIPSnet emulated controller\n (bsc#975136)\n - CVE-2016-4020: Fixed possible host data leakage to guest from TPR access\n (bsc#975700)\n - CVE-2016-2197: Prevent AHCI NULL pointer dereference when using FIS CLB\n engine (bsc#964411)\n - CVE-2015-5745: Buffer overflow in virtio-serial (bsc#940929).\n - CVE-2015-7549: PCI null pointer dereferences (bsc#958917).\n - CVE-2015-8504: VNC floating point exception (bsc#958491).\n - CVE-2015-8558: Infinite loop in ehci_advance_state resulting in DoS\n (bsc#959005).\n - CVE-2015-8567: A guest repeatedly activating a vmxnet3 device can leak\n host memory (bsc#959386).\n - CVE-2015-8568: A guest repeatedly activating a vmxnet3 device can leak\n host memory (bsc#959386).\n - CVE-2015-8613: Wrong sized memset in megasas command handler\n (bsc#961358).\n - CVE-2015-8619: Potential DoS for long HMP sendkey command argument\n (bsc#960334).\n - CVE-2015-8743: OOB memory access in ne2000 ioport r/w functions\n (bsc#960725).\n - CVE-2015-8744: Incorrect l2 header validation could have lead to a crash\n via assert(2) call (bsc#960835).\n - CVE-2015-8745: Reading IMR registers could have lead to a crash via\n assert(2) call (bsc#960708).\n - CVE-2016-1568: AHCI use-after-free in aio port commands (bsc#961332).\n - CVE-2016-1714: Potential OOB memory access in processing firmware\n configuration (bsc#961691).\n - CVE-2016-1922: NULL pointer dereference when processing hmp i/o command\n (bsc#962320).\n - CVE-2016-1981: Potential DoS (infinite loop) in e1000 device emulation\n by malicious privileged user within guest (bsc#963782).\n - CVE-2016-2198: Malicious privileged guest user were able to cause DoS by\n writing to read-only EHCI capabilities registers (bsc#964413).\n\n This non-security issue was fixed\n - bsc#886378: qemu truncates vhd images in virt-rescue\n\n", "edition": 1, "modified": "2016-06-29T11:07:43", "published": "2016-06-29T11:07:43", "id": "SUSE-SU-2016:1703-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00058.html", "title": "Security update for qemu (important)", "type": "suse", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2016-09-04T12:46:50", "bulletinFamily": "unix", "cvelist": ["CVE-2015-8567", "CVE-2016-2858", "CVE-2015-8619", "CVE-2015-8558", "CVE-2015-8613", "CVE-2016-1922", "CVE-2016-4441", "CVE-2016-3712", "CVE-2015-8817", "CVE-2016-4952", "CVE-2016-3710", "CVE-2015-5745", "CVE-2015-8568", "CVE-2016-2198", "CVE-2016-2197", "CVE-2016-4002", "CVE-2015-8744", "CVE-2016-4020", "CVE-2015-7549", "CVE-2016-2841", "CVE-2015-8743", "CVE-2016-4001", "CVE-2015-8818", "CVE-2016-1568", "CVE-2016-4037", "CVE-2015-8745", "CVE-2016-1714", "CVE-2016-2857", "CVE-2016-1981", "CVE-2015-8504", "CVE-2016-4439", "CVE-2016-2538"], "description": "qemu was updated to fix 29 security issues.\n\n These security issues were fixed:\n - CVE-2016-4439: Avoid OOB access in 53C9X emulation (bsc#980711)\n - CVE-2016-4441: Avoid OOB access in 53C9X emulation (bsc#980723)\n - CVE-2016-4952: Avoid OOB access in Vmware PV SCSI emulation (bsc#981266)\n - CVE-2015-8817: Avoid OOB access in PCI dma I/O (bsc#969121)\n - CVE-2015-8818: Avoid OOB access in PCI dma I/O (bsc#969122)\n - CVE-2016-3710: Fixed VGA emulation based OOB access with potential for\n guest escape (bsc#978158)\n - CVE-2016-3712: Fixed VGa emulation based DOS and OOB read access exploit\n (bsc#978160)\n - CVE-2016-4037: Fixed USB ehci based DOS (bsc#976109)\n - CVE-2016-2538: Fixed potential OOB access in USB net device emulation\n (bsc#967969)\n - CVE-2016-2841: Fixed OOB access / hang in ne2000 emulation (bsc#969350)\n - CVE-2016-2858: Avoid potential DOS when using QEMU pseudo random number\n generator (bsc#970036)\n - CVE-2016-2857: Fixed OOB access when processing IP checksums (bsc#970037)\n - CVE-2016-4001: Fixed OOB access in Stellaris enet emulated nic\n (bsc#975128)\n - CVE-2016-4002: Fixed OOB access in MIPSnet emulated controller\n (bsc#975136)\n - CVE-2016-4020: Fixed possible host data leakage to guest from TPR access\n (bsc#975700)\n - CVE-2016-2197: Prevent AHCI NULL pointer dereference when using FIS CLB\n engine (bsc#964411)\n - CVE-2015-5745: Buffer overflow in virtio-serial (bsc#940929).\n - CVE-2015-7549: PCI null pointer dereferences (bsc#958917).\n - CVE-2015-8504: VNC floating point exception (bsc#958491).\n - CVE-2015-8558: Infinite loop in ehci_advance_state resulting in DoS\n (bsc#959005).\n - CVE-2015-8567: A guest repeatedly activating a vmxnet3 device can leak\n host memory (bsc#959386).\n - CVE-2015-8568: A guest repeatedly activating a vmxnet3 device can leak\n host memory (bsc#959386).\n - CVE-2015-8613: Wrong sized memset in megasas command handler\n (bsc#961358).\n - CVE-2015-8619: Potential DoS for long HMP sendkey command argument\n (bsc#960334).\n - CVE-2015-8743: OOB memory access in ne2000 ioport r/w functions\n (bsc#960725).\n - CVE-2015-8744: Incorrect l2 header validation could have lead to a crash\n via assert(2) call (bsc#960835).\n - CVE-2015-8745: Reading IMR registers could have lead to a crash via\n assert(2) call (bsc#960708).\n - CVE-2016-1568: AHCI use-after-free in aio port commands (bsc#961332).\n - CVE-2016-1714: Potential OOB memory access in processing firmware\n configuration (bsc#961691).\n - CVE-2016-1922: NULL pointer dereference when processing hmp i/o command\n (bsc#962320).\n - CVE-2016-1981: Potential DoS (infinite loop) in e1000 device emulation\n by malicious privileged user within guest (bsc#963782).\n - CVE-2016-2198: Malicious privileged guest user were able to cause DoS by\n writing to read-only EHCI capabilities registers (bsc#964413).\n\n This non-security issue was fixed\n - bsc#886378: qemu truncates vhd images in virt-rescue\n\n This update was imported from the SUSE:SLE-12-SP1:Update update project.\n\n", "edition": 1, "modified": "2016-07-06T22:04:21", "published": "2016-07-06T22:04:21", "id": "OPENSUSE-SU-2016:1750-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00003.html", "type": "suse", "title": "Security update for qemu (important)", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2016-09-04T11:57:33", "bulletinFamily": "unix", "cvelist": ["CVE-2015-3214", "CVE-2016-2858", "CVE-2014-3689", "CVE-2014-9718", "CVE-2015-8619", "CVE-2015-8558", "CVE-2015-6855", "CVE-2015-8613", "CVE-2016-1922", "CVE-2016-4441", "CVE-2016-3712", "CVE-2015-5279", "CVE-2016-3710", "CVE-2015-5745", "CVE-2016-2198", "CVE-2016-4002", "CVE-2016-4020", "CVE-2015-7549", "CVE-2016-2841", "CVE-2015-8743", "CVE-2016-4001", "CVE-2016-1568", "CVE-2016-4037", "CVE-2016-1714", "CVE-2016-2857", "CVE-2016-1981", "CVE-2015-8504", "CVE-2016-4439", "CVE-2015-5239", "CVE-2016-2538", "CVE-2014-3615", "CVE-2015-7295", "CVE-2015-5278"], "description": "kvm was updated to fix 33 security issues.\n\n These security issues were fixed:\n - CVE-2016-4439: Avoid OOB access in 53C9X emulation (bsc#980711)\n - CVE-2016-4441: Avoid OOB access in 53C9X emulation (bsc#980723)\n - CVE-2016-3710: Fixed VGA emulation based OOB access with potential for\n guest escape (bsc#978158)\n - CVE-2016-3712: Fixed VGa emulation based DOS and OOB read access exploit\n (bsc#978160)\n - CVE-2016-4037: Fixed USB ehci based DOS (bsc#976109)\n - CVE-2016-2538: Fixed potential OOB access in USB net device emulation\n (bsc#967969)\n - CVE-2016-2841: Fixed OOB access / hang in ne2000 emulation (bsc#969350)\n - CVE-2016-2858: Avoid potential DOS when using QEMU pseudo random number\n generator (bsc#970036)\n - CVE-2016-2857: Fixed OOB access when processing IP checksums (bsc#970037)\n - CVE-2016-4001: Fixed OOB access in Stellaris enet emulated nic\n (bsc#975128)\n - CVE-2016-4002: Fixed OOB access in MIPSnet emulated controller\n (bsc#975136)\n - CVE-2016-4020: Fixed possible host data leakage to guest from TPR access\n (bsc#975700)\n - CVE-2015-3214: Fixed OOB read in i8254 PIC (bsc#934069)\n - CVE-2014-9718: Fixed the handling of malformed or short ide PRDTs to\n avoid any opportunity for guest to cause DoS by abusing that interface\n (bsc#928393)\n - CVE-2014-3689: Fixed insufficient parameter validation in rectangle\n functions (bsc#901508)\n - CVE-2014-3615: The VGA emulator in QEMU allowed local guest users to\n read host memory by setting the display to a high resolution\n (bsc#895528).\n - CVE-2015-5239: Integer overflow in vnc_client_read() and\n protocol_client_msg() (bsc#944463).\n - CVE-2015-5278: Infinite loop in ne2000_receive() function (bsc#945989).\n - CVE-2015-5279: Heap-based buffer overflow in the ne2000_receive function\n in hw/net/ne2000.c in QEMU allowed guest OS users to cause a denial of\n service (instance crash) or possibly execute arbitrary code via vectors\n related to receiving packets (bsc#945987).\n - CVE-2015-5745: Buffer overflow in virtio-serial (bsc#940929).\n - CVE-2015-6855: hw/ide/core.c in QEMU did not properly restrict the\n commands accepted by an ATAPI device, which allowed guest users to cause\n a denial of service or possibly have unspecified other impact via\n certain IDE commands, as demonstrated by a WIN_READ_NATIVE_MAX command\n to an empty drive, which triggers a divide-by-zero error and instance\n crash (bsc#945404).\n - CVE-2015-7295: hw/virtio/virtio.c in the Virtual Network Device\n (virtio-net) support in QEMU, when big or mergeable receive buffers are\n not supported, allowed remote attackers to cause a denial of service\n (guest network consumption) via a flood of jumbo frames on the (1)\n tuntap or (2) macvtap interface (bsc#947159).\n - CVE-2015-7549: PCI null pointer dereferences (bsc#958917).\n - CVE-2015-8504: VNC floating point exception (bsc#958491).\n - CVE-2015-8558: Infinite loop in ehci_advance_state resulting in DoS\n (bsc#959005).\n - CVE-2015-8613: Wrong sized memset in megasas command handler\n (bsc#961358).\n - CVE-2015-8619: Potential DoS for long HMP sendkey command argument\n (bsc#960334).\n - CVE-2015-8743: OOB memory access in ne2000 ioport r/w functions\n (bsc#960725).\n - CVE-2016-1568: AHCI use-after-free in aio port commands (bsc#961332).\n - CVE-2016-1714: Potential OOB memory access in processing firmware\n configuration (bsc#961691).\n - CVE-2016-1922: NULL pointer dereference when processing hmp i/o command\n (bsc#962320).\n - CVE-2016-1981: Potential DoS (infinite loop) in e1000 device emulation\n by malicious privileged user within guest (bsc#963782).\n - CVE-2016-2198: Malicious privileged guest user were able to cause DoS by\n writing to read-only EHCI capabilities registers (bsc#964413).\n\n This non-security issue was fixed:\n - Fix case of IDE interface needing busy status set before flush\n (bsc#936132)\n\n", "edition": 1, "modified": "2016-07-11T16:39:09", "published": "2016-07-11T16:39:09", "id": "SUSE-SU-2016:1785-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00012.html", "type": "suse", "title": "Security update for kvm (important)", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2016-09-04T12:23:04", "bulletinFamily": "unix", "cvelist": ["CVE-2015-3214", "CVE-2016-2858", "CVE-2014-3689", "CVE-2014-9718", "CVE-2015-8619", "CVE-2015-8558", "CVE-2015-6855", "CVE-2015-8613", "CVE-2016-1922", "CVE-2016-4441", "CVE-2016-3712", "CVE-2015-5279", "CVE-2016-3710", "CVE-2015-5745", "CVE-2016-2198", "CVE-2016-4002", "CVE-2016-4020", "CVE-2015-7549", "CVE-2016-2841", "CVE-2015-8743", "CVE-2016-4001", "CVE-2016-1568", "CVE-2016-4037", "CVE-2016-1714", "CVE-2016-2857", "CVE-2016-1981", "CVE-2015-8504", "CVE-2016-4439", "CVE-2015-5239", "CVE-2016-2538", "CVE-2014-3615", "CVE-2015-7295", "CVE-2015-5278"], "description": "kvm was updated to fix 33 security issues.\n\n These security issues were fixed:\n - CVE-2016-4439: Avoid OOB access in 53C9X emulation (bsc#980711)\n - CVE-2016-4441: Avoid OOB access in 53C9X emulation (bsc#980723)\n - CVE-2016-3710: Fixed VGA emulation based OOB access with potential for\n guest escape (bsc#978158)\n - CVE-2016-3712: Fixed VGa emulation based DOS and OOB read access exploit\n (bsc#978160)\n - CVE-2016-4037: Fixed USB ehci based DOS (bsc#976109)\n - CVE-2016-2538: Fixed potential OOB access in USB net device emulation\n (bsc#967969)\n - CVE-2016-2841: Fixed OOB access / hang in ne2000 emulation (bsc#969350)\n - CVE-2016-2858: Avoid potential DOS when using QEMU pseudo random number\n generator (bsc#970036)\n - CVE-2016-2857: Fixed OOB access when processing IP checksums (bsc#970037)\n - CVE-2016-4001: Fixed OOB access in Stellaris enet emulated nic\n (bsc#975128)\n - CVE-2016-4002: Fixed OOB access in MIPSnet emulated controller\n (bsc#975136)\n - CVE-2016-4020: Fixed possible host data leakage to guest from TPR access\n (bsc#975700)\n - CVE-2015-3214: Fixed OOB read in i8254 PIC (bsc#934069)\n - CVE-2014-9718: Fixed the handling of malformed or short ide PRDTs to\n avoid any opportunity for guest to cause DoS by abusing that interface\n (bsc#928393)\n - CVE-2014-3689: Fixed insufficient parameter validation in rectangle\n functions (bsc#901508)\n - CVE-2014-3615: The VGA emulator in QEMU allowed local guest users to\n read host memory by setting the display to a high resolution\n (bsc#895528).\n - CVE-2015-5239: Integer overflow in vnc_client_read() and\n protocol_client_msg() (bsc#944463).\n - CVE-2015-5278: Infinite loop in ne2000_receive() function (bsc#945989).\n - CVE-2015-5279: Heap-based buffer overflow in the ne2000_receive function\n in hw/net/ne2000.c in QEMU allowed guest OS users to cause a denial of\n service (instance crash) or possibly execute arbitrary code via vectors\n related to receiving packets (bsc#945987).\n - CVE-2015-5745: Buffer overflow in virtio-serial (bsc#940929).\n - CVE-2015-6855: hw/ide/core.c in QEMU did not properly restrict the\n commands accepted by an ATAPI device, which allowed guest users to cause\n a denial of service or possibly have unspecified other impact via\n certain IDE commands, as demonstrated by a WIN_READ_NATIVE_MAX command\n to an empty drive, which triggers a divide-by-zero error and instance\n crash (bsc#945404).\n - CVE-2015-7295: hw/virtio/virtio.c in the Virtual Network Device\n (virtio-net) support in QEMU, when big or mergeable receive buffers are\n not supported, allowed remote attackers to cause a denial of service\n (guest network consumption) via a flood of jumbo frames on the (1)\n tuntap or (2) macvtap interface (bsc#947159).\n - CVE-2015-7549: PCI null pointer dereferences (bsc#958917).\n - CVE-2015-8504: VNC floating point exception (bsc#958491).\n - CVE-2015-8558: Infinite loop in ehci_advance_state resulting in DoS\n (bsc#959005).\n - CVE-2015-8613: Wrong sized memset in megasas command handler\n (bsc#961358).\n - CVE-2015-8619: Potential DoS for long HMP sendkey command argument\n (bsc#960334).\n - CVE-2015-8743: OOB memory access in ne2000 ioport r/w functions\n (bsc#960725).\n - CVE-2016-1568: AHCI use-after-free in aio port commands (bsc#961332).\n - CVE-2016-1714: Potential OOB memory access in processing firmware\n configuration (bsc#961691).\n - CVE-2016-1922: NULL pointer dereference when processing hmp i/o command\n (bsc#962320).\n - CVE-2016-1981: Potential DoS (infinite loop) in e1000 device emulation\n by malicious privileged user within guest (bsc#963782).\n - CVE-2016-2198: Malicious privileged guest user were able to cause DoS by\n writing to read-only EHCI capabilities registers (bsc#964413).\n\n This non-security issue was fixed:\n - Fix case of IDE interface needing busy status set before flush\n (bsc#936132)\n\n", "edition": 1, "modified": "2016-06-28T20:07:43", "published": "2016-06-28T20:07:43", "id": "SUSE-SU-2016:1698-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00057.html", "title": "Security update for kvm (important)", "type": "suse", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2016-09-04T11:49:45", "bulletinFamily": "unix", "cvelist": ["CVE-2015-8567", "CVE-2016-2392", "CVE-2014-3689", "CVE-2014-9718", "CVE-2016-1570", "CVE-2015-8619", "CVE-2015-8558", "CVE-2016-2270", "CVE-2015-6855", "CVE-2015-8613", "CVE-2016-1922", "CVE-2013-4533", "CVE-2015-1779", "CVE-2015-8817", "CVE-2014-0222", "CVE-2014-3640", "CVE-2016-2391", "CVE-2015-7512", "CVE-2015-8550", "CVE-2015-8345", "CVE-2015-8554", "CVE-2015-8568", "CVE-2016-2198", "CVE-2014-7815", "CVE-2013-4534", "CVE-2013-4537", "CVE-2015-8555", "CVE-2015-8744", "CVE-2015-7549", "CVE-2016-2841", "CVE-2015-8743", "CVE-2015-8818", "CVE-2016-1568", "CVE-2013-4539", "CVE-2015-8745", "CVE-2016-1714", "CVE-2016-1981", "CVE-2015-8504", "CVE-2016-2538", "CVE-2016-2271", "CVE-2013-4538", "CVE-2015-5278", "CVE-2016-1571"], "description": "xen was updated to fix 44 security issues.\n\n These security issues were fixed:\n - CVE-2013-4533: Buffer overflow in the pxa2xx_ssp_load function in\n hw/arm/pxa2xx.c allowed remote attackers to cause a denial of service or\n possibly execute arbitrary code via a crafted s-&gt;rx_level value in a\n savevm image (bsc#864655).\n - CVE-2013-4534: Buffer overflow in hw/intc/openpic.c allowed remote\n attackers to cause a denial of service or possibly execute arbitrary\n code via vectors related to IRQDest elements (bsc#864811).\n - CVE-2013-4537: The ssi_sd_transfer function in hw/sd/ssi-sd.c allowed\n remote attackers to execute arbitrary code via a crafted arglen value in\n a savevm image (bsc#864391).\n - CVE-2013-4538: Multiple buffer overflows in the ssd0323_load function in\n hw/display/ssd0323.c allowed remote attackers to cause a denial of\n service (memory corruption) or possibly execute arbitrary code via\n crafted (1) cmd_len, (2) row, or (3) col values; (4) row_start and\n row_end values; or (5) col_star and col_end values in a savevm image\n (bsc#864769).\n - CVE-2013-4539: Multiple buffer overflows in the tsc210x_load function in\n hw/input/tsc210x.c might have allowed remote attackers to execute\n arbitrary code via a crafted (1) precision, (2) nextprecision, (3)\n function, or (4) nextfunction value in a savevm image (bsc#864805).\n - CVE-2014-0222: Integer overflow in the qcow_open function in\n block/qcow.c allowed remote attackers to cause a denial of service\n (crash) via a large L2 table in a QCOW version 1 image (bsc#877642).\n - CVE-2014-3640: The sosendto function in slirp/udp.c allowed local users\n to cause a denial of service (NULL pointer dereference) by sending a udp\n packet with a value of 0 in the source port and address, which triggers\n access of an uninitialized socket (bsc#897654).\n - CVE-2014-3689: The vmware-vga driver (hw/display/vmware_vga.c) allowed\n local guest users to write to qemu memory locations and gain privileges\n via unspecified parameters related to rectangle handling (bsc#901508).\n - CVE-2014-7815: The set_pixel_format function in ui/vnc.c allowed remote\n attackers to cause a denial of service (crash) via a small\n bytes_per_pixel value (bsc#902737).\n - CVE-2014-9718: The (1) BMDMA and (2) AHCI HBA interfaces in the IDE\n functionality had multiple interpretations of a function's return value,\n which allowed guest OS users to cause a host OS denial of service\n (memory consumption or infinite loop, and system crash) via a PRDT with\n zero complete sectors, related to the bmdma_prepare_buf and\n ahci_dma_prepare_buf functions (bsc#928393).\n - CVE-2015-1779: The VNC websocket frame decoder allowed remote attackers\n to cause a denial of service (memory and CPU consumption) via a large\n (1) websocket payload or (2) HTTP headers section (bsc#924018).\n - CVE-2015-5278: Infinite loop in ne2000_receive() function (bsc#945989).\n - CVE-2015-6855: hw/ide/core.c did not properly restrict the commands\n accepted by an ATAPI device, which allowed guest users to cause a denial\n of service or possibly have unspecified other impact via certain IDE\n commands, as demonstrated by a WIN_READ_NATIVE_MAX command to an empty\n drive, which triggers a divide-by-zero error and instance crash\n (bsc#945404).\n - CVE-2015-7512: Buffer overflow in the pcnet_receive function in\n hw/net/pcnet.c, when a guest NIC has a larger MTU, allowed remote\n attackers to cause a denial of service (guest OS crash) or execute\n arbitrary code via a large packet (bsc#957162).\n - CVE-2015-7549: pci: NULL pointer dereference issue (bsc#958917).\n - CVE-2015-8345: eepro100: infinite loop in processing command block list\n (bsc#956829).\n - CVE-2015-8504: VNC: floating point exception (bsc#958491).\n - CVE-2015-8550: Paravirtualized drivers were incautious about shared\n memory contents (XSA-155) (bsc#957988).\n - CVE-2015-8554: qemu-dm buffer overrun in MSI-X handling (XSA-164)\n (bsc#958007).\n - CVE-2015-8555: Information leak in legacy x86 FPU/XMM initialization\n (XSA-165) (bsc#958009).\n - CVE-2015-8558: Infinite loop in ehci_advance_state resulted in DoS\n (bsc#959005).\n - CVE-2015-8567: vmxnet3: host memory leakage (bsc#959387).\n - CVE-2015-8568: vmxnet3: host memory leakage (bsc#959387).\n - CVE-2015-8613: SCSI: stack based buffer overflow in\n megasas_ctrl_get_info (bsc#961358).\n - CVE-2015-8619: Stack based OOB write in hmp_sendkey routine (bsc#960334).\n - CVE-2015-8743: ne2000: OOB memory access in ioport r/w functions\n (bsc#960725).\n - CVE-2015-8744: vmxnet3: Incorrect l2 header validation lead to a crash\n via assert(2) call (bsc#960835).\n - CVE-2015-8745: Reading IMR registers lead to a crash via assert(2) call\n (bsc#960707).\n - CVE-2015-8817: OOB access in address_space_rw lead to segmentation fault\n (I) (bsc#969121).\n - CVE-2015-8818: OOB access in address_space_rw lead to segmentation fault\n (II) (bsc#969122).\n - CVE-2016-1568: AHCI use-after-free vulnerability in aio port commands\n (bsc#961332).\n - CVE-2016-1570: The PV superpage functionality in arch/x86/mm.c allowed\n local PV guests to obtain sensitive information, cause a denial of\n service, gain privileges, or have unspecified other impact via a crafted\n page identifier (MFN) to the (1) MMUEXT_MARK_SUPER or (2)\n MMUEXT_UNMARK_SUPER sub-op in the HYPERVISOR_mmuext_op hypercall or (3)\n unknown vectors related to page table updates (bsc#960861).\n - CVE-2016-1571: VMX: intercept issue with INVLPG on non-canonical address\n (XSA-168) (bsc#960862).\n - CVE-2016-1714: nvram: OOB r/w access in processing firmware\n configurations (bsc#961691).\n - CVE-2016-1922: NULL pointer dereference in vapic_write() (bsc#962320).\n - CVE-2016-1981: e1000 infinite loop in start_xmit and e1000_receive_iov\n routines (bsc#963782).\n - CVE-2016-2198: EHCI NULL pointer dereference in ehci_caps_write\n (bsc#964413).\n - CVE-2016-2270: Xen allowed local guest administrators to cause a denial\n of service (host reboot) via vectors related to multiple mappings of\n MMIO pages with different cachability settings (bsc#965315).\n - CVE-2016-2271: VMX when using an Intel or Cyrix CPU, allowed local HVM\n guest users to cause a denial of service (guest crash) via vectors\n related to a non-canonical RIP (bsc#965317).\n - CVE-2016-2391: usb: multiple eof_timers in ohci module lead to NULL\n pointer dereference (bsc#967013).\n - CVE-2016-2392: NULL pointer dereference in remote NDIS control message\n handling (bsc#967012).\n - CVE-2016-2538: Integer overflow in remote NDIS control message handling\n (bsc#967969).\n - CVE-2016-2841: ne2000: Infinite loop in ne2000_receive (bsc#969350).\n - XSA-166: ioreq handling possibly susceptible to multiple read issue\n (bsc#958523).\n\n These non-security issues were fixed:\n - bsc#954872: script block-dmmd not working as expected\n - bsc#957698: DOM0 can't bring up on Dell PC\n - bsc#963923: domain weights not honored when sched-credit tslice is\n reduced\n - bsc#959332: SLES12SP1 PV guest is unreachable when restored or migrated\n - bsc#959695: Missing docs for xen\n\n", "edition": 1, "modified": "2016-03-24T13:08:24", "published": "2016-03-24T13:08:24", "href": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00087.html", "id": "SUSE-SU-2016:0873-1", "title": "Security update for xen (important)", "type": "suse", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "nessus": [{"lastseen": "2021-01-07T14:24:17", "description": "qemu was updated to fix 29 security issues.\n\nThese security issues were fixed :\n\n - CVE-2016-4439: Avoid OOB access in 53C9X emulation\n (bsc#980711)\n\n - CVE-2016-4441: Avoid OOB access in 53C9X emulation\n (bsc#980723)\n\n - CVE-2016-4952: Avoid OOB access in Vmware PV SCSI\n emulation (bsc#981266)\n\n - CVE-2015-8817: Avoid OOB access in PCI dma I/O\n (bsc#969121)\n\n - CVE-2015-8818: Avoid OOB access in PCI dma I/O\n (bsc#969122)\n\n - CVE-2016-3710: Fixed VGA emulation based OOB access with\n potential for guest escape (bsc#978158)\n\n - CVE-2016-3712: Fixed VGa emulation based DOS and OOB\n read access exploit (bsc#978160)\n\n - CVE-2016-4037: Fixed USB ehci based DOS (bsc#976109)\n\n - CVE-2016-2538: Fixed potential OOB access in USB net\n device emulation (bsc#967969)\n\n - CVE-2016-2841: Fixed OOB access / hang in ne2000\n emulation (bsc#969350)\n\n - CVE-2016-2858: Avoid potential DOS when using QEMU\n pseudo random number generator (bsc#970036)\n\n - CVE-2016-2857: Fixed OOB access when processing IP\n checksums (bsc#970037)\n\n - CVE-2016-4001: Fixed OOB access in Stellaris enet\n emulated nic (bsc#975128)\n\n - CVE-2016-4002: Fixed OOB access in MIPSnet emulated\n controller (bsc#975136)\n\n - CVE-2016-4020: Fixed possible host data leakage to guest\n from TPR access (bsc#975700)\n\n - CVE-2016-2197: Prevent AHCI NULL pointer dereference\n when using FIS CLB engine (bsc#964411)\n\n - CVE-2015-5745: Buffer overflow in virtio-serial\n (bsc#940929).\n\n - CVE-2015-7549: PCI NULL pointer dereferences\n (bsc#958917).\n\n - CVE-2015-8504: VNC floating point exception\n (bsc#958491).\n\n - CVE-2015-8558: Infinite loop in ehci_advance_state\n resulting in DoS (bsc#959005).\n\n - CVE-2015-8567: A guest repeatedly activating a vmxnet3\n device can leak host memory (bsc#959386).\n\n - CVE-2015-8568: A guest repeatedly activating a vmxnet3\n device can leak host memory (bsc#959386).\n\n - CVE-2015-8613: Wrong sized memset in megasas command\n handler (bsc#961358).\n\n - CVE-2015-8619: Potential DoS for long HMP sendkey\n command argument (bsc#960334).\n\n - CVE-2015-8743: OOB memory access in ne2000 ioport r/w\n functions (bsc#960725).\n\n - CVE-2015-8744: Incorrect l2 header validation could have\n lead to a crash via assert(2) call (bsc#960835).\n\n - CVE-2015-8745: Reading IMR registers could have lead to\n a crash via assert(2) call (bsc#960708).\n\n - CVE-2016-1568: AHCI use-after-free in aio port commands\n (bsc#961332).\n\n - CVE-2016-1714: Potential OOB memory access in processing\n firmware configuration (bsc#961691).\n\n - CVE-2016-1922: NULL pointer dereference when processing\n hmp i/o command (bsc#962320).\n\n - CVE-2016-1981: Potential DoS (infinite loop) in e1000\n device emulation by malicious privileged user within\n guest (bsc#963782).\n\n - CVE-2016-2198: Malicious privileged guest user were able\n to cause DoS by writing to read-only EHCI capabilities\n registers (bsc#964413).\n\nThis non-security issue was fixed\n\n - bsc#886378: qemu truncates vhd images in virt-rescue\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 30, "cvss3": {"score": 9.0, "vector": "AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H"}, "published": "2016-08-29T00:00:00", "title": "SUSE SLED12 / SLES12 Security Update : qemu (SUSE-SU-2016:1703-1)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2015-8567", "CVE-2016-2858", "CVE-2015-8619", "CVE-2015-8558", "CVE-2015-8613", "CVE-2016-1922", "CVE-2016-4441", "CVE-2016-3712", "CVE-2015-8817", "CVE-2016-4952", "CVE-2016-3710", "CVE-2015-5745", "CVE-2015-8568", "CVE-2016-2198", "CVE-2016-2197", "CVE-2016-4002", "CVE-2015-8744", "CVE-2016-4020", "CVE-2015-7549", "CVE-2016-2841", "CVE-2015-8743", "CVE-2016-4001", "CVE-2015-8818", "CVE-2016-1568", "CVE-2016-4037", "CVE-2015-8745", "CVE-2016-1714", "CVE-2016-2857", "CVE-2016-1981", "CVE-2015-8504", "CVE-2016-4439", "CVE-2016-2538"], "modified": "2016-08-29T00:00:00", "cpe": ["p-cpe:/a:novell:suse_linux:qemu-block-curl-debuginfo", "cpe:/o:novell:suse_linux:12", "p-cpe:/a:novell:suse_linux:qemu-s390-debuginfo", "p-cpe:/a:novell:suse_linux:qemu-guest-agent-debuginfo", "p-cpe:/a:novell:suse_linux:qemu-debugsource", "p-cpe:/a:novell:suse_linux:qemu-lang", "p-cpe:/a:novell:suse_linux:qemu", "p-cpe:/a:novell:suse_linux:qemu-tools", "p-cpe:/a:novell:suse_linux:qemu-guest-agent", "p-cpe:/a:novell:suse_linux:qemu-tools-debuginfo", "p-cpe:/a:novell:suse_linux:qemu-block-rbd", "p-cpe:/a:novell:suse_linux:qemu-kvm", "p-cpe:/a:novell:suse_linux:qemu-block-curl", "p-cpe:/a:novell:suse_linux:qemu-block-rbd-debuginfo", "p-cpe:/a:novell:suse_linux:qemu-s390", "p-cpe:/a:novell:suse_linux:qemu-x86"], "id": "SUSE_SU-2016-1703-1.NASL", "href": "https://www.tenable.com/plugins/nessus/93170", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from SUSE update advisory SUSE-SU-2016:1703-1.\n# The text itself is copyright (C) SUSE.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(93170);\n script_version(\"2.12\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2015-5745\", \"CVE-2015-7549\", \"CVE-2015-8504\", \"CVE-2015-8558\", \"CVE-2015-8567\", \"CVE-2015-8568\", \"CVE-2015-8613\", \"CVE-2015-8619\", \"CVE-2015-8743\", \"CVE-2015-8744\", \"CVE-2015-8745\", \"CVE-2015-8817\", \"CVE-2015-8818\", \"CVE-2016-1568\", \"CVE-2016-1714\", \"CVE-2016-1922\", \"CVE-2016-1981\", \"CVE-2016-2197\", \"CVE-2016-2198\", \"CVE-2016-2538\", \"CVE-2016-2841\", \"CVE-2016-2857\", \"CVE-2016-2858\", \"CVE-2016-3710\", \"CVE-2016-3712\", \"CVE-2016-4001\", \"CVE-2016-4002\", \"CVE-2016-4020\", \"CVE-2016-4037\", \"CVE-2016-4439\", \"CVE-2016-4441\", \"CVE-2016-4952\");\n\n script_name(english:\"SUSE SLED12 / SLES12 Security Update : qemu (SUSE-SU-2016:1703-1)\");\n script_summary(english:\"Checks rpm output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\"The remote SUSE host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"qemu was updated to fix 29 security issues.\n\nThese security issues were fixed :\n\n - CVE-2016-4439: Avoid OOB access in 53C9X emulation\n (bsc#980711)\n\n - CVE-2016-4441: Avoid OOB access in 53C9X emulation\n (bsc#980723)\n\n - CVE-2016-4952: Avoid OOB access in Vmware PV SCSI\n emulation (bsc#981266)\n\n - CVE-2015-8817: Avoid OOB access in PCI dma I/O\n (bsc#969121)\n\n - CVE-2015-8818: Avoid OOB access in PCI dma I/O\n (bsc#969122)\n\n - CVE-2016-3710: Fixed VGA emulation based OOB access with\n potential for guest escape (bsc#978158)\n\n - CVE-2016-3712: Fixed VGa emulation based DOS and OOB\n read access exploit (bsc#978160)\n\n - CVE-2016-4037: Fixed USB ehci based DOS (bsc#976109)\n\n - CVE-2016-2538: Fixed potential OOB access in USB net\n device emulation (bsc#967969)\n\n - CVE-2016-2841: Fixed OOB access / hang in ne2000\n emulation (bsc#969350)\n\n - CVE-2016-2858: Avoid potential DOS when using QEMU\n pseudo random number generator (bsc#970036)\n\n - CVE-2016-2857: Fixed OOB access when processing IP\n checksums (bsc#970037)\n\n - CVE-2016-4001: Fixed OOB access in Stellaris enet\n emulated nic (bsc#975128)\n\n - CVE-2016-4002: Fixed OOB access in MIPSnet emulated\n controller (bsc#975136)\n\n - CVE-2016-4020: Fixed possible host data leakage to guest\n from TPR access (bsc#975700)\n\n - CVE-2016-2197: Prevent AHCI NULL pointer dereference\n when using FIS CLB engine (bsc#964411)\n\n - CVE-2015-5745: Buffer overflow in virtio-serial\n (bsc#940929).\n\n - CVE-2015-7549: PCI NULL pointer dereferences\n (bsc#958917).\n\n - CVE-2015-8504: VNC floating point exception\n (bsc#958491).\n\n - CVE-2015-8558: Infinite loop in ehci_advance_state\n resulting in DoS (bsc#959005).\n\n - CVE-2015-8567: A guest repeatedly activating a vmxnet3\n device can leak host memory (bsc#959386).\n\n - CVE-2015-8568: A guest repeatedly activating a vmxnet3\n device can leak host memory (bsc#959386).\n\n - CVE-2015-8613: Wrong sized memset in megasas command\n handler (bsc#961358).\n\n - CVE-2015-8619: Potential DoS for long HMP sendkey\n command argument (bsc#960334).\n\n - CVE-2015-8743: OOB memory access in ne2000 ioport r/w\n functions (bsc#960725).\n\n - CVE-2015-8744: Incorrect l2 header validation could have\n lead to a crash via assert(2) call (bsc#960835).\n\n - CVE-2015-8745: Reading IMR registers could have lead to\n a crash via assert(2) call (bsc#960708).\n\n - CVE-2016-1568: AHCI use-after-free in aio port commands\n (bsc#961332).\n\n - CVE-2016-1714: Potential OOB memory access in processing\n firmware configuration (bsc#961691).\n\n - CVE-2016-1922: NULL pointer dereference when processing\n hmp i/o command (bsc#962320).\n\n - CVE-2016-1981: Potential DoS (infinite loop) in e1000\n device emulation by malicious privileged user within\n guest (bsc#963782).\n\n - CVE-2016-2198: Malicious privileged guest user were able\n to cause DoS by writing to read-only EHCI capabilities\n registers (bsc#964413).\n\nThis non-security issue was fixed\n\n - bsc#886378: qemu truncates vhd images in virt-rescue\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=886378\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=940929\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=958491\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=958917\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=959005\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=959386\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=960334\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=960708\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=960725\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=960835\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=961332\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=961333\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=961358\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=961556\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=961691\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=962320\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=963782\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=964411\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=964413\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=967969\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=969121\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=969122\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=969350\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=970036\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=970037\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=975128\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=975136\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=975700\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=976109\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=978158\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=978160\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=980711\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=980723\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=981266\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-5745/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-7549/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8504/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8558/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8567/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8568/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8613/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8619/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8743/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8744/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8745/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8817/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8818/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-1568/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-1714/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-1922/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-1981/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-2197/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-2198/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-2538/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-2841/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-2857/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-2858/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-3710/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-3712/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-4001/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-4002/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-4020/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-4037/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-4439/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-4441/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-4952/\"\n );\n # https://www.suse.com/support/update/announcement/2016/suse-su-20161703-1/\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?0f03d2ce\"\n );\n script_set_attribute(\n attribute:\"solution\",\n value:\n\"To install this SUSE Security Update use YaST online_update.\nAlternatively you can run the command listed for your product :\n\nSUSE Linux Enterprise Server 12-SP1 :\n\nzypper in -t patch SUSE-SLE-SERVER-12-SP1-2016-1007=1\n\nSUSE Linux Enterprise Desktop 12-SP1 :\n\nzypper in -t patch SUSE-SLE-DESKTOP-12-SP1-2016-1007=1\n\nTo bring your system up-to-date, use 'zypper patch'.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:qemu\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:qemu-block-curl\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:qemu-block-curl-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:qemu-block-rbd\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:qemu-block-rbd-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:qemu-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:qemu-guest-agent\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:qemu-guest-agent-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:qemu-kvm\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:qemu-lang\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:qemu-s390\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:qemu-s390-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:qemu-tools\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:qemu-tools-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:qemu-x86\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:12\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2016/04/07\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/06/28\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/08/29\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nos_ver = pregmatch(pattern: \"^(SLE(S|D)\\d+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"SUSE\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLED12|SLES12)$\", string:os_ver)) audit(AUDIT_OS_NOT, \"SUSE SLED12 / SLES12\", \"SUSE \" + os_ver);\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^i[3-6]86$\" && \"x86_64\" >!< cpu && \"s390x\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"SUSE \" + os_ver, cpu);\n\nsp = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(sp)) sp = \"0\";\nif (os_ver == \"SLES12\" && (! preg(pattern:\"^(1)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLES12 SP1\", os_ver + \" SP\" + sp);\nif (os_ver == \"SLED12\" && (! preg(pattern:\"^(1)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLED12 SP1\", os_ver + \" SP\" + sp);\n\n\nflag = 0;\nif (rpm_check(release:\"SLES12\", sp:\"1\", cpu:\"x86_64\", reference:\"qemu-block-rbd-2.3.1-14.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", cpu:\"x86_64\", reference:\"qemu-block-rbd-debuginfo-2.3.1-14.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", cpu:\"x86_64\", reference:\"qemu-x86-2.3.1-14.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", cpu:\"s390x\", reference:\"qemu-s390-2.3.1-14.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", cpu:\"s390x\", reference:\"qemu-s390-debuginfo-2.3.1-14.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", reference:\"qemu-2.3.1-14.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", reference:\"qemu-block-curl-2.3.1-14.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", reference:\"qemu-block-curl-debuginfo-2.3.1-14.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", reference:\"qemu-debugsource-2.3.1-14.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", reference:\"qemu-guest-agent-2.3.1-14.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", reference:\"qemu-guest-agent-debuginfo-2.3.1-14.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", reference:\"qemu-lang-2.3.1-14.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", reference:\"qemu-tools-2.3.1-14.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", reference:\"qemu-tools-debuginfo-2.3.1-14.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", reference:\"qemu-kvm-2.3.1-14.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"1\", cpu:\"x86_64\", reference:\"qemu-2.3.1-14.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"1\", cpu:\"x86_64\", reference:\"qemu-block-curl-2.3.1-14.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"1\", cpu:\"x86_64\", reference:\"qemu-block-curl-debuginfo-2.3.1-14.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"1\", cpu:\"x86_64\", reference:\"qemu-debugsource-2.3.1-14.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"1\", cpu:\"x86_64\", reference:\"qemu-kvm-2.3.1-14.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"1\", cpu:\"x86_64\", reference:\"qemu-tools-2.3.1-14.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"1\", cpu:\"x86_64\", reference:\"qemu-tools-debuginfo-2.3.1-14.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"1\", cpu:\"x86_64\", reference:\"qemu-x86-2.3.1-14.1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"qemu\");\n}\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-06-05T11:13:03", "description": "qemu was updated to fix 29 security issues.\n\nThese security issues were fixed :\n\n - CVE-2016-4439: Avoid OOB access in 53C9X emulation\n (bsc#980711)\n\n - CVE-2016-4441: Avoid OOB access in 53C9X emulation\n (bsc#980723)\n\n - CVE-2016-4952: Avoid OOB access in Vmware PV SCSI\n emulation (bsc#981266)\n\n - CVE-2015-8817: Avoid OOB access in PCI dma I/O\n (bsc#969121)\n\n - CVE-2015-8818: Avoid OOB access in PCI dma I/O\n (bsc#969122)\n\n - CVE-2016-3710: Fixed VGA emulation based OOB access with\n potential for guest escape (bsc#978158)\n\n - CVE-2016-3712: Fixed VGa emulation based DOS and OOB\n read access exploit (bsc#978160)\n\n - CVE-2016-4037: Fixed USB ehci based DOS (bsc#976109)\n\n - CVE-2016-2538: Fixed potential OOB access in USB net\n device emulation (bsc#967969)\n\n - CVE-2016-2841: Fixed OOB access / hang in ne2000\n emulation (bsc#969350)\n\n - CVE-2016-2858: Avoid potential DOS when using QEMU\n pseudo random number generator (bsc#970036)\n\n - CVE-2016-2857: Fixed OOB access when processing IP\n checksums (bsc#970037)\n\n - CVE-2016-4001: Fixed OOB access in Stellaris enet\n emulated nic (bsc#975128)\n\n - CVE-2016-4002: Fixed OOB access in MIPSnet emulated\n controller (bsc#975136)\n\n - CVE-2016-4020: Fixed possible host data leakage to guest\n from TPR access (bsc#975700)\n\n - CVE-2016-2197: Prevent AHCI NULL pointer dereference\n when using FIS CLB engine (bsc#964411)\n\n - CVE-2015-5745: Buffer overflow in virtio-serial\n (bsc#940929).\n\n - CVE-2015-7549: PCI NULL pointer dereferences\n (bsc#958917).\n\n - CVE-2015-8504: VNC floating point exception\n (bsc#958491).\n\n - CVE-2015-8558: Infinite loop in ehci_advance_state\n resulting in DoS (bsc#959005).\n\n - CVE-2015-8567: A guest repeatedly activating a vmxnet3\n device can leak host memory (bsc#959386).\n\n - CVE-2015-8568: A guest repeatedly activating a vmxnet3\n device can leak host memory (bsc#959386).\n\n - CVE-2015-8613: Wrong sized memset in megasas command\n handler (bsc#961358).\n\n - CVE-2015-8619: Potential DoS for long HMP sendkey\n command argument (bsc#960334).\n\n - CVE-2015-8743: OOB memory access in ne2000 ioport r/w\n functions (bsc#960725).\n\n - CVE-2015-8744: Incorrect l2 header validation could have\n lead to a crash via assert(2) call (bsc#960835).\n\n - CVE-2015-8745: Reading IMR registers could have lead to\n a crash via assert(2) call (bsc#960708).\n\n - CVE-2016-1568: AHCI use-after-free in aio port commands\n (bsc#961332).\n\n - CVE-2016-1714: Potential OOB memory access in processing\n firmware configuration (bsc#961691).\n\n - CVE-2016-1922: NULL pointer dereference when processing\n hmp i/o command (bsc#962320).\n\n - CVE-2016-1981: Potential DoS (infinite loop) in e1000\n device emulation by malicious privileged user within\n guest (bsc#963782).\n\n - CVE-2016-2198: Malicious privileged guest user were able\n to cause DoS by writing to read-only EHCI capabilities\n registers (bsc#964413).\n\nThis non-security issue was fixed\n\n - bsc#886378: qemu truncates vhd images in virt-rescue\n\nThis update was imported from the SUSE:SLE-12-SP1:Update update\nproject.", "edition": 17, "cvss3": {"score": 9.0, "vector": "AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H"}, "published": "2016-07-08T00:00:00", "title": "openSUSE Security Update : qemu (openSUSE-2016-839)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2015-8567", "CVE-2016-2858", "CVE-2015-8619", "CVE-2015-8558", "CVE-2015-8613", "CVE-2016-1922", "CVE-2016-4441", "CVE-2016-3712", "CVE-2015-8817", "CVE-2016-4952", "CVE-2016-3710", "CVE-2015-5745", "CVE-2015-8568", "CVE-2016-2198", "CVE-2016-2197", "CVE-2016-4002", "CVE-2015-8744", "CVE-2016-4020", "CVE-2015-7549", "CVE-2016-2841", "CVE-2015-8743", "CVE-2016-4001", "CVE-2015-8818", "CVE-2016-1568", "CVE-2016-4037", "CVE-2015-8745", "CVE-2016-1714", "CVE-2016-2857", "CVE-2016-1981", "CVE-2015-8504", "CVE-2016-4439", "CVE-2016-2538"], "modified": "2016-07-08T00:00:00", "cpe": ["p-cpe:/a:novell:opensuse:qemu-ppc-debuginfo", "p-cpe:/a:novell:opensuse:qemu-s390-debuginfo", "p-cpe:/a:novell:opensuse:qemu-vgabios", "p-cpe:/a:novell:opensuse:qemu-block-curl-debuginfo", "p-cpe:/a:novell:opensuse:qemu", "p-cpe:/a:novell:opensuse:qemu-sgabios", "p-cpe:/a:novell:opensuse:qemu-tools-debuginfo", "p-cpe:/a:novell:opensuse:qemu-seabios", "p-cpe:/a:novell:opensuse:qemu-s390", "p-cpe:/a:novell:opensuse:qemu-ppc", "cpe:/o:novell:opensuse:42.1", "p-cpe:/a:novell:opensuse:qemu-linux-user-debugsource", "p-cpe:/a:novell:opensuse:qemu-arm", "p-cpe:/a:novell:opensuse:qemu-testsuite", "p-cpe:/a:novell:opensuse:qemu-kvm", "p-cpe:/a:novell:opensuse:qemu-linux-user", "p-cpe:/a:novell:opensuse:qemu-ipxe", "p-cpe:/a:novell:opensuse:qemu-block-curl", "p-cpe:/a:novell:opensuse:qemu-extra-debuginfo", "p-cpe:/a:novell:opensuse:qemu-x86-debuginfo", "p-cpe:/a:novell:opensuse:qemu-tools", "p-cpe:/a:novell:opensuse:qemu-guest-agent", "p-cpe:/a:novell:opensuse:qemu-x86", "p-cpe:/a:novell:opensuse:qemu-extra", "p-cpe:/a:novell:opensuse:qemu-linux-user-debuginfo", "p-cpe:/a:novell:opensuse:qemu-debugsource", "p-cpe:/a:novell:opensuse:qemu-arm-debuginfo", "p-cpe:/a:novell:opensuse:qemu-guest-agent-debuginfo", "p-cpe:/a:novell:opensuse:qemu-block-rbd", "p-cpe:/a:novell:opensuse:qemu-lang", "p-cpe:/a:novell:opensuse:qemu-block-rbd-debuginfo"], "id": "OPENSUSE-2016-839.NASL", "href": "https://www.tenable.com/plugins/nessus/91980", "sourceData": "#%NASL_MIN_LEVEL 80502\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update openSUSE-2016-839.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(91980);\n script_version(\"2.3\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2020/06/04\");\n\n script_cve_id(\"CVE-2015-5745\", \"CVE-2015-7549\", \"CVE-2015-8504\", \"CVE-2015-8558\", \"CVE-2015-8567\", \"CVE-2015-8568\", \"CVE-2015-8613\", \"CVE-2015-8619\", \"CVE-2015-8743\", \"CVE-2015-8744\", \"CVE-2015-8745\", \"CVE-2015-8817\", \"CVE-2015-8818\", \"CVE-2016-1568\", \"CVE-2016-1714\", \"CVE-2016-1922\", \"CVE-2016-1981\", \"CVE-2016-2197\", \"CVE-2016-2198\", \"CVE-2016-2538\", \"CVE-2016-2841\", \"CVE-2016-2857\", \"CVE-2016-2858\", \"CVE-2016-3710\", \"CVE-2016-3712\", \"CVE-2016-4001\", \"CVE-2016-4002\", \"CVE-2016-4020\", \"CVE-2016-4037\", \"CVE-2016-4439\", \"CVE-2016-4441\", \"CVE-2016-4952\");\n\n script_name(english:\"openSUSE Security Update : qemu (openSUSE-2016-839)\");\n script_summary(english:\"Check for the openSUSE-2016-839 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"qemu was updated to fix 29 security issues.\n\nThese security issues were fixed :\n\n - CVE-2016-4439: Avoid OOB access in 53C9X emulation\n (bsc#980711)\n\n - CVE-2016-4441: Avoid OOB access in 53C9X emulation\n (bsc#980723)\n\n - CVE-2016-4952: Avoid OOB access in Vmware PV SCSI\n emulation (bsc#981266)\n\n - CVE-2015-8817: Avoid OOB access in PCI dma I/O\n (bsc#969121)\n\n - CVE-2015-8818: Avoid OOB access in PCI dma I/O\n (bsc#969122)\n\n - CVE-2016-3710: Fixed VGA emulation based OOB access with\n potential for guest escape (bsc#978158)\n\n - CVE-2016-3712: Fixed VGa emulation based DOS and OOB\n read access exploit (bsc#978160)\n\n - CVE-2016-4037: Fixed USB ehci based DOS (bsc#976109)\n\n - CVE-2016-2538: Fixed potential OOB access in USB net\n device emulation (bsc#967969)\n\n - CVE-2016-2841: Fixed OOB access / hang in ne2000\n emulation (bsc#969350)\n\n - CVE-2016-2858: Avoid potential DOS when using QEMU\n pseudo random number generator (bsc#970036)\n\n - CVE-2016-2857: Fixed OOB access when processing IP\n checksums (bsc#970037)\n\n - CVE-2016-4001: Fixed OOB access in Stellaris enet\n emulated nic (bsc#975128)\n\n - CVE-2016-4002: Fixed OOB access in MIPSnet emulated\n controller (bsc#975136)\n\n - CVE-2016-4020: Fixed possible host data leakage to guest\n from TPR access (bsc#975700)\n\n - CVE-2016-2197: Prevent AHCI NULL pointer dereference\n when using FIS CLB engine (bsc#964411)\n\n - CVE-2015-5745: Buffer overflow in virtio-serial\n (bsc#940929).\n\n - CVE-2015-7549: PCI NULL pointer dereferences\n (bsc#958917).\n\n - CVE-2015-8504: VNC floating point exception\n (bsc#958491).\n\n - CVE-2015-8558: Infinite loop in ehci_advance_state\n resulting in DoS (bsc#959005).\n\n - CVE-2015-8567: A guest repeatedly activating a vmxnet3\n device can leak host memory (bsc#959386).\n\n - CVE-2015-8568: A guest repeatedly activating a vmxnet3\n device can leak host memory (bsc#959386).\n\n - CVE-2015-8613: Wrong sized memset in megasas command\n handler (bsc#961358).\n\n - CVE-2015-8619: Potential DoS for long HMP sendkey\n command argument (bsc#960334).\n\n - CVE-2015-8743: OOB memory access in ne2000 ioport r/w\n functions (bsc#960725).\n\n - CVE-2015-8744: Incorrect l2 header validation could have\n lead to a crash via assert(2) call (bsc#960835).\n\n - CVE-2015-8745: Reading IMR registers could have lead to\n a crash via assert(2) call (bsc#960708).\n\n - CVE-2016-1568: AHCI use-after-free in aio port commands\n (bsc#961332).\n\n - CVE-2016-1714: Potential OOB memory access in processing\n firmware configuration (bsc#961691).\n\n - CVE-2016-1922: NULL pointer dereference when processing\n hmp i/o command (bsc#962320).\n\n - CVE-2016-1981: Potential DoS (infinite loop) in e1000\n device emulation by malicious privileged user within\n guest (bsc#963782).\n\n - CVE-2016-2198: Malicious privileged guest user were able\n to cause DoS by writing to read-only EHCI capabilities\n registers (bsc#964413).\n\nThis non-security issue was fixed\n\n - bsc#886378: qemu truncates vhd images in virt-rescue\n\nThis update was imported from the SUSE:SLE-12-SP1:Update update\nproject.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=886378\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=940929\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=958491\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=958917\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=959005\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=959386\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=960334\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=960708\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=960725\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=960835\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=961332\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=961333\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=961358\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=961556\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=961691\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=962320\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=963782\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=964411\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=964413\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=967969\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=969121\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=969122\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=969350\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=970036\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=970037\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=975128\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=975136\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=975700\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=976109\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=978158\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=978160\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=980711\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=980723\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=981266\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected qemu packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:qemu\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:qemu-arm\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:qemu-arm-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:qemu-block-curl\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:qemu-block-curl-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:qemu-block-rbd\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:qemu-block-rbd-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:qemu-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:qemu-extra\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:qemu-extra-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:qemu-guest-agent\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:qemu-guest-agent-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:qemu-ipxe\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:qemu-kvm\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:qemu-lang\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:qemu-linux-user\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:qemu-linux-user-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:qemu-linux-user-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:qemu-ppc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:qemu-ppc-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:qemu-s390\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:qemu-s390-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:qemu-seabios\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:qemu-sgabios\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:qemu-testsuite\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:qemu-tools\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:qemu-tools-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:qemu-vgabios\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:qemu-x86\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:qemu-x86-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:42.1\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/07/06\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/07/08\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2020 Tenable Network Security, Inc.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE42\\.1)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"42.1\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(i586|i686|x86_64)$\") audit(AUDIT_ARCH_NOT, \"i586 / i686 / x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE42.1\", reference:\"qemu-2.3.1-15.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"qemu-arm-2.3.1-15.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"qemu-arm-debuginfo-2.3.1-15.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"qemu-block-curl-2.3.1-15.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"qemu-block-curl-debuginfo-2.3.1-15.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"qemu-debugsource-2.3.1-15.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"qemu-extra-2.3.1-15.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"qemu-extra-debuginfo-2.3.1-15.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"qemu-guest-agent-2.3.1-15.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"qemu-guest-agent-debuginfo-2.3.1-15.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"qemu-ipxe-1.0.0-15.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"qemu-kvm-2.3.1-15.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"qemu-lang-2.3.1-15.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"qemu-linux-user-2.3.1-15.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"qemu-linux-user-debuginfo-2.3.1-15.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"qemu-linux-user-debugsource-2.3.1-15.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"qemu-ppc-2.3.1-15.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"qemu-ppc-debuginfo-2.3.1-15.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"qemu-s390-2.3.1-15.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"qemu-s390-debuginfo-2.3.1-15.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"qemu-seabios-1.8.1-15.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"qemu-sgabios-8-15.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"qemu-tools-2.3.1-15.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"qemu-tools-debuginfo-2.3.1-15.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"qemu-vgabios-1.8.1-15.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"qemu-x86-2.3.1-15.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"qemu-x86-debuginfo-2.3.1-15.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"qemu-block-rbd-2.3.1-15.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"qemu-block-rbd-debuginfo-2.3.1-15.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"qemu-testsuite-2.3.1-15.2\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"qemu-linux-user / qemu-linux-user-debuginfo / etc\");\n}\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-09-23T18:15:53", "description": "kvm was updated to fix 33 security issues.\n\nThese security issues were fixed :\n\n - CVE-2016-4439: Avoid OOB access in 53C9X emulation\n (bsc#980711)\n\n - CVE-2016-4441: Avoid OOB access in 53C9X emulation\n (bsc#980723)\n\n - CVE-2016-3710: Fixed VGA emulation based OOB access with\n potential for guest escape (bsc#978158)\n\n - CVE-2016-3712: Fixed VGa emulation based DOS and OOB\n read access exploit (bsc#978160)\n\n - CVE-2016-4037: Fixed USB ehci based DOS (bsc#976109)\n\n - CVE-2016-2538: Fixed potential OOB access in USB net\n device emulation (bsc#967969)\n\n - CVE-2016-2841: Fixed OOB access / hang in ne2000\n emulation (bsc#969350)\n\n - CVE-2016-2858: Avoid potential DOS when using QEMU\n pseudo random number generator (bsc#970036)\n\n - CVE-2016-2857: Fixed OOB access when processing IP\n checksums (bsc#970037)\n\n - CVE-2016-4001: Fixed OOB access in Stellaris enet\n emulated nic (bsc#975128)\n\n - CVE-2016-4002: Fixed OOB access in MIPSnet emulated\n controller (bsc#975136)\n\n - CVE-2016-4020: Fixed possible host data leakage to guest\n from TPR access (bsc#975700)\n\n - CVE-2015-3214: Fixed OOB read in i8254 PIC (bsc#934069)\n\n - CVE-2014-9718: Fixed the handling of malformed or short\n ide PRDTs to avoid any opportunity for guest to cause\n DoS by abusing that interface (bsc#928393)\n\n - CVE-2014-3689: Fixed insufficient parameter validation\n in rectangle functions (bsc#901508)\n\n - CVE-2014-3615: The VGA emulator in QEMU allowed local\n guest users to read host memory by setting the display\n to a high resolution (bsc#895528).\n\n - CVE-2015-5239: Integer overflow in vnc_client_read() and\n protocol_client_msg() (bsc#944463).\n\n - CVE-2015-5278: Infinite loop in ne2000_receive()\n function (bsc#945989).\n\n - CVE-2015-5279: Heap-based buffer overflow in the\n ne2000_receive function in hw/net/ne2000.c in QEMU\n allowed guest OS users to cause a denial of service\n (instance crash) or possibly execute arbitrary code via\n vectors related to receiving packets (bsc#945987).\n\n - CVE-2015-5745: Buffer overflow in virtio-serial\n (bsc#940929).\n\n - CVE-2015-6855: hw/ide/core.c in QEMU did not properly\n restrict the commands accepted by an ATAPI device, which\n allowed guest users to cause a denial of service or\n possibly have unspecified other impact via certain IDE\n commands, as demonstrated by a WIN_READ_NATIVE_MAX\n command to an empty drive, which triggers a\n divide-by-zero error and instance crash (bsc#945404).\n\n - CVE-2015-7295: hw/virtio/virtio.c in the Virtual Network\n Device (virtio-net) support in QEMU, when big or\n mergeable receive buffers are not supported, allowed\n remote attackers to cause a denial of service (guest\n network consumption) via a flood of jumbo frames on the\n (1) tuntap or (2) macvtap interface (bsc#947159).\n\n - CVE-2015-7549: PCI NULL pointer dereferences\n (bsc#958917).\n\n - CVE-2015-8504: VNC floating point exception\n (bsc#958491).\n\n - CVE-2015-8558: Infinite loop in ehci_advance_state\n resulting in DoS (bsc#959005).\n\n - CVE-2015-8613: Wrong sized memset in megasas command\n handler (bsc#961358).\n\n - CVE-2015-8619: Potential DoS for long HMP sendkey\n command argument (bsc#960334).\n\n - CVE-2015-8743: OOB memory access in ne2000 ioport r/w\n functions (bsc#960725).\n\n - CVE-2016-1568: AHCI use-after-free in aio port commands\n (bsc#961332).\n\n - CVE-2016-1714: Potential OOB memory access in processing\n firmware configuration (bsc#961691).\n\n - CVE-2016-1922: NULL pointer dereference when processing\n hmp i/o command (bsc#962320).\n\n - CVE-2016-1981: Potential DoS (infinite loop) in e1000\n device emulation by malicious privileged user within\n guest (bsc#963782).\n\n - CVE-2016-2198: Malicious privileged guest user were able\n to cause DoS by writing to read-only EHCI capabilities\n registers (bsc#964413).\n\nThe update package also includes non-security fixes. See advisory for\ndetails.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 26, "cvss3": {"score": 9.0, "vector": "AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H"}, "published": "2016-08-29T00:00:00", "title": "SUSE SLES11 Security Update : kvm (SUSE-SU-2016:1698-1)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2015-3214", "CVE-2016-2858", "CVE-2014-3689", "CVE-2014-9718", "CVE-2015-8619", "CVE-2015-8558", "CVE-2015-6855", "CVE-2015-8613", "CVE-2016-1922", "CVE-2016-4441", "CVE-2016-3712", "CVE-2015-5279", "CVE-2016-3710", "CVE-2015-5745", "CVE-2016-2198", "CVE-2016-4002", "CVE-2016-4020", "CVE-2015-7549", "CVE-2016-2841", "CVE-2015-8743", "CVE-2016-4001", "CVE-2016-1568", "CVE-2016-4037", "CVE-2016-1714", "CVE-2016-2857", "CVE-2016-1981", "CVE-2015-8504", "CVE-2016-4439", "CVE-2015-5239", "CVE-2016-2538", "CVE-2014-3615", "CVE-2015-7295", "CVE-2015-5278"], "modified": "2016-08-29T00:00:00", "cpe": ["p-cpe:/a:novell:suse_linux:kvm", "cpe:/o:novell:suse_linux:11"], "id": "SUSE_SU-2016-1698-1.NASL", "href": "https://www.tenable.com/plugins/nessus/93169", "sourceData": "#%NASL_MIN_LEVEL 80502\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from SUSE update advisory SUSE-SU-2016:1698-1.\n# The text itself is copyright (C) SUSE.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(93169);\n script_version(\"2.10\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2020/09/22\");\n\n script_cve_id(\"CVE-2014-3615\", \"CVE-2014-3689\", \"CVE-2014-9718\", \"CVE-2015-3214\", \"CVE-2015-5239\", \"CVE-2015-5278\", \"CVE-2015-5279\", \"CVE-2015-5745\", \"CVE-2015-6855\", \"CVE-2015-7295\", \"CVE-2015-7549\", \"CVE-2015-8504\", \"CVE-2015-8558\", \"CVE-2015-8613\", \"CVE-2015-8619\", \"CVE-2015-8743\", \"CVE-2016-1568\", \"CVE-2016-1714\", \"CVE-2016-1922\", \"CVE-2016-1981\", \"CVE-2016-2198\", \"CVE-2016-2538\", \"CVE-2016-2841\", \"CVE-2016-2857\", \"CVE-2016-2858\", \"CVE-2016-3710\", \"CVE-2016-3712\", \"CVE-2016-4001\", \"CVE-2016-4002\", \"CVE-2016-4020\", \"CVE-2016-4037\", \"CVE-2016-4439\", \"CVE-2016-4441\");\n script_bugtraq_id(69654, 70997, 73316, 75273);\n\n script_name(english:\"SUSE SLES11 Security Update : kvm (SUSE-SU-2016:1698-1)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\"The remote SUSE host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"kvm was updated to fix 33 security issues.\n\nThese security issues were fixed :\n\n - CVE-2016-4439: Avoid OOB access in 53C9X emulation\n (bsc#980711)\n\n - CVE-2016-4441: Avoid OOB access in 53C9X emulation\n (bsc#980723)\n\n - CVE-2016-3710: Fixed VGA emulation based OOB access with\n potential for guest escape (bsc#978158)\n\n - CVE-2016-3712: Fixed VGa emulation based DOS and OOB\n read access exploit (bsc#978160)\n\n - CVE-2016-4037: Fixed USB ehci based DOS (bsc#976109)\n\n - CVE-2016-2538: Fixed potential OOB access in USB net\n device emulation (bsc#967969)\n\n - CVE-2016-2841: Fixed OOB access / hang in ne2000\n emulation (bsc#969350)\n\n - CVE-2016-2858: Avoid potential DOS when using QEMU\n pseudo random number generator (bsc#970036)\n\n - CVE-2016-2857: Fixed OOB access when processing IP\n checksums (bsc#970037)\n\n - CVE-2016-4001: Fixed OOB access in Stellaris enet\n emulated nic (bsc#975128)\n\n - CVE-2016-4002: Fixed OOB access in MIPSnet emulated\n controller (bsc#975136)\n\n - CVE-2016-4020: Fixed possible host data leakage to guest\n from TPR access (bsc#975700)\n\n - CVE-2015-3214: Fixed OOB read in i8254 PIC (bsc#934069)\n\n - CVE-2014-9718: Fixed the handling of malformed or short\n ide PRDTs to avoid any opportunity for guest to cause\n DoS by abusing that interface (bsc#928393)\n\n - CVE-2014-3689: Fixed insufficient parameter validation\n in rectangle functions (bsc#901508)\n\n - CVE-2014-3615: The VGA emulator in QEMU allowed local\n guest users to read host memory by setting the display\n to a high resolution (bsc#895528).\n\n - CVE-2015-5239: Integer overflow in vnc_client_read() and\n protocol_client_msg() (bsc#944463).\n\n - CVE-2015-5278: Infinite loop in ne2000_receive()\n function (bsc#945989).\n\n - CVE-2015-5279: Heap-based buffer overflow in the\n ne2000_receive function in hw/net/ne2000.c in QEMU\n allowed guest OS users to cause a denial of service\n (instance crash) or possibly execute arbitrary code via\n vectors related to receiving packets (bsc#945987).\n\n - CVE-2015-5745: Buffer overflow in virtio-serial\n (bsc#940929).\n\n - CVE-2015-6855: hw/ide/core.c in QEMU did not properly\n restrict the commands accepted by an ATAPI device, which\n allowed guest users to cause a denial of service or\n possibly have unspecified other impact via certain IDE\n commands, as demonstrated by a WIN_READ_NATIVE_MAX\n command to an empty drive, which triggers a\n divide-by-zero error and instance crash (bsc#945404).\n\n - CVE-2015-7295: hw/virtio/virtio.c in the Virtual Network\n Device (virtio-net) support in QEMU, when big or\n mergeable receive buffers are not supported, allowed\n remote attackers to cause a denial of service (guest\n network consumption) via a flood of jumbo frames on the\n (1) tuntap or (2) macvtap interface (bsc#947159).\n\n - CVE-2015-7549: PCI NULL pointer dereferences\n (bsc#958917).\n\n - CVE-2015-8504: VNC floating point exception\n (bsc#958491).\n\n - CVE-2015-8558: Infinite loop in ehci_advance_state\n resulting in DoS (bsc#959005).\n\n - CVE-2015-8613: Wrong sized memset in megasas command\n handler (bsc#961358).\n\n - CVE-2015-8619: Potential DoS for long HMP sendkey\n command argument (bsc#960334).\n\n - CVE-2015-8743: OOB memory access in ne2000 ioport r/w\n functions (bsc#960725).\n\n - CVE-2016-1568: AHCI use-after-free in aio port commands\n (bsc#961332).\n\n - CVE-2016-1714: Potential OOB memory access in processing\n firmware configuration (bsc#961691).\n\n - CVE-2016-1922: NULL pointer dereference when processing\n hmp i/o command (bsc#962320).\n\n - CVE-2016-1981: Potential DoS (infinite loop) in e1000\n device emulation by malicious privileged user within\n guest (bsc#963782).\n\n - CVE-2016-2198: Malicious privileged guest user were able\n to cause DoS by writing to read-only EHCI capabilities\n registers (bsc#964413).\n\nThe update package also includes non-security fixes. See advisory for\ndetails.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=895528\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=901508\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=928393\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=934069\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=936132\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=940929\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=944463\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=945404\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=945987\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=945989\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=947159\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=958491\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=958917\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=959005\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=960334\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=960725\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=961332\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=961333\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=961358\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=961556\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=961691\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=962320\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=963782\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=964413\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=967969\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=969350\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=970036\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=970037\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=975128\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=975136\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=975700\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=976109\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=978158\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=978160\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=980711\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=980723\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2014-3615/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2014-3689/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2014-9718/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-3214/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-5239/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-5278/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-5279/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-5745/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-6855/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-7295/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-7549/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8504/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8558/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8613/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8619/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8743/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-1568/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-1714/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-1922/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-1981/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-2198/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-2538/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-2841/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-2857/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-2858/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-3710/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-3712/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-4001/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-4002/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-4020/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-4037/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-4439/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-4441/\"\n );\n # https://www.suse.com/support/update/announcement/2016/suse-su-20161698-1/\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?4851fc1e\"\n );\n script_set_attribute(\n attribute:\"solution\",\n value:\n\"To install this SUSE Security Update use YaST online_update.\nAlternatively you can run the command listed for your product :\n\nSUSE Linux Enterprise Server 11-SP3-LTSS :\n\nzypper in -t patch slessp3-kvm-12634=1\n\nTo bring your system up-to-date, use 'zypper patch'.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kvm\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:11\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2014/11/01\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/06/28\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/08/29\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nos_ver = pregmatch(pattern: \"^(SLE(S|D)\\d+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"SUSE\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLES11)$\", string:os_ver)) audit(AUDIT_OS_NOT, \"SUSE SLES11\", \"SUSE \" + os_ver);\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^i[3-6]86$\" && \"x86_64\" >!< cpu && \"s390x\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"SUSE \" + os_ver, cpu);\n\nsp = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(sp)) sp = \"0\";\nif (os_ver == \"SLES11\" && (! preg(pattern:\"^(3)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLES11 SP3\", os_ver + \" SP\" + sp);\n\n\nflag = 0;\nif (rpm_check(release:\"SLES11\", sp:\"3\", reference:\"kvm-1.4.2-46.1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"kvm\");\n}\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-09-23T18:15:54", "description": "kvm was updated to fix 33 security issues.\n\nThese security issues were fixed :\n\n - CVE-2016-4439: Avoid OOB access in 53C9X emulation\n (bsc#980711)\n\n - CVE-2016-4441: Avoid OOB access in 53C9X emulation\n (bsc#980723)\n\n - CVE-2016-3710: Fixed VGA emulation based OOB access with\n potential for guest escape (bsc#978158)\n\n - CVE-2016-3712: Fixed VGa emulation based DOS and OOB\n read access exploit (bsc#978160)\n\n - CVE-2016-4037: Fixed USB ehci based DOS (bsc#976109)\n\n - CVE-2016-2538: Fixed potential OOB access in USB net\n device emulation (bsc#967969)\n\n - CVE-2016-2841: Fixed OOB access / hang in ne2000\n emulation (bsc#969350)\n\n - CVE-2016-2858: Avoid potential DOS when using QEMU\n pseudo random number generator (bsc#970036)\n\n - CVE-2016-2857: Fixed OOB access when processing IP\n checksums (bsc#970037)\n\n - CVE-2016-4001: Fixed OOB access in Stellaris enet\n emulated nic (bsc#975128)\n\n - CVE-2016-4002: Fixed OOB access in MIPSnet emulated\n controller (bsc#975136)\n\n - CVE-2016-4020: Fixed possible host data leakage to guest\n from TPR access (bsc#975700)\n\n - CVE-2015-3214: Fixed OOB read in i8254 PIC (bsc#934069)\n\n - CVE-2014-9718: Fixed the handling of malformed or short\n ide PRDTs to avoid any opportunity for guest to cause\n DoS by abusing that interface (bsc#928393)\n\n - CVE-2014-3689: Fixed insufficient parameter validation\n in rectangle functions (bsc#901508)\n\n - CVE-2014-3615: The VGA emulator in QEMU allowed local\n guest users to read host memory by setting the display\n to a high resolution (bsc#895528).\n\n - CVE-2015-5239: Integer overflow in vnc_client_read() and\n protocol_client_msg() (bsc#944463).\n\n - CVE-2015-5278: Infinite loop in ne2000_receive()\n function (bsc#945989).\n\n - CVE-2015-5279: Heap-based buffer overflow in the\n ne2000_receive function in hw/net/ne2000.c in QEMU\n allowed guest OS users to cause a denial of service\n (instance crash) or possibly execute arbitrary code via\n vectors related to receiving packets (bsc#945987).\n\n - CVE-2015-5745: Buffer overflow in virtio-serial\n (bsc#940929).\n\n - CVE-2015-6855: hw/ide/core.c in QEMU did not properly\n restrict the commands accepted by an ATAPI device, which\n allowed guest users to cause a denial of service or\n possibly have unspecified other impact via certain IDE\n commands, as demonstrated by a WIN_READ_NATIVE_MAX\n command to an empty drive, which triggers a\n divide-by-zero error and instance crash (bsc#945404).\n\n - CVE-2015-7295: hw/virtio/virtio.c in the Virtual Network\n Device (virtio-net) support in QEMU, when big or\n mergeable receive buffers are not supported, allowed\n remote attackers to cause a denial of service (guest\n network consumption) via a flood of jumbo frames on the\n (1) tuntap or (2) macvtap interface (bsc#947159).\n\n - CVE-2015-7549: PCI NULL pointer dereferences\n (bsc#958917).\n\n - CVE-2015-8504: VNC floating point exception\n (bsc#958491).\n\n - CVE-2015-8558: Infinite loop in ehci_advance_state\n resulting in DoS (bsc#959005).\n\n - CVE-2015-8613: Wrong sized memset in megasas command\n handler (bsc#961358).\n\n - CVE-2015-8619: Potential DoS for long HMP sendkey\n command argument (bsc#960334).\n\n - CVE-2015-8743: OOB memory access in ne2000 ioport r/w\n functions (bsc#960725).\n\n - CVE-2016-1568: AHCI use-after-free in aio port commands\n (bsc#961332).\n\n - CVE-2016-1714: Potential OOB memory access in processing\n firmware configuration (bsc#961691).\n\n - CVE-2016-1922: NULL pointer dereference when processing\n hmp i/o command (bsc#962320).\n\n - CVE-2016-1981: Potential DoS (infinite loop) in e1000\n device emulation by malicious privileged user within\n guest (bsc#963782).\n\n - CVE-2016-2198: Malicious privileged guest user were able\n to cause DoS by writing to read-only EHCI capabilities\n registers (bsc#964413).\n\nThe update package also includes non-security fixes. See advisory for\ndetails.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 26, "cvss3": {"score": 9.0, "vector": "AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H"}, "published": "2016-08-29T00:00:00", "title": "SUSE SLES11 Security Update : kvm (SUSE-SU-2016:1785-1)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2015-3214", "CVE-2016-2858", "CVE-2014-3689", "CVE-2014-9718", "CVE-2015-8619", "CVE-2015-8558", "CVE-2015-6855", "CVE-2015-8613", "CVE-2016-1922", "CVE-2016-4441", "CVE-2016-3712", "CVE-2015-5279", "CVE-2016-3710", "CVE-2015-5745", "CVE-2016-2198", "CVE-2016-4002", "CVE-2016-4020", "CVE-2015-7549", "CVE-2016-2841", "CVE-2015-8743", "CVE-2016-4001", "CVE-2016-1568", "CVE-2016-4037", "CVE-2016-1714", "CVE-2016-2857", "CVE-2016-1981", "CVE-2015-8504", "CVE-2016-4439", "CVE-2015-5239", "CVE-2016-2538", "CVE-2014-3615", "CVE-2015-7295", "CVE-2015-5278"], "modified": "2016-08-29T00:00:00", "cpe": ["p-cpe:/a:novell:suse_linux:kvm", "cpe:/o:novell:suse_linux:11"], "id": "SUSE_SU-2016-1785-1.NASL", "href": "https://www.tenable.com/plugins/nessus/93180", "sourceData": "#%NASL_MIN_LEVEL 80502\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from SUSE update advisory SUSE-SU-2016:1785-1.\n# The text itself is copyright (C) SUSE.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(93180);\n script_version(\"2.10\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2020/09/22\");\n\n script_cve_id(\"CVE-2014-3615\", \"CVE-2014-3689\", \"CVE-2014-9718\", \"CVE-2015-3214\", \"CVE-2015-5239\", \"CVE-2015-5278\", \"CVE-2015-5279\", \"CVE-2015-5745\", \"CVE-2015-6855\", \"CVE-2015-7295\", \"CVE-2015-7549\", \"CVE-2015-8504\", \"CVE-2015-8558\", \"CVE-2015-8613\", \"CVE-2015-8619\", \"CVE-2015-8743\", \"CVE-2016-1568\", \"CVE-2016-1714\", \"CVE-2016-1922\", \"CVE-2016-1981\", \"CVE-2016-2198\", \"CVE-2016-2538\", \"CVE-2016-2841\", \"CVE-2016-2857\", \"CVE-2016-2858\", \"CVE-2016-3710\", \"CVE-2016-3712\", \"CVE-2016-4001\", \"CVE-2016-4002\", \"CVE-2016-4020\", \"CVE-2016-4037\", \"CVE-2016-4439\", \"CVE-2016-4441\");\n script_bugtraq_id(69654, 70997, 73316, 75273);\n\n script_name(english:\"SUSE SLES11 Security Update : kvm (SUSE-SU-2016:1785-1)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\"The remote SUSE host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"kvm was updated to fix 33 security issues.\n\nThese security issues were fixed :\n\n - CVE-2016-4439: Avoid OOB access in 53C9X emulation\n (bsc#980711)\n\n - CVE-2016-4441: Avoid OOB access in 53C9X emulation\n (bsc#980723)\n\n - CVE-2016-3710: Fixed VGA emulation based OOB access with\n potential for guest escape (bsc#978158)\n\n - CVE-2016-3712: Fixed VGa emulation based DOS and OOB\n read access exploit (bsc#978160)\n\n - CVE-2016-4037: Fixed USB ehci based DOS (bsc#976109)\n\n - CVE-2016-2538: Fixed potential OOB access in USB net\n device emulation (bsc#967969)\n\n - CVE-2016-2841: Fixed OOB access / hang in ne2000\n emulation (bsc#969350)\n\n - CVE-2016-2858: Avoid potential DOS when using QEMU\n pseudo random number generator (bsc#970036)\n\n - CVE-2016-2857: Fixed OOB access when processing IP\n checksums (bsc#970037)\n\n - CVE-2016-4001: Fixed OOB access in Stellaris enet\n emulated nic (bsc#975128)\n\n - CVE-2016-4002: Fixed OOB access in MIPSnet emulated\n controller (bsc#975136)\n\n - CVE-2016-4020: Fixed possible host data leakage to guest\n from TPR access (bsc#975700)\n\n - CVE-2015-3214: Fixed OOB read in i8254 PIC (bsc#934069)\n\n - CVE-2014-9718: Fixed the handling of malformed or short\n ide PRDTs to avoid any opportunity for guest to cause\n DoS by abusing that interface (bsc#928393)\n\n - CVE-2014-3689: Fixed insufficient parameter validation\n in rectangle functions (bsc#901508)\n\n - CVE-2014-3615: The VGA emulator in QEMU allowed local\n guest users to read host memory by setting the display\n to a high resolution (bsc#895528).\n\n - CVE-2015-5239: Integer overflow in vnc_client_read() and\n protocol_client_msg() (bsc#944463).\n\n - CVE-2015-5278: Infinite loop in ne2000_receive()\n function (bsc#945989).\n\n - CVE-2015-5279: Heap-based buffer overflow in the\n ne2000_receive function in hw/net/ne2000.c in QEMU\n allowed guest OS users to cause a denial of service\n (instance crash) or possibly execute arbitrary code via\n vectors related to receiving packets (bsc#945987).\n\n - CVE-2015-5745: Buffer overflow in virtio-serial\n (bsc#940929).\n\n - CVE-2015-6855: hw/ide/core.c in QEMU did not properly\n restrict the commands accepted by an ATAPI device, which\n allowed guest users to cause a denial of service or\n possibly have unspecified other impact via certain IDE\n commands, as demonstrated by a WIN_READ_NATIVE_MAX\n command to an empty drive, which triggers a\n divide-by-zero error and instance crash (bsc#945404).\n\n - CVE-2015-7295: hw/virtio/virtio.c in the Virtual Network\n Device (virtio-net) support in QEMU, when big or\n mergeable receive buffers are not supported, allowed\n remote attackers to cause a denial of service (guest\n network consumption) via a flood of jumbo frames on the\n (1) tuntap or (2) macvtap interface (bsc#947159).\n\n - CVE-2015-7549: PCI NULL pointer dereferences\n (bsc#958917).\n\n - CVE-2015-8504: VNC floating point exception\n (bsc#958491).\n\n - CVE-2015-8558: Infinite loop in ehci_advance_state\n resulting in DoS (bsc#959005).\n\n - CVE-2015-8613: Wrong sized memset in megasas command\n handler (bsc#961358).\n\n - CVE-2015-8619: Potential DoS for long HMP sendkey\n command argument (bsc#960334).\n\n - CVE-2015-8743: OOB memory access in ne2000 ioport r/w\n functions (bsc#960725).\n\n - CVE-2016-1568: AHCI use-after-free in aio port commands\n (bsc#961332).\n\n - CVE-2016-1714: Potential OOB memory access in processing\n firmware configuration (bsc#961691).\n\n - CVE-2016-1922: NULL pointer dereference when processing\n hmp i/o command (bsc#962320).\n\n - CVE-2016-1981: Potential DoS (infinite loop) in e1000\n device emulation by malicious privileged user within\n guest (bsc#963782).\n\n - CVE-2016-2198: Malicious privileged guest user were able\n to cause DoS by writing to read-only EHCI capabilities\n registers (bsc#964413).\n\nThe update package also includes non-security fixes. See advisory for\ndetails.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=895528\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=901508\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=928393\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=934069\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=936132\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=940929\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=944463\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=945404\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=945987\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=945989\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=947159\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=958491\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=958917\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=959005\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=960334\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=960725\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=961332\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=961333\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=961358\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=961556\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=961691\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=962320\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=963782\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=964413\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=967969\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=969350\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=970036\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=970037\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=975128\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=975136\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=975700\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=976109\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=978158\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=978160\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=980711\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=980723\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2014-3615/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2014-3689/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2014-9718/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-3214/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-5239/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-5278/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-5279/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-5745/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-6855/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-7295/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-7549/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8504/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8558/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8613/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8619/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8743/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-1568/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-1714/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-1922/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-1981/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-2198/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-2538/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-2841/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-2857/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-2858/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-3710/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-3712/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-4001/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-4002/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-4020/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-4037/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-4439/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-4441/\"\n );\n # https://www.suse.com/support/update/announcement/2016/suse-su-20161785-1/\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?7e8d0dd2\"\n );\n script_set_attribute(\n attribute:\"solution\",\n value:\n\"To install this SUSE Security Update use YaST online_update.\nAlternatively you can run the command listed for your product :\n\nSUSE Linux Enterprise Server 11-SP4 :\n\nzypper in -t patch slessp4-kvm-12645=1\n\nTo bring your system up-to-date, use 'zypper patch'.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kvm\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:11\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2014/11/01\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/07/11\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/08/29\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nos_ver = pregmatch(pattern: \"^(SLE(S|D)\\d+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"SUSE\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLES11)$\", string:os_ver)) audit(AUDIT_OS_NOT, \"SUSE SLES11\", \"SUSE \" + os_ver);\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^i[3-6]86$\" && \"x86_64\" >!< cpu && \"s390x\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"SUSE \" + os_ver, cpu);\n\nsp = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(sp)) sp = \"0\";\nif (os_ver == \"SLES11\" && (! preg(pattern:\"^(4)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLES11 SP4\", os_ver + \" SP\" + sp);\n\n\nflag = 0;\nif (rpm_check(release:\"SLES11\", sp:\"4\", reference:\"kvm-1.4.2-44.1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"kvm\");\n}\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-09-23T18:55:36", "description": "Qinghao Tang discovered that QEMU incorrectly handled PCI MSI-X\nsupport. An attacker inside the guest could use this issue to cause\nQEMU to crash, resulting in a denial of service. This issue only\naffected Ubuntu 14.04 LTS and Ubuntu 15.10. (CVE-2015-7549)\n\nLian Yihan discovered that QEMU incorrectly handled the VNC server. A\nremote attacker could use this issue to cause QEMU to crash, resulting\nin a denial of service. (CVE-2015-8504)\n\nFelix Wilhelm discovered a race condition in the Xen paravirtualized\ndrivers which can cause double fetch vulnerabilities. An attacker in\nthe paravirtualized guest could exploit this flaw to cause a denial of\nservice (crash the host) or potentially execute arbitrary code on the\nhost. (CVE-2015-8550)\n\nQinghao Tang discovered that QEMU incorrectly handled USB EHCI\nemulation support. An attacker inside the guest could use this issue\nto cause QEMU to consume resources, resulting in a denial of service.\n(CVE-2015-8558)\n\nQinghao Tang discovered that QEMU incorrectly handled the vmxnet3\ndevice. An attacker inside the guest could use this issue to cause\nQEMU to consume resources, resulting in a denial of service. This\nissue only affected Ubuntu 14.04 LTS and Ubuntu 15.10. (CVE-2015-8567,\nCVE-2015-8568)\n\nQinghao Tang discovered that QEMU incorrectly handled SCSI MegaRAID\nSAS HBA emulation. An attacker inside the guest could use this issue\nto cause QEMU to crash, resulting in a denial of service. This issue\nonly affected Ubuntu 14.04 LTS and Ubuntu 15.10. (CVE-2015-8613)\n\nLing Liu discovered that QEMU incorrectly handled the Human Monitor\nInterface. A local attacker could use this issue to cause QEMU to\ncrash, resulting in a denial of service. This issue only affected\nUbuntu 14.04 LTS and Ubuntu 15.10. (CVE-2015-8619, CVE-2016-1922)\n\nDavid Alan Gilbert discovered that QEMU incorrectly handled the Q35\nchipset emulation when performing VM guest migrations. An attacker\ncould use this issue to cause QEMU to crash, resulting in a denial of\nservice. This issue only affected Ubuntu 14.04 LTS and Ubuntu 15.10.\n(CVE-2015-8666)\n\nLing Liu discovered that QEMU incorrectly handled the NE2000 device.\nAn attacker inside the guest could use this issue to cause QEMU to\ncrash, resulting in a denial of service. (CVE-2015-8743)\n\nIt was discovered that QEMU incorrectly handled the vmxnet3 device. An\nattacker inside the guest could use this issue to cause QEMU to crash,\nresulting in a denial of service. This issue only affected Ubuntu\n14.04 LTS and Ubuntu 15.10. (CVE-2015-8744, CVE-2015-8745)\n\nQinghao Tang discovered that QEMU incorrect handled IDE AHCI\nemulation. An attacker inside the guest could use this issue to cause\na denial of service, or possibly execute arbitrary code on the host as\nthe user running the QEMU process. In the default installation, when\nQEMU is used with libvirt, attackers would be isolated by the libvirt\nAppArmor profile. (CVE-2016-1568)\n\nDonghai Zhu discovered that QEMU incorrect handled the firmware\nconfiguration device. An attacker inside the guest could use this\nissue to cause a denial of service, or possibly execute arbitrary code\non the host as the user running the QEMU process. In the default\ninstallation, when QEMU is used with libvirt, attackers would be\nisolated by the libvirt AppArmor profile. (CVE-2016-1714)\n\nIt was discovered that QEMU incorrectly handled the e1000 device. An\nattacker inside the guest could use this issue to cause QEMU to crash,\nresulting in a denial of service. (CVE-2016-1981)\n\nZuozhi Fzz discovered that QEMU incorrectly handled IDE AHCI\nemulation. An attacker inside the guest could use this issue to cause\nQEMU to crash, resulting in a denial of service. This issue only\naffected Ubuntu 15.10. (CVE-2016-2197)\n\nZuozhi Fzz discovered that QEMU incorrectly handled USB EHCI\nemulation. An attacker inside the guest could use this issue to cause\nQEMU to crash, resulting in a denial of service. This issue only\naffected Ubuntu 14.04 LTS and Ubuntu 15.10. (CVE-2016-2198).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 27, "cvss3": {"score": 8.5, "vector": "AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H"}, "published": "2016-02-04T00:00:00", "title": "Ubuntu 12.04 LTS / 14.04 LTS / 15.10 : qemu, qemu-kvm vulnerabilities (USN-2891-1)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2015-8567", "CVE-2015-8619", "CVE-2015-8558", "CVE-2015-8613", "CVE-2016-1922", "CVE-2015-8666", "CVE-2015-8550", "CVE-2015-8568", "CVE-2016-2198", "CVE-2016-2197", "CVE-2015-8744", "CVE-2015-7549", "CVE-2015-8743", "CVE-2016-1568", "CVE-2015-8745", "CVE-2016-1714", "CVE-2016-1981", "CVE-2015-8504"], "modified": "2016-02-04T00:00:00", "cpe": ["p-cpe:/a:canonical:ubuntu_linux:qemu-system", "p-cpe:/a:canonical:ubuntu_linux:qemu-system-aarch64", "p-cpe:/a:canonical:ubuntu_linux:qemu-system-x86", "cpe:/o:canonical:ubuntu_linux:15.10", "p-cpe:/a:canonical:ubuntu_linux:qemu-system-ppc", "p-cpe:/a:canonical:ubuntu_linux:qemu-system-sparc", "p-cpe:/a:canonical:ubuntu_linux:qemu-system-arm", "p-cpe:/a:canonical:ubuntu_linux:qemu-system-mips", "p-cpe:/a:canonical:ubuntu_linux:qemu-system-misc", "p-cpe:/a:canonical:ubuntu_linux:qemu-kvm", "cpe:/o:canonical:ubuntu_linux:12.04:-:lts", "cpe:/o:canonical:ubuntu_linux:14.04"], "id": "UBUNTU_USN-2891-1.NASL", "href": "https://www.tenable.com/plugins/nessus/88576", "sourceData": "#%NASL_MIN_LEVEL 80502\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Ubuntu Security Notice USN-2891-1. The text \n# itself is copyright (C) Canonical, Inc. See \n# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered \n# trademark of Canonical, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(88576);\n script_version(\"2.14\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2020/09/22\");\n\n script_cve_id(\"CVE-2015-7549\", \"CVE-2015-8504\", \"CVE-2015-8550\", \"CVE-2015-8558\", \"CVE-2015-8567\", \"CVE-2015-8568\", \"CVE-2015-8613\", \"CVE-2015-8619\", \"CVE-2015-8666\", \"CVE-2015-8743\", \"CVE-2015-8744\", \"CVE-2015-8745\", \"CVE-2016-1568\", \"CVE-2016-1714\", \"CVE-2016-1922\", \"CVE-2016-1981\", \"CVE-2016-2197\", \"CVE-2016-2198\");\n script_xref(name:\"USN\", value:\"2891-1\");\n\n script_name(english:\"Ubuntu 12.04 LTS / 14.04 LTS / 15.10 : qemu, qemu-kvm vulnerabilities (USN-2891-1)\");\n script_summary(english:\"Checks dpkg output for updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Ubuntu host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Qinghao Tang discovered that QEMU incorrectly handled PCI MSI-X\nsupport. An attacker inside the guest could use this issue to cause\nQEMU to crash, resulting in a denial of service. This issue only\naffected Ubuntu 14.04 LTS and Ubuntu 15.10. (CVE-2015-7549)\n\nLian Yihan discovered that QEMU incorrectly handled the VNC server. A\nremote attacker could use this issue to cause QEMU to crash, resulting\nin a denial of service. (CVE-2015-8504)\n\nFelix Wilhelm discovered a race condition in the Xen paravirtualized\ndrivers which can cause double fetch vulnerabilities. An attacker in\nthe paravirtualized guest could exploit this flaw to cause a denial of\nservice (crash the host) or potentially execute arbitrary code on the\nhost. (CVE-2015-8550)\n\nQinghao Tang discovered that QEMU incorrectly handled USB EHCI\nemulation support. An attacker inside the guest could use this issue\nto cause QEMU to consume resources, resulting in a denial of service.\n(CVE-2015-8558)\n\nQinghao Tang discovered that QEMU incorrectly handled the vmxnet3\ndevice. An attacker inside the guest could use this issue to cause\nQEMU to consume resources, resulting in a denial of service. This\nissue only affected Ubuntu 14.04 LTS and Ubuntu 15.10. (CVE-2015-8567,\nCVE-2015-8568)\n\nQinghao Tang discovered that QEMU incorrectly handled SCSI MegaRAID\nSAS HBA emulation. An attacker inside the guest could use this issue\nto cause QEMU to crash, resulting in a denial of service. This issue\nonly affected Ubuntu 14.04 LTS and Ubuntu 15.10. (CVE-2015-8613)\n\nLing Liu discovered that QEMU incorrectly handled the Human Monitor\nInterface. A local attacker could use this issue to cause QEMU to\ncrash, resulting in a denial of service. This issue only affected\nUbuntu 14.04 LTS and Ubuntu 15.10. (CVE-2015-8619, CVE-2016-1922)\n\nDavid Alan Gilbert discovered that QEMU incorrectly handled the Q35\nchipset emulation when performing VM guest migrations. An attacker\ncould use this issue to cause QEMU to crash, resulting in a denial of\nservice. This issue only affected Ubuntu 14.04 LTS and Ubuntu 15.10.\n(CVE-2015-8666)\n\nLing Liu discovered that QEMU incorrectly handled the NE2000 device.\nAn attacker inside the guest could use this issue to cause QEMU to\ncrash, resulting in a denial of service. (CVE-2015-8743)\n\nIt was discovered that QEMU incorrectly handled the vmxnet3 device. An\nattacker inside the guest could use this issue to cause QEMU to crash,\nresulting in a denial of service. This issue only affected Ubuntu\n14.04 LTS and Ubuntu 15.10. (CVE-2015-8744, CVE-2015-8745)\n\nQinghao Tang discovered that QEMU incorrect handled IDE AHCI\nemulation. An attacker inside the guest could use this issue to cause\na denial of service, or possibly execute arbitrary code on the host as\nthe user running the QEMU process. In the default installation, when\nQEMU is used with libvirt, attackers would be isolated by the libvirt\nAppArmor profile. (CVE-2016-1568)\n\nDonghai Zhu discovered that QEMU incorrect handled the firmware\nconfiguration device. An attacker inside the guest could use this\nissue to cause a denial of service, or possibly execute arbitrary code\non the host as the user running the QEMU process. In the default\ninstallation, when QEMU is used with libvirt, attackers would be\nisolated by the libvirt AppArmor profile. (CVE-2016-1714)\n\nIt was discovered that QEMU incorrectly handled the e1000 device. An\nattacker inside the guest could use this issue to cause QEMU to crash,\nresulting in a denial of service. (CVE-2016-1981)\n\nZuozhi Fzz discovered that QEMU incorrectly handled IDE AHCI\nemulation. An attacker inside the guest could use this issue to cause\nQEMU to crash, resulting in a denial of service. This issue only\naffected Ubuntu 15.10. (CVE-2016-2197)\n\nZuozhi Fzz discovered that QEMU incorrectly handled USB EHCI\nemulation. An attacker inside the guest could use this issue to cause\nQEMU to crash, resulting in a denial of service. This issue only\naffected Ubuntu 14.04 LTS and Ubuntu 15.10. (CVE-2016-2198).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://usn.ubuntu.com/2891-1/\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:qemu-kvm\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:qemu-system\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:qemu-system-aarch64\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:qemu-system-arm\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:qemu-system-mips\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:qemu-system-misc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:qemu-system-ppc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:qemu-system-sparc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:qemu-system-x86\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:12.04:-:lts\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:14.04\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:15.10\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2016/04/07\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/02/03\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/02/04\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"Ubuntu Security Notice (C) 2016-2020 Canonical, Inc. / NASL script (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Ubuntu Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/cpu\", \"Host/Ubuntu\", \"Host/Ubuntu/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"ubuntu.inc\");\ninclude(\"misc_func.inc\");\n\nif ( ! get_kb_item(\"Host/local_checks_enabled\") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/Ubuntu/release\");\nif ( isnull(release) ) audit(AUDIT_OS_NOT, \"Ubuntu\");\nrelease = chomp(release);\nif (! preg(pattern:\"^(12\\.04|14\\.04|15\\.10)$\", string:release)) audit(AUDIT_OS_NOT, \"Ubuntu 12.04 / 14.04 / 15.10\", \"Ubuntu \" + release);\nif ( ! get_kb_item(\"Host/Debian/dpkg-l\") ) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Ubuntu\", cpu);\n\nflag = 0;\n\nif (ubuntu_check(osver:\"12.04\", pkgname:\"qemu-kvm\", pkgver:\"1.0+noroms-0ubuntu14.27\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"qemu-system\", pkgver:\"2.0.0+dfsg-2ubuntu1.22\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"qemu-system-aarch64\", pkgver:\"2.0.0+dfsg-2ubuntu1.22\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"qemu-system-arm\", pkgver:\"2.0.0+dfsg-2ubuntu1.22\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"qemu-system-mips\", pkgver:\"2.0.0+dfsg-2ubuntu1.22\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"qemu-system-misc\", pkgver:\"2.0.0+dfsg-2ubuntu1.22\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"qemu-system-ppc\", pkgver:\"2.0.0+dfsg-2ubuntu1.22\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"qemu-system-sparc\", pkgver:\"2.0.0+dfsg-2ubuntu1.22\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"qemu-system-x86\", pkgver:\"2.0.0+dfsg-2ubuntu1.22\")) flag++;\nif (ubuntu_check(osver:\"15.10\", pkgname:\"qemu-system\", pkgver:\"1:2.3+dfsg-5ubuntu9.2\")) flag++;\nif (ubuntu_check(osver:\"15.10\", pkgname:\"qemu-system-aarch64\", pkgver:\"1:2.3+dfsg-5ubuntu9.2\")) flag++;\nif (ubuntu_check(osver:\"15.10\", pkgname:\"qemu-system-arm\", pkgver:\"1:2.3+dfsg-5ubuntu9.2\")) flag++;\nif (ubuntu_check(osver:\"15.10\", pkgname:\"qemu-system-mips\", pkgver:\"1:2.3+dfsg-5ubuntu9.2\")) flag++;\nif (ubuntu_check(osver:\"15.10\", pkgname:\"qemu-system-misc\", pkgver:\"1:2.3+dfsg-5ubuntu9.2\")) flag++;\nif (ubuntu_check(osver:\"15.10\", pkgname:\"qemu-system-ppc\", pkgver:\"1:2.3+dfsg-5ubuntu9.2\")) flag++;\nif (ubuntu_check(osver:\"15.10\", pkgname:\"qemu-system-sparc\", pkgver:\"1:2.3+dfsg-5ubuntu9.2\")) flag++;\nif (ubuntu_check(osver:\"15.10\", pkgname:\"qemu-system-x86\", pkgver:\"1:2.3+dfsg-5ubuntu9.2\")) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : ubuntu_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = ubuntu_pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"qemu-kvm / qemu-system / qemu-system-aarch64 / qemu-system-arm / etc\");\n}\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-01-12T09:49:25", "description": "Several vulnerabilities were discovered in qemu, a full virtualization\nsolution on x86 hardware.\n\n - CVE-2015-7295\n Jason Wang of Red Hat Inc. discovered that the Virtual\n Network Device support is vulnerable to\n denial-of-service, that could occur when receiving large\n packets.\n\n - CVE-2015-7504\n Qinghao Tang of Qihoo 360 Inc. and Ling Liu of Qihoo 360\n Inc. discovered that the PC-Net II ethernet controller\n is vulnerable to a heap-based buffer overflow that could\n result in denial-of-service (via application crash) or\n arbitrary code execution.\n\n - CVE-2015-7512\n Ling Liu of Qihoo 360 Inc. and Jason Wang of Red Hat\n Inc. discovered that the PC-Net II ethernet controller\n is vulnerable to a buffer overflow that could result in\n denial-of-service (via application crash) or arbitrary\n code execution.\n\n - CVE-2015-7549\n Qinghao Tang of Qihoo 360 Inc. and Ling Liu of Qihoo 360\n Inc. discovered that the PCI MSI-X emulator is\n vulnerable to a NULL pointer dereference issue, that\n could lead to denial-of-service (via application crash).\n\n - CVE-2015-8345\n Qinghao Tang of Qihoo 360 Inc. discovered that the\n eepro100 emulator contains a flaw that could lead to an\n infinite loop when processing Command Blocks, eventually\n resulting in denial-of-service (via application crash).\n\n - CVE-2015-8504\n Lian Yihan of Qihoo 360 Inc. discovered that the VNC\n display driver support is vulnerable to an arithmetic\n exception flaw that could lead to denial-of-service (via\n application crash).\n\n - CVE-2015-8550\n Felix Wilhelm of ERNW Research discovered that the PV\n backend drivers are vulnerable to double fetch\n vulnerabilities, possibly resulting in arbitrary code\n execution.\n\n - CVE-2015-8558\n Qinghao Tang of Qihoo 360 Inc. discovered that the USB\n EHCI emulation support contains a flaw that could lead\n to an infinite loop during communication between the\n host controller and a device driver. This could lead to\n denial-of-service (via resource exhaustion).\n\n - CVE-2015-8567 CVE-2015-8568\n Qinghao Tang of Qihoo 360 Inc. discovered that the\n vmxnet3 device emulator could be used to intentionally\n leak host memory, thus resulting in denial-of-service.\n\n - CVE-2015-8613\n Qinghao Tang of Qihoo 360 Inc. discovered that the SCSI\n MegaRAID SAS HBA emulation support is vulnerable to a\n stack-based buffer overflow issue, that could lead to\n denial-of-service (via application crash).\n\n - CVE-2015-8619\n Ling Liu of Qihoo 360 Inc. discovered that the Human\n Monitor Interface support is vulnerable to an\n out-of-bound write access issue that could result in\n denial-of-service (via application crash).\n\n - CVE-2015-8743\n Ling Liu of Qihoo 360 Inc. discovered that the NE2000\n emulator is vulnerable to an out-of-bound read/write\n access issue, potentially resulting in information leak\n or memory corruption.\n\n - CVE-2015-8744\n The vmxnet3 driver incorrectly processes small packets,\n which could result in denial-of-service (via application\n crash).\n\n - CVE-2015-8745\n The vmxnet3 driver incorrectly processes Interrupt Mask\n Registers, which could result in denial-of-service (via\n application crash).\n\n - CVE-2016-1568\n Qinghao Tang of Qihoo 360 Inc. discovered that the IDE\n AHCI emulation support is vulnerable to a use-after-free\n issue, that could lead to denial-of-service (via\n application crash) or arbitrary code execution.\n\n - CVE-2016-1714\n Donghai Zhu of Alibaba discovered that the Firmware\n Configuration emulation support is vulnerable to an\n out-of-bound read/write access issue, that could lead to\n denial-of-service (via application crash) or arbitrary\n code execution.\n\n - CVE-2016-1922\n Ling Liu of Qihoo 360 Inc. discovered that 32-bit\n Windows guests support is vulnerable to a NULL pointer\n dereference issue, that could lead to denial-of-service\n (via application crash).\n\n - CVE-2016-1981\n The e1000 driver is vulnerable to an infinite loop issue\n that could lead to denial-of-service (via application\n crash).", "edition": 25, "cvss3": {"score": 9.0, "vector": "AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H"}, "published": "2016-02-09T00:00:00", "title": "Debian DSA-3471-1 : qemu - security update", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2015-8567", "CVE-2015-8619", "CVE-2015-8558", "CVE-2015-8613", "CVE-2016-1922", "CVE-2015-7504", "CVE-2015-7512", "CVE-2015-8550", "CVE-2015-8345", "CVE-2015-8568", "CVE-2015-8744", "CVE-2015-7549", "CVE-2015-8743", "CVE-2016-1568", "CVE-2015-8745", "CVE-2016-1714", "CVE-2016-1981", "CVE-2015-8504", "CVE-2015-7295"], "modified": "2016-02-09T00:00:00", "cpe": ["cpe:/o:debian:debian_linux:8.0", "p-cpe:/a:debian:debian_linux:qemu"], "id": "DEBIAN_DSA-3471.NASL", "href": "https://www.tenable.com/plugins/nessus/88630", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Debian Security Advisory DSA-3471. The text \n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(88630);\n script_version(\"2.15\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2015-7295\", \"CVE-2015-7504\", \"CVE-2015-7512\", \"CVE-2015-7549\", \"CVE-2015-8345\", \"CVE-2015-8504\", \"CVE-2015-8550\", \"CVE-2015-8558\", \"CVE-2015-8567\", \"CVE-2015-8568\", \"CVE-2015-8613\", \"CVE-2015-8619\", \"CVE-2015-8743\", \"CVE-2015-8744\", \"CVE-2015-8745\", \"CVE-2016-1568\", \"CVE-2016-1714\", \"CVE-2016-1922\", \"CVE-2016-1981\");\n script_xref(name:\"DSA\", value:\"3471\");\n\n script_name(english:\"Debian DSA-3471-1 : qemu - security update\");\n script_summary(english:\"Checks dpkg output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Several vulnerabilities were discovered in qemu, a full virtualization\nsolution on x86 hardware.\n\n - CVE-2015-7295\n Jason Wang of Red Hat Inc. discovered that the Virtual\n Network Device support is vulnerable to\n denial-of-service, that could occur when receiving large\n packets.\n\n - CVE-2015-7504\n Qinghao Tang of Qihoo 360 Inc. and Ling Liu of Qihoo 360\n Inc. discovered that the PC-Net II ethernet controller\n is vulnerable to a heap-based buffer overflow that could\n result in denial-of-service (via application crash) or\n arbitrary code execution.\n\n - CVE-2015-7512\n Ling Liu of Qihoo 360 Inc. and Jason Wang of Red Hat\n Inc. discovered that the PC-Net II ethernet controller\n is vulnerable to a buffer overflow that could result in\n denial-of-service (via application crash) or arbitrary\n code execution.\n\n - CVE-2015-7549\n Qinghao Tang of Qihoo 360 Inc. and Ling Liu of Qihoo 360\n Inc. discovered that the PCI MSI-X emulator is\n vulnerable to a NULL pointer dereference issue, that\n could lead to denial-of-service (via application crash).\n\n - CVE-2015-8345\n Qinghao Tang of Qihoo 360 Inc. discovered that the\n eepro100 emulator contains a flaw that could lead to an\n infinite loop when processing Command Blocks, eventually\n resulting in denial-of-service (via application crash).\n\n - CVE-2015-8504\n Lian Yihan of Qihoo 360 Inc. discovered that the VNC\n display driver support is vulnerable to an arithmetic\n exception flaw that could lead to denial-of-service (via\n application crash).\n\n - CVE-2015-8550\n Felix Wilhelm of ERNW Research discovered that the PV\n backend drivers are vulnerable to double fetch\n vulnerabilities, possibly resulting in arbitrary code\n execution.\n\n - CVE-2015-8558\n Qinghao Tang of Qihoo 360 Inc. discovered that the USB\n EHCI emulation support contains a flaw that could lead\n to an infinite loop during communication between the\n host controller and a device driver. This could lead to\n denial-of-service (via resource exhaustion).\n\n - CVE-2015-8567 CVE-2015-8568\n Qinghao Tang of Qihoo 360 Inc. discovered that the\n vmxnet3 device emulator could be used to intentionally\n leak host memory, thus resulting in denial-of-service.\n\n - CVE-2015-8613\n Qinghao Tang of Qihoo 360 Inc. discovered that the SCSI\n MegaRAID SAS HBA emulation support is vulnerable to a\n stack-based buffer overflow issue, that could lead to\n denial-of-service (via application crash).\n\n - CVE-2015-8619\n Ling Liu of Qihoo 360 Inc. discovered that the Human\n Monitor Interface support is vulnerable to an\n out-of-bound write access issue that could result in\n denial-of-service (via application crash).\n\n - CVE-2015-8743\n Ling Liu of Qihoo 360 Inc. discovered that the NE2000\n emulator is vulnerable to an out-of-bound read/write\n access issue, potentially resulting in information leak\n or memory corruption.\n\n - CVE-2015-8744\n The vmxnet3 driver incorrectly processes small packets,\n which could result in denial-of-service (via application\n crash).\n\n - CVE-2015-8745\n The vmxnet3 driver incorrectly processes Interrupt Mask\n Registers, which could result in denial-of-service (via\n application crash).\n\n - CVE-2016-1568\n Qinghao Tang of Qihoo 360 Inc. discovered that the IDE\n AHCI emulation support is vulnerable to a use-after-free\n issue, that could lead to denial-of-service (via\n application crash) or arbitrary code execution.\n\n - CVE-2016-1714\n Donghai Zhu of Alibaba discovered that the Firmware\n Configuration emulation support is vulnerable to an\n out-of-bound read/write access issue, that could lead to\n denial-of-service (via application crash) or arbitrary\n code execution.\n\n - CVE-2016-1922\n Ling Liu of Qihoo 360 Inc. discovered that 32-bit\n Windows guests support is vulnerable to a NULL pointer\n dereference issue, that could lead to denial-of-service\n (via application crash).\n\n - CVE-2016-1981\n The e1000 driver is vulnerable to an infinite loop issue\n that could lead to denial-of-service (via application\n crash).\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=799452\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=806373\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=806741\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=806742\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=808130\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=808131\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=808144\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=808145\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=809229\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=809232\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=810519\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=810527\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=811201\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=812307\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=809237\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=809237\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2015-7295\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2015-7504\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2015-7512\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2015-7549\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2015-8345\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2015-8504\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2015-8550\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2015-8558\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2015-8567\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2015-8568\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2015-8613\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2015-8619\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2015-8743\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2015-8744\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2015-8745\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2016-1568\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2016-1714\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2016-1922\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2016-1981\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://packages.debian.org/source/jessie/qemu\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.debian.org/security/2016/dsa-3471\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Upgrade the qemu packages.\n\nFor the stable distribution (jessie), these problems have been fixed\nin version 1:2.1+dfsg-12+deb8u5a.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:qemu\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:8.0\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2015/11/09\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/02/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/02/09\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"8.0\", prefix:\"qemu\", reference:\"1:2.1+dfsg-12+deb8u5a\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"qemu-guest-agent\", reference:\"1:2.1+dfsg-12+deb8u5a\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"qemu-kvm\", reference:\"1:2.1+dfsg-12+deb8u5a\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"qemu-system\", reference:\"1:2.1+dfsg-12+deb8u5a\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"qemu-system-arm\", reference:\"1:2.1+dfsg-12+deb8u5a\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"qemu-system-common\", reference:\"1:2.1+dfsg-12+deb8u5a\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"qemu-system-mips\", reference:\"1:2.1+dfsg-12+deb8u5a\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"qemu-system-misc\", reference:\"1:2.1+dfsg-12+deb8u5a\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"qemu-system-ppc\", reference:\"1:2.1+dfsg-12+deb8u5a\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"qemu-system-sparc\", reference:\"1:2.1+dfsg-12+deb8u5a\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"qemu-system-x86\", reference:\"1:2.1+dfsg-12+deb8u5a\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"qemu-user\", reference:\"1:2.1+dfsg-12+deb8u5a\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"qemu-user-binfmt\", reference:\"1:2.1+dfsg-12+deb8u5a\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"qemu-user-static\", reference:\"1:2.1+dfsg-12+deb8u5a\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"qemu-utils\", reference:\"1:2.1+dfsg-12+deb8u5a\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-01-12T10:14:08", "description": "Qemu: nvram: OOB r/w access in processing firmware configurations\nCVE-2016-1714 (#1296080)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 18, "cvss3": {"score": 8.1, "vector": "AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H"}, "published": "2016-03-21T00:00:00", "title": "Fedora 22 : xen-4.5.2-9.fc22 (2016-38b20aa50f)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2016-2392", "CVE-2016-2858", "CVE-2015-8613", "CVE-2016-1922", "CVE-2015-8817", "CVE-2016-2391", "CVE-2016-2198", "CVE-2016-2841", "CVE-2015-8818", "CVE-2016-1714", "CVE-2016-2857", "CVE-2016-1981", "CVE-2016-2538"], "modified": "2016-03-21T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:xen", "cpe:/o:fedoraproject:fedora:22"], "id": "FEDORA_2016-38B20AA50F.NASL", "href": "https://www.tenable.com/plugins/nessus/90036", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2016-38b20aa50f.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(90036);\n script_version(\"2.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2015-8613\", \"CVE-2015-8817\", \"CVE-2015-8818\", \"CVE-2016-1714\", \"CVE-2016-1922\", \"CVE-2016-1981\", \"CVE-2016-2198\", \"CVE-2016-2391\", \"CVE-2016-2392\", \"CVE-2016-2538\", \"CVE-2016-2841\", \"CVE-2016-2857\", \"CVE-2016-2858\");\n script_xref(name:\"FEDORA\", value:\"2016-38b20aa50f\");\n\n script_name(english:\"Fedora 22 : xen-4.5.2-9.fc22 (2016-38b20aa50f)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Qemu: nvram: OOB r/w access in processing firmware configurations\nCVE-2016-1714 (#1296080)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1283934\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1284008\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1296060\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1296567\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1298570\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1299455\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1300771\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1301643\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1302299\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1303106\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1303120\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1304794\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1314676\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2016-March/179057.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?133fe26f\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected xen package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:xen\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:22\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/03/19\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/03/21\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^22([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 22.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC22\", reference:\"xen-4.5.2-9.fc22\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"xen\");\n}\n", "cvss": {"score": 6.9, "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-01-12T10:15:02", "description": "Qemu: nvram: OOB r/w access in processing firmware configurations\nCVE-2016-1714 (#1296080) Qemu: i386: NULL pointer dereference in\nvapic_write() CVE-2016-1922 (#1292767) qemu: Stack-based buffer\noverflow in megasas_ctrl_get_info CVE-2015-8613 (#1293305) qemu-kvm:\nInfinite loop and out-of-bounds transfer start in start_xmit() and\ne1000_receive_iov() CVE-2016-1981 (#1299996) Qemu: usb ehci\nout-of-bounds read in ehci_process_itd (#1300235) Qemu: usb: ehci NULL\npointer dereference in ehci_caps_write CVE-2016-2198 (#1303135) Qemu:\nnet: ne2000: infinite loop in ne2000_receive CVE-2016-2841 (#1304048)\nQemu: usb: integer overflow in remote NDIS control message handling\nCVE-2016-2538 (#1305816) Qemu: usb: NULL pointer dereference in remote\nNDIS control message handling CVE-2016-2392 (#1307116) Qemu: usb:\nmultiple eof_timers in ohci module leads to NULL pointer dereference\nCVE-2016-2391 (#1308882) Qemu: net: out of bounds read in\nnet_checksum_calculate() CVE-2016-2857 (#1309565) Qemu: OOB access in\naddress_space_rw leads to segmentation fault CVE-2015-8817\nCVE-2015-8818 (#1313273) Qemu: rng-random: arbitrary stack based\nallocation leading to corruption CVE-2016-2858 (#1314678)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 18, "cvss3": {"score": 8.1, "vector": "AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H"}, "published": "2016-03-21T00:00:00", "title": "Fedora 23 : xen-4.5.2-9.fc23 (2016-f4504e9445)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2016-2392", "CVE-2016-2858", "CVE-2015-8613", "CVE-2016-1922", "CVE-2015-8817", "CVE-2016-2391", "CVE-2016-2198", "CVE-2016-2841", "CVE-2015-8818", "CVE-2016-1714", "CVE-2016-2857", "CVE-2016-1981", "CVE-2016-2538"], "modified": "2016-03-21T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:xen", "cpe:/o:fedoraproject:fedora:23"], "id": "FEDORA_2016-F4504E9445.NASL", "href": "https://www.tenable.com/plugins/nessus/90045", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2016-f4504e9445.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(90045);\n script_version(\"2.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2015-8613\", \"CVE-2015-8817\", \"CVE-2015-8818\", \"CVE-2016-1714\", \"CVE-2016-1922\", \"CVE-2016-1981\", \"CVE-2016-2198\", \"CVE-2016-2391\", \"CVE-2016-2392\", \"CVE-2016-2538\", \"CVE-2016-2841\", \"CVE-2016-2857\", \"CVE-2016-2858\");\n script_xref(name:\"FEDORA\", value:\"2016-f4504e9445\");\n\n script_name(english:\"Fedora 23 : xen-4.5.2-9.fc23 (2016-f4504e9445)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Qemu: nvram: OOB r/w access in processing firmware configurations\nCVE-2016-1714 (#1296080) Qemu: i386: NULL pointer dereference in\nvapic_write() CVE-2016-1922 (#1292767) qemu: Stack-based buffer\noverflow in megasas_ctrl_get_info CVE-2015-8613 (#1293305) qemu-kvm:\nInfinite loop and out-of-bounds transfer start in start_xmit() and\ne1000_receive_iov() CVE-2016-1981 (#1299996) Qemu: usb ehci\nout-of-bounds read in ehci_process_itd (#1300235) Qemu: usb: ehci NULL\npointer dereference in ehci_caps_write CVE-2016-2198 (#1303135) Qemu:\nnet: ne2000: infinite loop in ne2000_receive CVE-2016-2841 (#1304048)\nQemu: usb: integer overflow in remote NDIS control message handling\nCVE-2016-2538 (#1305816) Qemu: usb: NULL pointer dereference in remote\nNDIS control message handling CVE-2016-2392 (#1307116) Qemu: usb:\nmultiple eof_timers in ohci module leads to NULL pointer dereference\nCVE-2016-2391 (#1308882) Qemu: net: out of bounds read in\nnet_checksum_calculate() CVE-2016-2857 (#1309565) Qemu: OOB access in\naddress_space_rw leads to segmentation fault CVE-2015-8817\nCVE-2015-8818 (#1313273) Qemu: rng-random: arbitrary stack based\nallocation leading to corruption CVE-2016-2858 (#1314678)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1283934\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1284008\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1296060\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1296567\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1298570\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1299455\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1300771\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1301643\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1302299\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1303106\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1303120\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1304794\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1314676\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2016-March/179083.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?56044835\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected xen package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:xen\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:23\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/03/19\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/03/21\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^23([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 23.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC23\", reference:\"xen-4.5.2-9.fc23\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"xen\");\n}\n", "cvss": {"score": 6.9, "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-01-01T06:43:40", "description": "Zuozhi Fzz discovered that QEMU incorrectly handled USB OHCI emulation\nsupport. A privileged attacker inside the guest could use this issue\nto cause QEMU to crash, resulting in a denial of service.\n(CVE-2016-2391)\n\nQinghao Tang discovered that QEMU incorrectly handled USB Net\nemulation support. A privileged attacker inside the guest could use\nthis issue to cause QEMU to crash, resulting in a denial of service.\n(CVE-2016-2392)\n\nQinghao Tang discovered that QEMU incorrectly handled USB Net\nemulation support. A privileged attacker inside the guest could use\nthis issue to cause QEMU to crash, resulting in a denial of service,\nor possibly leak host memory bytes. (CVE-2016-2538)\n\nHongke Yang discovered that QEMU incorrectly handled NE2000 emulation\nsupport. A privileged attacker inside the guest could use this issue\nto cause QEMU to crash, resulting in a denial of service.\n(CVE-2016-2841)\n\nLing Liu discovered that QEMU incorrectly handled IP checksum\nroutines. An attacker inside the guest could use this issue to cause\nQEMU to crash, resulting in a denial of service, or possibly leak host\nmemory bytes. (CVE-2016-2857)\n\nIt was discovered that QEMU incorrectly handled the PRNG back-end\nsupport. An attacker inside the guest could use this issue to cause\nQEMU to crash, resulting in a denial of service. This issue only\napplied to Ubuntu 14.04 LTS, Ubuntu 15.10 and Ubuntu 16.04 LTS.\n(CVE-2016-2858)\n\nWei Xiao and Qinghao Tang discovered that QEMU incorrectly handled\naccess in the VGA module. A privileged attacker inside the guest could\nuse this issue to cause QEMU to crash, resulting in a denial of\nservice, or possibly execute arbitrary code on the host. In the\ndefault installation, when QEMU is used with libvirt, attackers would\nbe isolated by the libvirt AppArmor profile. (CVE-2016-3710)\n\nZuozhi Fzz discovered that QEMU incorrectly handled access in the VGA\nmodule. A privileged attacker inside the guest could use this issue to\ncause QEMU to crash, resulting in a denial of service, or possibly\nexecute arbitrary code on the host. In the default installation, when\nQEMU is used with libvirt, attackers would be isolated by the libvirt\nAppArmor profile. (CVE-2016-3712)\n\nOleksandr Bazhaniuk discovered that QEMU incorrectly handled Luminary\nMicro Stellaris ethernet controller emulation. A remote attacker could\nuse this issue to cause QEMU to crash, resulting in a denial of\nservice. (CVE-2016-4001)\n\nOleksandr Bazhaniuk discovered that QEMU incorrectly handled MIPSnet\ncontroller emulation. A remote attacker could use this issue to cause\nQEMU to crash, resulting in a denial of service. (CVE-2016-4002)\n\nDonghai Zdh discovered that QEMU incorrectly handled the Task Priority\nRegister(TPR). A privileged attacker inside the guest could use this\nissue to possibly leak host memory bytes. This issue only applied to\nUbuntu 14.04 LTS, Ubuntu 15.10 and Ubuntu 16.04 LTS. (CVE-2016-4020)\n\nDu Shaobo discovered that QEMU incorrectly handled USB EHCI emulation\nsupport. A privileged attacker inside the guest could use this issue\nto cause QEMU to consume resources, resulting in a denial of service.\n(CVE-2016-4037).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 27, "cvss3": {"score": 9.0, "vector": "AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H"}, "published": "2016-05-13T00:00:00", "title": "Ubuntu 12.04 LTS / 14.04 LTS / 15.10 / 16.04 LTS : qemu, qemu-kvm vulnerabilities (USN-2974-1)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2016-2392", "CVE-2016-2858", "CVE-2016-3712", "CVE-2016-2391", "CVE-2016-3710", "CVE-2016-4002", "CVE-2016-4020", "CVE-2016-2841", "CVE-2016-4001", "CVE-2016-4037", "CVE-2016-2857", "CVE-2016-2538"], "modified": "2021-01-02T00:00:00", "cpe": ["p-cpe:/a:canonical:ubuntu_linux:qemu-system-s390x", "p-cpe:/a:canonical:ubuntu_linux:qemu-system", "cpe:/o:canonical:ubuntu_linux:16.04", "p-cpe:/a:canonical:ubuntu_linux:qemu-system-aarch64", "p-cpe:/a:canonical:ubuntu_linux:qemu-system-x86", "cpe:/o:canonical:ubuntu_linux:15.10", "p-cpe:/a:canonical:ubuntu_linux:qemu-system-ppc", "p-cpe:/a:canonical:ubuntu_linux:qemu-system-sparc", "p-cpe:/a:canonical:ubuntu_linux:qemu-system-arm", "p-cpe:/a:canonical:ubuntu_linux:qemu-system-mips", "p-cpe:/a:canonical:ubuntu_linux:qemu-system-misc", "p-cpe:/a:canonical:ubuntu_linux:qemu-kvm", "cpe:/o:canonical:ubuntu_linux:12.04:-:lts", "cpe:/o:canonical:ubuntu_linux:14.04"], "id": "UBUNTU_USN-2974-1.NASL", "href": "https://www.tenable.com/plugins/nessus/91122", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Ubuntu Security Notice USN-2974-1. The text \n# itself is copyright (C) Canonical, Inc. See \n# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered \n# trademark of Canonical, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(91122);\n script_version(\"2.11\");\n script_cvs_date(\"Date: 2019/09/18 12:31:45\");\n\n script_cve_id(\"CVE-2016-2391\", \"CVE-2016-2392\", \"CVE-2016-2538\", \"CVE-2016-2841\", \"CVE-2016-2857\", \"CVE-2016-2858\", \"CVE-2016-3710\", \"CVE-2016-3712\", \"CVE-2016-4001\", \"CVE-2016-4002\", \"CVE-2016-4020\", \"CVE-2016-4037\");\n script_xref(name:\"USN\", value:\"2974-1\");\n\n script_name(english:\"Ubuntu 12.04 LTS / 14.04 LTS / 15.10 / 16.04 LTS : qemu, qemu-kvm vulnerabilities (USN-2974-1)\");\n script_summary(english:\"Checks dpkg output for updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Ubuntu host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Zuozhi Fzz discovered that QEMU incorrectly handled USB OHCI emulation\nsupport. A privileged attacker inside the guest could use this issue\nto cause QEMU to crash, resulting in a denial of service.\n(CVE-2016-2391)\n\nQinghao Tang discovered that QEMU incorrectly handled USB Net\nemulation support. A privileged attacker inside the guest could use\nthis issue to cause QEMU to crash, resulting in a denial of service.\n(CVE-2016-2392)\n\nQinghao Tang discovered that QEMU incorrectly handled USB Net\nemulation support. A privileged attacker inside the guest could use\nthis issue to cause QEMU to crash, resulting in a denial of service,\nor possibly leak host memory bytes. (CVE-2016-2538)\n\nHongke Yang discovered that QEMU incorrectly handled NE2000 emulation\nsupport. A privileged attacker inside the guest could use this issue\nto cause QEMU to crash, resulting in a denial of service.\n(CVE-2016-2841)\n\nLing Liu discovered that QEMU incorrectly handled IP checksum\nroutines. An attacker inside the guest could use this issue to cause\nQEMU to crash, resulting in a denial of service, or possibly leak host\nmemory bytes. (CVE-2016-2857)\n\nIt was discovered that QEMU incorrectly handled the PRNG back-end\nsupport. An attacker inside the guest could use this issue to cause\nQEMU to crash, resulting in a denial of service. This issue only\napplied to Ubuntu 14.04 LTS, Ubuntu 15.10 and Ubuntu 16.04 LTS.\n(CVE-2016-2858)\n\nWei Xiao and Qinghao Tang discovered that QEMU incorrectly handled\naccess in the VGA module. A privileged attacker inside the guest could\nuse this issue to cause QEMU to crash, resulting in a denial of\nservice, or possibly execute arbitrary code on the host. In the\ndefault installation, when QEMU is used with libvirt, attackers would\nbe isolated by the libvirt AppArmor profile. (CVE-2016-3710)\n\nZuozhi Fzz discovered that QEMU incorrectly handled access in the VGA\nmodule. A privileged attacker inside the guest could use this issue to\ncause QEMU to crash, resulting in a denial of service, or possibly\nexecute arbitrary code on the host. In the default installation, when\nQEMU is used with libvirt, attackers would be isolated by the libvirt\nAppArmor profile. (CVE-2016-3712)\n\nOleksandr Bazhaniuk discovered that QEMU incorrectly handled Luminary\nMicro Stellaris ethernet controller emulation. A remote attacker could\nuse this issue to cause QEMU to crash, resulting in a denial of\nservice. (CVE-2016-4001)\n\nOleksandr Bazhaniuk discovered that QEMU incorrectly handled MIPSnet\ncontroller emulation. A remote attacker could use this issue to cause\nQEMU to crash, resulting in a denial of service. (CVE-2016-4002)\n\nDonghai Zdh discovered that QEMU incorrectly handled the Task Priority\nRegister(TPR). A privileged attacker inside the guest could use this\nissue to possibly leak host memory bytes. This issue only applied to\nUbuntu 14.04 LTS, Ubuntu 15.10 and Ubuntu 16.04 LTS. (CVE-2016-4020)\n\nDu Shaobo discovered that QEMU incorrectly handled USB EHCI emulation\nsupport. A privileged attacker inside the guest could use this issue\nto cause QEMU to consume resources, resulting in a denial of service.\n(CVE-2016-4037).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://usn.ubuntu.com/2974-1/\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:qemu-kvm\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:qemu-system\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:qemu-system-aarch64\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:qemu-system-arm\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:qemu-system-mips\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:qemu-system-misc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:qemu-system-ppc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:qemu-system-s390x\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:qemu-system-sparc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:qemu-system-x86\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:12.04:-:lts\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:14.04\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:15.10\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:16.04\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2016/04/07\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/05/12\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/05/13\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"Ubuntu Security Notice (C) 2016-2019 Canonical, Inc. / NASL script (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Ubuntu Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/cpu\", \"Host/Ubuntu\", \"Host/Ubuntu/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"ubuntu.inc\");\ninclude(\"misc_func.inc\");\n\nif ( ! get_kb_item(\"Host/local_checks_enabled\") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/Ubuntu/release\");\nif ( isnull(release) ) audit(AUDIT_OS_NOT, \"Ubuntu\");\nrelease = chomp(release);\nif (! preg(pattern:\"^(12\\.04|14\\.04|15\\.10|16\\.04)$\", string:release)) audit(AUDIT_OS_NOT, \"Ubuntu 12.04 / 14.04 / 15.10 / 16.04\", \"Ubuntu \" + release);\nif ( ! get_kb_item(\"Host/Debian/dpkg-l\") ) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Ubuntu\", cpu);\n\nflag = 0;\n\nif (ubuntu_check(osver:\"12.04\", pkgname:\"qemu-kvm\", pkgver:\"1.0+noroms-0ubuntu14.28\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"qemu-system\", pkgver:\"2.0.0+dfsg-2ubuntu1.24\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"qemu-system-aarch64\", pkgver:\"2.0.0+dfsg-2ubuntu1.24\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"qemu-system-arm\", pkgver:\"2.0.0+dfsg-2ubuntu1.24\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"qemu-system-mips\", pkgver:\"2.0.0+dfsg-2ubuntu1.24\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"qemu-system-misc\", pkgver:\"2.0.0+dfsg-2ubuntu1.24\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"qemu-system-ppc\", pkgver:\"2.0.0+dfsg-2ubuntu1.24\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"qemu-system-sparc\", pkgver:\"2.0.0+dfsg-2ubuntu1.24\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"qemu-system-x86\", pkgver:\"2.0.0+dfsg-2ubuntu1.24\")) flag++;\nif (ubuntu_check(osver:\"15.10\", pkgname:\"qemu-system\", pkgver:\"1:2.3+dfsg-5ubuntu9.4\")) flag++;\nif (ubuntu_check(osver:\"15.10\", pkgname:\"qemu-system-aarch64\", pkgver:\"1:2.3+dfsg-5ubuntu9.4\")) flag++;\nif (ubuntu_check(osver:\"15.10\", pkgname:\"qemu-system-arm\", pkgver:\"1:2.3+dfsg-5ubuntu9.4\")) flag++;\nif (ubuntu_check(osver:\"15.10\", pkgname:\"qemu-system-mips\", pkgver:\"1:2.3+dfsg-5ubuntu9.4\")) flag++;\nif (ubuntu_check(osver:\"15.10\", pkgname:\"qemu-system-misc\", pkgver:\"1:2.3+dfsg-5ubuntu9.4\")) flag++;\nif (ubuntu_check(osver:\"15.10\", pkgname:\"qemu-system-ppc\", pkgver:\"1:2.3+dfsg-5ubuntu9.4\")) flag++;\nif (ubuntu_check(osver:\"15.10\", pkgname:\"qemu-system-sparc\", pkgver:\"1:2.3+dfsg-5ubuntu9.4\")) flag++;\nif (ubuntu_check(osver:\"15.10\", pkgname:\"qemu-system-x86\", pkgver:\"1:2.3+dfsg-5ubuntu9.4\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"qemu-system\", pkgver:\"1:2.5+dfsg-5ubuntu10.1\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"qemu-system-aarch64\", pkgver:\"1:2.5+dfsg-5ubuntu10.1\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"qemu-system-arm\", pkgver:\"1:2.5+dfsg-5ubuntu10.1\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"qemu-system-mips\", pkgver:\"1:2.5+dfsg-5ubuntu10.1\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"qemu-system-misc\", pkgver:\"1:2.5+dfsg-5ubuntu10.1\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"qemu-system-ppc\", pkgver:\"1:2.5+dfsg-5ubuntu10.1\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"qemu-system-s390x\", pkgver:\"1:2.5+dfsg-5ubuntu10.1\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"qemu-system-sparc\", pkgver:\"1:2.5+dfsg-5ubuntu10.1\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"qemu-system-x86\", pkgver:\"1:2.5+dfsg-5ubuntu10.1\")) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : ubuntu_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = ubuntu_pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"qemu-kvm / qemu-system / qemu-system-aarch64 / qemu-system-arm / etc\");\n}\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-01-12T10:14:12", "description": " - CVE-2015-8745: vmxnet3: don't assert reading registers\n in bar0 (bz #1295442) * CVE-2015-8567: net: vmxnet3:\n host memory leakage (bz #1289818) * CVE-2016-1922: i386:\n avoid NULL pointer dereference (bz #1292766) *\n CVE-2015-8613: buffer overflow in megasas_ctrl_get_info\n (bz #1284008) * CVE-2015-8701: Buffer overflow in\n tx_consume in rocker.c (bz #1293720) * CVE-2015-8743:\n ne2000: OOB memory access in ioport r/w functions (bz\n #1294787) * CVE-2016-1568: Use-after-free vulnerability\n in ahci (bz #1297023) * Fix modules.d/kvm.conf example\n syntax (bz #1298823)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 19, "cvss3": {"score": 8.5, "vector": "AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H"}, "published": "2016-03-04T00:00:00", "title": "Fedora 23 : qemu-2.4.1-6.fc23 (2016-42778e8c82)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2015-8567", "CVE-2015-8613", "CVE-2016-1922", "CVE-2015-8568", "CVE-2015-8743", "CVE-2016-1568", "CVE-2015-8701", "CVE-2015-8745"], "modified": "2016-03-04T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:qemu", "cpe:/o:fedoraproject:fedora:23"], "id": "FEDORA_2016-42778E8C82.NASL", "href": "https://www.tenable.com/plugins/nessus/89526", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2016-42778e8c82.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(89526);\n script_version(\"1.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2015-8567\", \"CVE-2015-8568\", \"CVE-2015-8613\", \"CVE-2015-8701\", \"CVE-2015-8743\", \"CVE-2015-8745\", \"CVE-2016-1568\", \"CVE-2016-1922\");\n script_xref(name:\"FEDORA\", value:\"2016-42778e8c82\");\n\n script_name(english:\"Fedora 23 : qemu-2.4.1-6.fc23 (2016-42778e8c82)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\" - CVE-2015-8745: vmxnet3: don't assert reading registers\n in bar0 (bz #1295442) * CVE-2015-8567: net: vmxnet3:\n host memory leakage (bz #1289818) * CVE-2016-1922: i386:\n avoid NULL pointer dereference (bz #1292766) *\n CVE-2015-8613: buffer overflow in megasas_ctrl_get_info\n (bz #1284008) * CVE-2015-8701: Buffer overflow in\n tx_consume in rocker.c (bz #1293720) * CVE-2015-8743:\n ne2000: OOB memory access in ioport r/w functions (bz\n #1294787) * CVE-2016-1568: Use-after-free vulnerability\n in ahci (bz #1297023) * Fix modules.d/kvm.conf example\n syntax (bz #1298823)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1264929\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1270876\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1283934\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1284008\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1286971\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1288532\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1289816\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2016-January/175967.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?67fb35c0\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected qemu package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:qemu\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:23\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/01/23\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/03/04\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^23([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 23.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC23\", reference:\"qemu-2.4.1-6.fc23\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"qemu\");\n}\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}], "ubuntu": [{"lastseen": "2020-10-16T13:18:38", "bulletinFamily": "unix", "cvelist": ["CVE-2015-8567", "CVE-2015-8619", "CVE-2015-8558", "CVE-2015-8613", "CVE-2016-1922", "CVE-2015-8666", "CVE-2015-8550", "CVE-2015-8568", "CVE-2016-2198", "CVE-2016-2197", "CVE-2015-8744", "CVE-2015-7549", "CVE-2015-8743", "CVE-2016-1568", "CVE-2015-8745", "CVE-2016-1714", "CVE-2016-1981", "CVE-2015-8504"], "description": "Qinghao Tang discovered that QEMU incorrectly handled PCI MSI-X support. An \nattacker inside the guest could use this issue to cause QEMU to crash, \nresulting in a denial of service. This issue only affected Ubuntu 14.04 LTS \nand Ubuntu 15.10. (CVE-2015-7549)\n\nLian Yihan discovered that QEMU incorrectly handled the VNC server. A \nremote attacker could use this issue to cause QEMU to crash, resulting in a \ndenial of service. (CVE-2015-8504)\n\nFelix Wilhelm discovered a race condition in the Xen paravirtualized \ndrivers which can cause double fetch vulnerabilities. An attacker in the \nparavirtualized guest could exploit this flaw to cause a denial of service \n(crash the host) or potentially execute arbitrary code on the host. \n(CVE-2015-8550)\n\nQinghao Tang discovered that QEMU incorrectly handled USB EHCI emulation \nsupport. An attacker inside the guest could use this issue to cause QEMU to \nconsume resources, resulting in a denial of service. (CVE-2015-8558)\n\nQinghao Tang discovered that QEMU incorrectly handled the vmxnet3 device. \nAn attacker inside the guest could use this issue to cause QEMU to consume \nresources, resulting in a denial of service. This issue only affected \nUbuntu 14.04 LTS and Ubuntu 15.10. (CVE-2015-8567, CVE-2015-8568)\n\nQinghao Tang discovered that QEMU incorrectly handled SCSI MegaRAID SAS HBA \nemulation. An attacker inside the guest could use this issue to cause QEMU \nto crash, resulting in a denial of service. This issue only affected \nUbuntu 14.04 LTS and Ubuntu 15.10. (CVE-2015-8613)\n\nLing Liu discovered that QEMU incorrectly handled the Human Monitor \nInterface. A local attacker could use this issue to cause QEMU to crash, \nresulting in a denial of service. This issue only affected Ubuntu 14.04 LTS \nand Ubuntu 15.10. (CVE-2015-8619, CVE-2016-1922)\n\nDavid Alan Gilbert discovered that QEMU incorrectly handled the Q35 chipset \nemulation when performing VM guest migrations. An attacker could use this \nissue to cause QEMU to crash, resulting in a denial of service. This issue \nonly affected Ubuntu 14.04 LTS and Ubuntu 15.10. (CVE-2015-8666)\n\nLing Liu discovered that QEMU incorrectly handled the NE2000 device. An \nattacker inside the guest could use this issue to cause QEMU to crash, \nresulting in a denial of service. (CVE-2015-8743)\n\nIt was discovered that QEMU incorrectly handled the vmxnet3 device. An \nattacker inside the guest could use this issue to cause QEMU to crash, \nresulting in a denial of service. This issue only affected Ubuntu 14.04 LTS \nand Ubuntu 15.10. (CVE-2015-8744, CVE-2015-8745)\n\nQinghao Tang discovered that QEMU incorrect handled IDE AHCI emulation. An \nattacker inside the guest could use this issue to cause a denial of \nservice, or possibly execute arbitrary code on the host as the user running \nthe QEMU process. In the default installation, when QEMU is used with \nlibvirt, attackers would be isolated by the libvirt AppArmor profile. \n(CVE-2016-1568)\n\nDonghai Zhu discovered that QEMU incorrect handled the firmware \nconfiguration device. An attacker inside the guest could use this issue to \ncause a denial of service, or possibly execute arbitrary code on the host \nas the user running the QEMU process. In the default installation, when \nQEMU is used with libvirt, attackers would be isolated by the libvirt \nAppArmor profile. (CVE-2016-1714)\n\nIt was discovered that QEMU incorrectly handled the e1000 device. An \nattacker inside the guest could use this issue to cause QEMU to crash, \nresulting in a denial of service. (CVE-2016-1981)\n\nZuozhi Fzz discovered that QEMU incorrectly handled IDE AHCI emulation. An \nattacker inside the guest could use this issue to cause QEMU to crash, \nresulting in a denial of service. This issue only affected Ubuntu 15.10. \n(CVE-2016-2197)\n\nZuozhi Fzz discovered that QEMU incorrectly handled USB EHCI emulation. An \nattacker inside the guest could use this issue to cause QEMU to crash, \nresulting in a denial of service. This issue only affected Ubuntu 14.04 LTS \nand Ubuntu 15.10. (CVE-2016-2198)", "edition": 6, "modified": "2016-02-03T00:00:00", "published": "2016-02-03T00:00:00", "id": "USN-2891-1", "href": "https://ubuntu.com/security/notices/USN-2891-1", "title": "QEMU vulnerabilities", "type": "ubuntu", "cvss": {"score": 6.9, "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-07-02T11:41:59", "bulletinFamily": "unix", "cvelist": ["CVE-2016-2392", "CVE-2016-2858", "CVE-2016-3712", "CVE-2016-2391", "CVE-2016-3710", "CVE-2016-4002", "CVE-2016-4020", "CVE-2016-2841", "CVE-2016-4001", "CVE-2016-4037", "CVE-2016-2857", "CVE-2016-2538"], "description": "Zuozhi Fzz discovered that QEMU incorrectly handled USB OHCI emulation \nsupport. A privileged attacker inside the guest could use this issue to \ncause QEMU to crash, resulting in a denial of service. (CVE-2016-2391)\n\nQinghao Tang discovered that QEMU incorrectly handled USB Net emulation \nsupport. A privileged attacker inside the guest could use this issue to \ncause QEMU to crash, resulting in a denial of service. (CVE-2016-2392)\n\nQinghao Tang discovered that QEMU incorrectly handled USB Net emulation \nsupport. A privileged attacker inside the guest could use this issue to \ncause QEMU to crash, resulting in a denial of service, or possibly leak \nhost memory bytes. (CVE-2016-2538)\n\nHongke Yang discovered that QEMU incorrectly handled NE2000 emulation \nsupport. A privileged attacker inside the guest could use this issue to \ncause QEMU to crash, resulting in a denial of service. (CVE-2016-2841)\n\nLing Liu discovered that QEMU incorrectly handled IP checksum routines. An \nattacker inside the guest could use this issue to cause QEMU to crash, \nresulting in a denial of service, or possibly leak host memory bytes. \n(CVE-2016-2857)\n\nIt was discovered that QEMU incorrectly handled the PRNG back-end support. \nAn attacker inside the guest could use this issue to cause QEMU to crash, \nresulting in a denial of service. This issue only applied to Ubuntu 14.04 \nLTS, Ubuntu 15.10 and Ubuntu 16.04 LTS. (CVE-2016-2858)\n\nWei Xiao and Qinghao Tang discovered that QEMU incorrectly handled access \nin the VGA module. A privileged attacker inside the guest could use this \nissue to cause QEMU to crash, resulting in a denial of service, or possibly \nexecute arbitrary code on the host. In the default installation, when QEMU \nis used with libvirt, attackers would be isolated by the libvirt AppArmor \nprofile. (CVE-2016-3710)\n\nZuozhi Fzz discovered that QEMU incorrectly handled access in the VGA \nmodule. A privileged attacker inside the guest could use this issue to \ncause QEMU to crash, resulting in a denial of service, or possibly \nexecute arbitrary code on the host. In the default installation, when QEMU \nis used with libvirt, attackers would be isolated by the libvirt AppArmor \nprofile. (CVE-2016-3712)\n\nOleksandr Bazhaniuk discovered that QEMU incorrectly handled Luminary \nMicro Stellaris ethernet controller emulation. A remote attacker could use \nthis issue to cause QEMU to crash, resulting in a denial of service. \n(CVE-2016-4001)\n\nOleksandr Bazhaniuk discovered that QEMU incorrectly handled MIPSnet \ncontroller emulation. A remote attacker could use this issue to cause QEMU \nto crash, resulting in a denial of service. (CVE-2016-4002)\n\nDonghai Zdh discovered that QEMU incorrectly handled the Task Priority \nRegister(TPR). A privileged attacker inside the guest could use this issue \nto possibly leak host memory bytes. This issue only applied to Ubuntu 14.04 \nLTS, Ubuntu 15.10 and Ubuntu 16.04 LTS. (CVE-2016-4020)\n\nDu Shaobo discovered that QEMU incorrectly handled USB EHCI emulation \nsupport. A privileged attacker inside the guest could use this issue to \ncause QEMU to consume resources, resulting in a denial of service. \n(CVE-2016-4037)", "edition": 5, "modified": "2016-05-12T00:00:00", "published": "2016-05-12T00:00:00", "id": "USN-2974-1", "href": "https://ubuntu.com/security/notices/USN-2974-1", "title": "QEMU vulnerabilities", "type": "ubuntu", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}], "debian": [{"lastseen": "2020-10-17T01:27:31", "bulletinFamily": "unix", "cvelist": ["CVE-2015-8567", "CVE-2015-8619", "CVE-2015-8558", "CVE-2015-8613", "CVE-2016-1922", "CVE-2015-7504", "CVE-2015-7512", "CVE-2015-8550", "CVE-2015-8345", "CVE-2015-8568", "CVE-2015-8744", "CVE-2015-7549", "CVE-2015-8743", "CVE-2016-1568", "CVE-2015-8745", "CVE-2016-1714", "CVE-2016-1981", "CVE-2015-8504", "CVE-2015-7295"], "description": "- -------------------------------------------------------------------------\nDebian Security Advisory DSA-3471-1 security@debian.org\nhttps://www.debian.org/security/ Sebastien Delafond\nFebruary 08, 2016 https://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage : qemu\nCVE ID : CVE-2015-7295 CVE-2015-7504 CVE-2015-7512 CVE-2015-7549 \n CVE-2015-8345 CVE-2015-8504 CVE-2015-8550 CVE-2015-8558 CVE-2015-8567 CVE-2015-8568 CVE-2015-8613 CVE-2015-8619 CVE-2015-8743 CVE-2015-8744 CVE-2015-8745 CVE-2016-1568 CVE-2016-1714 CVE-2016-1922 CVE-2016-1981\nDebian Bug : 799452 806373 806741 806742 808130 808131 808144 808145 809229 809232 810519 810527 811201 812307 809237 809237\n\nSeveral vulnerabilities were discovered in qemu, a full virtualization\nsolution on x86 hardware.\n\nCVE-2015-7295\n\n Jason Wang of Red Hat Inc. discovered that the Virtual Network\n Device support is vulnerable to denial-of-service, that could\n occur when receiving large packets.\n\nCVE-2015-7504\n\n Qinghao Tang of Qihoo 360 Inc. and Ling Liu of Qihoo 360 Inc.\n discovered that the PC-Net II ethernet controller is vulnerable to\n a heap-based buffer overflow that could result in\n denial-of-service (via application crash) or arbitrary code\n execution.\n\nCVE-2015-7512\n\n Ling Liu of Qihoo 360 Inc. and Jason Wang of Red Hat Inc.\n discovered that the PC-Net II ethernet controller is vulnerable to\n a buffer overflow that could result in denial-of-service (via\n application crash) or arbitrary code execution.\n\nCVE-2015-7549\n\n Qinghao Tang of Qihoo 360 Inc. and Ling Liu of Qihoo 360\n Inc. discovered that the PCI MSI-X emulator is vulnerable to a\n null pointer dereference issue, that could lead to\n denial-of-service (via application crash).\n\nCVE-2015-8345\n\n Qinghao Tang of Qihoo 360 Inc. discovered that the eepro100\n emulator contains a flaw that could lead to an infinite loop when\n processing Command Blocks, eventually resulting in\n denial-of-service (via application crash).\n\nCVE-2015-8504\n\n Lian Yihan of Qihoo 360 Inc. discovered that the VNC display\n driver support is vulnerable to an arithmetic exception flaw that\n could lead to denial-of-service (via application crash).\n\nCVE-2015-8550\n\n Felix Wilhelm of ERNW Research that the PV backend drivers are\n vulnerable to double fetch vulnerabilities, possibly resulting in\n arbitrary code execution.\n\nCVE-2015-8558\n\n Qinghao Tang of Qihoo 360 Inc. discovered that the USB EHCI\n emulation support contains a flaw that could lead to an infinite\n loop during communication between the host controller and a device\n driver. This could lead to denial-of-service (via resource\n exhaustion).\n\nCVE-2015-8567 CVE-2015-8568\n\n Qinghao Tang of Qihoo 360 Inc. discovered that the vmxnet3 device\n emulator could be used to intentionally leak host memory, thus\n resulting in denial-of-service.\n\nCVE-2015-8613\n\n Qinghao Tang of Qihoo 360 Inc. discovered that the SCSI MegaRAID\n SAS HBA emulation support is vulnerable to a stack-based buffer\n overflow issue, that could lead to denial-of-service (via\n application crash).\n\nCVE-2015-8619\n\n Ling Liu of Qihoo 360 Inc. discovered that the Human Monitor\n Interface support is vulnerable to an out-of-bound write access\n issue that could result in denial-of-service (via application\n crash).\n\nCVE-2015-8743\n\n Ling Liu of Qihoo 360 Inc. discovered that the NE2000 emulator is\n vulnerable to an out-of-bound read/write access issue, potentially\n resulting in information leak or memory corruption.\n\nCVE-2015-8744\n\n The vmxnet3 driver incorrectly processes small packets, which could\n result in denial-of-service (via application crash).\n\nCVE-2015-8745\n\n The vmxnet3 driver incorrectly processes Interrupt Mask Registers,\n which could result in denial-of-service (via application crash).\n\nCVE-2016-1568\n\n Qinghao Tang of Qihoo 360 Inc. discovered that the IDE AHCI\n emulation support is vulnerable to a use-after-free issue, that\n could lead to denial-of-service (via application crash) or\n arbitrary code execution.\n\nCVE-2016-1714\n\n Donghai Zhu of Alibaba discovered that the Firmware Configuration\n emulation support is vulnerable to an out-of-bound read/write\n access issue, that could lead to denial-of-service (via\n application crash) or arbitrary code execution.\n\nCVE-2016-1922\n\n Ling Liu of Qihoo 360 Inc. discovered that 32-bit Windows guests\n support is vulnerable to a null pointer dereference issue, that\n could lead to denial-of-service (via application crash).\n\nCVE-2016-1981\n\n The e1000 driver is vulnerable to an infinite loop issue that\n could lead to denial-of-service (via application crash).\n\nFor the stable distribution (jessie), these problems have been fixed in\nversion 1:2.1+dfsg-12+deb8u5a.\n\nWe recommend that you upgrade your qemu packages.\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org\n", "edition": 7, "modified": "2016-02-08T19:46:19", "published": "2016-02-08T19:46:19", "id": "DEBIAN:DSA-3471-1:91F2D", "href": "https://lists.debian.org/debian-security-announce/debian-security-announce-2016/msg00041.html", "title": "[SECURITY] [DSA 3471-1] qemu security update", "type": "debian", "cvss": {"score": 6.9, "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-10-16T13:15:11", "bulletinFamily": "unix", "cvelist": ["CVE-2015-8558", "CVE-2016-1922", "CVE-2015-7504", "CVE-2015-7512", "CVE-2015-8345", "CVE-2015-8743", "CVE-2016-1568", "CVE-2016-1714", "CVE-2015-8504", "CVE-2015-7295"], "description": "- -------------------------------------------------------------------------\nDebian Security Advisory DSA-3470-1 security@debian.org\nhttps://www.debian.org/security/ Sebastien Delafond\nFebruary 08, 2016 https://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage : qemu-kvm\nCVE ID : CVE-2015-7295 CVE-2015-7504 CVE-2015-7512 CVE-2015-8345 \n CVE-2015-8504 CVE-2015-8558 CVE-2015-8743 CVE-2016-1568 CVE-2016-1714 CVE-2016-1922\nDebian Bug : 799452 806373 806741 806742 808130 808144 810519 810527 811201\n\nSeveral vulnerabilities were discovered in qemu-kvm, a full\nvirtualization solution on x86 hardware.\n\nCVE-2015-7295\n\n Jason Wang of Red Hat Inc. discovered that the Virtual Network\n Device support is vulnerable to denial-of-service (via resource\n exhaustion), that could occur when receiving large packets.\n\nCVE-2015-7504\n\n Qinghao Tang of Qihoo 360 Inc. and Ling Liu of Qihoo 360 Inc.\n discovered that the PC-Net II ethernet controller is vulnerable to\n a heap-based buffer overflow that could result in\n denial-of-service (via application crash) or arbitrary code\n execution.\n\nCVE-2015-7512\n\n Ling Liu of Qihoo 360 Inc. and Jason Wang of Red Hat Inc.\n discovered that the PC-Net II ethernet controller is vulnerable to\n a buffer overflow that could result in denial-of-service (via\n application crash) or arbitrary code execution.\n\nCVE-2015-8345\n\n Qinghao Tang of Qihoo 360 Inc. discovered that the eepro100\n emulator contains a flaw that could lead to an infinite loop when\n processing Command Blocks, eventually resulting in\n denial-of-service (via application crash).\n\nCVE-2015-8504\n\n Lian Yihan of Qihoo 360 Inc. discovered that the VNC display\n driver support is vulnerable to an arithmetic exception flaw that\n could lead to denial-of-service (via application crash).\n\nCVE-2015-8558\n\n Qinghao Tang of Qihoo 360 Inc. discovered that the USB EHCI\n emulation support contains a flaw that could lead to an infinite\n loop during communication between the host controller and a device\n driver. This could lead to denial-of-service (via resource\n exhaustion).\n\nCVE-2015-8743\n\n Ling Liu of Qihoo 360 Inc. discovered that the NE2000 emulator is\n vulnerable to an out-of-bound read/write access issue, potentially\n resulting in information leak or memory corruption.\n\nCVE-2016-1568\n\n Qinghao Tang of Qihoo 360 Inc. discovered that the IDE AHCI\n emulation support is vulnerable to a use-after-free issue, that\n could lead to denial-of-service (via application crash) or\n arbitrary code execution.\n\nCVE-2016-1714\n\n Donghai Zhu of Alibaba discovered that the Firmware Configuration\n emulation support is vulnerable to an out-of-bound read/write\n access issue, that could lead to denial-of-service (via\n application crash) or arbitrary code execution.\n\nCVE-2016-1922\n\n Ling Liu of Qihoo 360 Inc. discovered that 32-bit Windows guests\n support is vulnerable to a null pointer dereference issue, that\n could lead to denial-of-service (via application crash).\n\nFor the oldstable distribution (wheezy), these problems have been fixed\nin version 1.1.2+dfsg-6+deb7u12.\n\nWe recommend that you upgrade your qemu-kvm packages.\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org\n", "edition": 4, "modified": "2016-02-08T19:46:11", "published": "2016-02-08T19:46:11", "id": "DEBIAN:DSA-3470-1:E622E", "href": "https://lists.debian.org/debian-security-announce/debian-security-announce-2016/msg00040.html", "title": "[SECURITY] [DSA 3470-1] qemu-kvm security update", "type": "debian", "cvss": {"score": 6.9, "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-10-16T13:17:36", "bulletinFamily": "unix", "cvelist": ["CVE-2015-8558", "CVE-2016-1922", "CVE-2015-7504", "CVE-2015-7512", "CVE-2015-8345", "CVE-2015-8743", "CVE-2016-1568", "CVE-2016-1714", "CVE-2015-8504", "CVE-2015-7295"], "description": "- -------------------------------------------------------------------------\nDebian Security Advisory DSA-3469-1 security@debian.org\nhttps://www.debian.org/security/ Sebastien Delafond\nFebruary 08, 2016 https://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage : qemu\nCVE ID : CVE-2015-7295 CVE-2015-7504 CVE-2015-7512 CVE-2015-8345 \n CVE-2015-8504 CVE-2015-8558 CVE-2015-8743 CVE-2016-1568 CVE-2016-1714 CVE-2016-1922\nDebian Bug : 799452 806373 806741 806742 808130 808144 810519 810527 811201\n\nSeveral vulnerabilities were discovered in qemu, a full virtualization\nsolution on x86 hardware.\n\nCVE-2015-7295\n\n Jason Wang of Red Hat Inc. discovered that the Virtual Network\n Device support is vulnerable to denial-of-service (via resource\n exhaustion), that could occur when receiving large packets.\n\nCVE-2015-7504\n\n Qinghao Tang of Qihoo 360 Inc. and Ling Liu of Qihoo 360 Inc.\n discovered that the PC-Net II ethernet controller is vulnerable to\n a heap-based buffer overflow that could result in\n denial-of-service (via application crash) or arbitrary code\n execution.\n\nCVE-2015-7512\n\n Ling Liu of Qihoo 360 Inc. and Jason Wang of Red Hat Inc.\n discovered that the PC-Net II ethernet controller is vulnerable to\n a buffer overflow that could result in denial-of-service (via\n application crash) or arbitrary code execution.\n\nCVE-2015-8345\n\n Qinghao Tang of Qihoo 360 Inc. discovered that the eepro100\n emulator contains a flaw that could lead to an infinite loop when\n processing Command Blocks, eventually resulting in\n denial-of-service (via application crash).\n\nCVE-2015-8504\n\n Lian Yihan of Qihoo 360 Inc. discovered that the VNC display\n driver support is vulnerable to an arithmetic exception flaw that\n could lead to denial-of-service (via application crash).\n\nCVE-2015-8558\n\n Qinghao Tang of Qihoo 360 Inc. discovered that the USB EHCI\n emulation support contains a flaw that could lead to an infinite\n loop during communication between the host controller and a device\n driver. This could lead to denial-of-service (via resource\n exhaustion).\n\nCVE-2015-8743\n\n Ling Liu of Qihoo 360 Inc. discovered that the NE2000 emulator is\n vulnerable to an out-of-bound read/write access issue, potentially\n resulting in information leak or memory corruption.\n\nCVE-2016-1568\n\n Qinghao Tang of Qihoo 360 Inc. discovered that the IDE AHCI\n emulation support is vulnerable to a use-after-free issue, that\n could lead to denial-of-service (via application crash) or\n arbitrary code execution.\n\nCVE-2016-1714\n\n Donghai Zhu of Alibaba discovered that the Firmware Configuration\n emulation support is vulnerable to an out-of-bound read/write\n access issue, that could lead to denial-of-service (via\n application crash) or arbitrary code execution.\n\nCVE-2016-1922\n\n Ling Liu of Qihoo 360 Inc. discovered that 32-bit Windows guests\n support is vulnerable to a null pointer dereference issue, that\n could lead to denial-of-service (via application crash).\n\nFor the oldstable distribution (wheezy), these problems have been fixed\nin version 1.1.2+dfsg-6a+deb7u12.\n\nWe recommend that you upgrade your qemu packages.\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org\n", "edition": 4, "modified": "2016-02-08T19:46:02", "published": "2016-02-08T19:46:02", "id": "DEBIAN:DSA-3469-1:9C2F1", "href": "https://lists.debian.org/debian-security-announce/debian-security-announce-2016/msg00039.html", "title": "[SECURITY] [DSA 3469-1] qemu security update", "type": "debian", "cvss": {"score": 6.9, "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"}}], "fedora": [{"lastseen": "2020-12-21T08:17:53", "bulletinFamily": "unix", "cvelist": ["CVE-2015-8613", "CVE-2015-8817", "CVE-2015-8818", "CVE-2016-1714", "CVE-2016-1922", "CVE-2016-1981", "CVE-2016-2198", "CVE-2016-2391", "CVE-2016-2392", "CVE-2016-2538", "CVE-2016-2841", "CVE-2016-2857", "CVE-2016-2858"], "description": "This package contains the XenD daemon and xm command line tools, needed to manage virtual machines running under the Xen hypervisor ", "modified": "2016-03-20T02:32:30", "published": "2016-03-20T02:32:30", "id": "FEDORA:068D36097257", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 23 Update: xen-4.5.2-9.fc23", "cvss": {"score": 6.9, "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-12-21T08:17:53", "bulletinFamily": "unix", "cvelist": ["CVE-2015-8613", "CVE-2015-8817", "CVE-2015-8818", "CVE-2016-1714", "CVE-2016-1922", "CVE-2016-1981", "CVE-2016-2198", "CVE-2016-2391", "CVE-2016-2392", "CVE-2016-2538", "CVE-2016-2841", "CVE-2016-2857", "CVE-2016-2858"], "description": "This package contains the XenD daemon and xm command line tools, needed to manage virtual machines running under the Xen hypervisor ", "modified": "2016-03-19T21:28:58", "published": "2016-03-19T21:28:58", "id": "FEDORA:0BA3A605A0E5", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 22 Update: xen-4.5.2-9.fc22", "cvss": {"score": 6.9, "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-12-21T08:17:53", "bulletinFamily": "unix", "cvelist": ["CVE-2015-8567", "CVE-2015-8568", "CVE-2015-8613", "CVE-2015-8701", "CVE-2015-8743", "CVE-2015-8745", "CVE-2016-1568", "CVE-2016-1922"], "description": "QEMU is a generic and open source processor emulator which achieves a good emulation speed by using dynamic translation. QEMU has two operating modes: * Full system emulation. In this mode, QEMU emulates a full system (for example a PC), including a processor and various peripherials. It can be used to launch different Operating Systems without rebooting the PC or to debug system code. * User mode emulation. In this mode, QEMU can launch Linux processes compi led for one CPU on another CPU. As QEMU requires no host kernel patches to run, it is safe and easy to use. ", "modified": "2016-01-24T03:34:25", "published": "2016-01-24T03:34:25", "id": "FEDORA:A686460350CF", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 23 Update: qemu-2.4.1-6.fc23", "cvss": {"score": 6.9, "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-12-21T08:17:53", "bulletinFamily": "unix", "cvelist": ["CVE-2015-8567", "CVE-2015-8568", "CVE-2015-8613", "CVE-2015-8743", "CVE-2016-1922"], "description": "QEMU is a generic and open source processor emulator which achieves a good emulation speed by using dynamic translation. QEMU has two operating modes: * Full system emulation. In this mode, QEMU emulates a full system (for example a PC), including a processor and various peripherials. It can be used to launch different Operating Systems without rebooting the PC or to debug system code. * User mode emulation. In this mode, QEMU can launch Linux processes compi led for one CPU on another CPU. As QEMU requires no host kernel patches to run, it is safe and easy to use. ", "modified": "2016-02-02T00:56:23", "published": "2016-02-02T00:56:23", "id": "FEDORA:0C5CE60528EE", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 22 Update: qemu-2.3.1-11.fc22", "cvss": {"score": 6.8, "vector": "AV:N/AC:L/Au:S/C:N/I:N/A:C"}}, {"lastseen": "2020-12-21T08:17:53", "bulletinFamily": "unix", "cvelist": ["CVE-2016-2198", "CVE-2016-2391", "CVE-2016-2858", "CVE-2016-3710", "CVE-2016-3712", "CVE-2016-4001", "CVE-2016-4037"], "description": "QEMU is a generic and open source processor emulator which achieves a good emulation speed by using dynamic translation. QEMU has two operating modes: * Full system emulation. In this mode, QEMU emulates a full system (for example a PC), including a processor and various peripherials. It can be used to launch different Operating Systems without rebooting the PC or to debug system code. * User mode emulation. In this mode, QEMU can launch Linux processes compi led for one CPU on another CPU. As QEMU requires no host kernel patches to run, it is safe and easy to use. ", "modified": "2016-05-20T23:53:50", "published": "2016-05-20T23:53:50", "id": "FEDORA:9C91760D32D9", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 22 Update: qemu-2.3.1-14.fc22", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-12-21T08:17:53", "bulletinFamily": "unix", "cvelist": ["CVE-2016-2198", "CVE-2016-2391", "CVE-2016-2858", "CVE-2016-3710", "CVE-2016-3712", "CVE-2016-4001", "CVE-2016-4037"], "description": "QEMU is a generic and open source processor emulator which achieves a good emulation speed by using dynamic translation. QEMU has two operating modes: * Full system emulation. In this mode, QEMU emulates a full system (for example a PC), including a processor and various peripherials. It can be used to launch different Operating Systems without rebooting the PC or to debug system code. * User mode emulation. In this mode, QEMU can launch Linux processes compi led for one CPU on another CPU. As QEMU requires no host kernel patches to run, it is safe and easy to use. ", "modified": "2016-05-15T05:33:39", "published": "2016-05-15T05:33:39", "id": "FEDORA:60C2562E61B8", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 23 Update: qemu-2.4.1-9.fc23", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-12-21T08:17:53", "bulletinFamily": "unix", "cvelist": ["CVE-2015-7549", "CVE-2015-8558", "CVE-2015-8567", "CVE-2015-8568", "CVE-2015-8666", "CVE-2015-8743", "CVE-2015-8744", "CVE-2015-8745", "CVE-2016-1570", "CVE-2016-1571"], "description": "This package contains the XenD daemon and xm command line tools, needed to manage virtual machines running under the Xen hypervisor ", "modified": "2016-02-01T06:35:52", "published": "2016-02-01T06:35:52", "id": "FEDORA:2FEAA604E478", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 22 Update: xen-4.5.2-7.fc22", "cvss": {"score": 6.9, "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-12-21T08:17:53", "bulletinFamily": "unix", "cvelist": ["CVE-2015-7549", "CVE-2015-8558", "CVE-2015-8567", "CVE-2015-8568", "CVE-2015-8666", "CVE-2015-8743", "CVE-2015-8744", "CVE-2015-8745", "CVE-2016-1570", "CVE-2016-1571"], "description": "This package contains the XenD daemon and xm command line tools, needed to manage virtual machines running under the Xen hypervisor ", "modified": "2016-01-28T18:35:02", "published": "2016-01-28T18:35:02", "id": "FEDORA:D3EC061CDFC5", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 23 Update: xen-4.5.2-7.fc23", "cvss": {"score": 6.9, "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-12-21T08:17:53", "bulletinFamily": "unix", "cvelist": ["CVE-2015-7549", "CVE-2015-8558", "CVE-2015-8666", "CVE-2015-8744", "CVE-2015-8745"], "description": "QEMU is a generic and open source processor emulator which achieves a good emulation speed by using dynamic translation. QEMU has two operating modes: * Full system emulation. In this mode, QEMU emulates a full system (for example a PC), including a processor and various peripherials. It can be used to launch different Operating Systems without rebooting the PC or to debug system code. * User mode emulation. In this mode, QEMU can launch Linux processes compi led for one CPU on another CPU. As QEMU requires no host kernel patches to run, it is safe and easy to use. ", "modified": "2016-01-12T08:02:56", "published": "2016-01-12T08:02:56", "id": "FEDORA:8F26C604D751", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 23 Update: qemu-2.4.1-5.fc23", "cvss": {"score": 4.9, "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2020-12-21T08:17:53", "bulletinFamily": "unix", "cvelist": ["CVE-2015-7549", "CVE-2015-8558", "CVE-2015-8666", "CVE-2015-8744", "CVE-2015-8745"], "description": "QEMU is a generic and open source processor emulator which achieves a good emulation speed by using dynamic translation. QEMU has two operating modes: * Full system emulation. In this mode, QEMU emulates a full system (for example a PC), including a processor and various peripherials. It can be used to launch different Operating Systems without rebooting the PC or to debug system code. * User mode emulation. In this mode, QEMU can launch Linux processes compi led for one CPU on another CPU. As QEMU requires no host kernel patches to run, it is safe and easy to use. ", "modified": "2016-01-19T23:57:26", "published": "2016-01-19T23:57:26", "id": "FEDORA:2F4596049D3C", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 22 Update: qemu-2.3.1-10.fc22", "cvss": {"score": 4.9, "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"}}], "gentoo": [{"lastseen": "2016-09-06T19:46:37", "bulletinFamily": "unix", "cvelist": ["CVE-2016-2392", "CVE-2016-2858", "CVE-2015-8619", "CVE-2015-8613", "CVE-2016-1922", "CVE-2016-2198", "CVE-2016-2197", "CVE-2016-1714", "CVE-2016-1981", "CVE-2016-2538"], "edition": 1, "description": "### Background\n\nQEMU is a generic and open source machine emulator and virtualizer.\n\n### Description\n\nMultiple vulnerabilities have been discovered in QEMU. Please review the CVE identifiers referenced below for details. \n\n### Impact\n\nLocal users within a guest QEMU environment can execute arbitrary code within the host or a cause a Denial of Service condition of the QEMU guest process. \n\n### Workaround\n\nThere is no known workaround at this time.\n\n### Resolution\n\nAll QEMU users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=app-emulation/qemu-2.5.0-r2\"", "modified": "2016-04-02T00:00:00", "published": "2016-04-02T00:00:00", "id": "GLSA-201604-01", "href": "https://security.gentoo.org/glsa/201604-01", "type": "gentoo", "title": "QEMU: Multiple vulnerabilities", "cvss": {"score": 6.9, "vector": "AV:LOCAL/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "f5": [{"lastseen": "2016-11-09T00:09:56", "bulletinFamily": "software", "cvelist": ["CVE-2016-2392", "CVE-2016-2858", "CVE-2015-8619", "CVE-2015-8613", "CVE-2016-1922", "CVE-2016-2198", "CVE-2016-2197", "CVE-2016-1981", "CVE-2016-2538"], "description": "Vulnerability Recommended Actions\n\nNone\n\nSupplemental Information\n\n * SOL9970: Subscribing to email notifications regarding F5 products\n * SOL9957: Creating a custom RSS feed to view new and updated documents\n * SOL4602: Overview of the F5 security vulnerability response policy\n * SOL4918: Overview of the F5 critical issue hotfix policy\n", "edition": 1, "modified": "2016-05-10T00:00:00", "published": "2016-05-10T00:00:00", "id": "SOL04755144", "href": "http://support.f5.com/kb/en-us/solutions/public/k/04/sol04755144.html", "type": "f5", "title": "SOL04755144 - Multiple QEMU vulnerabilities", "cvss": {"score": 4.7, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:LOW/"}}, {"lastseen": "2019-04-30T18:21:00", "bulletinFamily": "software", "cvelist": ["CVE-2016-2392", "CVE-2016-2858", "CVE-2015-8619", "CVE-2015-8613", "CVE-2016-1922", "CVE-2016-2198", "CVE-2016-2197", "CVE-2016-1981", "CVE-2016-2538"], "description": "\nF5 Product Development has evaluated the currently supported releases for potential vulnerability.\n\nTo determine if your release is known to be vulnerable, the components or features that are affected by the vulnerability, and for information about releases or hotfixes that address the vulnerability, refer to the following table:\n\nProduct| Versions known to be vulnerable| Versions known to be not vulnerable| Severity| Vulnerable component or feature \n---|---|---|---|--- \nBIG-IP LTM| None \n| 12.0.0 \n11.0.0 - 11.6.0 \n10.1.0 - 10.2.4 \n| Not vulnerable| None \n \nBIG-IP AAM| None| 12.0.0 \n11.4.0 - 11.6.0 \n| Not vulnerable| None \n \nBIG-IP AFM| None| 12.0.0 \n11.3.0 - 11.6.0 \n| Not vulnerable| None \n \nBIG-IP Analytics| None| 12.0.0 \n11.0.0 - 11.6.0 \n| Not vulnerable| None \n \nBIG-IP APM| None| 12.0.0 \n11.0.0 - 11.6.0 \n10.1.0 - 10.2.4 \n| Not vulnerable| None \n \nBIG-IP ASM| None| 12.0.0 \n11.0.0 - 11.6.0 \n10.1.0 - 10.2.4 \n| Not vulnerable \n| None \n \nBIG-IP DNS| None| 12.0.0 \n| Not vulnerable \n| None \n \nBIG-IP Edge Gateway| None| 11.0.0 - 11.3.0 \n10.1.0 - 10.2.4 \n| Not vulnerable| None \n \nBIG-IP GTM| None| 11.0.0 - 11.6.0 \n10.1.0 - 10.2.4 \n| Not vulnerable| None \n \nBIG-IP Link Controller| None| 12.0.0 \n11.0.0 - 11.6.0 \n10.1.0 - 10.2.4 \n| Not vulnerable| None \nBIG-IP PEM| None| 12.0.0 \n11.3.0 - 11.6.0 \n| Not vulnerable \n| None \n \nBIG-IP PSM| None| 11.0.0 - 11.4.1 \n10.1.0 - 10.2.4 \n| Not vulnerable \n| None \n \nBIG-IP WebAccelerator| None \n| 11.0.0 - 11.3.0 \n10.1.0 - 10.2.4 \n| Not vulnerable| None \n \nBIG-IP WOM| None| 11.0.0 - 11.3.0 \n10.1.0 - 10.2.4 \n| Not vulnerable \n| None \n \nARX| None| 6.0.0 - 6.4.0 \n| Not vulnerable \n| None \n \nEnterprise Manager| None| 3.0.0 - 3.1.1 \n| Not vulnerable| None \n \nFirePass| None| 7.0.0 \n6.0.0 - 6.1.0 \n| Not vulnerable| None \n \nBIG-IQ Cloud| None| 4.0.0 - 4.5.0 \n| Not vulnerable| None \n \nBIG-IQ Device| None| 4.2.0 - 4.5.0 \n| Not vulnerable| None \n \nBIG-IQ Security| None| 4.0.0 - 4.5.0 \n| Not vulnerable \n| None \n \nBIG-IQ ADC| None| 4.5.0 \n| Not vulnerable| None \n \nBIG-IQ Centralized Management| None| 4.6.0 \n| Not vulnerable| None \n \nBIG-IQ Cloud and Orchestration| None| 1.0.0 \n| Not vulnerable| None \n \nLineRate| None| 2.5.0 - 2.6.1 \n| Not vulnerable| None \n \nF5 WebSafe| None| 1.0.0 \n| Not vulnerable| None \n \nTraffix SDC| None| 4.0.0 - 4.4.0 \n3.3.2 - 3.5.1 \n \n| Not vulnerable \n| None \n\n\nNone\n\n * K9970: Subscribing to email notifications regarding F5 products\n * K9957: Creating a custom RSS feed to view new and updated documents\n * K4602: Overview of the F5 security vulnerability response policy\n * K4918: Overview of the F5 critical issue hotfix policy\n", "edition": 1, "modified": "2017-04-27T18:44:00", "published": "2016-05-11T01:05:00", "id": "F5:K04755144", "href": "https://support.f5.com/csp/article/K04755144", "title": "Multiple QEMU vulnerabilities", "type": "f5", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}], "cve": [{"lastseen": "2020-10-03T12:01:24", "description": "The (1) BMDMA and (2) AHCI HBA interfaces in the IDE functionality in QEMU 1.0 through 2.1.3 have multiple interpretations of a function's return value, which allows guest OS users to cause a host OS denial of service (memory consumption or infinite loop, and system crash) via a PRDT with zero complete sectors, related to the bmdma_prepare_buf and ahci_dma_prepare_buf functions.", "edition": 3, "cvss3": {}, "published": "2015-04-21T16:59:00", "title": "CVE-2014-9718", "type": "cve", "cwe": ["CWE-399"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "COMPLETE", "integrityImpact": "NONE", "baseScore": 4.9, "vectorString": "AV:L/AC:L/Au:N/C:N/I:N/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 6.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2014-9718"], "modified": "2016-06-23T18:30:00", "cpe": ["cpe:/a:qemu:qemu:1.6.1", "cpe:/a:qemu:qemu:2.1.2", "cpe:/a:qemu:qemu:2.1.1", "cpe:/a:qemu:qemu:1.0.1", "cpe:/a:qemu:qemu:2.0.0", "cpe:/o:debian:debian_linux:8.0", "cpe:/a:qemu:qemu:1.6.0", "cpe:/a:qemu:qemu:1.0", "cpe:/a:qemu:qemu:1.5.1", "cpe:/a:qemu:qemu:1.6.2", "cpe:/a:qemu:qemu:1.5.3", "cpe:/a:qemu:qemu:2.0.2", "cpe:/a:qemu:qemu:1.7.1", "cpe:/a:qemu:qemu:1.5.2", "cpe:/a:qemu:qemu:1.5.0", "cpe:/a:qemu:qemu:2.1.0", "cpe:/a:qemu:qemu:1.4.1", "cpe:/a:qemu:qemu:1.4.2", "cpe:/a:qemu:qemu:1.1", "cpe:/a:qemu:qemu:2.1.3"], "id": "CVE-2014-9718", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9718", "cvss": {"score": 4.9, "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"}, "cpe23": ["cpe:2.3:a:qemu:qemu:2.0.0:-:*:*:*:*:*:*", "cpe:2.3:a:qemu:qemu:2.0.0:rc1:*:*:*:*:*:*", "cpe:2.3:a:qemu:qemu:1.6.0:rc3:*:*:*:*:*:*", "cpe:2.3:a:qemu:qemu:1.6.0:rc2:*:*:*:*:*:*", "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*", "cpe:2.3:a:qemu:qemu:1.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:qemu:qemu:1.0:rc4:*:*:*:*:*:*", "cpe:2.3:a:qemu:qemu:2.1.2:*:*:*:*:*:*:*", "cpe:2.3:a:qemu:qemu:1.0:rc1:*:*:*:*:*:*", "cpe:2.3:a:qemu:qemu:1.5.2:*:*:*:*:*:*:*", "cpe:2.3:a:qemu:qemu:1.5.0:rc3:*:*:*:*:*:*", "cpe:2.3:a:qemu:qemu:1.1:rc2:*:*:*:*:*:*", "cpe:2.3:a:qemu:qemu:1.6.2:*:*:*:*:*:*:*", "cpe:2.3:a:qemu:qemu:1.1:rc1:*:*:*:*:*:*", "cpe:2.3:a:qemu:qemu:2.1.3:*:*:*:*:*:*:*", "cpe:2.3:a:qemu:qemu:1.1:rc4:*:*:*:*:*:*", "cpe:2.3:a:qemu:qemu:1.0:rc3:*:*:*:*:*:*", "cpe:2.3:a:qemu:qemu:2.0.0:rc2:*:*:*:*:*:*", "cpe:2.3:a:qemu:qemu:2.1.0:rc1:*:*:*:*:*:*", "cpe:2.3:a:qemu:qemu:2.0.0:rc3:*:*:*:*:*:*", "cpe:2.3:a:qemu:qemu:1.5.0:rc1:*:*:*:*:*:*", "cpe:2.3:a:qemu:qemu:1.6.1:*:*:*:*:*:*:*", "cpe:2.3:a:qemu:qemu:2.1.0:rc5:*:*:*:*:*:*", "cpe:2.3:a:qemu:qemu:2.1.0:rc2:*:*:*:*:*:*", "cpe:2.3:a:qemu:qemu:1.0:rc2:*:*:*:*:*:*", "cpe:2.3:a:qemu:qemu:1.1:*:*:*:*:*:*:*", "cpe:2.3:a:qemu:qemu:2.0.2:*:*:*:*:*:*:*", "cpe:2.3:a:qemu:qemu:1.4.2:*:*:*:*:*:*:*", "cpe:2.3:a:qemu:qemu:1.5.0:*:*:*:*:*:*:*", "cpe:2.3:a:qemu:qemu:1.4.1:*:*:*:*:*:*:*", "cpe:2.3:a:qemu:qemu:1.6.0:rc1:*:*:*:*:*:*", "cpe:2.3:a:qemu:qemu:2.1.0:rc0:*:*:*:*:*:*", "cpe:2.3:a:qemu:qemu:1.5.1:*:*:*:*:*:*:*", "cpe:2.3:a:qemu:qemu:2.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:qemu:qemu:1.0:*:*:*:*:*:*:*", "cpe:2.3:a:qemu:qemu:1.1:rc3:*:*:*:*:*:*", "cpe:2.3:a:qemu:qemu:2.1.1:*:*:*:*:*:*:*", "cpe:2.3:a:qemu:qemu:1.7.1:*:*:*:*:*:*:*", "cpe:2.3:a:qemu:qemu:1.5.0:rc2:*:*:*:*:*:*", "cpe:2.3:a:qemu:qemu:2.0.0:rc0:*:*:*:*:*:*", "cpe:2.3:a:qemu:qemu:1.5.3:*:*:*:*:*:*:*", "cpe:2.3:a:qemu:qemu:1.6.0:*:*:*:*:*:*:*", "cpe:2.3:a:qemu:qemu:2.1.0:rc3:*:*:*:*:*:*"]}, {"lastseen": "2020-12-09T20:03:08", "description": "Stack-based buffer overflow in the megasas_ctrl_get_info function in QEMU, when built with SCSI MegaRAID SAS HBA emulation support, allows local guest users to cause a denial of service (QEMU instance crash) via a crafted SCSI controller CTRL_GET_INFO command.", "edition": 6, "cvss3": {"exploitabilityScore": 2.0, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "NONE", "baseScore": 6.5, "privilegesRequired": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H", "userInteraction": "NONE", "version": "3.1"}, "impactScore": 4.0}, "published": "2017-04-11T19:59:00", "title": "CVE-2015-8613", "type": "cve", "cwe": ["CWE-787"], "bulletinFamily": "NVD", "cvss2": {"severity": "LOW", "exploitabilityScore": 3.4, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 1.9, "vectorString": "AV:L/AC:M/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-8613"], "modified": "2020-09-11T15:20:00", "cpe": ["cpe:/a:qemu:qemu:2.5.1", "cpe:/o:debian:debian_linux:8.0"], "id": "CVE-2015-8613", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8613", "cvss": {"score": 1.9, "vector": "AV:L/AC:M/Au:N/C:N/I:N/A:P"}, "cpe23": ["cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*", "cpe:2.3:a:qemu:qemu:2.5.1:*:*:*:*:*:*:*"]}, {"lastseen": "2020-12-09T20:03:09", "description": "QEMU (aka Quick Emulator) built with a VMWARE VMXNET3 paravirtual NIC emulator support is vulnerable to crash issue. It occurs when a guest sends a Layer-2 packet smaller than 22 bytes. A privileged (CAP_SYS_RAWIO) guest user could use this flaw to crash the QEMU process instance resulting in DoS.", "edition": 6, "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "NONE", "baseScore": 5.5, "privilegesRequired": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "userInteraction": "NONE", "version": "3.1"}, "impactScore": 3.6}, "published": "2016-12-29T22:59:00", "title": "CVE-2015-8744", "type": "cve", "cwe": ["CWE-20"], "bulletinFamily": "NVD", "cvss2": {"severity": "LOW", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 2.1, "vectorString": "AV:L/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-8744"], "modified": "2020-11-10T17:54:00", "cpe": ["cpe:/o:debian:debian_linux:8.0", "cpe:/a:qemu:qemu:2.4.1"], "id": "CVE-2015-8744", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8744", "cvss": {"score": 2.1, "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:P"}, "cpe23": ["cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*", "cpe:2.3:a:qemu:qemu:2.4.1:*:*:*:*:*:*:*"]}, {"lastseen": "2020-12-09T20:03:09", "description": "The cpu_physical_memory_write_rom_internal function in exec.c in QEMU (aka Quick Emulator) does not properly skip MMIO regions, which allows local privileged guest users to cause a denial of service (guest crash) via unspecified vectors.", "edition": 6, "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "NONE", "baseScore": 5.5, "privilegesRequired": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "userInteraction": "NONE", "version": "3.1"}, "impactScore": 3.6}, "published": "2016-12-29T22:59:00", "title": "CVE-2015-8818", "type": "cve", "cwe": ["NVD-CWE-noinfo"], "bulletinFamily": "NVD", "cvss2": {"severity": "LOW", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 2.1, "vectorString": "AV:L/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-8818"], "modified": "2020-11-10T18:55:00", "cpe": ["cpe:/a:qemu:qemu:2.3.1"], "id": "CVE-2015-8818", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8818", "cvss": {"score": 2.1, "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:P"}, "cpe23": ["cpe:2.3:a:qemu:qemu:2.3.1:*:*:*:*:*:*:*"]}, {"lastseen": "2020-12-09T20:03:08", "description": "Memory leak in QEMU, when built with a VMWARE VMXNET3 paravirtual NIC emulator support, allows local guest users to cause a denial of service (host memory consumption) by trying to activate the vmxnet3 device repeatedly.", "edition": 6, "cvss3": {"exploitabilityScore": 2.0, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "NONE", "baseScore": 6.5, "privilegesRequired": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H", "userInteraction": "NONE", "version": "3.1"}, "impactScore": 4.0}, "published": "2017-04-11T19:59:00", "title": "CVE-2015-8568", "type": "cve", "cwe": ["CWE-772"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 3.4, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "COMPLETE", "integrityImpact": "NONE", "baseScore": 4.7, "vectorString": "AV:L/AC:M/Au:N/C:N/I:N/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 6.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-8568"], "modified": "2020-09-10T17:42:00", "cpe": ["cpe:/a:qemu:qemu:2.5.1", "cpe:/o:debian:debian_linux:8.0"], "id": "CVE-2015-8568", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8568", "cvss": {"score": 4.7, "vector": "AV:L/AC:M/Au:N/C:N/I:N/A:C"}, "cpe23": ["cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*", "cpe:2.3:a:qemu:qemu:2.5.1:*:*:*:*:*:*:*"]}, {"lastseen": "2020-12-09T20:03:07", "description": "hw/virtio/virtio.c in the Virtual Network Device (virtio-net) support in QEMU, when big or mergeable receive buffers are not supported, allows remote attackers to cause a denial of service (guest network consumption) via a flood of jumbo frames on the (1) tuntap or (2) macvtap interface.", "edition": 6, "cvss3": {}, "published": "2015-11-09T16:59:00", "title": "CVE-2015-7295", "type": "cve", "cwe": ["CWE-119"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-7295"], "modified": "2020-09-09T15:14:00", "cpe": ["cpe:/o:debian:debian_linux:8.0", "cpe:/a:qemu:qemu:2.4.1", "cpe:/o:fedoraproject:fedora:21", "cpe:/o:debian:debian_linux:7.0", "cpe:/o:fedoraproject:fedora:22"], "id": "CVE-2015-7295", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7295", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}, "cpe23": ["cpe:2.3:o:fedoraproject:fedora:21:*:*:*:*:*:*:*", "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*", "cpe:2.3:a:qemu:qemu:2.4.1:*:*:*:*:*:*:*", "cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:*", "cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*"]}, {"lastseen": "2020-12-09T20:03:08", "description": "Memory leak in net/vmxnet3.c in QEMU allows remote attackers to cause a denial of service (memory consumption).", "edition": 6, "cvss3": {"exploitabilityScore": 3.1, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "NONE", "baseScore": 7.7, "privilegesRequired": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H", "userInteraction": "NONE", "version": "3.1"}, "impactScore": 4.0}, "published": "2017-04-13T17:59:00", "title": "CVE-2015-8567", "type": "cve", "cwe": ["CWE-401"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "COMPLETE", "integrityImpact": "NONE", "baseScore": 6.8, "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "acInsufInfo": false, "impactScore": 6.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-8567"], "modified": "2020-09-09T15:12:00", "cpe": ["cpe:/a:qemu:qemu:2.5.1.1", "cpe:/o:suse:linux_enterprise_desktop:12", "cpe:/o:debian:debian_linux:8.0", "cpe:/o:canonical:ubuntu_linux:12.04", "cpe:/a:suse:linux_enterprise_debuginfo:11", "cpe:/o:suse:linux_enterprise_software_development_kit:11", "cpe:/o:suse:linux_enterprise_software_development_kit:12", "cpe:/o:canonical:ubuntu_linux:15.10", "cpe:/o:opensuse:opensuse:13.2", "cpe:/o:opensuse:leap:42.1", "cpe:/o:suse:linux_enterprise_server:12", "cpe:/o:suse:linux_enterprise_server:11", "cpe:/o:suse:linux_enterprise_desktop:11", "cpe:/o:fedoraproject:fedora:22", "cpe:/o:fedoraproject:fedora:23", "cpe:/o:canonical:ubuntu_linux:14.04"], "id": "CVE-2015-8567", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8567", "cvss": {"score": 6.8, "vector": "AV:N/AC:L/Au:S/C:N/I:N/A:C"}, "cpe23": ["cpe:2.3:o:suse:linux_enterprise_server:12:sp1:*:*:*:*:*:*", "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*", "cpe:2.3:o:suse:linux_enterprise_software_development_kit:12:sp1:*:*:*:*:*:*", "cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*", "cpe:2.3:a:qemu:qemu:2.5.1.1:*:*:*:*:*:*:*", "cpe:2.3:o:suse:linux_enterprise_server:12:-:*:*:*:*:*:*", "cpe:2.3:o:suse:linux_enterprise_server:11:sp4:*:*:*:*:*:*", "cpe:2.3:a:suse:linux_enterprise_debuginfo:11:sp4:*:*:*:*:*:*", "cpe:2.3:o:suse:linux_enterprise_software_development_kit:12:-:*:*:*:*:*:*", "cpe:2.3:o:fedoraproject:fedora:23:*:*:*:*:*:*:*", "cpe:2.3:o:suse:linux_enterprise_desktop:12:-:*:*:*:*:*:*", "cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:*", "cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*", "cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:*", "cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp4:*:*:*:*:*:*", "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*", "cpe:2.3:o:suse:linux_enterprise_desktop:11:sp4:*:*:*:*:*:*", "cpe:2.3:o:suse:linux_enterprise_desktop:12:sp1:*:*:*:*:*:*", "cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*"]}, {"lastseen": "2020-12-09T20:03:07", "description": "The MSI-X MMIO support in hw/pci/msix.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (NULL pointer dereference and QEMU process crash) by leveraging failure to define the .write method.", "edition": 5, "cvss3": {"exploitabilityScore": 1.5, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "NONE", "baseScore": 6.0, "privilegesRequired": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H", "userInteraction": "NONE", "version": "3.0"}, "impactScore": 4.0}, "published": "2017-10-30T14:29:00", "title": "CVE-2015-7549", "type": "cve", "cwe": ["CWE-476"], "bulletinFamily": "NVD", "cvss2": {"severity": "LOW", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 2.1, "vectorString": "AV:L/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-7549"], "modified": "2017-11-21T15:31:00", "cpe": [], "id": "CVE-2015-7549", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7549", "cvss": {"score": 2.1, "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:P"}, "cpe23": []}, {"lastseen": "2020-10-03T12:49:58", "description": "QEMU (aka Quick Emulator) built to use 'address_space_translate' to map an address to a MemoryRegionSection is vulnerable to an OOB r/w access issue. It could occur while doing pci_dma_read/write calls. Affects QEMU versions >= 1.6.0 and <= 2.3.1. A privileged user inside guest could use this flaw to crash the guest instance resulting in DoS.", "edition": 3, "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "NONE", "baseScore": 5.5, "privilegesRequired": "LOW", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "userInteraction": "NONE", "version": "3.0"}, "impactScore": 3.6}, "published": "2016-12-29T22:59:00", "title": "CVE-2015-8817", "type": "cve", "cwe": ["CWE-125", "CWE-787"], "bulletinFamily": "NVD", "cvss2": {"severity": "LOW", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 2.1, "vectorString": "AV:L/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-8817"], "modified": "2018-01-05T02:30:00", "cpe": ["cpe:/a:qemu:qemu:2.3.0", "cpe:/a:qemu:qemu:1.6.1", "cpe:/a:qemu:qemu:2.1.2", "cpe:/a:qemu:qemu:2.1.1", "cpe:/a:qemu:qemu:2.0.0", "cpe:/a:qemu:qemu:2.3.1", "cpe:/a:qemu:qemu:2.2.0", "cpe:/a:qemu:qemu:1.6.0", "cpe:/a:qemu:qemu:1.6.2", "cpe:/a:qemu:qemu:2.0.2", "cpe:/a:qemu:qemu:1.7.1", "cpe:/a:qemu:qemu:2.1.0", "cpe:/a:qemu:qemu:2.2.1", "cpe:/a:qemu:qemu:2.1.3"], "id": "CVE-2015-8817", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8817", "cvss": {"score": 2.1, "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:P"}, "cpe23": ["cpe:2.3:a:qemu:qemu:2.0.0:-:*:*:*:*:*:*", "cpe:2.3:a:qemu:qemu:2.0.0:rc1:*:*:*:*:*:*", "cpe:2.3:a:qemu:qemu:1.6.0:rc3:*:*:*:*:*:*", "cpe:2.3:a:qemu:qemu:1.6.0:rc2:*:*:*:*:*:*", "cpe:2.3:a:qemu:qemu:2.3.0:*:*:*:*:*:*:*", "cpe:2.3:a:qemu:qemu:2.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:qemu:qemu:2.1.2:*:*:*:*:*:*:*", "cpe:2.3:a:qemu:qemu:1.6.2:*:*:*:*:*:*:*", "cpe:2.3:a:qemu:qemu:2.1.3:*:*:*:*:*:*:*", "cpe:2.3:a:qemu:qemu:2.0.0:rc2:*:*:*:*:*:*", "cpe:2.3:a:qemu:qemu:2.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:qemu:qemu:2.1.0:rc1:*:*:*:*:*:*", "cpe:2.3:a:qemu:qemu:2.0.0:rc3:*:*:*:*:*:*", "cpe:2.3:a:qemu:qemu:1.6.1:*:*:*:*:*:*:*", "cpe:2.3:a:qemu:qemu:2.1.0:rc5:*:*:*:*:*:*", "cpe:2.3:a:qemu:qemu:2.1.0:rc2:*:*:*:*:*:*", "cpe:2.3:a:qemu:qemu:2.0.2:*:*:*:*:*:*:*", "cpe:2.3:a:qemu:qemu:1.6.0:rc1:*:*:*:*:*:*", "cpe:2.3:a:qemu:qemu:2.1.0:rc0:*:*:*:*:*:*", "cpe:2.3:a:qemu:qemu:2.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:qemu:qemu:2.1.1:*:*:*:*:*:*:*", "cpe:2.3:a:qemu:qemu:1.7.1:*:*:*:*:*:*:*", "cpe:2.3:a:qemu:qemu:2.0.0:rc0:*:*:*:*:*:*", "cpe:2.3:a:qemu:qemu:1.6.0:*:*:*:*:*:*:*", "cpe:2.3:a:qemu:qemu:2.3.1:*:*:*:*:*:*:*", "cpe:2.3:a:qemu:qemu:2.1.0:rc3:*:*:*:*:*:*"]}, {"lastseen": "2020-12-09T20:03:08", "description": "Qemu, when built with VNC display driver support, allows remote attackers to cause a denial of service (arithmetic exception and application crash) via crafted SetPixelFormat messages from a client.", "edition": 6, "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "NONE", "baseScore": 6.5, "privilegesRequired": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "userInteraction": "NONE", "version": "3.1"}, "impactScore": 3.6}, "published": "2017-04-11T19:59:00", "title": "CVE-2015-8504", "type": "cve", "cwe": ["CWE-369"], "bulletinFamily": "NVD", "cvss2": {"severity": "LOW", "exploitabilityScore": 6.8, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 3.5, "vectorString": "AV:N/AC:M/Au:S/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-8504"], "modified": "2020-09-09T15:13:00", "cpe": ["cpe:/a:qemu:qemu:2.5.0", "cpe:/o:debian:debian_linux:8.0", "cpe:/a:qemu:qemu:2.4.1", "cpe:/o:debian:debian_linux:7.0"], "id": "CVE-2015-8504", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8504", "cvss": {"score": 3.5, "vector": "AV:N/AC:M/Au:S/C:N/I:N/A:P"}, "cpe23": ["cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*", "cpe:2.3:a:qemu:qemu:2.5.0:rc2:*:*:*:*:*:*", "cpe:2.3:a:qemu:qemu:2.5.0:rc0:*:*:*:*:*:*", "cpe:2.3:a:qemu:qemu:2.4.1:*:*:*:*:*:*:*", "cpe:2.3:a:qemu:qemu:2.5.0:rc1:*:*:*:*:*:*", "cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*"]}]}