Lucene search

K
osvGoogleOSV:DSA-3361-1
HistorySep 18, 2015 - 12:00 a.m.

qemu - security update

2015-09-1800:00:00
Google
osv.dev
13

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.2 High

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

0.011 Low

EPSS

Percentile

82.7%

Several vulnerabilities were discovered in qemu, a fast processor
emulator.

  • CVE-2015-5278
    Qinghao Tang of QIHU 360 Inc. discovered an infinite loop issue in
    the NE2000 NIC emulation. A privileged guest user could use this
    flaw to mount a denial of service (QEMU process crash).
  • CVE-2015-5279
    Qinghao Tang of QIHU 360 Inc. discovered a heap buffer overflow flaw
    in the NE2000 NIC emulation. A privileged guest user could use this
    flaw to mount a denial of service (QEMU process crash), or
    potentially to execute arbitrary code on the host with the
    privileges of the hosting QEMU process.
  • CVE-2015-6815
    Qinghao Tang of QIHU 360 Inc. discovered an infinite loop issue in
    the e1000 NIC emulation. A privileged guest user could use this flaw
    to mount a denial of service (QEMU process crash).
  • CVE-2015-6855
    Qinghao Tang of QIHU 360 Inc. discovered a flaw in the IDE
    subsystem in QEMU occurring while executing IDE’s
    WIN_READ_NATIVE_MAX command to determine the maximum size of a
    drive. A privileged guest user could use this flaw to mount a
    denial of service (QEMU process crash).

For the oldstable distribution (wheezy), these problems have been fixed
in version 1.1.2+dfsg-6a+deb7u11.

For the stable distribution (jessie), these problems have been fixed in
version 1:2.1+dfsg-12+deb8u4.

For the testing distribution (stretch), these problems have been fixed
in version 1:2.4+dfsg-3 or earlier.

For the unstable distribution (sid), these problems have been fixed in
version 1:2.4+dfsg-3 or earlier.

We recommend that you upgrade your qemu packages.

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.2 High

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

0.011 Low

EPSS

Percentile

82.7%

Related for OSV:DSA-3361-1