DATABASE RESOURCES PRICING ABOUT US

{"id": "RHSA-2016:0086", "type": "redhat", "bulletinFamily": "unix", "title": "(RHSA-2016:0086) Important: qemu-kvm-rhev security update", "description": "KVM (Kernel-based Virtual Machine) is a full virtualization solution for\nLinux on AMD64 and Intel 64 systems. The qemu-kvm-rhev package provides the\nuser-space component for running virtual machines using KVM.\n\nA use-after-free flaw was found in the way QEMU's IDE AHCI emulator\nprocessed certain AHCI Native Command Queuing (NCQ) AIO commands.\nA privileged guest user could use this flaw to crash the QEMU process\ninstance or, potentially, execute arbitrary code on the host with\nprivileges of the QEMU process. (CVE-2016-1568)\n\nAn out-of-bounds read/write flaw was discovered in the way QEMU's Firmware\nConfiguration device emulation processed certain firmware configurations.\nA privileged (CAP_SYS_RAWIO) guest user could use this flaw to crash the\nQEMU process instance or, potentially, execute arbitrary code on the host\nwith privileges of the QEMU process. (CVE-2016-1714)\n\nRed Hat would like to thank Qinghao Tang of Qihoo 360 Marvel Team for\nreporting the CVE-2016-1568 issue, and Donghai Zhu of Alibaba for reporting\nthe CVE-2016-1714 issue.\n\nAll qemu-kvm-rhev users are advised to upgrade to these updated packages,\nwhich contain backported patches to correct these issues. After installing\nthis update, shut down all running virtual machines. Once all virtual\nmachines have shut down, start them again for this update to take effect.", "published": "2016-01-28T15:43:52", "modified": "2018-03-19T12:26:43", "cvss": {"score": 6.9, "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "MEDIUM", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 6.9, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 3.4, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.0, "impactScore": 6.0}, "href": "https://access.redhat.com/errata/RHSA-2016:0086", "reporter": "RedHat", "references": [], "cvelist": ["CVE-2016-1568", "CVE-2016-1714"], "immutableFields": [], "lastseen": "2021-10-21T04:43:07", "viewCount": 7, "enchantments": {"score": {"value": 2.1, "vector": "NONE"}, "dependencies": {"references": [{"type": "centos", "idList": ["CESA-2016:0082", "CESA-2016:0083"]}, {"type": "cve", "idList": ["CVE-2016-1568", "CVE-2016-1714"]}, {"type": "debian", "idList": ["DEBIAN:DSA-3469-1:9C2F1", "DEBIAN:DSA-3469-1:DCEAB", "DEBIAN:DSA-3470-1:8EE3B", "DEBIAN:DSA-3470-1:E622E", "DEBIAN:DSA-3471-1:91F2D", "DEBIAN:DSA-3471-1:DE1BB"]}, {"type": "debiancve", "idList": ["DEBIANCVE:CVE-2016-1568", "DEBIANCVE:CVE-2016-1714"]}, {"type": "f5", "idList": ["F5:K75248350", "SOL75248350"]}, {"type": "fedora", "idList": ["FEDORA:068D36097257", "FEDORA:0BA3A605A0E5", "FEDORA:A686460350CF"]}, {"type": "gentoo", "idList": ["GLSA-201602-01", "GLSA-201604-01"]}, {"type": "ibm", "idList": ["4AC6AFD1D67BFF01AFA90372C061AC359158A86A40AE29CB499BF485EBE79852"]}, {"type": "mageia", "idList": ["MGASA-2016-0023"]}, {"type": "nessus", "idList": ["CENTOS_RHSA-2016-0082.NASL", "CENTOS_RHSA-2016-0083.NASL", "DEBIAN_DSA-3469.NASL", "DEBIAN_DSA-3470.NASL", "DEBIAN_DSA-3471.NASL", "EULEROS_SA-2019-2431.NASL", "EULEROS_SA-2020-1430.NASL", "F5_BIGIP_SOL75248350.NASL", "FEDORA_2016-38B20AA50F.NASL", "FEDORA_2016-42778E8C82.NASL", "FEDORA_2016-F4504E9445.NASL", "GENTOO_GLSA-201602-01.NASL", "GENTOO_GLSA-201604-01.NASL", "OPENSUSE-2016-1170.NASL", "OPENSUSE-2016-413.NASL", "OPENSUSE-2016-439.NASL", "OPENSUSE-2016-839.NASL", "ORACLELINUX_ELSA-2016-0082.NASL", "ORACLELINUX_ELSA-2016-0083.NASL", "ORACLEVM_OVMSA-2016-0051.NASL", "REDHAT-RHSA-2016-0081.NASL", "REDHAT-RHSA-2016-0082.NASL", "REDHAT-RHSA-2016-0083.NASL", "REDHAT-RHSA-2016-0084.NASL", "SL_20160128_QEMU_KVM_ON_SL6_X.NASL", "SL_20160128_QEMU_KVM_ON_SL7_X.NASL", "SUSE_SU-2016-0873-1.NASL", "SUSE_SU-2016-0955-1.NASL", "SUSE_SU-2016-1154-1.NASL", "SUSE_SU-2016-1318-1.NASL", "SUSE_SU-2016-1560-1.NASL", "SUSE_SU-2016-1698-1.NASL", "SUSE_SU-2016-1703-1.NASL", "SUSE_SU-2016-1745-1.NASL", "SUSE_SU-2016-1785-1.NASL", "UBUNTU_USN-2891-1.NASL"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310121440", "OPENVAS:1361412562310121458", "OPENVAS:1361412562310122865", "OPENVAS:1361412562310131187", "OPENVAS:1361412562310703469", "OPENVAS:1361412562310703470", "OPENVAS:1361412562310703471", "OPENVAS:1361412562310807207", "OPENVAS:1361412562310807717", "OPENVAS:1361412562310842633", "OPENVAS:1361412562310851262", "OPENVAS:1361412562310851269", "OPENVAS:1361412562310851315", "OPENVAS:1361412562310851335", "OPENVAS:1361412562310851362", "OPENVAS:1361412562310851407", "OPENVAS:1361412562310871552", "OPENVAS:1361412562310871553", "OPENVAS:1361412562310882388", "OPENVAS:1361412562310882389", "OPENVAS:1361412562311220192431", "OPENVAS:1361412562311220201430", "OPENVAS:703469", "OPENVAS:703470", "OPENVAS:703471"]}, {"type": "oraclelinux", "idList": ["ELSA-2016-0082", "ELSA-2016-0083", "ELSA-2016-0997", "ELSA-2016-2585"]}, {"type": "osv", "idList": ["OSV:DSA-3469-1", "OSV:DSA-3470-1", "OSV:DSA-3471-1"]}, {"type": "redhat", "idList": ["RHSA-2016:0081", "RHSA-2016:0082", "RHSA-2016:0083", "RHSA-2016:0084", "RHSA-2016:0085", "RHSA-2016:0087", "RHSA-2016:0088"]}, {"type": "suse", "idList": ["OPENSUSE-SU-2016:0914-1", "OPENSUSE-SU-2016:0995-1", "OPENSUSE-SU-2016:1750-1", "OPENSUSE-SU-2016:2494-1", "SUSE-SU-2016:0873-1", "SUSE-SU-2016:0955-1", "SUSE-SU-2016:1154-1", "SUSE-SU-2016:1318-1", "SUSE-SU-2016:1560-1", "SUSE-SU-2016:1698-1", "SUSE-SU-2016:1703-1", "SUSE-SU-2016:1745-1", "SUSE-SU-2016:1785-1"]}, {"type": "ubuntu", "idList": ["USN-2891-1"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2016-1568", "UB:CVE-2016-1714"]}]}, "backreferences": {"references": [{"type": "centos", "idList": ["CESA-2016:0082", "CESA-2016:0083"]}, {"type": "cve", "idList": ["CVE-2016-1714"]}, {"type": "debian", "idList": ["DEBIAN:DSA-3470-1:8EE3B"]}, {"type": "debiancve", "idList": ["DEBIANCVE:CVE-2016-1568", "DEBIANCVE:CVE-2016-1714"]}, {"type": "f5", "idList": ["F5:K75248350"]}, {"type": "fedora", "idList": ["FEDORA:0BA3A605A0E5"]}, {"type": "gentoo", "idList": ["GLSA-201602-01"]}, {"type": "ibm", "idList": ["4AC6AFD1D67BFF01AFA90372C061AC359158A86A40AE29CB499BF485EBE79852"]}, {"type": "nessus", "idList": ["EULEROS_SA-2020-1430.NASL"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310871552"]}, {"type": "oraclelinux", "idList": ["ELSA-2016-0082", "ELSA-2016-0083"]}, {"type": "redhat", "idList": ["RHSA-2016:0081", "RHSA-2016:0083", "RHSA-2016:0084", "RHSA-2016:0085", "RHSA-2016:0088"]}, {"type": "suse", "idList": ["OPENSUSE-SU-2016:0914-1"]}, {"type": "ubuntu", "idList": ["USN-2891-1"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2016-1568"]}]}, "exploitation": null, "vulnersScore": 2.1}, "affectedPackage": [{"OS": "RedHat", "OSVersion": "7", "arch": "x86_64", "packageVersion": "2.3.0-31.el7_2.7", "packageFilename": "qemu-kvm-rhev-2.3.0-31.el7_2.7.x86_64.rpm", "operator": "lt", "packageName": "qemu-kvm-rhev"}, {"OS": "RedHat", "OSVersion": "7", "arch": "x86_64", "packageVersion": "2.3.0-31.el7_2.7", "packageFilename": "qemu-img-rhev-2.3.0-31.el7_2.7.x86_64.rpm", "operator": "lt", "packageName": "qemu-img-rhev"}, {"OS": "RedHat", "OSVersion": "7", "arch": "x86_64", "packageVersion": "2.3.0-31.el7_2.7", "packageFilename": "qemu-kvm-tools-rhev-2.3.0-31.el7_2.7.x86_64.rpm", "operator": "lt", "packageName": "qemu-kvm-tools-rhev"}, {"OS": "RedHat", "OSVersion": "7", "arch": "x86_64", "packageVersion": "2.3.0-31.el7_2.7", "packageFilename": "qemu-kvm-rhev-debuginfo-2.3.0-31.el7_2.7.x86_64.rpm", "operator": "lt", "packageName": "qemu-kvm-rhev-debuginfo"}, {"OS": "RedHat", "OSVersion": "7", "arch": "x86_64", "packageVersion": "2.3.0-31.el7_2.7", "packageFilename": "qemu-kvm-common-rhev-2.3.0-31.el7_2.7.x86_64.rpm", "operator": "lt", "packageName": "qemu-kvm-common-rhev"}, {"OS": "RedHat", "OSVersion": "7", "arch": "x86_64", "packageVersion": "2.3.0-31.el7_2.7", "packageFilename": "libcacard-devel-rhev-2.3.0-31.el7_2.7.x86_64.rpm", "operator": "lt", "packageName": "libcacard-devel-rhev"}, {"OS": "RedHat", "OSVersion": "7", "arch": "x86_64", "packageVersion": "2.3.0-31.el7_2.7", "packageFilename": "libcacard-rhev-2.3.0-31.el7_2.7.x86_64.rpm", "operator": "lt", "packageName": "libcacard-rhev"}, {"OS": "RedHat", "OSVersion": "7", "arch": "x86_64", "packageVersion": "2.3.0-31.el7_2.7", "packageFilename": "libcacard-tools-rhev-2.3.0-31.el7_2.7.x86_64.rpm", "operator": "lt", "packageName": "libcacard-tools-rhev"}, {"OS": "RedHat", "OSVersion": "7", "arch": "src", "packageVersion": "2.3.0-31.el7_2.7", "packageFilename": "qemu-kvm-rhev-2.3.0-31.el7_2.7.src.rpm", "operator": "lt", "packageName": "qemu-kvm-rhev"}], "vendorCvss": {"severity": "important"}, "_state": {"dependencies": 1659986029, "score": 1659974161}, "_internal": {"score_hash": "ec2d5467d5bb192f9276c2cc57ed9273"}}

{"redhat": [{"lastseen": "2021-10-21T04:47:09", "description": "KVM (Kernel-based Virtual Machine) is a full virtualization solution for\nLinux on AMD64 and Intel 64 systems. The qemu-kvm-rhev package provides the\nuser-space component for running virtual machines using KVM.\n\nA use-after-free flaw was found in the way QEMU's IDE AHCI emulator\nprocessed certain AHCI Native Command Queuing (NCQ) AIO commands.\nA privileged guest user could use this flaw to crash the QEMU process\ninstance or, potentially, execute arbitrary code on the host with\nprivileges of the QEMU process. (CVE-2016-1568)\n\nAn out-of-bounds read/write flaw was discovered in the way QEMU's Firmware\nConfiguration device emulation processed certain firmware configurations.\nA privileged (CAP_SYS_RAWIO) guest user could use this flaw to crash the\nQEMU process instance or, potentially, execute arbitrary code on the host\nwith privileges of the QEMU process. (CVE-2016-1714)\n\nRed Hat would like to thank Qinghao Tang of Qihoo 360 Marvel Team for\nreporting the CVE-2016-1568 issue, and Donghai Zhu of Alibaba for reporting\nthe CVE-2016-1714 issue.\n\nAll qemu-kvm-rhev users are advised to upgrade to these updated packages,\nwhich contain backported patches to correct these issues. After installing\nthis update, shut down all running virtual machines. Once all virtual\nmachines have shut down, start them again for this update to take effect.", "cvss3": {"exploitabilityScore": 2.0, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.8, "privilegesRequired": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "userInteraction": "NONE", "version": "3.1"}, "impactScore": 6.0}, "published": "2016-01-28T15:44:02", "type": "redhat", "title": "(RHSA-2016:0088) Important: qemu-kvm-rhev security update", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 3.4, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 6.9, "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2016-1568", "CVE-2016-1714"], "modified": "2018-03-19T12:27:18", "id": "RHSA-2016:0088", "href": "https://access.redhat.com/errata/RHSA-2016:0088", "cvss": {"score": 6.9, "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-10-21T04:43:21", "description": "KVM (Kernel-based Virtual Machine) is a full virtualization solution for\nLinux on AMD64 and Intel 64 systems. The qemu-kvm-rhev package provides the\nuser-space component for running virtual machines using KVM.\n\nA use-after-free flaw was found in the way QEMU's IDE AHCI emulator\nprocessed certain AHCI Native Command Queuing (NCQ) AIO commands.\nA privileged guest user could use this flaw to crash the QEMU process\ninstance or, potentially, execute arbitrary code on the host with\nprivileges of the QEMU process. (CVE-2016-1568)\n\nAn out-of-bounds read/write flaw was discovered in the way QEMU's Firmware\nConfiguration device emulation processed certain firmware configurations.\nA privileged (CAP_SYS_RAWIO) guest user could use this flaw to crash the\nQEMU process instance or, potentially, execute arbitrary code on the host\nwith privileges of the QEMU process. (CVE-2016-1714)\n\nRed Hat would like to thank Qinghao Tang of Qihoo 360 Marvel Team for\nreporting the CVE-2016-1568 issue, and Donghai Zhu of Alibaba for reporting\nthe CVE-2016-1714 issue.\n\nThis update also fixes the following bugs:\n\n* Incorrect handling of the last sector of an image file could trigger an\nassertion failure in qemu-img. This update changes the handling of the last\nsector, and no assertion failure occurs. (BZ#1299345)\n\n* Previously, rebooting a guest after multiple memory hot-plugs in some\ncases caused the qemu-kvm process to terminate unexpectedly, and the reboot\nto fail. This update fixes the problem, and guests with hot-plugged memory\nreboot successfully. (BZ#1288096)\n\n* When the OHCI driver received an interrupt during the suspending process,\nthe interrupt was not acknowledged. As a consequence, the interrupt kept\nbeing sent repeatedly, and the system became unresponsive. This update\nmodifies the suspend procedure to acknowledge the interrupt, which prevents\nthe described problem. (BZ#1298971)\n\nAll qemu-kvm-rhev users are advised to upgrade to these updated packages,\nwhich contain backported patches to correct these issues. After installing\nthis update, shut down all running virtual machines. Once all virtual\nmachines have shut down, start them again for this update to take effect.", "cvss3": {"exploitabilityScore": 2.0, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.8, "privilegesRequired": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "userInteraction": "NONE", "version": "3.1"}, "impactScore": 6.0}, "published": "2016-01-28T15:38:41", "type": "redhat", "title": "(RHSA-2016:0084) Important: qemu-kvm-rhev security and bug fix update", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 3.4, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 6.9, "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2016-1568", "CVE-2016-1714"], "modified": "2018-04-25T20:41:37", "id": "RHSA-2016:0084", "href": "https://access.redhat.com/errata/RHSA-2016:0084", "cvss": {"score": 6.9, "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-10-21T04:43:59", "description": "KVM (Kernel-based Virtual Machine) is a full virtualization solution for\nLinux on AMD64 and Intel 64 systems. The qemu-kvm-rhev package provides the\nuser-space component for running virtual machines using KVM.\n\nA use-after-free flaw was found in the way QEMU's IDE AHCI emulator\nprocessed certain AHCI Native Command Queuing (NCQ) AIO commands.\nA privileged guest user could use this flaw to crash the QEMU process\ninstance or, potentially, execute arbitrary code on the host with\nprivileges of the QEMU process. (CVE-2016-1568)\n\nAn out-of-bounds read/write flaw was discovered in the way QEMU's Firmware\nConfiguration device emulation processed certain firmware configurations.\nA privileged (CAP_SYS_RAWIO) guest user could use this flaw to crash the\nQEMU process instance or, potentially, execute arbitrary code on the host\nwith privileges of the QEMU process. (CVE-2016-1714)\n\nRed Hat would like to thank Qinghao Tang of Qihoo 360 Marvel Team for\nreporting the CVE-2016-1568 issue, and Donghai Zhu of Alibaba for reporting\nthe CVE-2016-1714 issue.\n\nAll qemu-kvm-rhev users are advised to upgrade to these updated packages,\nwhich contain backported patches to correct these issues. After installing\nthis update, shut down all running virtual machines. Once all virtual\nmachines have shut down, start them again for this update to take effect.", "cvss3": {"exploitabilityScore": 2.0, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.8, "privilegesRequired": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "userInteraction": "NONE", "version": "3.1"}, "impactScore": 6.0}, "published": "2016-01-28T15:43:58", "type": "redhat", "title": "(RHSA-2016:0087) Important: qemu-kvm-rhev security update", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 3.4, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 6.9, "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2016-1568", "CVE-2016-1714"], "modified": "2018-03-19T12:27:05", "id": "RHSA-2016:0087", "href": "https://access.redhat.com/errata/RHSA-2016:0087", "cvss": {"score": 6.9, "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-10-19T20:37:00", "description": "KVM (Kernel-based Virtual Machine) is a full virtualization solution for\nLinux on AMD64 and Intel 64 systems. The qemu-kvm-rhev package provides the\nuser-space component for running virtual machines using KVM.\n\nAn out-of-bounds read/write flaw was discovered in the way QEMU's Firmware\nConfiguration device emulation processed certain firmware configurations.\nA privileged (CAP_SYS_RAWIO) guest user could use this flaw to crash the\nQEMU process instance or, potentially, execute arbitrary code on the host\nwith privileges of the QEMU process. (CVE-2016-1714)\n\nRed Hat would like to thank Donghai Zhu of Alibaba for reporting this\nissue.\n\nAll qemu-kvm-rhev users are advised to upgrade to these updated packages,\nwhich contain a backported patch to correct this issue. After installing\nthis update, shut down all running virtual machines. Once all virtual\nmachines have shut down, start them again for this update to take effect.\n", "cvss3": {"exploitabilityScore": 1.4, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "CHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.1, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "userInteraction": "NONE", "version": "3.0"}, "impactScore": 6.0}, "published": "2016-01-28T00:00:00", "type": "redhat", "title": "(RHSA-2016:0081) Important: qemu-kvm-rhev security update", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 3.4, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 6.9, "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2016-1714"], "modified": "2018-06-07T04:59:30", "id": "RHSA-2016:0081", "href": "https://access.redhat.com/errata/RHSA-2016:0081", "cvss": {"score": 6.9, "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-10-19T20:40:51", "description": "KVM (Kernel-based Virtual Machine) is a full virtualization solution for\nLinux on AMD64 and Intel 64 systems. The qemu-kvm-rhev package provides the\nuser-space component for running virtual machines using KVM.\n\nAn out-of-bounds read/write flaw was discovered in the way QEMU's Firmware\nConfiguration device emulation processed certain firmware configurations.\nA privileged (CAP_SYS_RAWIO) guest user could use this flaw to crash the\nQEMU process instance or, potentially, execute arbitrary code on the host\nwith privileges of the QEMU process. (CVE-2016-1714)\n\nRed Hat would like to thank Donghai Zhu of Alibaba for reporting this\nissue.\n\nAll qemu-kvm-rhev users are advised to upgrade to these updated packages,\nwhich contain a backported patch to correct this issue. After installing\nthis update, shut down all running virtual machines. Once all virtual\nmachines have shut down, start them again for this update to take effect.", "cvss3": {"exploitabilityScore": 1.4, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "CHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.1, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "userInteraction": "NONE", "version": "3.0"}, "impactScore": 6.0}, "published": "2016-01-28T15:42:25", "type": "redhat", "title": "(RHSA-2016:0085) Important: qemu-kvm-rhev security update", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 3.4, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 6.9, "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2016-1714"], "modified": "2018-06-06T22:48:03", "id": "RHSA-2016:0085", "href": "https://access.redhat.com/errata/RHSA-2016:0085", "cvss": {"score": 6.9, "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-10-19T18:39:28", "description": "KVM (Kernel-based Virtual Machine) is a full virtualization solution for\nLinux on AMD64 and Intel 64 systems. The qemu-kvm package provides the\nuser-space component for running virtual machines using KVM.\n\nAn out-of-bounds read/write flaw was discovered in the way QEMU's Firmware\nConfiguration device emulation processed certain firmware configurations.\nA privileged (CAP_SYS_RAWIO) guest user could use this flaw to crash the\nQEMU process instance or, potentially, execute arbitrary code on the host\nwith privileges of the QEMU process. (CVE-2016-1714)\n\nRed Hat would like to thank Donghai Zhu of Alibaba for reporting this\nissue.\n\nAll qemu-kvm users are advised to upgrade to these updated packages, which\ncontain a backported patch to correct this issue. After installing this\nupdate, shut down all running virtual machines. Once all virtual machines\nhave shut down, start them again for this update to take effect.\n", "cvss3": {"exploitabilityScore": 1.4, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "CHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.1, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "userInteraction": "NONE", "version": "3.0"}, "impactScore": 6.0}, "published": "2016-01-28T00:00:00", "type": "redhat", "title": "(RHSA-2016:0082) Important: qemu-kvm security update", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 3.4, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 6.9, "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2016-1714"], "modified": "2018-06-06T16:24:25", "id": "RHSA-2016:0082", "href": "https://access.redhat.com/errata/RHSA-2016:0082", "cvss": {"score": 6.9, "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-10-21T04:45:20", "description": "KVM (Kernel-based Virtual Machine) is a full virtualization solution for\nLinux on AMD64 and Intel 64 systems. The qemu-kvm package provides the\nuser-space component for running virtual machines using KVM.\n\nAn out-of-bounds read/write flaw was discovered in the way QEMU's Firmware\nConfiguration device emulation processed certain firmware configurations.\nA privileged (CAP_SYS_RAWIO) guest user could use this flaw to crash the\nQEMU process instance or, potentially, execute arbitrary code on the host\nwith privileges of the QEMU process. (CVE-2016-1714)\n\nRed Hat would like to thank Donghai Zhu of Alibaba for reporting this\nissue.\n\nThis update also fixes the following bugs:\n\n* Incorrect handling of the last sector of an image file could trigger an\nassertion failure in qemu-img. This update changes the handling of the last\nsector, and no assertion failure occurs. (BZ#1298828)\n\nAll qemu-kvm users are advised to upgrade to these updated packages, which\ncontain backported patches to correct these issues. After installing this\nupdate, shut down all running virtual machines. Once all virtual machines\nhave shut down, start them again for this update to take effect.", "cvss3": {"exploitabilityScore": 1.4, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "CHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.1, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "userInteraction": "NONE", "version": "3.0"}, "impactScore": 6.0}, "published": "2016-01-28T15:38:19", "type": "redhat", "title": "(RHSA-2016:0083) Important: qemu-kvm security and bug fix update", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 3.4, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 6.9, "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2016-1714"], "modified": "2018-04-11T23:33:04", "id": "RHSA-2016:0083", "href": "https://access.redhat.com/errata/RHSA-2016:0083", "cvss": {"score": 6.9, "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"}}], "nessus": [{"lastseen": "2023-01-11T14:49:24", "description": "Updated qemu-kvm-rhev packages that fix two security issues and three bugs are now available for Red Hat Enterprise Virtualization.\n\nRed Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.\n\nKVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on AMD64 and Intel 64 systems. The qemu-kvm-rhev package provides the user-space component for running virtual machines using KVM.\n\nA use-after-free flaw was found in the way QEMU's IDE AHCI emulator processed certain AHCI Native Command Queuing (NCQ) AIO commands. A privileged guest user could use this flaw to crash the QEMU process instance or, potentially, execute arbitrary code on the host with privileges of the QEMU process. (CVE-2016-1568)\n\nAn out-of-bounds read/write flaw was discovered in the way QEMU's Firmware Configuration device emulation processed certain firmware configurations. A privileged (CAP_SYS_RAWIO) guest user could use this flaw to crash the QEMU process instance or, potentially, execute arbitrary code on the host with privileges of the QEMU process.\n(CVE-2016-1714)\n\nRed Hat would like to thank Qinghao Tang of Qihoo 360 Marvel Team for reporting the CVE-2016-1568 issue, and Donghai Zhu of Alibaba for reporting the CVE-2016-1714 issue.\n\nThis update also fixes the following bugs :\n\n* Incorrect handling of the last sector of an image file could trigger an assertion failure in qemu-img. This update changes the handling of the last sector, and no assertion failure occurs. (BZ#1299345)\n\n* Previously, rebooting a guest after multiple memory hot-plugs in some cases caused the qemu-kvm process to terminate unexpectedly, and the reboot to fail. This update fixes the problem, and guests with hot-plugged memory reboot successfully. (BZ#1288096)\n\n* When the OHCI driver received an interrupt during the suspending process, the interrupt was not acknowledged. As a consequence, the interrupt kept being sent repeatedly, and the system became unresponsive. This update modifies the suspend procedure to acknowledge the interrupt, which prevents the described problem.\n(BZ#1298971)\n\nAll qemu-kvm-rhev users are advised to upgrade to these updated packages, which contain backported patches to correct these issues.\nAfter installing this update, shut down all running virtual machines.\nOnce all virtual machines have shut down, start them again for this update to take effect.", "cvss3": {"exploitabilityScore": 2.0, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 6.0}, "published": "2018-09-06T00:00:00", "type": "nessus", "title": "RHEL 7 : qemu-kvm-rhev (RHSA-2016:0084)", "bulletinFamily": "scanner", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 3.4, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 6.9, "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2016-1568", "CVE-2016-1714"], "modified": "2020-10-16T00:00:00", "cpe": ["p-cpe:/a:redhat:enterprise_linux:libcacard-devel-rhev", "p-cpe:/a:redhat:enterprise_linux:libcacard-rhev", "p-cpe:/a:redhat:enterprise_linux:libcacard-tools-rhev", "p-cpe:/a:redhat:enterprise_linux:qemu-img-rhev", "p-cpe:/a:redhat:enterprise_linux:qemu-kvm-common-rhev", "p-cpe:/a:redhat:enterprise_linux:qemu-kvm-rhev", "p-cpe:/a:redhat:enterprise_linux:qemu-kvm-rhev-debuginfo", "p-cpe:/a:redhat:enterprise_linux:qemu-kvm-tools-rhev", "cpe:/o:redhat:enterprise_linux:7"], "id": "REDHAT-RHSA-2016-0084.NASL", "href": "https://www.tenable.com/plugins/nessus/117310", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Red Hat Security Advisory RHSA-2016:0084. The text \n# itself is copyright (C) Red Hat, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(117310);\n script_version(\"1.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2020/10/16\");\n\n script_cve_id(\"CVE-2016-1568\", \"CVE-2016-1714\");\n script_xref(name:\"RHSA\", value:\"2016:0084\");\n\n script_name(english:\"RHEL 7 : qemu-kvm-rhev (RHSA-2016:0084)\");\n script_summary(english:\"Checks the rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\"The remote Red Hat host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"Updated qemu-kvm-rhev packages that fix two security issues and three\nbugs are now available for Red Hat Enterprise Virtualization.\n\nRed Hat Product Security has rated this update as having Important\nsecurity impact. Common Vulnerability Scoring System (CVSS) base\nscores, which give detailed severity ratings, are available for each\nvulnerability from the CVE links in the References section.\n\nKVM (Kernel-based Virtual Machine) is a full virtualization solution\nfor Linux on AMD64 and Intel 64 systems. The qemu-kvm-rhev package\nprovides the user-space component for running virtual machines using\nKVM.\n\nA use-after-free flaw was found in the way QEMU's IDE AHCI emulator\nprocessed certain AHCI Native Command Queuing (NCQ) AIO commands. A\nprivileged guest user could use this flaw to crash the QEMU process\ninstance or, potentially, execute arbitrary code on the host with\nprivileges of the QEMU process. (CVE-2016-1568)\n\nAn out-of-bounds read/write flaw was discovered in the way QEMU's\nFirmware Configuration device emulation processed certain firmware\nconfigurations. A privileged (CAP_SYS_RAWIO) guest user could use this\nflaw to crash the QEMU process instance or, potentially, execute\narbitrary code on the host with privileges of the QEMU process.\n(CVE-2016-1714)\n\nRed Hat would like to thank Qinghao Tang of Qihoo 360 Marvel Team for\nreporting the CVE-2016-1568 issue, and Donghai Zhu of Alibaba for\nreporting the CVE-2016-1714 issue.\n\nThis update also fixes the following bugs :\n\n* Incorrect handling of the last sector of an image file could trigger\nan assertion failure in qemu-img. This update changes the handling of\nthe last sector, and no assertion failure occurs. (BZ#1299345)\n\n* Previously, rebooting a guest after multiple memory hot-plugs in\nsome cases caused the qemu-kvm process to terminate unexpectedly, and\nthe reboot to fail. This update fixes the problem, and guests with\nhot-plugged memory reboot successfully. (BZ#1288096)\n\n* When the OHCI driver received an interrupt during the suspending\nprocess, the interrupt was not acknowledged. As a consequence, the\ninterrupt kept being sent repeatedly, and the system became\nunresponsive. This update modifies the suspend procedure to\nacknowledge the interrupt, which prevents the described problem.\n(BZ#1298971)\n\nAll qemu-kvm-rhev users are advised to upgrade to these updated\npackages, which contain backported patches to correct these issues.\nAfter installing this update, shut down all running virtual machines.\nOnce all virtual machines have shut down, start them again for this\nupdate to take effect.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/errata/RHSA-2016:0084\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2016-1568\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2016-1714\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:libcacard-devel-rhev\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:libcacard-rhev\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:libcacard-tools-rhev\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:qemu-img-rhev\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:qemu-kvm-common-rhev\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:qemu-kvm-rhev\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:qemu-kvm-rhev-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:qemu-kvm-tools-rhev\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:7\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2016/04/07\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/01/28\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/09/06\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Red Hat\" >!< release) audit(AUDIT_OS_NOT, \"Red Hat\");\nos_ver = pregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Red Hat\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^7([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Red Hat 7.x\", \"Red Hat \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"s390\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Red Hat\", cpu);\nif (\"x86_64\" >!< cpu) audit(AUDIT_ARCH_NOT, \"x86_64\", cpu);\n\nyum_updateinfo = get_kb_item(\"Host/RedHat/yum-updateinfo\");\nif (!empty_or_null(yum_updateinfo)) \n{\n rhsa = \"RHSA-2016:0084\";\n yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);\n if (!empty_or_null(yum_report))\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : yum_report \n );\n exit(0);\n }\n else\n {\n audit_message = \"affected by Red Hat security advisory \" + rhsa;\n audit(AUDIT_OS_NOT, audit_message);\n }\n}\nelse\n{\n flag = 0;\n if (rpm_check(release:\"RHEL7\", cpu:\"x86_64\", reference:\"libcacard-devel-rhev-2.3.0-31.el7_2.7\")) flag++;\n if (rpm_check(release:\"RHEL7\", cpu:\"x86_64\", reference:\"libcacard-rhev-2.3.0-31.el7_2.7\")) flag++;\n if (rpm_check(release:\"RHEL7\", cpu:\"x86_64\", reference:\"libcacard-tools-rhev-2.3.0-31.el7_2.7\")) flag++;\n if (rpm_check(release:\"RHEL7\", cpu:\"x86_64\", reference:\"qemu-img-rhev-2.3.0-31.el7_2.7\")) flag++;\n if (rpm_check(release:\"RHEL7\", cpu:\"x86_64\", reference:\"qemu-kvm-common-rhev-2.3.0-31.el7_2.7\")) flag++;\n if (rpm_check(release:\"RHEL7\", cpu:\"x86_64\", reference:\"qemu-kvm-rhev-2.3.0-31.el7_2.7\")) flag++;\n if (rpm_check(release:\"RHEL7\", cpu:\"x86_64\", reference:\"qemu-kvm-rhev-debuginfo-2.3.0-31.el7_2.7\")) flag++;\n if (rpm_check(release:\"RHEL7\", cpu:\"x86_64\", reference:\"qemu-kvm-tools-rhev-2.3.0-31.el7_2.7\")) flag++;\n\n if (flag)\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get() + redhat_report_package_caveat()\n );\n exit(0);\n }\n else\n {\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"libcacard-devel-rhev / libcacard-rhev / libcacard-tools-rhev / etc\");\n }\n}\n", "cvss": {"score": 6.9, "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-11T16:31:03", "description": "From Red Hat Security Advisory 2016:0083 :\n\nUpdated qemu-kvm packages that fix one security issue and one bug are now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.\n\nKVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on AMD64 and Intel 64 systems. The qemu-kvm package provides the user-space component for running virtual machines using KVM.\n\nAn out-of-bounds read/write flaw was discovered in the way QEMU's Firmware Configuration device emulation processed certain firmware configurations. A privileged (CAP_SYS_RAWIO) guest user could use this flaw to crash the QEMU process instance or, potentially, execute arbitrary code on the host with privileges of the QEMU process.\n(CVE-2016-1714)\n\nRed Hat would like to thank Donghai Zhu of Alibaba for reporting this issue.\n\nThis update also fixes the following bugs :\n\n* Incorrect handling of the last sector of an image file could trigger an assertion failure in qemu-img. This update changes the handling of the last sector, and no assertion failure occurs. (BZ#1298828)\n\nAll qemu-kvm users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.", "cvss3": {"exploitabilityScore": 1.4, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "CHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.1, "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.0", "userInteraction": "NONE"}, "impactScore": 6.0}, "published": "2016-01-29T00:00:00", "type": "nessus", "title": "Oracle Linux 7 : qemu-kvm (ELSA-2016-0083)", "bulletinFamily": "scanner", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 3.4, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 6.9, "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2016-1714"], "modified": "2021-01-14T00:00:00", "cpe": ["p-cpe:/a:oracle:linux:libcacard", "p-cpe:/a:oracle:linux:libcacard-devel", "p-cpe:/a:oracle:linux:libcacard-tools", "p-cpe:/a:oracle:linux:qemu-img", "p-cpe:/a:oracle:linux:qemu-kvm", "p-cpe:/a:oracle:linux:qemu-kvm-common", "p-cpe:/a:oracle:linux:qemu-kvm-tools", "cpe:/o:oracle:linux:7"], "id": "ORACLELINUX_ELSA-2016-0083.NASL", "href": "https://www.tenable.com/plugins/nessus/88478", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Red Hat Security Advisory RHSA-2016:0083 and \n# Oracle Linux Security Advisory ELSA-2016-0083 respectively.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(88478);\n script_version(\"2.9\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/14\");\n\n script_cve_id(\"CVE-2016-1714\");\n script_xref(name:\"RHSA\", value:\"2016:0083\");\n\n script_name(english:\"Oracle Linux 7 : qemu-kvm (ELSA-2016-0083)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Oracle Linux host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"From Red Hat Security Advisory 2016:0083 :\n\nUpdated qemu-kvm packages that fix one security issue and one bug are\nnow available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having Important\nsecurity impact. A Common Vulnerability Scoring System (CVSS) base\nscore, which gives a detailed severity rating, is available from the\nCVE link in the References section.\n\nKVM (Kernel-based Virtual Machine) is a full virtualization solution\nfor Linux on AMD64 and Intel 64 systems. The qemu-kvm package provides\nthe user-space component for running virtual machines using KVM.\n\nAn out-of-bounds read/write flaw was discovered in the way QEMU's\nFirmware Configuration device emulation processed certain firmware\nconfigurations. A privileged (CAP_SYS_RAWIO) guest user could use this\nflaw to crash the QEMU process instance or, potentially, execute\narbitrary code on the host with privileges of the QEMU process.\n(CVE-2016-1714)\n\nRed Hat would like to thank Donghai Zhu of Alibaba for reporting this\nissue.\n\nThis update also fixes the following bugs :\n\n* Incorrect handling of the last sector of an image file could trigger\nan assertion failure in qemu-img. This update changes the handling of\nthe last sector, and no assertion failure occurs. (BZ#1298828)\n\nAll qemu-kvm users are advised to upgrade to these updated packages,\nwhich contain backported patches to correct these issues. After\ninstalling this update, shut down all running virtual machines. Once\nall virtual machines have shut down, start them again for this update\nto take effect.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://oss.oracle.com/pipermail/el-errata/2016-January/005729.html\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected qemu-kvm packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:libcacard\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:libcacard-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:libcacard-tools\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:qemu-img\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:qemu-kvm\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:qemu-kvm-common\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:qemu-kvm-tools\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:oracle:linux:7\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2016/04/07\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/01/28\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/01/29\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Oracle Linux Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/OracleLinux\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/OracleLinux\")) audit(AUDIT_OS_NOT, \"Oracle Linux\");\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || !pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux)\", string:release)) audit(AUDIT_OS_NOT, \"Oracle Linux\");\nos_ver = pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux) .*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Oracle Linux\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^7([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Oracle Linux 7\", \"Oracle Linux \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Oracle Linux\", cpu);\nif (\"x86_64\" >!< cpu) audit(AUDIT_ARCH_NOT, \"x86_64\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"EL7\", cpu:\"x86_64\", reference:\"libcacard-1.5.3-105.el7_2.3\")) flag++;\nif (rpm_check(release:\"EL7\", cpu:\"x86_64\", reference:\"libcacard-devel-1.5.3-105.el7_2.3\")) flag++;\nif (rpm_check(release:\"EL7\", cpu:\"x86_64\", reference:\"libcacard-tools-1.5.3-105.el7_2.3\")) flag++;\nif (rpm_check(release:\"EL7\", cpu:\"x86_64\", reference:\"qemu-img-1.5.3-105.el7_2.3\")) flag++;\nif (rpm_check(release:\"EL7\", cpu:\"x86_64\", reference:\"qemu-kvm-1.5.3-105.el7_2.3\")) flag++;\nif (rpm_check(release:\"EL7\", cpu:\"x86_64\", reference:\"qemu-kvm-common-1.5.3-105.el7_2.3\")) flag++;\nif (rpm_check(release:\"EL7\", cpu:\"x86_64\", reference:\"qemu-kvm-tools-1.5.3-105.el7_2.3\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"libcacard / libcacard-devel / libcacard-tools / qemu-img / qemu-kvm / etc\");\n}\n", "cvss": {"score": 6.9, "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-11T16:32:57", "description": "Updated qemu-kvm packages that fix one security issue and one bug are now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.\n\nKVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on AMD64 and Intel 64 systems. The qemu-kvm package provides the user-space component for running virtual machines using KVM.\n\nAn out-of-bounds read/write flaw was discovered in the way QEMU's Firmware Configuration device emulation processed certain firmware configurations. A privileged (CAP_SYS_RAWIO) guest user could use this flaw to crash the QEMU process instance or, potentially, execute arbitrary code on the host with privileges of the QEMU process.\n(CVE-2016-1714)\n\nRed Hat would like to thank Donghai Zhu of Alibaba for reporting this issue.\n\nThis update also fixes the following bugs :\n\n* Incorrect handling of the last sector of an image file could trigger an assertion failure in qemu-img. This update changes the handling of the last sector, and no assertion failure occurs. (BZ#1298828)\n\nAll qemu-kvm users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.", "cvss3": {"exploitabilityScore": 1.4, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "CHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.1, "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.0", "userInteraction": "NONE"}, "impactScore": 6.0}, "published": "2016-02-02T00:00:00", "type": "nessus", "title": "CentOS 7 : qemu-kvm (CESA-2016:0083)", "bulletinFamily": "scanner", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 3.4, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 6.9, "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2016-1714"], "modified": "2021-01-04T00:00:00", "cpe": ["p-cpe:/a:centos:centos:libcacard", "p-cpe:/a:centos:centos:libcacard-devel", "p-cpe:/a:centos:centos:libcacard-tools", "p-cpe:/a:centos:centos:qemu-img", "p-cpe:/a:centos:centos:qemu-kvm", "p-cpe:/a:centos:centos:qemu-kvm-common", "p-cpe:/a:centos:centos:qemu-kvm-tools", "cpe:/o:centos:centos:7"], "id": "CENTOS_RHSA-2016-0083.NASL", "href": "https://www.tenable.com/plugins/nessus/88510", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Red Hat Security Advisory RHSA-2016:0083 and \n# CentOS Errata and Security Advisory 2016:0083 respectively.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(88510);\n script_version(\"2.11\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/04\");\n\n script_cve_id(\"CVE-2016-1714\");\n script_xref(name:\"RHSA\", value:\"2016:0083\");\n\n script_name(english:\"CentOS 7 : qemu-kvm (CESA-2016:0083)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote CentOS host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Updated qemu-kvm packages that fix one security issue and one bug are\nnow available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having Important\nsecurity impact. A Common Vulnerability Scoring System (CVSS) base\nscore, which gives a detailed severity rating, is available from the\nCVE link in the References section.\n\nKVM (Kernel-based Virtual Machine) is a full virtualization solution\nfor Linux on AMD64 and Intel 64 systems. The qemu-kvm package provides\nthe user-space component for running virtual machines using KVM.\n\nAn out-of-bounds read/write flaw was discovered in the way QEMU's\nFirmware Configuration device emulation processed certain firmware\nconfigurations. A privileged (CAP_SYS_RAWIO) guest user could use this\nflaw to crash the QEMU process instance or, potentially, execute\narbitrary code on the host with privileges of the QEMU process.\n(CVE-2016-1714)\n\nRed Hat would like to thank Donghai Zhu of Alibaba for reporting this\nissue.\n\nThis update also fixes the following bugs :\n\n* Incorrect handling of the last sector of an image file could trigger\nan assertion failure in qemu-img. This update changes the handling of\nthe last sector, and no assertion failure occurs. (BZ#1298828)\n\nAll qemu-kvm users are advised to upgrade to these updated packages,\nwhich contain backported patches to correct these issues. After\ninstalling this update, shut down all running virtual machines. Once\nall virtual machines have shut down, start them again for this update\nto take effect.\"\n );\n # https://lists.centos.org/pipermail/centos-announce/2016-February/021637.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?d3dad616\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected qemu-kvm packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2016-1714\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:libcacard\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:libcacard-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:libcacard-tools\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:qemu-img\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:qemu-kvm\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:qemu-kvm-common\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:qemu-kvm-tools\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:centos:centos:7\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2016/04/07\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/02/01\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/02/02\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"CentOS Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/CentOS/release\", \"Host/CentOS/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/CentOS/release\");\nif (isnull(release) || \"CentOS\" >!< release) audit(AUDIT_OS_NOT, \"CentOS\");\nos_ver = pregmatch(pattern: \"CentOS(?: Linux)? release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"CentOS\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^7([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"CentOS 7.x\", \"CentOS \" + os_ver);\n\nif (!get_kb_item(\"Host/CentOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"CentOS\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"CentOS-7\", cpu:\"x86_64\", reference:\"libcacard-1.5.3-105.el7_2.3\")) flag++;\nif (rpm_check(release:\"CentOS-7\", cpu:\"x86_64\", reference:\"libcacard-devel-1.5.3-105.el7_2.3\")) flag++;\nif (rpm_check(release:\"CentOS-7\", cpu:\"x86_64\", reference:\"libcacard-tools-1.5.3-105.el7_2.3\")) flag++;\nif (rpm_check(release:\"CentOS-7\", cpu:\"x86_64\", reference:\"qemu-img-1.5.3-105.el7_2.3\")) flag++;\nif (rpm_check(release:\"CentOS-7\", cpu:\"x86_64\", reference:\"qemu-kvm-1.5.3-105.el7_2.3\")) flag++;\nif (rpm_check(release:\"CentOS-7\", cpu:\"x86_64\", reference:\"qemu-kvm-common-1.5.3-105.el7_2.3\")) flag++;\nif (rpm_check(release:\"CentOS-7\", cpu:\"x86_64\", reference:\"qemu-kvm-tools-1.5.3-105.el7_2.3\")) flag++;\n\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"libcacard / libcacard-devel / libcacard-tools / qemu-img / qemu-kvm / etc\");\n}\n", "cvss": {"score": 6.9, "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-11T16:28:57", "description": "An out-of-bounds read/write flaw was discovered in the way QEMU's Firmware Configuration device emulation processed certain firmware configurations. A privileged (CAP_SYS_RAWIO) guest user could use this flaw to crash the QEMU process instance or, potentially, execute arbitrary code on the host with privileges of the QEMU process.\n(CVE-2016-1714)\n\nThis update also fixes the following bugs :\n\n - Incorrect handling of the last sector of an image file could trigger an assertion failure in qemu-img. This update changes the handling of the last sector, and no assertion failure occurs.\n\nAfter installing this update, shut down all running virtual machines.\nOnce all virtual machines have shut down, start them again for this update to take effect.", "cvss3": {"exploitabilityScore": 1.4, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "CHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.1, "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.0", "userInteraction": "NONE"}, "impactScore": 6.0}, "published": "2016-01-29T00:00:00", "type": "nessus", "title": "Scientific Linux Security Update : qemu-kvm on SL7.x x86_64 (20160128)", "bulletinFamily": "scanner", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 3.4, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 6.9, "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2016-1714"], "modified": "2021-01-14T00:00:00", "cpe": ["p-cpe:/a:fermilab:scientific_linux:libcacard", "p-cpe:/a:fermilab:scientific_linux:libcacard-devel", "p-cpe:/a:fermilab:scientific_linux:libcacard-tools", "p-cpe:/a:fermilab:scientific_linux:qemu-img", "p-cpe:/a:fermilab:scientific_linux:qemu-kvm", "p-cpe:/a:fermilab:scientific_linux:qemu-kvm-common", "p-cpe:/a:fermilab:scientific_linux:qemu-kvm-debuginfo", "p-cpe:/a:fermilab:scientific_linux:qemu-kvm-tools", "x-cpe:/o:fermilab:scientific_linux"], "id": "SL_20160128_QEMU_KVM_ON_SL7_X.NASL", "href": "https://www.tenable.com/plugins/nessus/88484", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text is (C) Scientific Linux.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(88484);\n script_version(\"2.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/14\");\n\n script_cve_id(\"CVE-2016-1714\");\n\n script_name(english:\"Scientific Linux Security Update : qemu-kvm on SL7.x x86_64 (20160128)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Scientific Linux host is missing one or more security\nupdates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"An out-of-bounds read/write flaw was discovered in the way QEMU's\nFirmware Configuration device emulation processed certain firmware\nconfigurations. A privileged (CAP_SYS_RAWIO) guest user could use this\nflaw to crash the QEMU process instance or, potentially, execute\narbitrary code on the host with privileges of the QEMU process.\n(CVE-2016-1714)\n\nThis update also fixes the following bugs :\n\n - Incorrect handling of the last sector of an image file\n could trigger an assertion failure in qemu-img. This\n update changes the handling of the last sector, and no\n assertion failure occurs.\n\nAfter installing this update, shut down all running virtual machines.\nOnce all virtual machines have shut down, start them again for this\nupdate to take effect.\"\n );\n # https://listserv.fnal.gov/scripts/wa.exe?A2=ind1601&L=scientific-linux-errata&F=&S=&P=13539\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?c459ec77\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fermilab:scientific_linux:libcacard\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fermilab:scientific_linux:libcacard-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fermilab:scientific_linux:libcacard-tools\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fermilab:scientific_linux:qemu-img\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fermilab:scientific_linux:qemu-kvm\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fermilab:scientific_linux:qemu-kvm-common\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fermilab:scientific_linux:qemu-kvm-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fermilab:scientific_linux:qemu-kvm-tools\");\n script_set_attribute(attribute:\"cpe\", value:\"x-cpe:/o:fermilab:scientific_linux\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2016/04/07\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/01/28\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/01/29\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Scientific Linux Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Scientific Linux \" >!< release) audit(AUDIT_HOST_NOT, \"running Scientific Linux\");\nos_ver = pregmatch(pattern: \"Scientific Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Scientific Linux\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^7([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Scientific Linux 7.x\", \"Scientific Linux \" + os_ver);\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu >!< \"x86_64\" && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Scientific Linux\", cpu);\nif (\"x86_64\" >!< cpu) audit(AUDIT_ARCH_NOT, \"x86_64\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"SL7\", cpu:\"x86_64\", reference:\"libcacard-1.5.3-105.el7_2.3\")) flag++;\nif (rpm_check(release:\"SL7\", cpu:\"x86_64\", reference:\"libcacard-devel-1.5.3-105.el7_2.3\")) flag++;\nif (rpm_check(release:\"SL7\", cpu:\"x86_64\", reference:\"libcacard-tools-1.5.3-105.el7_2.3\")) flag++;\nif (rpm_check(release:\"SL7\", cpu:\"x86_64\", reference:\"qemu-img-1.5.3-105.el7_2.3\")) flag++;\nif (rpm_check(release:\"SL7\", cpu:\"x86_64\", reference:\"qemu-kvm-1.5.3-105.el7_2.3\")) flag++;\nif (rpm_check(release:\"SL7\", cpu:\"x86_64\", reference:\"qemu-kvm-common-1.5.3-105.el7_2.3\")) flag++;\nif (rpm_check(release:\"SL7\", cpu:\"x86_64\", reference:\"qemu-kvm-debuginfo-1.5.3-105.el7_2.3\")) flag++;\nif (rpm_check(release:\"SL7\", cpu:\"x86_64\", reference:\"qemu-kvm-tools-1.5.3-105.el7_2.3\")) flag++;\n\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"libcacard / libcacard-devel / libcacard-tools / qemu-img / qemu-kvm / etc\");\n}\n", "cvss": {"score": 6.9, "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-11T16:37:38", "description": "The (1) fw_cfg_write and (2) fw_cfg_read functions in hw/nvram/fw_cfg.c in QEMU before 2.4, when built with the Firmware Configuration device emulation support, allow guest OS users with the CAP_SYS_RAWIO privilege to cause a denial of service (out-of-bounds read or write access and process crash) or possibly execute arbitrary code via an invalid current entry value in a firmware configuration.\n(CVE-2016-1714)", "cvss3": {"exploitabilityScore": 1.4, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "CHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.1, "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.0", "userInteraction": "NONE"}, "impactScore": 6.0}, "published": "2016-05-31T00:00:00", "type": "nessus", "title": "F5 Networks BIG-IP : QEMU vulnerability (K75248350)", "bulletinFamily": "scanner", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 3.4, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 6.9, "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2016-1714"], "modified": "2019-01-04T00:00:00", "cpe": ["cpe:/a:f5:big-ip_access_policy_manager", "cpe:/a:f5:big-ip_advanced_firewall_manager", "cpe:/a:f5:big-ip_application_acceleration_manager", "cpe:/a:f5:big-ip_application_security_manager", "cpe:/a:f5:big-ip_application_visibility_and_reporting", "cpe:/a:f5:big-ip_global_traffic_manager", "cpe:/a:f5:big-ip_link_controller", "cpe:/a:f5:big-ip_local_traffic_manager", "cpe:/a:f5:big-ip_policy_enforcement_manager", "cpe:/a:f5:big-ip_wan_optimization_manager", "cpe:/a:f5:big-ip_webaccelerator", "cpe:/h:f5:big-ip", "cpe:/h:f5:big-ip_protocol_security_manager"], "id": "F5_BIGIP_SOL75248350.NASL", "href": "https://www.tenable.com/plugins/nessus/91369", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from F5 Networks BIG-IP Solution K75248350.\n#\n# The text description of this plugin is (C) F5 Networks.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(91369);\n script_version(\"2.13\");\n script_cvs_date(\"Date: 2019/01/04 10:03:40\");\n\n script_cve_id(\"CVE-2016-1714\");\n\n script_name(english:\"F5 Networks BIG-IP : QEMU vulnerability (K75248350)\");\n script_summary(english:\"Checks the BIG-IP version.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote device is missing a vendor-supplied security patch.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The (1) fw_cfg_write and (2) fw_cfg_read functions in\nhw/nvram/fw_cfg.c in QEMU before 2.4, when built with the Firmware\nConfiguration device emulation support, allow guest OS users with the\nCAP_SYS_RAWIO privilege to cause a denial of service (out-of-bounds\nread or write access and process crash) or possibly execute arbitrary\ncode via an invalid current entry value in a firmware configuration.\n(CVE-2016-1714)\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://support.f5.com/csp/article/K75248350\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Upgrade to one of the non-vulnerable versions listed in the F5\nSolution K75248350.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"potential_vulnerability\", value:\"true\");\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:f5:big-ip_access_policy_manager\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:f5:big-ip_advanced_firewall_manager\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:f5:big-ip_application_acceleration_manager\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:f5:big-ip_application_security_manager\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:f5:big-ip_application_visibility_and_reporting\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:f5:big-ip_global_traffic_manager\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:f5:big-ip_link_controller\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:f5:big-ip_local_traffic_manager\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:f5:big-ip_policy_enforcement_manager\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:f5:big-ip_wan_optimization_manager\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:f5:big-ip_webaccelerator\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/h:f5:big-ip\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/h:f5:big-ip_protocol_security_manager\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/05/10\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/05/31\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"F5 Networks Local Security Checks\");\n\n script_dependencies(\"f5_bigip_detect.nbin\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/BIG-IP/hotfix\", \"Host/BIG-IP/modules\", \"Host/BIG-IP/version\", \"Settings/ParanoidReport\");\n\n exit(0);\n}\n\n\ninclude(\"f5_func.inc\");\n\nif ( ! get_kb_item(\"Host/local_checks_enabled\") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nversion = get_kb_item(\"Host/BIG-IP/version\");\nif ( ! version ) audit(AUDIT_OS_NOT, \"F5 Networks BIG-IP\");\nif ( isnull(get_kb_item(\"Host/BIG-IP/hotfix\")) ) audit(AUDIT_KB_MISSING, \"Host/BIG-IP/hotfix\");\nif ( ! get_kb_item(\"Host/BIG-IP/modules\") ) audit(AUDIT_KB_MISSING, \"Host/BIG-IP/modules\");\n\nsol = \"K75248350\";\nvmatrix = make_array();\n\nif (report_paranoia < 2) audit(AUDIT_PARANOID);\n\n# AFM\nvmatrix[\"AFM\"] = make_array();\nvmatrix[\"AFM\"][\"affected\" ] = make_list(\"12.0.0\",\"11.3.0-11.6.1\");\nvmatrix[\"AFM\"][\"unaffected\"] = make_list(\"12.1.0\",\"11.6.1HF1\",\"11.5.5\");\n\n# AM\nvmatrix[\"AM\"] = make_array();\nvmatrix[\"AM\"][\"affected\" ] = make_list(\"12.0.0\",\"11.4.0-11.6.1\");\nvmatrix[\"AM\"][\"unaffected\"] = make_list(\"12.1.0\",\"11.6.1HF1\",\"11.5.5\");\n\n# APM\nvmatrix[\"APM\"] = make_array();\nvmatrix[\"APM\"][\"affected\" ] = make_list(\"12.0.0\",\"11.4.0-11.6.1\",\"11.2.1\");\nvmatrix[\"APM\"][\"unaffected\"] = make_list(\"12.1.0\",\"11.6.1HF1\",\"11.5.5\",\"10.1.0-10.2.4\");\n\n# ASM\nvmatrix[\"ASM\"] = make_array();\nvmatrix[\"ASM\"][\"affected\" ] = make_list(\"12.0.0\",\"11.4.0-11.6.1\",\"11.2.1\");\nvmatrix[\"ASM\"][\"unaffected\"] = make_list(\"12.1.0\",\"11.6.1HF1\",\"11.5.5\",\"10.1.0-10.2.4\");\n\n# AVR\nvmatrix[\"AVR\"] = make_array();\nvmatrix[\"AVR\"][\"affected\" ] = make_list(\"12.0.0\",\"11.4.0-11.6.1\",\"11.2.1\");\nvmatrix[\"AVR\"][\"unaffected\"] = make_list(\"12.1.0\",\"11.6.1HF1\",\"11.5.5\");\n\n# GTM\nvmatrix[\"GTM\"] = make_array();\nvmatrix[\"GTM\"][\"affected\" ] = make_list(\"11.4.0-11.6.1\",\"11.2.1\");\nvmatrix[\"GTM\"][\"unaffected\"] = make_list(\"11.6.1HF1\",\"11.5.5\",\"10.1.0-10.2.4\");\n\n# LC\nvmatrix[\"LC\"] = make_array();\nvmatrix[\"LC\"][\"affected\" ] = make_list(\"12.0.0\",\"11.4.0-11.6.1\",\"11.2.1\");\nvmatrix[\"LC\"][\"unaffected\"] = make_list(\"12.1.0\",\"11.6.1HF1\",\"11.5.5\",\"10.1.0-10.2.4\");\n\n# LTM\nvmatrix[\"LTM\"] = make_array();\nvmatrix[\"LTM\"][\"affected\" ] = make_list(\"12.0.0\",\"11.4.0-11.6.1\",\"11.2.1\");\nvmatrix[\"LTM\"][\"unaffected\"] = make_list(\"12.1.0\",\"11.6.1HF1\",\"11.5.5\",\"10.1.0-10.2.4\");\n\n# PEM\nvmatrix[\"PEM\"] = make_array();\nvmatrix[\"PEM\"][\"affected\" ] = make_list(\"12.0.0\",\"11.4.0-11.6.1\");\nvmatrix[\"PEM\"][\"unaffected\"] = make_list(\"12.1.0\",\"11.6.1HF1\",\"11.5.5\");\n\n# PSM\nvmatrix[\"PSM\"] = make_array();\nvmatrix[\"PSM\"][\"affected\" ] = make_list(\"11.4.0-11.4.1\",\"11.2.1\");\nvmatrix[\"PSM\"][\"unaffected\"] = make_list(\"10.1.0-10.2.4\");\n\n# WAM\nvmatrix[\"WAM\"] = make_array();\nvmatrix[\"WAM\"][\"affected\" ] = make_list(\"11.2.1\");\nvmatrix[\"WAM\"][\"unaffected\"] = make_list(\"10.1.0-10.2.4\");\n\n# WOM\nvmatrix[\"WOM\"] = make_array();\nvmatrix[\"WOM\"][\"affected\" ] = make_list(\"11.2.1\");\nvmatrix[\"WOM\"][\"unaffected\"] = make_list(\"10.1.0-10.2.4\");\n\n\nif (bigip_is_affected(vmatrix:vmatrix, sol:sol))\n{\n if (report_verbosity > 0) security_warning(port:0, extra:bigip_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = bigip_get_tested_modules();\n audit_extra = \"For BIG-IP module(s) \" + tested + \",\";\n if (tested) audit(AUDIT_INST_VER_NOT_VULN, audit_extra, version);\n else audit(AUDIT_HOST_NOT, \"running any of the affected modules\");\n}\n", "cvss": {"score": 6.9, "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-11T16:28:06", "description": "From Red Hat Security Advisory 2016:0082 :\n\nUpdated qemu-kvm packages that fix one security issue are now available for Red Hat Enterprise Linux 6.\n\nRed Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.\n\nKVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on AMD64 and Intel 64 systems. The qemu-kvm package provides the user-space component for running virtual machines using KVM.\n\nAn out-of-bounds read/write flaw was discovered in the way QEMU's Firmware Configuration device emulation processed certain firmware configurations. A privileged (CAP_SYS_RAWIO) guest user could use this flaw to crash the QEMU process instance or, potentially, execute arbitrary code on the host with privileges of the QEMU process.\n(CVE-2016-1714)\n\nRed Hat would like to thank Donghai Zhu of Alibaba for reporting this issue.\n\nAll qemu-kvm users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.", "cvss3": {"exploitabilityScore": 1.4, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "CHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.1, "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.0", "userInteraction": "NONE"}, "impactScore": 6.0}, "published": "2016-01-29T00:00:00", "type": "nessus", "title": "Oracle Linux 6 : qemu-kvm (ELSA-2016-0082)", "bulletinFamily": "scanner", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 3.4, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 6.9, "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2016-1714"], "modified": "2021-01-14T00:00:00", "cpe": ["p-cpe:/a:oracle:linux:qemu-guest-agent", "p-cpe:/a:oracle:linux:qemu-img", "p-cpe:/a:oracle:linux:qemu-kvm", "p-cpe:/a:oracle:linux:qemu-kvm-tools", "cpe:/o:oracle:linux:6"], "id": "ORACLELINUX_ELSA-2016-0082.NASL", "href": "https://www.tenable.com/plugins/nessus/88477", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Red Hat Security Advisory RHSA-2016:0082 and \n# Oracle Linux Security Advisory ELSA-2016-0082 respectively.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(88477);\n script_version(\"2.9\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/14\");\n\n script_cve_id(\"CVE-2016-1714\");\n script_xref(name:\"RHSA\", value:\"2016:0082\");\n\n script_name(english:\"Oracle Linux 6 : qemu-kvm (ELSA-2016-0082)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Oracle Linux host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"From Red Hat Security Advisory 2016:0082 :\n\nUpdated qemu-kvm packages that fix one security issue are now\navailable for Red Hat Enterprise Linux 6.\n\nRed Hat Product Security has rated this update as having Important\nsecurity impact. A Common Vulnerability Scoring System (CVSS) base\nscore, which gives a detailed severity rating, is available from the\nCVE link in the References section.\n\nKVM (Kernel-based Virtual Machine) is a full virtualization solution\nfor Linux on AMD64 and Intel 64 systems. The qemu-kvm package provides\nthe user-space component for running virtual machines using KVM.\n\nAn out-of-bounds read/write flaw was discovered in the way QEMU's\nFirmware Configuration device emulation processed certain firmware\nconfigurations. A privileged (CAP_SYS_RAWIO) guest user could use this\nflaw to crash the QEMU process instance or, potentially, execute\narbitrary code on the host with privileges of the QEMU process.\n(CVE-2016-1714)\n\nRed Hat would like to thank Donghai Zhu of Alibaba for reporting this\nissue.\n\nAll qemu-kvm users are advised to upgrade to these updated packages,\nwhich contain a backported patch to correct this issue. After\ninstalling this update, shut down all running virtual machines. Once\nall virtual machines have shut down, start them again for this update\nto take effect.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://oss.oracle.com/pipermail/el-errata/2016-January/005730.html\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected qemu-kvm packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:qemu-guest-agent\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:qemu-img\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:qemu-kvm\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:qemu-kvm-tools\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:oracle:linux:6\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2016/04/07\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/01/28\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/01/29\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Oracle Linux Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/OracleLinux\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/OracleLinux\")) audit(AUDIT_OS_NOT, \"Oracle Linux\");\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || !pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux)\", string:release)) audit(AUDIT_OS_NOT, \"Oracle Linux\");\nos_ver = pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux) .*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Oracle Linux\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^6([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Oracle Linux 6\", \"Oracle Linux \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Oracle Linux\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"EL6\", reference:\"qemu-guest-agent-0.12.1.2-2.479.el6_7.4\")) flag++;\nif (rpm_check(release:\"EL6\", cpu:\"x86_64\", reference:\"qemu-img-0.12.1.2-2.479.el6_7.4\")) flag++;\nif (rpm_check(release:\"EL6\", cpu:\"x86_64\", reference:\"qemu-kvm-0.12.1.2-2.479.el6_7.4\")) flag++;\nif (rpm_check(release:\"EL6\", cpu:\"x86_64\", reference:\"qemu-kvm-tools-0.12.1.2-2.479.el6_7.4\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"qemu-guest-agent / qemu-img / qemu-kvm / qemu-kvm-tools\");\n}\n", "cvss": {"score": 6.9, "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-11T16:28:07", "description": "An out-of-bounds read/write flaw was discovered in the way QEMU's Firmware Configuration device emulation processed certain firmware configurations. A privileged (CAP_SYS_RAWIO) guest user could use this flaw to crash the QEMU process instance or, potentially, execute arbitrary code on the host with privileges of the QEMU process.\n(CVE-2016-1714)\n\nAfter installing this update, shut down all running virtual machines.\nOnce all virtual machines have shut down, start them again for this update to take effect.", "cvss3": {"exploitabilityScore": 1.4, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "CHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.1, "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.0", "userInteraction": "NONE"}, "impactScore": 6.0}, "published": "2016-01-29T00:00:00", "type": "nessus", "title": "Scientific Linux Security Update : qemu-kvm on SL6.x i386/x86_64 (20160128)", "bulletinFamily": "scanner", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 3.4, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 6.9, "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2016-1714"], "modified": "2021-01-14T00:00:00", "cpe": ["p-cpe:/a:fermilab:scientific_linux:qemu-guest-agent", "p-cpe:/a:fermilab:scientific_linux:qemu-img", "p-cpe:/a:fermilab:scientific_linux:qemu-kvm", "p-cpe:/a:fermilab:scientific_linux:qemu-kvm-debuginfo", "p-cpe:/a:fermilab:scientific_linux:qemu-kvm-tools", "x-cpe:/o:fermilab:scientific_linux"], "id": "SL_20160128_QEMU_KVM_ON_SL6_X.NASL", "href": "https://www.tenable.com/plugins/nessus/88483", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text is (C) Scientific Linux.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(88483);\n script_version(\"2.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/14\");\n\n script_cve_id(\"CVE-2016-1714\");\n\n script_name(english:\"Scientific Linux Security Update : qemu-kvm on SL6.x i386/x86_64 (20160128)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Scientific Linux host is missing one or more security\nupdates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"An out-of-bounds read/write flaw was discovered in the way QEMU's\nFirmware Configuration device emulation processed certain firmware\nconfigurations. A privileged (CAP_SYS_RAWIO) guest user could use this\nflaw to crash the QEMU process instance or, potentially, execute\narbitrary code on the host with privileges of the QEMU process.\n(CVE-2016-1714)\n\nAfter installing this update, shut down all running virtual machines.\nOnce all virtual machines have shut down, start them again for this\nupdate to take effect.\"\n );\n # https://listserv.fnal.gov/scripts/wa.exe?A2=ind1601&L=scientific-linux-errata&F=&S=&P=13206\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?d0a89774\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fermilab:scientific_linux:qemu-guest-agent\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fermilab:scientific_linux:qemu-img\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fermilab:scientific_linux:qemu-kvm\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fermilab:scientific_linux:qemu-kvm-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fermilab:scientific_linux:qemu-kvm-tools\");\n script_set_attribute(attribute:\"cpe\", value:\"x-cpe:/o:fermilab:scientific_linux\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2016/04/07\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/01/28\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/01/29\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Scientific Linux Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Scientific Linux \" >!< release) audit(AUDIT_HOST_NOT, \"running Scientific Linux\");\nos_ver = pregmatch(pattern: \"Scientific Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Scientific Linux\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^6([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Scientific Linux 6.x\", \"Scientific Linux \" + os_ver);\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu >!< \"x86_64\" && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Scientific Linux\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"SL6\", reference:\"qemu-guest-agent-0.12.1.2-2.479.el6_7.4\")) flag++;\nif (rpm_check(release:\"SL6\", cpu:\"x86_64\", reference:\"qemu-img-0.12.1.2-2.479.el6_7.4\")) flag++;\nif (rpm_check(release:\"SL6\", cpu:\"x86_64\", reference:\"qemu-kvm-0.12.1.2-2.479.el6_7.4\")) flag++;\nif (rpm_check(release:\"SL6\", reference:\"qemu-kvm-debuginfo-0.12.1.2-2.479.el6_7.4\")) flag++;\nif (rpm_check(release:\"SL6\", cpu:\"x86_64\", reference:\"qemu-kvm-tools-0.12.1.2-2.479.el6_7.4\")) flag++;\n\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"qemu-guest-agent / qemu-img / qemu-kvm / qemu-kvm-debuginfo / etc\");\n}\n", "cvss": {"score": 6.9, "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-11T16:28:27", "description": "Updated qemu-kvm packages that fix one security issue are now available for Red Hat Enterprise Linux 6.\n\nRed Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.\n\nKVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on AMD64 and Intel 64 systems. The qemu-kvm package provides the user-space component for running virtual machines using KVM.\n\nAn out-of-bounds read/write flaw was discovered in the way QEMU's Firmware Configuration device emulation processed certain firmware configurations. A privileged (CAP_SYS_RAWIO) guest user could use this flaw to crash the QEMU process instance or, potentially, execute arbitrary code on the host with privileges of the QEMU process.\n(CVE-2016-1714)\n\nRed Hat would like to thank Donghai Zhu of Alibaba for reporting this issue.\n\nAll qemu-kvm users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.", "cvss3": {"exploitabilityScore": 1.4, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "CHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.1, "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.0", "userInteraction": "NONE"}, "impactScore": 6.0}, "published": "2016-01-29T00:00:00", "type": "nessus", "title": "RHEL 6 : qemu-kvm (RHSA-2016:0082)", "bulletinFamily": "scanner", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 3.4, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 6.9, "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2016-1714"], "modified": "2019-10-24T00:00:00", "cpe": ["p-cpe:/a:redhat:enterprise_linux:qemu-guest-agent", "p-cpe:/a:redhat:enterprise_linux:qemu-img", "p-cpe:/a:redhat:enterprise_linux:qemu-kvm", "p-cpe:/a:redhat:enterprise_linux:qemu-kvm-debuginfo", "p-cpe:/a:redhat:enterprise_linux:qemu-kvm-tools", "cpe:/o:redhat:enterprise_linux:6", "cpe:/o:redhat:enterprise_linux:6.7"], "id": "REDHAT-RHSA-2016-0082.NASL", "href": "https://www.tenable.com/plugins/nessus/88481", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Red Hat Security Advisory RHSA-2016:0082. The text \n# itself is copyright (C) Red Hat, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(88481);\n script_version(\"2.12\");\n script_cvs_date(\"Date: 2019/10/24 15:35:41\");\n\n script_cve_id(\"CVE-2016-1714\");\n script_xref(name:\"RHSA\", value:\"2016:0082\");\n\n script_name(english:\"RHEL 6 : qemu-kvm (RHSA-2016:0082)\");\n script_summary(english:\"Checks the rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Red Hat host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Updated qemu-kvm packages that fix one security issue are now\navailable for Red Hat Enterprise Linux 6.\n\nRed Hat Product Security has rated this update as having Important\nsecurity impact. A Common Vulnerability Scoring System (CVSS) base\nscore, which gives a detailed severity rating, is available from the\nCVE link in the References section.\n\nKVM (Kernel-based Virtual Machine) is a full virtualization solution\nfor Linux on AMD64 and Intel 64 systems. The qemu-kvm package provides\nthe user-space component for running virtual machines using KVM.\n\nAn out-of-bounds read/write flaw was discovered in the way QEMU's\nFirmware Configuration device emulation processed certain firmware\nconfigurations. A privileged (CAP_SYS_RAWIO) guest user could use this\nflaw to crash the QEMU process instance or, potentially, execute\narbitrary code on the host with privileges of the QEMU process.\n(CVE-2016-1714)\n\nRed Hat would like to thank Donghai Zhu of Alibaba for reporting this\nissue.\n\nAll qemu-kvm users are advised to upgrade to these updated packages,\nwhich contain a backported patch to correct this issue. After\ninstalling this update, shut down all running virtual machines. Once\nall virtual machines have shut down, start them again for this update\nto take effect.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/errata/RHSA-2016:0082\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2016-1714\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:qemu-guest-agent\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:qemu-img\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:qemu-kvm\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:qemu-kvm-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:qemu-kvm-tools\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:6\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:6.7\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2016/04/07\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/01/28\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/01/29\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Red Hat\" >!< release) audit(AUDIT_OS_NOT, \"Red Hat\");\nos_ver = pregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Red Hat\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^6([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Red Hat 6.x\", \"Red Hat \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"s390\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Red Hat\", cpu);\n\nyum_updateinfo = get_kb_item(\"Host/RedHat/yum-updateinfo\");\nif (!empty_or_null(yum_updateinfo)) \n{\n rhsa = \"RHSA-2016:0082\";\n yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);\n if (!empty_or_null(yum_report))\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : yum_report \n );\n exit(0);\n }\n else\n {\n audit_message = \"affected by Red Hat security advisory \" + rhsa;\n audit(AUDIT_OS_NOT, audit_message);\n }\n}\nelse\n{\n flag = 0;\n if (rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"qemu-guest-agent-0.12.1.2-2.479.el6_7.4\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"qemu-guest-agent-0.12.1.2-2.479.el6_7.4\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"qemu-img-0.12.1.2-2.479.el6_7.4\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"qemu-kvm-0.12.1.2-2.479.el6_7.4\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"qemu-kvm-debuginfo-0.12.1.2-2.479.el6_7.4\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"qemu-kvm-debuginfo-0.12.1.2-2.479.el6_7.4\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"qemu-kvm-tools-0.12.1.2-2.479.el6_7.4\")) flag++;\n\n\n if (flag)\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get() + redhat_report_package_caveat()\n );\n exit(0);\n }\n else\n {\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"qemu-guest-agent / qemu-img / qemu-kvm / qemu-kvm-debuginfo / etc\");\n }\n}\n", "cvss": {"score": 6.9, "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-11T16:31:06", "description": "Updated qemu-kvm-rhev packages that fix one security issue are now available for Red Hat Enterprise Virtualization.\n\nRed Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.\n\nKVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on AMD64 and Intel 64 systems. The qemu-kvm-rhev package provides the user-space component for running virtual machines using KVM.\n\nAn out-of-bounds read/write flaw was discovered in the way QEMU's Firmware Configuration device emulation processed certain firmware configurations. A privileged (CAP_SYS_RAWIO) guest user could use this flaw to crash the QEMU process instance or, potentially, execute arbitrary code on the host with privileges of the QEMU process.\n(CVE-2016-1714)\n\nRed Hat would like to thank Donghai Zhu of Alibaba for reporting this issue.\n\nAll qemu-kvm-rhev users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue.\nAfter installing this update, shut down all running virtual machines.\nOnce all virtual machines have shut down, start them again for this update to take effect.", "cvss3": {"exploitabilityScore": 1.4, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "CHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.1, "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.0", "userInteraction": "NONE"}, "impactScore": 6.0}, "published": "2016-02-01T00:00:00", "type": "nessus", "title": "RHEL 6 : qemu-kvm-rhev (RHSA-2016:0081)", "bulletinFamily": "scanner", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 3.4, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 6.9, "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2016-1714"], "modified": "2019-10-24T00:00:00", "cpe": ["p-cpe:/a:redhat:enterprise_linux:qemu-img-rhev", "p-cpe:/a:redhat:enterprise_linux:qemu-kvm-rhev", "p-cpe:/a:redhat:enterprise_linux:qemu-kvm-rhev-debuginfo", "p-cpe:/a:redhat:enterprise_linux:qemu-kvm-rhev-tools", "cpe:/o:redhat:enterprise_linux:6"], "id": "REDHAT-RHSA-2016-0081.NASL", "href": "https://www.tenable.com/plugins/nessus/88506", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Red Hat Security Advisory RHSA-2016:0081. The text \n# itself is copyright (C) Red Hat, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(88506);\n script_version(\"2.12\");\n script_cvs_date(\"Date: 2019/10/24 15:35:41\");\n\n script_cve_id(\"CVE-2016-1714\");\n script_xref(name:\"RHSA\", value:\"2016:0081\");\n\n script_name(english:\"RHEL 6 : qemu-kvm-rhev (RHSA-2016:0081)\");\n script_summary(english:\"Checks the rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Red Hat host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Updated qemu-kvm-rhev packages that fix one security issue are now\navailable for Red Hat Enterprise Virtualization.\n\nRed Hat Product Security has rated this update as having Important\nsecurity impact. A Common Vulnerability Scoring System (CVSS) base\nscore, which gives a detailed severity rating, is available from the\nCVE link in the References section.\n\nKVM (Kernel-based Virtual Machine) is a full virtualization solution\nfor Linux on AMD64 and Intel 64 systems. The qemu-kvm-rhev package\nprovides the user-space component for running virtual machines using\nKVM.\n\nAn out-of-bounds read/write flaw was discovered in the way QEMU's\nFirmware Configuration device emulation processed certain firmware\nconfigurations. A privileged (CAP_SYS_RAWIO) guest user could use this\nflaw to crash the QEMU process instance or, potentially, execute\narbitrary code on the host with privileges of the QEMU process.\n(CVE-2016-1714)\n\nRed Hat would like to thank Donghai Zhu of Alibaba for reporting this\nissue.\n\nAll qemu-kvm-rhev users are advised to upgrade to these updated\npackages, which contain a backported patch to correct this issue.\nAfter installing this update, shut down all running virtual machines.\nOnce all virtual machines have shut down, start them again for this\nupdate to take effect.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/errata/RHSA-2016:0081\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2016-1714\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:qemu-img-rhev\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:qemu-kvm-rhev\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:qemu-kvm-rhev-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:qemu-kvm-rhev-tools\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:6\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2016/04/07\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/01/28\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/02/01\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Red Hat\" >!< release) audit(AUDIT_OS_NOT, \"Red Hat\");\nos_ver = pregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Red Hat\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^6([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Red Hat 6.x\", \"Red Hat \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"s390\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Red Hat\", cpu);\nif (\"x86_64\" >!< cpu) audit(AUDIT_ARCH_NOT, \"x86_64\", cpu);\n\nyum_updateinfo = get_kb_item(\"Host/RedHat/yum-updateinfo\");\nif (!empty_or_null(yum_updateinfo)) \n{\n rhsa = \"RHSA-2016:0081\";\n yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);\n if (!empty_or_null(yum_report))\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : yum_report \n );\n exit(0);\n }\n else\n {\n audit_message = \"affected by Red Hat security advisory \" + rhsa;\n audit(AUDIT_OS_NOT, audit_message);\n }\n}\nelse\n{\n flag = 0;\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"qemu-img-rhev-0.12.1.2-2.479.el6_7.4\")) flag++;\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"qemu-kvm-rhev-0.12.1.2-2.479.el6_7.4\")) flag++;\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"qemu-kvm-rhev-debuginfo-0.12.1.2-2.479.el6_7.4\")) flag++;\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"qemu-kvm-rhev-tools-0.12.1.2-2.479.el6_7.4\")) flag++;\n\n if (flag)\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get() + redhat_report_package_caveat()\n );\n exit(0);\n }\n else\n {\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"qemu-img-rhev / qemu-kvm-rhev / qemu-kvm-rhev-debuginfo / etc\");\n }\n}\n", "cvss": {"score": 6.9, "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-11T16:28:25", "description": "Updated qemu-kvm packages that fix one security issue and one bug are now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.\n\nKVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on AMD64 and Intel 64 systems. The qemu-kvm package provides the user-space component for running virtual machines using KVM.\n\nAn out-of-bounds read/write flaw was discovered in the way QEMU's Firmware Configuration device emulation processed certain firmware configurations. A privileged (CAP_SYS_RAWIO) guest user could use this flaw to crash the QEMU process instance or, potentially, execute arbitrary code on the host with privileges of the QEMU process.\n(CVE-2016-1714)\n\nRed Hat would like to thank Donghai Zhu of Alibaba for reporting this issue.\n\nThis update also fixes the following bugs :\n\n* Incorrect handling of the last sector of an image file could trigger an assertion failure in qemu-img. This update changes the handling of the last sector, and no assertion failure occurs. (BZ#1298828)\n\nAll qemu-kvm users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.", "cvss3": {"exploitabilityScore": 1.4, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "CHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.1, "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.0", "userInteraction": "NONE"}, "impactScore": 6.0}, "published": "2016-01-29T00:00:00", "type": "nessus", "title": "RHEL 7 : qemu-kvm (RHSA-2016:0083)", "bulletinFamily": "scanner", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 3.4, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 6.9, "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2016-1714"], "modified": "2019-10-24T00:00:00", "cpe": ["p-cpe:/a:redhat:enterprise_linux:libcacard", "p-cpe:/a:redhat:enterprise_linux:libcacard-devel", "p-cpe:/a:redhat:enterprise_linux:libcacard-tools", "p-cpe:/a:redhat:enterprise_linux:qemu-img", "p-cpe:/a:redhat:enterprise_linux:qemu-kvm", "p-cpe:/a:redhat:enterprise_linux:qemu-kvm-common", "p-cpe:/a:redhat:enterprise_linux:qemu-kvm-debuginfo", "p-cpe:/a:redhat:enterprise_linux:qemu-kvm-tools", "cpe:/o:redhat:enterprise_linux:7", "cpe:/o:redhat:enterprise_linux:7.2", "cpe:/o:redhat:enterprise_linux:7.3", "cpe:/o:redhat:enterprise_linux:7.4", "cpe:/o:redhat:enterprise_linux:7.5", "cpe:/o:redhat:enterprise_linux:7.6", "cpe:/o:redhat:enterprise_linux:7.7"], "id": "REDHAT-RHSA-2016-0083.NASL", "href": "https://www.tenable.com/plugins/nessus/88482", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Red Hat Security Advisory RHSA-2016:0083. The text \n# itself is copyright (C) Red Hat, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(88482);\n script_version(\"2.15\");\n script_cvs_date(\"Date: 2019/10/24 15:35:41\");\n\n script_cve_id(\"CVE-2016-1714\");\n script_xref(name:\"RHSA\", value:\"2016:0083\");\n\n script_name(english:\"RHEL 7 : qemu-kvm (RHSA-2016:0083)\");\n script_summary(english:\"Checks the rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Red Hat host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Updated qemu-kvm packages that fix one security issue and one bug are\nnow available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having Important\nsecurity impact. A Common Vulnerability Scoring System (CVSS) base\nscore, which gives a detailed severity rating, is available from the\nCVE link in the References section.\n\nKVM (Kernel-based Virtual Machine) is a full virtualization solution\nfor Linux on AMD64 and Intel 64 systems. The qemu-kvm package provides\nthe user-space component for running virtual machines using KVM.\n\nAn out-of-bounds read/write flaw was discovered in the way QEMU's\nFirmware Configuration device emulation processed certain firmware\nconfigurations. A privileged (CAP_SYS_RAWIO) guest user could use this\nflaw to crash the QEMU process instance or, potentially, execute\narbitrary code on the host with privileges of the QEMU process.\n(CVE-2016-1714)\n\nRed Hat would like to thank Donghai Zhu of Alibaba for reporting this\nissue.\n\nThis update also fixes the following bugs :\n\n* Incorrect handling of the last sector of an image file could trigger\nan assertion failure in qemu-img. This update changes the handling of\nthe last sector, and no assertion failure occurs. (BZ#1298828)\n\nAll qemu-kvm users are advised to upgrade to these updated packages,\nwhich contain backported patches to correct these issues. After\ninstalling this update, shut down all running virtual machines. Once\nall virtual machines have shut down, start them again for this update\nto take effect.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/errata/RHSA-2016:0083\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2016-1714\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:libcacard\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:libcacard-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:libcacard-tools\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:qemu-img\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:qemu-kvm\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:qemu-kvm-common\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:qemu-kvm-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:qemu-kvm-tools\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:7\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:7.2\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:7.3\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:7.4\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:7.5\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:7.6\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:7.7\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2016/04/07\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/01/28\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/01/29\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Red Hat\" >!< release) audit(AUDIT_OS_NOT, \"Red Hat\");\nos_ver = pregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Red Hat\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^7([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Red Hat 7.x\", \"Red Hat \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"s390\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Red Hat\", cpu);\n\nyum_updateinfo = get_kb_item(\"Host/RedHat/yum-updateinfo\");\nif (!empty_or_null(yum_updateinfo)) \n{\n rhsa = \"RHSA-2016:0083\";\n yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);\n if (!empty_or_null(yum_report))\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : yum_report \n );\n exit(0);\n }\n else\n {\n audit_message = \"affected by Red Hat security advisory \" + rhsa;\n audit(AUDIT_OS_NOT, audit_message);\n }\n}\nelse\n{\n flag = 0;\n if (rpm_check(release:\"RHEL7\", cpu:\"i686\", reference:\"libcacard-1.5.3-105.el7_2.3\")) flag++;\n\n if (rpm_check(release:\"RHEL7\", cpu:\"x86_64\", reference:\"libcacard-1.5.3-105.el7_2.3\")) flag++;\n\n if (rpm_check(release:\"RHEL7\", cpu:\"i686\", reference:\"libcacard-devel-1.5.3-105.el7_2.3\")) flag++;\n\n if (rpm_check(release:\"RHEL7\", cpu:\"x86_64\", reference:\"libcacard-devel-1.5.3-105.el7_2.3\")) flag++;\n\n if (rpm_check(release:\"RHEL7\", cpu:\"x86_64\", reference:\"libcacard-tools-1.5.3-105.el7_2.3\")) flag++;\n\n if (rpm_check(release:\"RHEL7\", cpu:\"x86_64\", reference:\"qemu-img-1.5.3-105.el7_2.3\")) flag++;\n\n if (rpm_check(release:\"RHEL7\", cpu:\"x86_64\", reference:\"qemu-kvm-1.5.3-105.el7_2.3\")) flag++;\n\n if (rpm_check(release:\"RHEL7\", cpu:\"x86_64\", reference:\"qemu-kvm-common-1.5.3-105.el7_2.3\")) flag++;\n\n if (rpm_check(release:\"RHEL7\", cpu:\"i686\", reference:\"qemu-kvm-debuginfo-1.5.3-105.el7_2.3\")) flag++;\n\n if (rpm_check(release:\"RHEL7\", cpu:\"x86_64\", reference:\"qemu-kvm-debuginfo-1.5.3-105.el7_2.3\")) flag++;\n\n if (rpm_check(release:\"RHEL7\", cpu:\"x86_64\", reference:\"qemu-kvm-tools-1.5.3-105.el7_2.3\")) flag++;\n\n\n if (flag)\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get() + redhat_report_package_caveat()\n );\n exit(0);\n }\n else\n {\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"libcacard / libcacard-devel / libcacard-tools / qemu-img / qemu-kvm / etc\");\n }\n}\n", "cvss": {"score": 6.9, "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-11T16:32:55", "description": "Updated qemu-kvm packages that fix one security issue are now available for Red Hat Enterprise Linux 6.\n\nRed Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.\n\nKVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on AMD64 and Intel 64 systems. The qemu-kvm package provides the user-space component for running virtual machines using KVM.\n\nAn out-of-bounds read/write flaw was discovered in the way QEMU's Firmware Configuration device emulation processed certain firmware configurations. A privileged (CAP_SYS_RAWIO) guest user could use this flaw to crash the QEMU process instance or, potentially, execute arbitrary code on the host with privileges of the QEMU process.\n(CVE-2016-1714)\n\nRed Hat would like to thank Donghai Zhu of Alibaba for reporting this issue.\n\nAll qemu-kvm users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.", "cvss3": {"exploitabilityScore": 1.4, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "CHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.1, "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.0", "userInteraction": "NONE"}, "impactScore": 6.0}, "published": "2016-02-02T00:00:00", "type": "nessus", "title": "CentOS 6 : qemu-kvm (CESA-2016:0082)", "bulletinFamily": "scanner", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 3.4, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 6.9, "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2016-1714"], "modified": "2021-01-04T00:00:00", "cpe": ["p-cpe:/a:centos:centos:qemu-guest-agent", "p-cpe:/a:centos:centos:qemu-img", "p-cpe:/a:centos:centos:qemu-kvm", "p-cpe:/a:centos:centos:qemu-kvm-tools", "cpe:/o:centos:centos:6"], "id": "CENTOS_RHSA-2016-0082.NASL", "href": "https://www.tenable.com/plugins/nessus/88509", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Red Hat Security Advisory RHSA-2016:0082 and \n# CentOS Errata and Security Advisory 2016:0082 respectively.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(88509);\n script_version(\"2.11\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/04\");\n\n script_cve_id(\"CVE-2016-1714\");\n script_xref(name:\"RHSA\", value:\"2016:0082\");\n\n script_name(english:\"CentOS 6 : qemu-kvm (CESA-2016:0082)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote CentOS host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Updated qemu-kvm packages that fix one security issue are now\navailable for Red Hat Enterprise Linux 6.\n\nRed Hat Product Security has rated this update as having Important\nsecurity impact. A Common Vulnerability Scoring System (CVSS) base\nscore, which gives a detailed severity rating, is available from the\nCVE link in the References section.\n\nKVM (Kernel-based Virtual Machine) is a full virtualization solution\nfor Linux on AMD64 and Intel 64 systems. The qemu-kvm package provides\nthe user-space component for running virtual machines using KVM.\n\nAn out-of-bounds read/write flaw was discovered in the way QEMU's\nFirmware Configuration device emulation processed certain firmware\nconfigurations. A privileged (CAP_SYS_RAWIO) guest user could use this\nflaw to crash the QEMU process instance or, potentially, execute\narbitrary code on the host with privileges of the QEMU process.\n(CVE-2016-1714)\n\nRed Hat would like to thank Donghai Zhu of Alibaba for reporting this\nissue.\n\nAll qemu-kvm users are advised to upgrade to these updated packages,\nwhich contain a backported patch to correct this issue. After\ninstalling this update, shut down all running virtual machines. Once\nall virtual machines have shut down, start them again for this update\nto take effect.\"\n );\n # https://lists.centos.org/pipermail/centos-announce/2016-February/021636.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?ac787316\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected qemu-kvm packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2016-1714\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:qemu-guest-agent\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:qemu-img\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:qemu-kvm\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:qemu-kvm-tools\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:centos:centos:6\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2016/04/07\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/02/01\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/02/02\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"CentOS Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/CentOS/release\", \"Host/CentOS/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/CentOS/release\");\nif (isnull(release) || \"CentOS\" >!< release) audit(AUDIT_OS_NOT, \"CentOS\");\nos_ver = pregmatch(pattern: \"CentOS(?: Linux)? release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"CentOS\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^6([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"CentOS 6.x\", \"CentOS \" + os_ver);\n\nif (!get_kb_item(\"Host/CentOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"CentOS\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"CentOS-6\", reference:\"qemu-guest-agent-0.12.1.2-2.479.el6_7.4\")) flag++;\nif (rpm_check(release:\"CentOS-6\", cpu:\"x86_64\", reference:\"qemu-img-0.12.1.2-2.479.el6_7.4\")) flag++;\nif (rpm_check(release:\"CentOS-6\", cpu:\"x86_64\", reference:\"qemu-kvm-0.12.1.2-2.479.el6_7.4\")) flag++;\nif (rpm_check(release:\"CentOS-6\", cpu:\"x86_64\", reference:\"qemu-kvm-tools-0.12.1.2-2.479.el6_7.4\")) flag++;\n\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"qemu-guest-agent / qemu-img / qemu-kvm / qemu-kvm-tools\");\n}\n", "cvss": {"score": 6.9, "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-11T16:31:39", "description": "Several vulnerabilities were discovered in qemu-kvm, a full virtualization solution on x86 hardware.\n\n - CVE-2015-7295 Jason Wang of Red Hat Inc. discovered that the Virtual Network Device support is vulnerable to denial-of-service (via resource exhaustion), that could occur when receiving large packets.\n\n - CVE-2015-7504 Qinghao Tang of Qihoo 360 Inc. and Ling Liu of Qihoo 360 Inc. discovered that the PC-Net II ethernet controller is vulnerable to a heap-based buffer overflow that could result in denial-of-service (via application crash) or arbitrary code execution.\n\n - CVE-2015-7512 Ling Liu of Qihoo 360 Inc. and Jason Wang of Red Hat Inc. discovered that the PC-Net II ethernet controller is vulnerable to a buffer overflow that could result in denial-of-service (via application crash) or arbitrary code execution.\n\n - CVE-2015-8345 Qinghao Tang of Qihoo 360 Inc. discovered that the eepro100 emulator contains a flaw that could lead to an infinite loop when processing Command Blocks, eventually resulting in denial-of-service (via application crash).\n\n - CVE-2015-8504 Lian Yihan of Qihoo 360 Inc. discovered that the VNC display driver support is vulnerable to an arithmetic exception flaw that could lead to denial-of-service (via application crash).\n\n - CVE-2015-8558 Qinghao Tang of Qihoo 360 Inc. discovered that the USB EHCI emulation support contains a flaw that could lead to an infinite loop during communication between the host controller and a device driver. This could lead to denial-of-service (via resource exhaustion).\n\n - CVE-2015-8743 Ling Liu of Qihoo 360 Inc. discovered that the NE2000 emulator is vulnerable to an out-of-bound read/write access issue, potentially resulting in information leak or memory corruption.\n\n - CVE-2016-1568 Qinghao Tang of Qihoo 360 Inc. discovered that the IDE AHCI emulation support is vulnerable to a use-after-free issue, that could lead to denial-of-service (via application crash) or arbitrary code execution.\n\n - CVE-2016-1714 Donghai Zhu of Alibaba discovered that the Firmware Configuration emulation support is vulnerable to an out-of-bound read/write access issue, that could lead to denial-of-service (via application crash) or arbitrary code execution.\n\n - CVE-2016-1922 Ling Liu of Qihoo 360 Inc. discovered that 32-bit Windows guests support is vulnerable to a NULL pointer dereference issue, that could lead to denial-of-service (via application crash).", "cvss3": {"exploitabilityScore": 2.2, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 9.0, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 6.0}, "published": "2016-02-09T00:00:00", "type": "nessus", "title": "Debian DSA-3470-1 : qemu-kvm - security update", "bulletinFamily": "scanner", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 3.4, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 6.9, "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-7295", "CVE-2015-7504", "CVE-2015-7512", "CVE-2015-8345", "CVE-2015-8504", "CVE-2015-8558", "CVE-2015-8743", "CVE-2016-1568", "CVE-2016-1714", "CVE-2016-1922", "CVE-2016-1981"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:debian:debian_linux:qemu-kvm", "cpe:/o:debian:debian_linux:7.0"], "id": "DEBIAN_DSA-3470.NASL", "href": "https://www.tenable.com/plugins/nessus/88629", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Debian Security Advisory DSA-3470. The text \n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(88629);\n script_version(\"2.15\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2015-7295\", \"CVE-2015-7504\", \"CVE-2015-7512\", \"CVE-2015-8345\", \"CVE-2015-8504\", \"CVE-2015-8558\", \"CVE-2015-8743\", \"CVE-2016-1568\", \"CVE-2016-1714\", \"CVE-2016-1922\", \"CVE-2016-1981\");\n script_xref(name:\"DSA\", value:\"3470\");\n\n script_name(english:\"Debian DSA-3470-1 : qemu-kvm - security update\");\n script_summary(english:\"Checks dpkg output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Several vulnerabilities were discovered in qemu-kvm, a full\nvirtualization solution on x86 hardware.\n\n - CVE-2015-7295\n Jason Wang of Red Hat Inc. discovered that the Virtual\n Network Device support is vulnerable to\n denial-of-service (via resource exhaustion), that could\n occur when receiving large packets.\n\n - CVE-2015-7504\n Qinghao Tang of Qihoo 360 Inc. and Ling Liu of Qihoo 360\n Inc. discovered that the PC-Net II ethernet controller\n is vulnerable to a heap-based buffer overflow that could\n result in denial-of-service (via application crash) or\n arbitrary code execution.\n\n - CVE-2015-7512\n Ling Liu of Qihoo 360 Inc. and Jason Wang of Red Hat\n Inc. discovered that the PC-Net II ethernet controller\n is vulnerable to a buffer overflow that could result in\n denial-of-service (via application crash) or arbitrary\n code execution.\n\n - CVE-2015-8345\n Qinghao Tang of Qihoo 360 Inc. discovered that the\n eepro100 emulator contains a flaw that could lead to an\n infinite loop when processing Command Blocks, eventually\n resulting in denial-of-service (via application crash).\n\n - CVE-2015-8504\n Lian Yihan of Qihoo 360 Inc. discovered that the VNC\n display driver support is vulnerable to an arithmetic\n exception flaw that could lead to denial-of-service (via\n application crash).\n\n - CVE-2015-8558\n Qinghao Tang of Qihoo 360 Inc. discovered that the USB\n EHCI emulation support contains a flaw that could lead\n to an infinite loop during communication between the\n host controller and a device driver. This could lead to\n denial-of-service (via resource exhaustion).\n\n - CVE-2015-8743\n Ling Liu of Qihoo 360 Inc. discovered that the NE2000\n emulator is vulnerable to an out-of-bound read/write\n access issue, potentially resulting in information leak\n or memory corruption.\n\n - CVE-2016-1568\n Qinghao Tang of Qihoo 360 Inc. discovered that the IDE\n AHCI emulation support is vulnerable to a use-after-free\n issue, that could lead to denial-of-service (via\n application crash) or arbitrary code execution.\n\n - CVE-2016-1714\n Donghai Zhu of Alibaba discovered that the Firmware\n Configuration emulation support is vulnerable to an\n out-of-bound read/write access issue, that could lead to\n denial-of-service (via application crash) or arbitrary\n code execution.\n\n - CVE-2016-1922\n Ling Liu of Qihoo 360 Inc. discovered that 32-bit\n Windows guests support is vulnerable to a NULL pointer\n dereference issue, that could lead to denial-of-service\n (via application crash).\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=799452\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=806373\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=806741\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=806742\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=808130\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=808144\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=810519\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=810527\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=811201\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2015-7295\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2015-7504\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2015-7512\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2015-8345\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2015-8504\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2015-8558\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2015-8743\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2016-1568\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2016-1714\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2016-1922\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://packages.debian.org/source/wheezy/qemu-kvm\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.debian.org/security/2016/dsa-3470\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Upgrade the qemu-kvm packages.\n\nFor the oldstable distribution (wheezy), these problems have been\nfixed in version 1.1.2+dfsg-6+deb7u12.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:qemu-kvm\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:7.0\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2015/11/09\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/02/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/02/09\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"7.0\", prefix:\"kvm\", reference:\"1.1.2+dfsg-6+deb7u12\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"qemu-kvm\", reference:\"1.1.2+dfsg-6+deb7u12\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"qemu-kvm-dbg\", reference:\"1.1.2+dfsg-6+deb7u12\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 6.9, "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-11T16:32:03", "description": "Several vulnerabilities were discovered in qemu, a full virtualization solution on x86 hardware.\n\n - CVE-2015-7295 Jason Wang of Red Hat Inc. discovered that the Virtual Network Device support is vulnerable to denial-of-service (via resource exhaustion), that could occur when receiving large packets.\n\n - CVE-2015-7504 Qinghao Tang of Qihoo 360 Inc. and Ling Liu of Qihoo 360 Inc. discovered that the PC-Net II ethernet controller is vulnerable to a heap-based buffer overflow that could result in denial-of-service (via application crash) or arbitrary code execution.\n\n - CVE-2015-7512 Ling Liu of Qihoo 360 Inc. and Jason Wang of Red Hat Inc. discovered that the PC-Net II ethernet controller is vulnerable to a buffer overflow that could result in denial-of-service (via application crash) or arbitrary code execution.\n\n - CVE-2015-8345 Qinghao Tang of Qihoo 360 Inc. discovered that the eepro100 emulator contains a flaw that could lead to an infinite loop when processing Command Blocks, eventually resulting in denial-of-service (via application crash).\n\n - CVE-2015-8504 Lian Yihan of Qihoo 360 Inc. discovered that the VNC display driver support is vulnerable to an arithmetic exception flaw that could lead to denial-of-service (via application crash).\n\n - CVE-2015-8558 Qinghao Tang of Qihoo 360 Inc. discovered that the USB EHCI emulation support contains a flaw that could lead to an infinite loop during communication between the host controller and a device driver. This could lead to denial-of-service (via resource exhaustion).\n\n - CVE-2015-8743 Ling Liu of Qihoo 360 Inc. discovered that the NE2000 emulator is vulnerable to an out-of-bound read/write access issue, potentially resulting in information leak or memory corruption.\n\n - CVE-2016-1568 Qinghao Tang of Qihoo 360 Inc. discovered that the IDE AHCI emulation support is vulnerable to a use-after-free issue, that could lead to denial-of-service (via application crash) or arbitrary code execution.\n\n - CVE-2016-1714 Donghai Zhu of Alibaba discovered that the Firmware Configuration emulation support is vulnerable to an out-of-bound read/write access issue, that could lead to denial-of-service (via application crash) or arbitrary code execution.\n\n - CVE-2016-1922 Ling Liu of Qihoo 360 Inc. discovered that 32-bit Windows guests support is vulnerable to a NULL pointer dereference issue, that could lead to denial-of-service (via application crash).", "cvss3": {"exploitabilityScore": 2.2, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 9.0, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 6.0}, "published": "2016-02-09T00:00:00", "type": "nessus", "title": "Debian DSA-3469-1 : qemu - security update", "bulletinFamily": "scanner", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 3.4, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 6.9, "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-7295", "CVE-2015-7504", "CVE-2015-7512", "CVE-2015-8345", "CVE-2015-8504", "CVE-2015-8558", "CVE-2015-8743", "CVE-2016-1568", "CVE-2016-1714", "CVE-2016-1922", "CVE-2016-1981"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:debian:debian_linux:qemu", "cpe:/o:debian:debian_linux:7.0"], "id": "DEBIAN_DSA-3469.NASL", "href": "https://www.tenable.com/plugins/nessus/88628", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Debian Security Advisory DSA-3469. The text \n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(88628);\n script_version(\"2.16\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2015-7295\", \"CVE-2015-7504\", \"CVE-2015-7512\", \"CVE-2015-8345\", \"CVE-2015-8504\", \"CVE-2015-8558\", \"CVE-2015-8743\", \"CVE-2016-1568\", \"CVE-2016-1714\", \"CVE-2016-1922\", \"CVE-2016-1981\");\n script_xref(name:\"DSA\", value:\"3469\");\n\n script_name(english:\"Debian DSA-3469-1 : qemu - security update\");\n script_summary(english:\"Checks dpkg output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Several vulnerabilities were discovered in qemu, a full virtualization\nsolution on x86 hardware.\n\n - CVE-2015-7295\n Jason Wang of Red Hat Inc. discovered that the Virtual\n Network Device support is vulnerable to\n denial-of-service (via resource exhaustion), that could\n occur when receiving large packets.\n\n - CVE-2015-7504\n Qinghao Tang of Qihoo 360 Inc. and Ling Liu of Qihoo 360\n Inc. discovered that the PC-Net II ethernet controller\n is vulnerable to a heap-based buffer overflow that could\n result in denial-of-service (via application crash) or\n arbitrary code execution.\n\n - CVE-2015-7512\n Ling Liu of Qihoo 360 Inc. and Jason Wang of Red Hat\n Inc. discovered that the PC-Net II ethernet controller\n is vulnerable to a buffer overflow that could result in\n denial-of-service (via application crash) or arbitrary\n code execution.\n\n - CVE-2015-8345\n Qinghao Tang of Qihoo 360 Inc. discovered that the\n eepro100 emulator contains a flaw that could lead to an\n infinite loop when processing Command Blocks, eventually\n resulting in denial-of-service (via application crash).\n\n - CVE-2015-8504\n Lian Yihan of Qihoo 360 Inc. discovered that the VNC\n display driver support is vulnerable to an arithmetic\n exception flaw that could lead to denial-of-service (via\n application crash).\n\n - CVE-2015-8558\n Qinghao Tang of Qihoo 360 Inc. discovered that the USB\n EHCI emulation support contains a flaw that could lead\n to an infinite loop during communication between the\n host controller and a device driver. This could lead to\n denial-of-service (via resource exhaustion).\n\n - CVE-2015-8743\n Ling Liu of Qihoo 360 Inc. discovered that the NE2000\n emulator is vulnerable to an out-of-bound read/write\n access issue, potentially resulting in information leak\n or memory corruption.\n\n - CVE-2016-1568\n Qinghao Tang of Qihoo 360 Inc. discovered that the IDE\n AHCI emulation support is vulnerable to a use-after-free\n issue, that could lead to denial-of-service (via\n application crash) or arbitrary code execution.\n\n - CVE-2016-1714\n Donghai Zhu of Alibaba discovered that the Firmware\n Configuration emulation support is vulnerable to an\n out-of-bound read/write access issue, that could lead to\n denial-of-service (via application crash) or arbitrary\n code execution.\n\n - CVE-2016-1922\n Ling Liu of Qihoo 360 Inc. discovered that 32-bit\n Windows guests support is vulnerable to a NULL pointer\n dereference issue, that could lead to denial-of-service\n (via application crash).\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=799452\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=806373\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=806741\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=806742\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=808130\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=808144\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=810519\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=810527\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=811201\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=812307\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2015-7295\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2015-7504\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2015-7512\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2015-8345\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2015-8504\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2015-8558\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2015-8743\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2016-1568\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2016-1714\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2016-1922\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://packages.debian.org/source/wheezy/qemu\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.debian.org/security/2016/dsa-3469\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Upgrade the qemu packages.\n\nFor the oldstable distribution (wheezy), these problems have been\nfixed in version 1.1.2+dfsg-6+deb7u12.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:qemu\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:7.0\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2015/11/09\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/02/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/02/09\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"7.0\", prefix:\"qemu\", reference:\"1.1.2+dfsg-6+deb7u12\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"qemu-keymaps\", reference:\"1.1.2+dfsg-6+deb7u12\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"qemu-system\", reference:\"1.1.2+dfsg-6+deb7u12\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"qemu-user\", reference:\"1.1.2+dfsg-6+deb7u12\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"qemu-user-static\", reference:\"1.1.2+dfsg-6+deb7u12\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"qemu-utils\", reference:\"1.1.2+dfsg-6+deb7u12\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 6.9, "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-11T16:38:26", "description": "The remote OracleVM system is missing necessary patches to address critical security updates :\n\n - kvm-Add-vga.h-unmodified-from-Linux.patch [bz#1331407]\n\n - kvm-vga.h-remove-unused-stuff-and-reformat.patch [bz#1331407]\n\n - kvm-vga-use-constants-from-vga.h.patch [bz#1331407]\n\n - kvm-vga-Remove-some-should-be-done-in-BIOS-comments.patc h [bz#1331407]\n\n - kvm-vga-fix-banked-access-bounds-checking-CVE-2016-3710.\n patch [bz#1331407]\n\n - kvm-vga-add-vbe_enabled-helper.patch [bz#1331407]\n\n - kvm-vga-factor-out-vga-register-setup.patch [bz#1331407]\n\n - kvm-vga-update-vga-register-setup-on-vbe-changes.patch [bz#1331407]\n\n - kvm-vga-make-sure-vga-register-setup-for-vbe-stays-intac .patch \n\n - Resolves: bz#1331407 (EMBARGOED CVE-2016-3710 qemu-kvm:\n qemu: incorrect banked access bounds checking in vga module [rhel-6.8.z])\n\n - Revert 'warning when CPU threads>1 for non-Intel CPUs' fix\n\n - kvm-qemu-ga-implement-win32-guest-set-user-password.patc h [bz#1174181]\n\n - kvm-util-add-base64-decoding-function.patch [bz#1174181]\n\n - kvm-qga-convert-to-use-error-checked-base64-decode.patch [bz#1174181]\n\n - kvm-qga-use-more-idiomatic-qemu-style-eol-operators.patc h [bz#1174181]\n\n - kvm-qga-use-size_t-for-wcslen-return-value.patch [bz#1174181]\n\n - kvm-qga-use-wide-chars-constants-for-wchar_t-comparisons .patch \n\n - kvm-qga-fix-off-by-one-length-check.patch [bz#1174181]\n\n - kvm-qga-check-utf8-to-utf16-conversion.patch [bz#1174181]\n\n - Resolves: bz#1174181 (RFE: provide QEMU guest agent command for setting root account password (Linux guest))\n\n - kvm-hw-qxl-qxl_send_events-nop-if-stopped.patch [bz#1290743]\n\n - kvm-block-mirror-fix-full-sync-mode-when-target-does-not .patch [bz#971312]\n\n - Resolves: bz#1290743 (qemu-kvm core dumped when repeat system_reset 20 times during guest boot)\n\n - Resolves: bz#971312 (block: Mirroring to raw block device doesn't zero out unused blocks)\n\n - Mon Feb 08 2016 Miroslav Rezanina < - 0.12.1.2-2.488.el6\n\n - Fixed qemu-ga path configuration [bz#1213233]\n\n - Resolves: bz#1213233 ([virtagent] The default path '/etc/qemu/fsfreeze-hook' for 'fsfreeze-hook' script doesn't exist)\n\n - kvm-virtio-scsi-use-virtqueue_map_sg-when-loading-reques .patch \n\n - kvm-scsi-disk-fix-cmd.mode-field-typo.patch [bz#1249740]\n\n - Resolves: bz#1249740 (Segfault occurred at Dst VM while completed migration upon ENOSPC)\n\n - kvm-blockdev-Error-out-on-negative-throttling-option-val .patch \n\n - kvm-fw_cfg-add-check-to-validate-current-entry-value-CVE .patch \n\n - Resolves: bz#1294619 (Guest should failed to boot if set iops,bps to negative number)\n\n - Resolves: bz#1298046 (CVE-2016-1714 qemu-kvm: Qemu:\n nvram: OOB r/w access in processing firmware configurations [rhel-6.8])\n\n - kvm-Change-fsfreeze-hook-default-location.patch [bz#1213233]\n\n - kvm-qxl-replace-pipe-signaling-with-bottom-half.patch [bz#1290743]\n\n - Resolves: bz#1213233 ([virtagent] The default path '/etc/qemu/fsfreeze-hook' for 'fsfreeze-hook' script doesn't exist)\n\n - Resolves: bz#1290743 (qemu-kvm core dumped when repeat system_reset 20 times during guest boot)\n\n - kvm-qga-flush-explicitly-when-needed.patch [bz#1210246]\n\n - kvm-qga-add-guest-set-user-password-command.patch [bz#1174181]\n\n - kvm-qcow2-Zero-initialise-first-cluster-for-new-images.p atch [bz#1223216]\n\n - kvm-Documentation-Warn-against-qemu-img-on-active-image.\n patch [bz#1297424]\n\n - kvm-target-i386-warns-users-when-CPU-threads-1-for-non-I .patch \n\n - kvm-qemu-options-Fix-texinfo-markup.patch [bz#1250442]\n\n - kvm-qga-Fix-memory-allocation-pasto.patch []\n\n - kvm-block-raw-posix-Open-file-descriptor-O_RDWR-to-work- .patch \n\n - Resolves: bz#1174181 (RFE: provide QEMU guest agent command for setting root/administrator account password)\n\n - Resolves: bz#1210246 ([virtagent]The 'write' content is lost if 'read' it before flush through guest agent)\n\n - Resolves: bz#1223216 (qemu-img can not create qcow2 image when backend is block device)\n\n - Resolves: bz#1250442 (qemu-doc.html bad markup in section 3.3 Invocation)\n\n - Resolves: bz#1268347 (posix_fallocate emulation on NFS fails with Bad file descriptor if fd is opened O_WRONLY)\n\n - Resolves: bz#1292678 (Qemu should report error when cmdline set threads=2 in amd host)\n\n - Resolves: bz#1297424 (Add warning about running qemu-img on active VMs to its manpage)\n\n - kvm-rtl8139-Fix-receive-buffer-overflow-check.patch [bz#1262866]\n\n - kvm-rtl8139-Do-not-consume-the-packet-during-overflow-in .patch \n\n - Resolves: bz#1262866 ([RHEL6] Package is 100% lost when ping from host to Win2012r2 guest with 64000 size)\n\n - kvm-qemu-kvm-get-put-MSR_TSC_AUX-across-reset-and-migrat .patch \n\n - kvm-qcow2-Discard-VM-state-in-active-L1-after-creating-s .patch \n\n - kvm-net-pcnet-add-check-to-validate-receive-data-size-CV .patch \n\n - kvm-pcnet-fix-rx-buffer-overflow-CVE-2015-7512.patch [bz#1286567]\n\n - Resolves: bz#1219908 (Writing snapshots with 'virsh snapshot-create-as' command slows as more snapshots are created)\n\n - Resolves: bz#1265428 (contents of MSR_TSC_AUX are not migrated)\n\n - Resolves: bz#1286567 (CVE-2015-7512 qemu-kvm: Qemu: net:\n pcnet: buffer overflow in non-loopback mode [rhel-6.8])\n\n - kvm-net-add-checks-to-validate-ring-buffer-pointers-CVE- .patch \n\n - Resolves: bz#1263275 (CVE-2015-5279 qemu-kvm: qemu: Heap overflow vulnerability in ne2000_receive function [rhel-6.8])\n\n - kvm-virtio-rng-fix-segfault-when-adding-a-virtio-pci-rng .patch \n\n - kvm-qga-commands-posix-Fix-bug-in-guest-fstrim.patch [bz#1213236]\n\n - kvm-rtl8139-avoid-nested-ifs-in-IP-header-parsing-CVE-20 .patch \n\n - kvm-rtl8139-drop-tautologous-if-ip-.-statement-CVE-2015- .patch \n\n - kvm-rtl8139-skip-offload-on-short-Ethernet-IP-header-CVE .patch \n\n - kvm-rtl8139-check-IP-Header-Length-field-CVE-2015-5165.p atch [bz#1248763]\n\n - kvm-rtl8139-check-IP-Total-Length-field-CVE-2015-5165.pa tch [bz#1248763]\n\n - kvm-rtl8139-skip-offload-on-short-TCP-header-CVE-2015-51 .patch \n\n - kvm-rtl8139-check-TCP-Data-Offset-field-CVE-2015-5165.pa tch [bz#1248763]\n\n - Resolves: bz#1213236 ([virtagent] 'guest-fstrim' failed for guest with os on spapr-vscsi disk)\n\n - Resolves: bz#1230068 (Segmentation fault when re-adding virtio-rng-pci device)\n\n - Resolves: bz#1248763 (CVE-2015-5165 qemu-kvm: Qemu:\n rtl8139 uninitialized heap memory information leakage to guest [rhel-6.8])", "cvss3": {"exploitabilityScore": 2.2, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 9.0, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 6.0}, "published": "2016-05-25T00:00:00", "type": "nessus", "title": "OracleVM 3.4 : qemu-kvm (OVMSA-2016-0051)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-5165", "CVE-2015-5279", "CVE-2015-7512", "CVE-2016-1714", "CVE-2016-3710"], "modified": "2021-01-04T00:00:00", "cpe": ["p-cpe:/a:oracle:vm:qemu-img", "cpe:/o:oracle:vm_server:3.4"], "id": "ORACLEVM_OVMSA-2016-0051.NASL", "href": "https://www.tenable.com/plugins/nessus/91316", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The package checks in this plugin were extracted from OracleVM\n# Security Advisory OVMSA-2016-0051.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(91316);\n script_version(\"2.7\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/04\");\n\n script_cve_id(\"CVE-2015-5165\", \"CVE-2015-5279\", \"CVE-2015-7512\", \"CVE-2016-1714\", \"CVE-2016-3710\");\n\n script_name(english:\"OracleVM 3.4 : qemu-kvm (OVMSA-2016-0051)\");\n script_summary(english:\"Checks the RPM output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote OracleVM host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The remote OracleVM system is missing necessary patches to address\ncritical security updates :\n\n - kvm-Add-vga.h-unmodified-from-Linux.patch [bz#1331407]\n\n - kvm-vga.h-remove-unused-stuff-and-reformat.patch\n [bz#1331407]\n\n - kvm-vga-use-constants-from-vga.h.patch [bz#1331407]\n\n -\n kvm-vga-Remove-some-should-be-done-in-BIOS-comments.patc\n h [bz#1331407]\n\n -\n kvm-vga-fix-banked-access-bounds-checking-CVE-2016-3710.\n patch [bz#1331407]\n\n - kvm-vga-add-vbe_enabled-helper.patch [bz#1331407]\n\n - kvm-vga-factor-out-vga-register-setup.patch [bz#1331407]\n\n - kvm-vga-update-vga-register-setup-on-vbe-changes.patch\n [bz#1331407]\n\n -\n kvm-vga-make-sure-vga-register-setup-for-vbe-stays-intac\n .patch \n\n - Resolves: bz#1331407 (EMBARGOED CVE-2016-3710 qemu-kvm:\n qemu: incorrect banked access bounds checking in vga\n module [rhel-6.8.z])\n\n - Revert 'warning when CPU threads>1 for non-Intel CPUs'\n fix\n\n -\n kvm-qemu-ga-implement-win32-guest-set-user-password.patc\n h [bz#1174181]\n\n - kvm-util-add-base64-decoding-function.patch [bz#1174181]\n\n - kvm-qga-convert-to-use-error-checked-base64-decode.patch\n [bz#1174181]\n\n -\n kvm-qga-use-more-idiomatic-qemu-style-eol-operators.patc\n h [bz#1174181]\n\n - kvm-qga-use-size_t-for-wcslen-return-value.patch\n [bz#1174181]\n\n -\n kvm-qga-use-wide-chars-constants-for-wchar_t-comparisons\n .patch \n\n - kvm-qga-fix-off-by-one-length-check.patch [bz#1174181]\n\n - kvm-qga-check-utf8-to-utf16-conversion.patch\n [bz#1174181]\n\n - Resolves: bz#1174181 (RFE: provide QEMU guest agent\n command for setting root account password (Linux guest))\n\n - kvm-hw-qxl-qxl_send_events-nop-if-stopped.patch\n [bz#1290743]\n\n -\n kvm-block-mirror-fix-full-sync-mode-when-target-does-not\n .patch [bz#971312]\n\n - Resolves: bz#1290743 (qemu-kvm core dumped when repeat\n system_reset 20 times during guest boot)\n\n - Resolves: bz#971312 (block: Mirroring to raw block\n device doesn't zero out unused blocks)\n\n - Mon Feb 08 2016 Miroslav Rezanina < - 0.12.1.2-2.488.el6\n\n - Fixed qemu-ga path configuration [bz#1213233]\n\n - Resolves: bz#1213233 ([virtagent] The default path\n '/etc/qemu/fsfreeze-hook' for 'fsfreeze-hook' script\n doesn't exist)\n\n -\n kvm-virtio-scsi-use-virtqueue_map_sg-when-loading-reques\n .patch \n\n - kvm-scsi-disk-fix-cmd.mode-field-typo.patch [bz#1249740]\n\n - Resolves: bz#1249740 (Segfault occurred at Dst VM while\n completed migration upon ENOSPC)\n\n -\n kvm-blockdev-Error-out-on-negative-throttling-option-val\n .patch \n\n -\n kvm-fw_cfg-add-check-to-validate-current-entry-value-CVE\n .patch \n\n - Resolves: bz#1294619 (Guest should failed to boot if set\n iops,bps to negative number)\n\n - Resolves: bz#1298046 (CVE-2016-1714 qemu-kvm: Qemu:\n nvram: OOB r/w access in processing firmware\n configurations [rhel-6.8])\n\n - kvm-Change-fsfreeze-hook-default-location.patch\n [bz#1213233]\n\n - kvm-qxl-replace-pipe-signaling-with-bottom-half.patch\n [bz#1290743]\n\n - Resolves: bz#1213233 ([virtagent] The default path\n '/etc/qemu/fsfreeze-hook' for 'fsfreeze-hook' script\n doesn't exist)\n\n - Resolves: bz#1290743 (qemu-kvm core dumped when repeat\n system_reset 20 times during guest boot)\n\n - kvm-qga-flush-explicitly-when-needed.patch [bz#1210246]\n\n - kvm-qga-add-guest-set-user-password-command.patch\n [bz#1174181]\n\n -\n kvm-qcow2-Zero-initialise-first-cluster-for-new-images.p\n atch [bz#1223216]\n\n -\n kvm-Documentation-Warn-against-qemu-img-on-active-image.\n patch [bz#1297424]\n\n -\n kvm-target-i386-warns-users-when-CPU-threads-1-for-non-I\n .patch \n\n - kvm-qemu-options-Fix-texinfo-markup.patch [bz#1250442]\n\n - kvm-qga-Fix-memory-allocation-pasto.patch []\n\n -\n kvm-block-raw-posix-Open-file-descriptor-O_RDWR-to-work-\n .patch \n\n - Resolves: bz#1174181 (RFE: provide QEMU guest agent\n command for setting root/administrator account password)\n\n - Resolves: bz#1210246 ([virtagent]The 'write' content is\n lost if 'read' it before flush through guest agent)\n\n - Resolves: bz#1223216 (qemu-img can not create qcow2\n image when backend is block device)\n\n - Resolves: bz#1250442 (qemu-doc.html bad markup in\n section 3.3 Invocation)\n\n - Resolves: bz#1268347 (posix_fallocate emulation on NFS\n fails with Bad file descriptor if fd is opened O_WRONLY)\n\n - Resolves: bz#1292678 (Qemu should report error when\n cmdline set threads=2 in amd host)\n\n - Resolves: bz#1297424 (Add warning about running qemu-img\n on active VMs to its manpage)\n\n - kvm-rtl8139-Fix-receive-buffer-overflow-check.patch\n [bz#1262866]\n\n -\n kvm-rtl8139-Do-not-consume-the-packet-during-overflow-in\n .patch \n\n - Resolves: bz#1262866 ([RHEL6] Package is 100% lost when\n ping from host to Win2012r2 guest with 64000 size)\n\n -\n kvm-qemu-kvm-get-put-MSR_TSC_AUX-across-reset-and-migrat\n .patch \n\n -\n kvm-qcow2-Discard-VM-state-in-active-L1-after-creating-s\n .patch \n\n -\n kvm-net-pcnet-add-check-to-validate-receive-data-size-CV\n .patch \n\n - kvm-pcnet-fix-rx-buffer-overflow-CVE-2015-7512.patch\n [bz#1286567]\n\n - Resolves: bz#1219908 (Writing snapshots with 'virsh\n snapshot-create-as' command slows as more snapshots are\n created)\n\n - Resolves: bz#1265428 (contents of MSR_TSC_AUX are not\n migrated)\n\n - Resolves: bz#1286567 (CVE-2015-7512 qemu-kvm: Qemu: net:\n pcnet: buffer overflow in non-loopback mode [rhel-6.8])\n\n -\n kvm-net-add-checks-to-validate-ring-buffer-pointers-CVE-\n .patch \n\n - Resolves: bz#1263275 (CVE-2015-5279 qemu-kvm: qemu: Heap\n overflow vulnerability in ne2000_receive function\n [rhel-6.8])\n\n -\n kvm-virtio-rng-fix-segfault-when-adding-a-virtio-pci-rng\n .patch \n\n - kvm-qga-commands-posix-Fix-bug-in-guest-fstrim.patch\n [bz#1213236]\n\n -\n kvm-rtl8139-avoid-nested-ifs-in-IP-header-parsing-CVE-20\n .patch \n\n -\n kvm-rtl8139-drop-tautologous-if-ip-.-statement-CVE-2015-\n .patch \n\n -\n kvm-rtl8139-skip-offload-on-short-Ethernet-IP-header-CVE\n .patch \n\n -\n kvm-rtl8139-check-IP-Header-Length-field-CVE-2015-5165.p\n atch [bz#1248763]\n\n -\n kvm-rtl8139-check-IP-Total-Length-field-CVE-2015-5165.pa\n tch [bz#1248763]\n\n -\n kvm-rtl8139-skip-offload-on-short-TCP-header-CVE-2015-51\n .patch \n\n -\n kvm-rtl8139-check-TCP-Data-Offset-field-CVE-2015-5165.pa\n tch [bz#1248763]\n\n - Resolves: bz#1213236 ([virtagent] 'guest-fstrim' failed\n for guest with os on spapr-vscsi disk)\n\n - Resolves: bz#1230068 (Segmentation fault when re-adding\n virtio-rng-pci device)\n\n - Resolves: bz#1248763 (CVE-2015-5165 qemu-kvm: Qemu:\n rtl8139 uninitialized heap memory information leakage to\n guest [rhel-6.8])\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://oss.oracle.com/pipermail/oraclevm-errata/2016-May/000467.html\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected qemu-img package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:vm:qemu-img\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:oracle:vm_server:3.4\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2015/08/12\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/05/24\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/05/25\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"OracleVM Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/OracleVM/release\", \"Host/OracleVM/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/OracleVM/release\");\nif (isnull(release) || \"OVS\" >!< release) audit(AUDIT_OS_NOT, \"OracleVM\");\nif (! preg(pattern:\"^OVS\" + \"3\\.4\" + \"(\\.[0-9]|$)\", string:release)) audit(AUDIT_OS_NOT, \"OracleVM 3.4\", \"OracleVM \" + release);\nif (!get_kb_item(\"Host/OracleVM/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"OracleVM\", cpu);\nif (\"x86_64\" >!< cpu) audit(AUDIT_ARCH_NOT, \"x86_64\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"OVS3.4\", reference:\"qemu-img-0.12.1.2-2.491.el6_8.1\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"qemu-img\");\n}\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-18T14:35:43", "description": "Qinghao Tang discovered that QEMU incorrectly handled PCI MSI-X support. An attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 15.10. (CVE-2015-7549)\n\nLian Yihan discovered that QEMU incorrectly handled the VNC server. A remote attacker could use this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2015-8504)\n\nFelix Wilhelm discovered a race condition in the Xen paravirtualized drivers which can cause double fetch vulnerabilities. An attacker in the paravirtualized guest could exploit this flaw to cause a denial of service (crash the host) or potentially execute arbitrary code on the host. (CVE-2015-8550)\n\nQinghao Tang discovered that QEMU incorrectly handled USB EHCI emulation support. An attacker inside the guest could use this issue to cause QEMU to consume resources, resulting in a denial of service.\n(CVE-2015-8558)\n\nQinghao Tang discovered that QEMU incorrectly handled the vmxnet3 device. An attacker inside the guest could use this issue to cause QEMU to consume resources, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 15.10. (CVE-2015-8567, CVE-2015-8568)\n\nQinghao Tang discovered that QEMU incorrectly handled SCSI MegaRAID SAS HBA emulation. An attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 15.10. (CVE-2015-8613)\n\nLing Liu discovered that QEMU incorrectly handled the Human Monitor Interface. A local attacker could use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 15.10. (CVE-2015-8619, CVE-2016-1922)\n\nDavid Alan Gilbert discovered that QEMU incorrectly handled the Q35 chipset emulation when performing VM guest migrations. An attacker could use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 15.10.\n(CVE-2015-8666)\n\nLing Liu discovered that QEMU incorrectly handled the NE2000 device.\nAn attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2015-8743)\n\nIt was discovered that QEMU incorrectly handled the vmxnet3 device. An attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 15.10. (CVE-2015-8744, CVE-2015-8745)\n\nQinghao Tang discovered that QEMU incorrect handled IDE AHCI emulation. An attacker inside the guest could use this issue to cause a denial of service, or possibly execute arbitrary code on the host as the user running the QEMU process. In the default installation, when QEMU is used with libvirt, attackers would be isolated by the libvirt AppArmor profile. (CVE-2016-1568)\n\nDonghai Zhu discovered that QEMU incorrect handled the firmware configuration device. An attacker inside the guest could use this issue to cause a denial of service, or possibly execute arbitrary code on the host as the user running the QEMU process. In the default installation, when QEMU is used with libvirt, attackers would be isolated by the libvirt AppArmor profile. (CVE-2016-1714)\n\nIt was discovered that QEMU incorrectly handled the e1000 device. An attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2016-1981)\n\nZuozhi Fzz discovered that QEMU incorrectly handled IDE AHCI emulation. An attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 15.10. (CVE-2016-2197)\n\nZuozhi Fzz discovered that QEMU incorrectly handled USB EHCI emulation. An attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 15.10. (CVE-2016-2198).\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"exploitabilityScore": 2.0, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 6.0}, "published": "2016-02-04T00:00:00", "type": "nessus", "title": "Ubuntu 12.04 LTS / 14.04 LTS / 15.10 : qemu, qemu-kvm vulnerabilities (USN-2891-1)", "bulletinFamily": "scanner", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 3.4, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 6.9, "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-7549", "CVE-2015-8504", "CVE-2015-8550", "CVE-2015-8558", "CVE-2015-8567", "CVE-2015-8568", "CVE-2015-8613", "CVE-2015-8619", "CVE-2015-8666", "CVE-2015-8743", "CVE-2015-8744", "CVE-2015-8745", "CVE-2016-1568", "CVE-2016-1714", "CVE-2016-1922", "CVE-2016-1981", "CVE-2016-2197", "CVE-2016-2198"], "modified": "2023-01-17T00:00:00", "cpe": ["p-cpe:/a:canonical:ubuntu_linux:qemu-kvm", "p-cpe:/a:canonical:ubuntu_linux:qemu-system", "p-cpe:/a:canonical:ubuntu_linux:qemu-system-aarch64", "p-cpe:/a:canonical:ubuntu_linux:qemu-system-arm", "p-cpe:/a:canonical:ubuntu_linux:qemu-system-mips", "p-cpe:/a:canonical:ubuntu_linux:qemu-system-misc", "p-cpe:/a:canonical:ubuntu_linux:qemu-system-ppc", "p-cpe:/a:canonical:ubuntu_linux:qemu-system-sparc", "p-cpe:/a:canonical:ubuntu_linux:qemu-system-x86", "cpe:/o:canonical:ubuntu_linux:12.04:-:lts", "cpe:/o:canonical:ubuntu_linux:14.04", "cpe:/o:canonical:ubuntu_linux:15.10"], "id": "UBUNTU_USN-2891-1.NASL", "href": "https://www.tenable.com/plugins/nessus/88576", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Ubuntu Security Notice USN-2891-1. The text \n# itself is copyright (C) Canonical, Inc. See \n# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered \n# trademark of Canonical, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(88576);\n script_version(\"2.16\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/01/17\");\n\n script_cve_id(\"CVE-2015-7549\", \"CVE-2015-8504\", \"CVE-2015-8550\", \"CVE-2015-8558\", \"CVE-2015-8567\", \"CVE-2015-8568\", \"CVE-2015-8613\", \"CVE-2015-8619\", \"CVE-2015-8666\", \"CVE-2015-8743\", \"CVE-2015-8744\", \"CVE-2015-8745\", \"CVE-2016-1568\", \"CVE-2016-1714\", \"CVE-2016-1922\", \"CVE-2016-1981\", \"CVE-2016-2197\", \"CVE-2016-2198\");\n script_xref(name:\"USN\", value:\"2891-1\");\n\n script_name(english:\"Ubuntu 12.04 LTS / 14.04 LTS / 15.10 : qemu, qemu-kvm vulnerabilities (USN-2891-1)\");\n script_summary(english:\"Checks dpkg output for updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Ubuntu host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Qinghao Tang discovered that QEMU incorrectly handled PCI MSI-X\nsupport. An attacker inside the guest could use this issue to cause\nQEMU to crash, resulting in a denial of service. This issue only\naffected Ubuntu 14.04 LTS and Ubuntu 15.10. (CVE-2015-7549)\n\nLian Yihan discovered that QEMU incorrectly handled the VNC server. A\nremote attacker could use this issue to cause QEMU to crash, resulting\nin a denial of service. (CVE-2015-8504)\n\nFelix Wilhelm discovered a race condition in the Xen paravirtualized\ndrivers which can cause double fetch vulnerabilities. An attacker in\nthe paravirtualized guest could exploit this flaw to cause a denial of\nservice (crash the host) or potentially execute arbitrary code on the\nhost. (CVE-2015-8550)\n\nQinghao Tang discovered that QEMU incorrectly handled USB EHCI\nemulation support. An attacker inside the guest could use this issue\nto cause QEMU to consume resources, resulting in a denial of service.\n(CVE-2015-8558)\n\nQinghao Tang discovered that QEMU incorrectly handled the vmxnet3\ndevice. An attacker inside the guest could use this issue to cause\nQEMU to consume resources, resulting in a denial of service. This\nissue only affected Ubuntu 14.04 LTS and Ubuntu 15.10. (CVE-2015-8567,\nCVE-2015-8568)\n\nQinghao Tang discovered that QEMU incorrectly handled SCSI MegaRAID\nSAS HBA emulation. An attacker inside the guest could use this issue\nto cause QEMU to crash, resulting in a denial of service. This issue\nonly affected Ubuntu 14.04 LTS and Ubuntu 15.10. (CVE-2015-8613)\n\nLing Liu discovered that QEMU incorrectly handled the Human Monitor\nInterface. A local attacker could use this issue to cause QEMU to\ncrash, resulting in a denial of service. This issue only affected\nUbuntu 14.04 LTS and Ubuntu 15.10. (CVE-2015-8619, CVE-2016-1922)\n\nDavid Alan Gilbert discovered that QEMU incorrectly handled the Q35\nchipset emulation when performing VM guest migrations. An attacker\ncould use this issue to cause QEMU to crash, resulting in a denial of\nservice. This issue only affected Ubuntu 14.04 LTS and Ubuntu 15.10.\n(CVE-2015-8666)\n\nLing Liu discovered that QEMU incorrectly handled the NE2000 device.\nAn attacker inside the guest could use this issue to cause QEMU to\ncrash, resulting in a denial of service. (CVE-2015-8743)\n\nIt was discovered that QEMU incorrectly handled the vmxnet3 device. An\nattacker inside the guest could use this issue to cause QEMU to crash,\nresulting in a denial of service. This issue only affected Ubuntu\n14.04 LTS and Ubuntu 15.10. (CVE-2015-8744, CVE-2015-8745)\n\nQinghao Tang discovered that QEMU incorrect handled IDE AHCI\nemulation. An attacker inside the guest could use this issue to cause\na denial of service, or possibly execute arbitrary code on the host as\nthe user running the QEMU process. In the default installation, when\nQEMU is used with libvirt, attackers would be isolated by the libvirt\nAppArmor profile. (CVE-2016-1568)\n\nDonghai Zhu discovered that QEMU incorrect handled the firmware\nconfiguration device. An attacker inside the guest could use this\nissue to cause a denial of service, or possibly execute arbitrary code\non the host as the user running the QEMU process. In the default\ninstallation, when QEMU is used with libvirt, attackers would be\nisolated by the libvirt AppArmor profile. (CVE-2016-1714)\n\nIt was discovered that QEMU incorrectly handled the e1000 device. An\nattacker inside the guest could use this issue to cause QEMU to crash,\nresulting in a denial of service. (CVE-2016-1981)\n\nZuozhi Fzz discovered that QEMU incorrectly handled IDE AHCI\nemulation. An attacker inside the guest could use this issue to cause\nQEMU to crash, resulting in a denial of service. This issue only\naffected Ubuntu 15.10. (CVE-2016-2197)\n\nZuozhi Fzz discovered that QEMU incorrectly handled USB EHCI\nemulation. An attacker inside the guest could use this issue to cause\nQEMU to crash, resulting in a denial of service. This issue only\naffected Ubuntu 14.04 LTS and Ubuntu 15.10. (CVE-2016-2198).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://usn.ubuntu.com/2891-1/\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:qemu-kvm\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:qemu-system\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:qemu-system-aarch64\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:qemu-system-arm\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:qemu-system-mips\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:qemu-system-misc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:qemu-system-ppc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:qemu-system-sparc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:qemu-system-x86\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:12.04:-:lts\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:14.04\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:15.10\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2016/04/07\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/02/03\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/02/04\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"Ubuntu Security Notice (C) 2016-2020 Canonical, Inc. / NASL script (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Ubuntu Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/cpu\", \"Host/Ubuntu\", \"Host/Ubuntu/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"ubuntu.inc\");\ninclude(\"misc_func.inc\");\n\nif ( ! get_kb_item(\"Host/local_checks_enabled\") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/Ubuntu/release\");\nif ( isnull(release) ) audit(AUDIT_OS_NOT, \"Ubuntu\");\nrelease = chomp(release);\nif (! preg(pattern:\"^(12\\.04|14\\.04|15\\.10)$\", string:release)) audit(AUDIT_OS_NOT, \"Ubuntu 12.04 / 14.04 / 15.10\", \"Ubuntu \" + release);\nif ( ! get_kb_item(\"Host/Debian/dpkg-l\") ) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Ubuntu\", cpu);\n\nflag = 0;\n\nif (ubuntu_check(osver:\"12.04\", pkgname:\"qemu-kvm\", pkgver:\"1.0+noroms-0ubuntu14.27\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"qemu-system\", pkgver:\"2.0.0+dfsg-2ubuntu1.22\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"qemu-system-aarch64\", pkgver:\"2.0.0+dfsg-2ubuntu1.22\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"qemu-system-arm\", pkgver:\"2.0.0+dfsg-2ubuntu1.22\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"qemu-system-mips\", pkgver:\"2.0.0+dfsg-2ubuntu1.22\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"qemu-system-misc\", pkgver:\"2.0.0+dfsg-2ubuntu1.22\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"qemu-system-ppc\", pkgver:\"2.0.0+dfsg-2ubuntu1.22\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"qemu-system-sparc\", pkgver:\"2.0.0+dfsg-2ubuntu1.22\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"qemu-system-x86\", pkgver:\"2.0.0+dfsg-2ubuntu1.22\")) flag++;\nif (ubuntu_check(osver:\"15.10\", pkgname:\"qemu-system\", pkgver:\"1:2.3+dfsg-5ubuntu9.2\")) flag++;\nif (ubuntu_check(osver:\"15.10\", pkgname:\"qemu-system-aarch64\", pkgver:\"1:2.3+dfsg-5ubuntu9.2\")) flag++;\nif (ubuntu_check(osver:\"15.10\", pkgname:\"qemu-system-arm\", pkgver:\"1:2.3+dfsg-5ubuntu9.2\")) flag++;\nif (ubuntu_check(osver:\"15.10\", pkgname:\"qemu-system-mips\", pkgver:\"1:2.3+dfsg-5ubuntu9.2\")) flag++;\nif (ubuntu_check(osver:\"15.10\", pkgname:\"qemu-system-misc\", pkgver:\"1:2.3+dfsg-5ubuntu9.2\")) flag++;\nif (ubuntu_check(osver:\"15.10\", pkgname:\"qemu-system-ppc\", pkgver:\"1:2.3+dfsg-5ubuntu9.2\")) flag++;\nif (ubuntu_check(osver:\"15.10\", pkgname:\"qemu-system-sparc\", pkgver:\"1:2.3+dfsg-5ubuntu9.2\")) flag++;\nif (ubuntu_check(osver:\"15.10\", pkgname:\"qemu-system-x86\", pkgver:\"1:2.3+dfsg-5ubuntu9.2\")) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : ubuntu_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = ubuntu_pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"qemu-kvm / qemu-system / qemu-system-aarch64 / qemu-system-arm / etc\");\n}\n", "cvss": {"score": 6.9, "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-11T16:32:01", "description": "Several vulnerabilities were discovered in qemu, a full virtualization solution on x86 hardware.\n\n - CVE-2015-7295 Jason Wang of Red Hat Inc. discovered that the Virtual Network Device support is vulnerable to denial-of-service, that could occur when receiving large packets.\n\n - CVE-2015-7504 Qinghao Tang of Qihoo 360 Inc. and Ling Liu of Qihoo 360 Inc. discovered that the PC-Net II ethernet controller is vulnerable to a heap-based buffer overflow that could result in denial-of-service (via application crash) or arbitrary code execution.\n\n - CVE-2015-7512 Ling Liu of Qihoo 360 Inc. and Jason Wang of Red Hat Inc. discovered that the PC-Net II ethernet controller is vulnerable to a buffer overflow that could result in denial-of-service (via application crash) or arbitrary code execution.\n\n - CVE-2015-7549 Qinghao Tang of Qihoo 360 Inc. and Ling Liu of Qihoo 360 Inc. discovered that the PCI MSI-X emulator is vulnerable to a NULL pointer dereference issue, that could lead to denial-of-service (via application crash).\n\n - CVE-2015-8345 Qinghao Tang of Qihoo 360 Inc. discovered that the eepro100 emulator contains a flaw that could lead to an infinite loop when processing Command Blocks, eventually resulting in denial-of-service (via application crash).\n\n - CVE-2015-8504 Lian Yihan of Qihoo 360 Inc. discovered that the VNC display driver support is vulnerable to an arithmetic exception flaw that could lead to denial-of-service (via application crash).\n\n - CVE-2015-8550 Felix Wilhelm of ERNW Research discovered that the PV backend drivers are vulnerable to double fetch vulnerabilities, possibly resulting in arbitrary code execution.\n\n - CVE-2015-8558 Qinghao Tang of Qihoo 360 Inc. discovered that the USB EHCI emulation support contains a flaw that could lead to an infinite loop during communication between the host controller and a device driver. This could lead to denial-of-service (via resource exhaustion).\n\n - CVE-2015-8567 CVE-2015-8568 Qinghao Tang of Qihoo 360 Inc. discovered that the vmxnet3 device emulator could be used to intentionally leak host memory, thus resulting in denial-of-service.\n\n - CVE-2015-8613 Qinghao Tang of Qihoo 360 Inc. discovered that the SCSI MegaRAID SAS HBA emulation support is vulnerable to a stack-based buffer overflow issue, that could lead to denial-of-service (via application crash).\n\n - CVE-2015-8619 Ling Liu of Qihoo 360 Inc. discovered that the Human Monitor Interface support is vulnerable to an out-of-bound write access issue that could result in denial-of-service (via application crash).\n\n - CVE-2015-8743 Ling Liu of Qihoo 360 Inc. discovered that the NE2000 emulator is vulnerable to an out-of-bound read/write access issue, potentially resulting in information leak or memory corruption.\n\n - CVE-2015-8744 The vmxnet3 driver incorrectly processes small packets, which could result in denial-of-service (via application crash).\n\n - CVE-2015-8745 The vmxnet3 driver incorrectly processes Interrupt Mask Registers, which could result in denial-of-service (via application crash).\n\n - CVE-2016-1568 Qinghao Tang of Qihoo 360 Inc. discovered that the IDE AHCI emulation support is vulnerable to a use-after-free issue, that could lead to denial-of-service (via application crash) or arbitrary code execution.\n\n - CVE-2016-1714 Donghai Zhu of Alibaba discovered that the Firmware Configuration emulation support is vulnerable to an out-of-bound read/write access issue, that could lead to denial-of-service (via application crash) or arbitrary code execution.\n\n - CVE-2016-1922 Ling Liu of Qihoo 360 Inc. discovered that 32-bit Windows guests support is vulnerable to a NULL pointer dereference issue, that could lead to denial-of-service (via application crash).\n\n - CVE-2016-1981 The e1000 driver is vulnerable to an infinite loop issue that could lead to denial-of-service (via application crash).", "cvss3": {"exploitabilityScore": 2.2, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 9.0, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 6.0}, "published": "2016-02-09T00:00:00", "type": "nessus", "title": "Debian DSA-3471-1 : qemu - security update", "bulletinFamily": "scanner", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 3.4, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 6.9, "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-7295", "CVE-2015-7504", "CVE-2015-7512", "CVE-2015-7549", "CVE-2015-8345", "CVE-2015-8504", "CVE-2015-8550", "CVE-2015-8558", "CVE-2015-8567", "CVE-2015-8568", "CVE-2015-8613", "CVE-2015-8619", "CVE-2015-8743", "CVE-2015-8744", "CVE-2015-8745", "CVE-2016-1568", "CVE-2016-1714", "CVE-2016-1922", "CVE-2016-1981"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:debian:debian_linux:qemu", "cpe:/o:debian:debian_linux:8.0"], "id": "DEBIAN_DSA-3471.NASL", "href": "https://www.tenable.com/plugins/nessus/88630", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Debian Security Advisory DSA-3471. The text \n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(88630);\n script_version(\"2.15\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2015-7295\", \"CVE-2015-7504\", \"CVE-2015-7512\", \"CVE-2015-7549\", \"CVE-2015-8345\", \"CVE-2015-8504\", \"CVE-2015-8550\", \"CVE-2015-8558\", \"CVE-2015-8567\", \"CVE-2015-8568\", \"CVE-2015-8613\", \"CVE-2015-8619\", \"CVE-2015-8743\", \"CVE-2015-8744\", \"CVE-2015-8745\", \"CVE-2016-1568\", \"CVE-2016-1714\", \"CVE-2016-1922\", \"CVE-2016-1981\");\n script_xref(name:\"DSA\", value:\"3471\");\n\n script_name(english:\"Debian DSA-3471-1 : qemu - security update\");\n script_summary(english:\"Checks dpkg output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Several vulnerabilities were discovered in qemu, a full virtualization\nsolution on x86 hardware.\n\n - CVE-2015-7295\n Jason Wang of Red Hat Inc. discovered that the Virtual\n Network Device support is vulnerable to\n denial-of-service, that could occur when receiving large\n packets.\n\n - CVE-2015-7504\n Qinghao Tang of Qihoo 360 Inc. and Ling Liu of Qihoo 360\n Inc. discovered that the PC-Net II ethernet controller\n is vulnerable to a heap-based buffer overflow that could\n result in denial-of-service (via application crash) or\n arbitrary code execution.\n\n - CVE-2015-7512\n Ling Liu of Qihoo 360 Inc. and Jason Wang of Red Hat\n Inc. discovered that the PC-Net II ethernet controller\n is vulnerable to a buffer overflow that could result in\n denial-of-service (via application crash) or arbitrary\n code execution.\n\n - CVE-2015-7549\n Qinghao Tang of Qihoo 360 Inc. and Ling Liu of Qihoo 360\n Inc. discovered that the PCI MSI-X emulator is\n vulnerable to a NULL pointer dereference issue, that\n could lead to denial-of-service (via application crash).\n\n - CVE-2015-8345\n Qinghao Tang of Qihoo 360 Inc. discovered that the\n eepro100 emulator contains a flaw that could lead to an\n infinite loop when processing Command Blocks, eventually\n resulting in denial-of-service (via application crash).\n\n - CVE-2015-8504\n Lian Yihan of Qihoo 360 Inc. discovered that the VNC\n display driver support is vulnerable to an arithmetic\n exception flaw that could lead to denial-of-service (via\n application crash).\n\n - CVE-2015-8550\n Felix Wilhelm of ERNW Research discovered that the PV\n backend drivers are vulnerable to double fetch\n vulnerabilities, possibly resulting in arbitrary code\n execution.\n\n - CVE-2015-8558\n Qinghao Tang of Qihoo 360 Inc. discovered that the USB\n EHCI emulation support contains a flaw that could lead\n to an infinite loop during communication between the\n host controller and a device driver. This could lead to\n denial-of-service (via resource exhaustion).\n\n - CVE-2015-8567 CVE-2015-8568\n Qinghao Tang of Qihoo 360 Inc. discovered that the\n vmxnet3 device emulator could be used to intentionally\n leak host memory, thus resulting in denial-of-service.\n\n - CVE-2015-8613\n Qinghao Tang of Qihoo 360 Inc. discovered that the SCSI\n MegaRAID SAS HBA emulation support is vulnerable to a\n stack-based buffer overflow issue, that could lead to\n denial-of-service (via application crash).\n\n - CVE-2015-8619\n Ling Liu of Qihoo 360 Inc. discovered that the Human\n Monitor Interface support is vulnerable to an\n out-of-bound write access issue that could result in\n denial-of-service (via application crash).\n\n - CVE-2015-8743\n Ling Liu of Qihoo 360 Inc. discovered that the NE2000\n emulator is vulnerable to an out-of-bound read/write\n access issue, potentially resulting in information leak\n or memory corruption.\n\n - CVE-2015-8744\n The vmxnet3 driver incorrectly processes small packets,\n which could result in denial-of-service (via application\n crash).\n\n - CVE-2015-8745\n The vmxnet3 driver incorrectly processes Interrupt Mask\n Registers, which could result in denial-of-service (via\n application crash).\n\n - CVE-2016-1568\n Qinghao Tang of Qihoo 360 Inc. discovered that the IDE\n AHCI emulation support is vulnerable to a use-after-free\n issue, that could lead to denial-of-service (via\n application crash) or arbitrary code execution.\n\n - CVE-2016-1714\n Donghai Zhu of Alibaba discovered that the Firmware\n Configuration emulation support is vulnerable to an\n out-of-bound read/write access issue, that could lead to\n denial-of-service (via application crash) or arbitrary\n code execution.\n\n - CVE-2016-1922\n Ling Liu of Qihoo 360 Inc. discovered that 32-bit\n Windows guests support is vulnerable to a NULL pointer\n dereference issue, that could lead to denial-of-service\n (via application crash).\n\n - CVE-2016-1981\n The e1000 driver is vulnerable to an infinite loop issue\n that could lead to denial-of-service (via application\n crash).\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=799452\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=806373\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=806741\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=806742\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=808130\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=808131\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=808144\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=808145\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=809229\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=809232\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=810519\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=810527\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=811201\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=812307\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=809237\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=809237\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2015-7295\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2015-7504\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2015-7512\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2015-7549\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2015-8345\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2015-8504\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2015-8550\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2015-8558\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2015-8567\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2015-8568\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2015-8613\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2015-8619\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2015-8743\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2015-8744\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2015-8745\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2016-1568\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2016-1714\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2016-1922\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2016-1981\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://packages.debian.org/source/jessie/qemu\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.debian.org/security/2016/dsa-3471\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Upgrade the qemu packages.\n\nFor the stable distribution (jessie), these problems have been fixed\nin version 1:2.1+dfsg-12+deb8u5a.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:qemu\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:8.0\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2015/11/09\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/02/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/02/09\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"8.0\", prefix:\"qemu\", reference:\"1:2.1+dfsg-12+deb8u5a\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"qemu-guest-agent\", reference:\"1:2.1+dfsg-12+deb8u5a\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"qemu-kvm\", reference:\"1:2.1+dfsg-12+deb8u5a\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"qemu-system\", reference:\"1:2.1+dfsg-12+deb8u5a\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"qemu-system-arm\", reference:\"1:2.1+dfsg-12+deb8u5a\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"qemu-system-common\", reference:\"1:2.1+dfsg-12+deb8u5a\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"qemu-system-mips\", reference:\"1:2.1+dfsg-12+deb8u5a\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"qemu-system-misc\", reference:\"1:2.1+dfsg-12+deb8u5a\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"qemu-system-ppc\", reference:\"1:2.1+dfsg-12+deb8u5a\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"qemu-system-sparc\", reference:\"1:2.1+dfsg-12+deb8u5a\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"qemu-system-x86\", reference:\"1:2.1+dfsg-12+deb8u5a\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"qemu-user\", reference:\"1:2.1+dfsg-12+deb8u5a\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"qemu-user-binfmt\", reference:\"1:2.1+dfsg-12+deb8u5a\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"qemu-user-static\", reference:\"1:2.1+dfsg-12+deb8u5a\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"qemu-utils\", reference:\"1:2.1+dfsg-12+deb8u5a\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 6.9, "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-11T16:35:34", "description": "- CVE-2015-8745: vmxnet3: don't assert reading registers in bar0 (bz #1295442) * CVE-2015-8567: net: vmxnet3:\n host memory leakage (bz #1289818) * CVE-2016-1922: i386:\n avoid NULL pointer dereference (bz #1292766) * CVE-2015-8613: buffer overflow in megasas_ctrl_get_info (bz #1284008) * CVE-2015-8701: Buffer overflow in tx_consume in rocker.c (bz #1293720) * CVE-2015-8743:\n ne2000: OOB memory access in ioport r/w functions (bz #1294787) * CVE-2016-1568: Use-after-free vulnerability in ahci (bz #1297023) * Fix modules.d/kvm.conf example syntax (bz #1298823)\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"exploitabilityScore": 2.0, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 6.0}, "published": "2016-03-04T00:00:00", "type": "nessus", "title": "Fedora 23 : qemu-2.4.1-6.fc23 (2016-42778e8c82)", "bulletinFamily": "scanner", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 3.4, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 6.9, "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-8567", "CVE-2015-8568", "CVE-2015-8613", "CVE-2015-8701", "CVE-2015-8743", "CVE-2015-8745", "CVE-2016-1568", "CVE-2016-1922"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:qemu", "cpe:/o:fedoraproject:fedora:23"], "id": "FEDORA_2016-42778E8C82.NASL", "href": "https://www.tenable.com/plugins/nessus/89526", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2016-42778e8c82.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(89526);\n script_version(\"1.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2015-8567\", \"CVE-2015-8568\", \"CVE-2015-8613\", \"CVE-2015-8701\", \"CVE-2015-8743\", \"CVE-2015-8745\", \"CVE-2016-1568\", \"CVE-2016-1922\");\n script_xref(name:\"FEDORA\", value:\"2016-42778e8c82\");\n\n script_name(english:\"Fedora 23 : qemu-2.4.1-6.fc23 (2016-42778e8c82)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\" - CVE-2015-8745: vmxnet3: don't assert reading registers\n in bar0 (bz #1295442) * CVE-2015-8567: net: vmxnet3:\n host memory leakage (bz #1289818) * CVE-2016-1922: i386:\n avoid NULL pointer dereference (bz #1292766) *\n CVE-2015-8613: buffer overflow in megasas_ctrl_get_info\n (bz #1284008) * CVE-2015-8701: Buffer overflow in\n tx_consume in rocker.c (bz #1293720) * CVE-2015-8743:\n ne2000: OOB memory access in ioport r/w functions (bz\n #1294787) * CVE-2016-1568: Use-after-free vulnerability\n in ahci (bz #1297023) * Fix modules.d/kvm.conf example\n syntax (bz #1298823)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1264929\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1270876\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1283934\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1284008\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1286971\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1288532\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1289816\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2016-January/175967.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?67fb35c0\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected qemu package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:qemu\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:23\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/01/23\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/03/04\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^23([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 23.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC23\", reference:\"qemu-2.4.1-6.fc23\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"qemu\");\n}\n", "cvss": {"score": 6.9, "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-11T16:36:47", "description": "The remote host is affected by the vulnerability described in GLSA-201604-01 (QEMU: Multiple vulnerabilities)\n\n Multiple vulnerabilities have been discovered in QEMU. Please review the CVE identifiers referenced below for details.\n Impact :\n\n Local users within a guest QEMU environment can execute arbitrary code within the host or a cause a Denial of Service condition of the QEMU guest process.\n Workaround :\n\n There is no known workaround at this time.", "cvss3": {"exploitabilityScore": 1.4, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "CHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.1, "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.0", "userInteraction": "NONE"}, "impactScore": 6.0}, "published": "2016-04-05T00:00:00", "type": "nessus", "title": "GLSA-201604-01 : QEMU: Multiple vulnerabilities", "bulletinFamily": "scanner", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 3.4, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 6.9, "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-8613", "CVE-2015-8619", "CVE-2016-1714", "CVE-2016-1922", "CVE-2016-1981", "CVE-2016-2197", "CVE-2016-2198", "CVE-2016-2392", "CVE-2016-2538", "CVE-2016-2858"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:gentoo:linux:qemu", "cpe:/o:gentoo:linux"], "id": "GENTOO_GLSA-201604-01.NASL", "href": "https://www.tenable.com/plugins/nessus/90339", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Gentoo Linux Security Advisory GLSA 201604-01.\n#\n# The advisory text is Copyright (C) 2001-2016 Gentoo Foundation, Inc.\n# and licensed under the Creative Commons - Attribution / Share Alike \n# license. See http://creativecommons.org/licenses/by-sa/3.0/\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(90339);\n script_version(\"2.4\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2015-8613\", \"CVE-2015-8619\", \"CVE-2016-1714\", \"CVE-2016-1922\", \"CVE-2016-1981\", \"CVE-2016-2197\", \"CVE-2016-2198\", \"CVE-2016-2392\", \"CVE-2016-2538\", \"CVE-2016-2858\");\n script_xref(name:\"GLSA\", value:\"201604-01\");\n\n script_name(english:\"GLSA-201604-01 : QEMU: Multiple vulnerabilities\");\n script_summary(english:\"Checks for updated package(s) in /var/db/pkg\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Gentoo host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The remote host is affected by the vulnerability described in GLSA-201604-01\n(QEMU: Multiple vulnerabilities)\n\n Multiple vulnerabilities have been discovered in QEMU. Please review the\n CVE identifiers referenced below for details.\n \nImpact :\n\n Local users within a guest QEMU environment can execute arbitrary code\n within the host or a cause a Denial of Service condition of the QEMU\n guest process.\n \nWorkaround :\n\n There is no known workaround at this time.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security.gentoo.org/glsa/201604-01\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"All QEMU users should upgrade to the latest version:\n # emerge --sync\n # emerge --ask --oneshot --verbose '>=app-emulation/qemu-2.5.0-r2'\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:gentoo:linux:qemu\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:gentoo:linux\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/04/02\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/04/05\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Gentoo Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Gentoo/release\", \"Host/Gentoo/qpkg-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"qpkg.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Gentoo/release\")) audit(AUDIT_OS_NOT, \"Gentoo\");\nif (!get_kb_item(\"Host/Gentoo/qpkg-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (qpkg_check(package:\"app-emulation/qemu\", unaffected:make_list(\"ge 2.5.0-r2\"), vulnerable:make_list(\"lt 2.5.0-r2\"))) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:qpkg_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = qpkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"QEMU\");\n}\n", "cvss": {"score": 6.9, "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-11T16:34:59", "description": "xen was updated to fix 26 security issues.\n\nThese security issues were fixed :\n\n - CVE-2013-4533: Buffer overflow in the pxa2xx_ssp_load function in hw/arm/pxa2xx.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted s->rx_level value in a savevm image (bsc#864655).\n\n - CVE-2013-4537: The ssi_sd_transfer function in hw/sd/ssi-sd.c allowed remote attackers to execute arbitrary code via a crafted arglen value in a savevm image (bsc#864391).\n\n - CVE-2013-4538: Multiple buffer overflows in the ssd0323_load function in hw/display/ssd0323.c allowed remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via crafted (1) cmd_len, (2) row, or (3) col values; (4) row_start and row_end values; or (5) col_star and col_end values in a savevm image (bsc#864769).\n\n - CVE-2013-4539: Multiple buffer overflows in the tsc210x_load function in hw/input/tsc210x.c might have allowed remote attackers to execute arbitrary code via a crafted (1) precision, (2) nextprecision, (3) function, or (4) nextfunction value in a savevm image (bsc#864805).\n\n - CVE-2014-0222: Integer overflow in the qcow_open function in block/qcow.c allowed remote attackers to cause a denial of service (crash) via a large L2 table in a QCOW version 1 image (bsc#877642).\n\n - CVE-2014-3689: The vmware-vga driver (hw/display/vmware_vga.c) allowed local guest users to write to qemu memory locations and gain privileges via unspecified parameters related to rectangle handling (bsc#901508).\n\n - CVE-2014-7815: The set_pixel_format function in ui/vnc.c allowed remote attackers to cause a denial of service (crash) via a small bytes_per_pixel value (bsc#902737).\n\n - CVE-2014-9718: The (1) BMDMA and (2) AHCI HBA interfaces in the IDE functionality had multiple interpretations of a function's return value, which allowed guest OS users to cause a host OS denial of service (memory consumption or infinite loop, and system crash) via a PRDT with zero complete sectors, related to the bmdma_prepare_buf and ahci_dma_prepare_buf functions (bsc#928393).\n\n - CVE-2015-1779: The VNC websocket frame decoder allowed remote attackers to cause a denial of service (memory and CPU consumption) via a large (1) websocket payload or (2) HTTP headers section (bsc#924018).\n\n - CVE-2015-5278: Infinite loop in ne2000_receive() function (bsc#945989).\n\n - CVE-2015-6855: hw/ide/core.c did not properly restrict the commands accepted by an ATAPI device, which allowed guest users to cause a denial of service or possibly have unspecified other impact via certain IDE commands, as demonstrated by a WIN_READ_NATIVE_MAX command to an empty drive, which triggers a divide-by-zero error and instance crash (bsc#945404).\n\n - CVE-2015-7512: Buffer overflow in the pcnet_receive function in hw/net/pcnet.c, when a guest NIC has a larger MTU, allowed remote attackers to cause a denial of service (guest OS crash) or execute arbitrary code via a large packet (bsc#957162).\n\n - CVE-2015-8345: eepro100: infinite loop in processing command block list (bsc#956829).\n\n - CVE-2015-8613: SCSI: stack based buffer overflow in megasas_ctrl_get_info (bsc#961358).\n\n - CVE-2015-8619: Stack based OOB write in hmp_sendkey routine (bsc#960334).\n\n - CVE-2015-8743: ne2000: OOB memory access in ioport r/w functions (bsc#960725).\n\n - CVE-2015-8744: vmxnet3: Incorrect l2 header validation lead to a crash via assert(2) call (bsc#960835).\n\n - CVE-2015-8745: Reading IMR registers lead to a crash via assert(2) call (bsc#960707).\n\n - CVE-2016-1568: AHCI use-after-free vulnerability in aio port commands (bsc#961332).\n\n - CVE-2016-1570: The PV superpage functionality in arch/x86/mm.c allowed local PV guests to obtain sensitive information, cause a denial of service, gain privileges, or have unspecified other impact via a crafted page identifier (MFN) to the (1) MMUEXT_MARK_SUPER or (2) MMUEXT_UNMARK_SUPER sub-op in the HYPERVISOR_mmuext_op hypercall or (3) unknown vectors related to page table updates (bsc#960861).\n\n - CVE-2016-1714: nvram: OOB r/w access in processing firmware configurations (bsc#961691).\n\n - CVE-2016-1981: e1000 infinite loop in start_xmit and e1000_receive_iov routines (bsc#963782).\n\n - CVE-2016-2198: EHCI NULL pointer dereference in ehci_caps_write (bsc#964413).\n\n - CVE-2016-2391: usb: multiple eof_timers in ohci module lead to NULL pointer dereference (bsc#967013).\n\n - CVE-2016-2392: NULL pointer dereference in remote NDIS control message handling (bsc#967012).\n\n - CVE-2016-2538: Integer overflow in remote NDIS control message handling (bsc#967969).\n\nThese non-security issues were fixed :\n\n - bsc#954872: script block-dmmd not working as expected \n\n - bsc#957698: DOM0 can't bring up on Dell PC\n\n - bsc#963923: domain weights not honored when sched-credit tslice is reduced\n\n - bsc#959332: SLES12SP1 PV guest is unreachable when restored or migrated\n\n - bsc#959695: Missing docs for xen", "cvss3": {"exploitabilityScore": 2.2, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 9.0, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 6.0}, "published": "2016-04-01T00:00:00", "type": "nessus", "title": "openSUSE Security Update : xen (openSUSE-2016-413)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "COMPLETE", "integrityImpact": "NONE", "baseScore": 7.8, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-4533", "CVE-2013-4537", "CVE-2013-4538", "CVE-2013-4539", "CVE-2014-0222", "CVE-2014-3689", "CVE-2014-7815", "CVE-2014-9718", "CVE-2015-1779", "CVE-2015-5278", "CVE-2015-6855", "CVE-2015-7512", "CVE-2015-8345", "CVE-2015-8613", "CVE-2015-8619", "CVE-2015-8743", "CVE-2015-8744", "CVE-2015-8745", "CVE-2016-1568", "CVE-2016-1570", "CVE-2016-1714", "CVE-2016-1981", "CVE-2016-2198", "CVE-2016-2391", "CVE-2016-2392", "CVE-2016-2538"], "modified": "2021-01-19T00:00:00", "cpe": ["p-cpe:/a:novell:opensuse:xen", "p-cpe:/a:novell:opensuse:xen-debugsource", "p-cpe:/a:novell:opensuse:xen-devel", "p-cpe:/a:novell:opensuse:xen-doc-html", "p-cpe:/a:novell:opensuse:xen-kmp-default", "p-cpe:/a:novell:opensuse:xen-kmp-default-debuginfo", "p-cpe:/a:novell:opensuse:xen-libs", "p-cpe:/a:novell:opensuse:xen-libs-32bit", "p-cpe:/a:novell:opensuse:xen-libs-debuginfo", "p-cpe:/a:novell:opensuse:xen-libs-debuginfo-32bit", "p-cpe:/a:novell:opensuse:xen-tools", "p-cpe:/a:novell:opensuse:xen-tools-debuginfo", "p-cpe:/a:novell:opensuse:xen-tools-domU", "p-cpe:/a:novell:opensuse:xen-tools-domU-debuginfo", "cpe:/o:novell:opensuse:42.1"], "id": "OPENSUSE-2016-413.NASL", "href": "https://www.tenable.com/plugins/nessus/90260", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update openSUSE-2016-413.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(90260);\n script_version(\"1.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/19\");\n\n script_cve_id(\"CVE-2013-4533\", \"CVE-2013-4537\", \"CVE-2013-4538\", \"CVE-2013-4539\", \"CVE-2014-0222\", \"CVE-2014-3689\", \"CVE-2014-7815\", \"CVE-2014-9718\", \"CVE-2015-1779\", \"CVE-2015-5278\", \"CVE-2015-6855\", \"CVE-2015-7512\", \"CVE-2015-8345\", \"CVE-2015-8613\", \"CVE-2015-8619\", \"CVE-2015-8743\", \"CVE-2015-8744\", \"CVE-2015-8745\", \"CVE-2016-1568\", \"CVE-2016-1570\", \"CVE-2016-1714\", \"CVE-2016-1981\", \"CVE-2016-2198\", \"CVE-2016-2391\", \"CVE-2016-2392\", \"CVE-2016-2538\");\n\n script_name(english:\"openSUSE Security Update : xen (openSUSE-2016-413)\");\n script_summary(english:\"Check for the openSUSE-2016-413 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"xen was updated to fix 26 security issues.\n\nThese security issues were fixed :\n\n - CVE-2013-4533: Buffer overflow in the pxa2xx_ssp_load\n function in hw/arm/pxa2xx.c allowed remote attackers to\n cause a denial of service or possibly execute arbitrary\n code via a crafted s->rx_level value in a savevm image\n (bsc#864655).\n\n - CVE-2013-4537: The ssi_sd_transfer function in\n hw/sd/ssi-sd.c allowed remote attackers to execute\n arbitrary code via a crafted arglen value in a savevm\n image (bsc#864391).\n\n - CVE-2013-4538: Multiple buffer overflows in the\n ssd0323_load function in hw/display/ssd0323.c allowed\n remote attackers to cause a denial of service (memory\n corruption) or possibly execute arbitrary code via\n crafted (1) cmd_len, (2) row, or (3) col values; (4)\n row_start and row_end values; or (5) col_star and\n col_end values in a savevm image (bsc#864769).\n\n - CVE-2013-4539: Multiple buffer overflows in the\n tsc210x_load function in hw/input/tsc210x.c might have\n allowed remote attackers to execute arbitrary code via a\n crafted (1) precision, (2) nextprecision, (3) function,\n or (4) nextfunction value in a savevm image\n (bsc#864805).\n\n - CVE-2014-0222: Integer overflow in the qcow_open\n function in block/qcow.c allowed remote attackers to\n cause a denial of service (crash) via a large L2 table\n in a QCOW version 1 image (bsc#877642).\n\n - CVE-2014-3689: The vmware-vga driver\n (hw/display/vmware_vga.c) allowed local guest users to\n write to qemu memory locations and gain privileges via\n unspecified parameters related to rectangle handling\n (bsc#901508).\n\n - CVE-2014-7815: The set_pixel_format function in ui/vnc.c\n allowed remote attackers to cause a denial of service\n (crash) via a small bytes_per_pixel value (bsc#902737).\n\n - CVE-2014-9718: The (1) BMDMA and (2) AHCI HBA interfaces\n in the IDE functionality had multiple interpretations of\n a function's return value, which allowed guest OS users\n to cause a host OS denial of service (memory consumption\n or infinite loop, and system crash) via a PRDT with zero\n complete sectors, related to the bmdma_prepare_buf and\n ahci_dma_prepare_buf functions (bsc#928393).\n\n - CVE-2015-1779: The VNC websocket frame decoder allowed\n remote attackers to cause a denial of service (memory\n and CPU consumption) via a large (1) websocket payload\n or (2) HTTP headers section (bsc#924018).\n\n - CVE-2015-5278: Infinite loop in ne2000_receive()\n function (bsc#945989).\n\n - CVE-2015-6855: hw/ide/core.c did not properly restrict\n the commands accepted by an ATAPI device, which allowed\n guest users to cause a denial of service or possibly\n have unspecified other impact via certain IDE commands,\n as demonstrated by a WIN_READ_NATIVE_MAX command to an\n empty drive, which triggers a divide-by-zero error and\n instance crash (bsc#945404).\n\n - CVE-2015-7512: Buffer overflow in the pcnet_receive\n function in hw/net/pcnet.c, when a guest NIC has a\n larger MTU, allowed remote attackers to cause a denial\n of service (guest OS crash) or execute arbitrary code\n via a large packet (bsc#957162).\n\n - CVE-2015-8345: eepro100: infinite loop in processing\n command block list (bsc#956829).\n\n - CVE-2015-8613: SCSI: stack based buffer overflow in\n megasas_ctrl_get_info (bsc#961358).\n\n - CVE-2015-8619: Stack based OOB write in hmp_sendkey\n routine (bsc#960334).\n\n - CVE-2015-8743: ne2000: OOB memory access in ioport r/w\n functions (bsc#960725).\n\n - CVE-2015-8744: vmxnet3: Incorrect l2 header validation\n lead to a crash via assert(2) call (bsc#960835).\n\n - CVE-2015-8745: Reading IMR registers lead to a crash via\n assert(2) call (bsc#960707).\n\n - CVE-2016-1568: AHCI use-after-free vulnerability in aio\n port commands (bsc#961332).\n\n - CVE-2016-1570: The PV superpage functionality in\n arch/x86/mm.c allowed local PV guests to obtain\n sensitive information, cause a denial of service, gain\n privileges, or have unspecified other impact via a\n crafted page identifier (MFN) to the (1)\n MMUEXT_MARK_SUPER or (2) MMUEXT_UNMARK_SUPER sub-op in\n the HYPERVISOR_mmuext_op hypercall or (3) unknown\n vectors related to page table updates (bsc#960861).\n\n - CVE-2016-1714: nvram: OOB r/w access in processing\n firmware configurations (bsc#961691).\n\n - CVE-2016-1981: e1000 infinite loop in start_xmit and\n e1000_receive_iov routines (bsc#963782).\n\n - CVE-2016-2198: EHCI NULL pointer dereference in\n ehci_caps_write (bsc#964413).\n\n - CVE-2016-2391: usb: multiple eof_timers in ohci module\n lead to NULL pointer dereference (bsc#967013).\n\n - CVE-2016-2392: NULL pointer dereference in remote NDIS\n control message handling (bsc#967012).\n\n - CVE-2016-2538: Integer overflow in remote NDIS control\n message handling (bsc#967969).\n\nThese non-security issues were fixed :\n\n - bsc#954872: script block-dmmd not working as expected \n\n - bsc#957698: DOM0 can't bring up on Dell PC\n\n - bsc#963923: domain weights not honored when sched-credit\n tslice is reduced\n\n - bsc#959332: SLES12SP1 PV guest is unreachable when\n restored or migrated\n\n - bsc#959695: Missing docs for xen\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=864391\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=864655\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=864769\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=864805\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=877642\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=901508\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=902737\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=924018\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=928393\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=945404\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=945989\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=954872\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=956829\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=957162\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=957698\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=959332\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=959695\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=960334\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=960707\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=960725\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=960835\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=960861\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=961332\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=961358\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=961691\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=963782\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=963923\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=964413\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=967012\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=967013\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=967969\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected xen packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:xen\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:xen-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:xen-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:xen-doc-html\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:xen-kmp-default\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:xen-kmp-default-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:xen-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:xen-libs-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:xen-libs-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:xen-libs-debuginfo-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:xen-tools\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:xen-tools-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:xen-tools-domU\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:xen-tools-domU-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:42.1\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/03/30\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/04/01\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2021 Tenable Network Security, Inc.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE42\\.1)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"42.1\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(i586|i686|x86_64)$\") audit(AUDIT_ARCH_NOT, \"i586 / i686 / x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE42.1\", reference:\"xen-debugsource-4.5.2_06-12.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"xen-devel-4.5.2_06-12.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"xen-libs-4.5.2_06-12.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"xen-libs-debuginfo-4.5.2_06-12.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"xen-tools-domU-4.5.2_06-12.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"xen-tools-domU-debuginfo-4.5.2_06-12.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"xen-4.5.2_06-12.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"xen-doc-html-4.5.2_06-12.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"xen-kmp-default-4.5.2_06_k4.1.15_8-12.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"xen-kmp-default-debuginfo-4.5.2_06_k4.1.15_8-12.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"xen-libs-32bit-4.5.2_06-12.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"xen-libs-debuginfo-32bit-4.5.2_06-12.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"xen-tools-4.5.2_06-12.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"xen-tools-debuginfo-4.5.2_06-12.1\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"xen-debugsource / xen-devel / xen-libs-32bit / xen-libs / etc\");\n}\n", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2023-01-11T16:35:19", "description": "Qemu: nvram: OOB r/w access in processing firmware configurations CVE-2016-1714 (#1296080) Qemu: i386: NULL pointer dereference in vapic_write() CVE-2016-1922 (#1292767) qemu: Stack-based buffer overflow in megasas_ctrl_get_info CVE-2015-8613 (#1293305) qemu-kvm:\nInfinite loop and out-of-bounds transfer start in start_xmit() and e1000_receive_iov() CVE-2016-1981 (#1299996) Qemu: usb ehci out-of-bounds read in ehci_process_itd (#1300235) Qemu: usb: ehci NULL pointer dereference in ehci_caps_write CVE-2016-2198 (#1303135) Qemu:\nnet: ne2000: infinite loop in ne2000_receive CVE-2016-2841 (#1304048) Qemu: usb: integer overflow in remote NDIS control message handling CVE-2016-2538 (#1305816) Qemu: usb: NULL pointer dereference in remote NDIS control message handling CVE-2016-2392 (#1307116) Qemu: usb:\nmultiple eof_timers in ohci module leads to NULL pointer dereference CVE-2016-2391 (#1308882) Qemu: net: out of bounds read in net_checksum_calculate() CVE-2016-2857 (#1309565) Qemu: OOB access in address_space_rw leads to segmentation fault CVE-2015-8817 CVE-2015-8818 (#1313273) Qemu: rng-random: arbitrary stack based allocation leading to corruption CVE-2016-2858 (#1314678)\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"exploitabilityScore": 2.0, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "baseScore": 8.4, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.8}, "published": "2016-03-21T00:00:00", "type": "nessus", "title": "Fedora 23 : xen-4.5.2-9.fc23 (2016-f4504e9445)", "bulletinFamily": "scanner", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 3.4, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 6.9, "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-8613", "CVE-2015-8817", "CVE-2015-8818", "CVE-2016-1714", "CVE-2016-1922", "CVE-2016-1981", "CVE-2016-2198", "CVE-2016-2391", "CVE-2016-2392", "CVE-2016-2538", "CVE-2016-2841", "CVE-2016-2857", "CVE-2016-2858"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:xen", "cpe:/o:fedoraproject:fedora:23"], "id": "FEDORA_2016-F4504E9445.NASL", "href": "https://www.tenable.com/plugins/nessus/90045", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2016-f4504e9445.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(90045);\n script_version(\"2.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2015-8613\", \"CVE-2015-8817\", \"CVE-2015-8818\", \"CVE-2016-1714\", \"CVE-2016-1922\", \"CVE-2016-1981\", \"CVE-2016-2198\", \"CVE-2016-2391\", \"CVE-2016-2392\", \"CVE-2016-2538\", \"CVE-2016-2841\", \"CVE-2016-2857\", \"CVE-2016-2858\");\n script_xref(name:\"FEDORA\", value:\"2016-f4504e9445\");\n\n script_name(english:\"Fedora 23 : xen-4.5.2-9.fc23 (2016-f4504e9445)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Qemu: nvram: OOB r/w access in processing firmware configurations\nCVE-2016-1714 (#1296080) Qemu: i386: NULL pointer dereference in\nvapic_write() CVE-2016-1922 (#1292767) qemu: Stack-based buffer\noverflow in megasas_ctrl_get_info CVE-2015-8613 (#1293305) qemu-kvm:\nInfinite loop and out-of-bounds transfer start in start_xmit() and\ne1000_receive_iov() CVE-2016-1981 (#1299996) Qemu: usb ehci\nout-of-bounds read in ehci_process_itd (#1300235) Qemu: usb: ehci NULL\npointer dereference in ehci_caps_write CVE-2016-2198 (#1303135) Qemu:\nnet: ne2000: infinite loop in ne2000_receive CVE-2016-2841 (#1304048)\nQemu: usb: integer overflow in remote NDIS control message handling\nCVE-2016-2538 (#1305816) Qemu: usb: NULL pointer dereference in remote\nNDIS control message handling CVE-2016-2392 (#1307116) Qemu: usb:\nmultiple eof_timers in ohci module leads to NULL pointer dereference\nCVE-2016-2391 (#1308882) Qemu: net: out of bounds read in\nnet_checksum_calculate() CVE-2016-2857 (#1309565) Qemu: OOB access in\naddress_space_rw leads to segmentation fault CVE-2015-8817\nCVE-2015-8818 (#1313273) Qemu: rng-random: arbitrary stack based\nallocation leading to corruption CVE-2016-2858 (#1314678)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1283934\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1284008\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1296060\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1296567\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1298570\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1299455\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1300771\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1301643\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1302299\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1303106\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1303120\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1304794\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1314676\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2016-March/179083.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?56044835\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected xen package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:xen\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:23\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/03/19\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/03/21\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^23([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 23.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC23\", reference:\"xen-4.5.2-9.fc23\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"xen\");\n}\n", "cvss": {"score": 6.9, "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-11T16:35:11", "description": "Qemu: nvram: OOB r/w access in processing firmware configurations CVE-2016-1714 (#1296080)\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"exploitabilityScore": 2.0, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "baseScore": 8.4, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.8}, "published": "2016-03-21T00:00:00", "type": "nessus", "title": "Fedora 22 : xen-4.5.2-9.fc22 (2016-38b20aa50f)", "bulletinFamily": "scanner", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 3.4, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 6.9, "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-8613", "CVE-2015-8817", "CVE-2015-8818", "CVE-2016-1714", "CVE-2016-1922", "CVE-2016-1981", "CVE-2016-2198", "CVE-2016-2391", "CVE-2016-2392", "CVE-2016-2538", "CVE-2016-2841", "CVE-2016-2857", "CVE-2016-2858"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:xen", "cpe:/o:fedoraproject:fedora:22"], "id": "FEDORA_2016-38B20AA50F.NASL", "href": "https://www.tenable.com/plugins/nessus/90036", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2016-38b20aa50f.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(90036);\n script_version(\"2.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2015-8613\", \"CVE-2015-8817\", \"CVE-2015-8818\", \"CVE-2016-1714\", \"CVE-2016-1922\", \"CVE-2016-1981\", \"CVE-2016-2198\", \"CVE-2016-2391\", \"CVE-2016-2392\", \"CVE-2016-2538\", \"CVE-2016-2841\", \"CVE-2016-2857\", \"CVE-2016-2858\");\n script_xref(name:\"FEDORA\", value:\"2016-38b20aa50f\");\n\n script_name(english:\"Fedora 22 : xen-4.5.2-9.fc22 (2016-38b20aa50f)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Qemu: nvram: OOB r/w access in processing firmware configurations\nCVE-2016-1714 (#1296080)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1283934\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1284008\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1296060\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1296567\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1298570\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1299455\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1300771\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1301643\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1302299\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1303106\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1303120\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1304794\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1314676\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2016-March/179057.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?133fe26f\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected xen package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:xen\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:22\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/03/19\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/03/21\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^22([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 22.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC22\", reference:\"xen-4.5.2-9.fc22\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"xen\");\n}\n", "cvss": {"score": 6.9, "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-09-28T14:08:54", "description": "kvm was updated to fix 33 security issues.\n\nThese security issues were fixed :\n\n - CVE-2016-4439: Avoid OOB access in 53C9X emulation (bsc#980711)\n\n - CVE-2016-4441: Avoid OOB access in 53C9X emulation (bsc#980723)\n\n - CVE-2016-3710: Fixed VGA emulation based OOB access with potential for guest escape (bsc#978158)\n\n - CVE-2016-3712: Fixed VGa emulation based DOS and OOB read access exploit (bsc#978160)\n\n - CVE-2016-4037: Fixed USB ehci based DOS (bsc#976109)\n\n - CVE-2016-2538: Fixed potential OOB access in USB net device emulation (bsc#967969)\n\n - CVE-2016-2841: Fixed OOB access / hang in ne2000 emulation (bsc#969350)\n\n - CVE-2016-2858: Avoid potential DOS when using QEMU pseudo random number generator (bsc#970036)\n\n - CVE-2016-2857: Fixed OOB access when processing IP checksums (bsc#970037)\n\n - CVE-2016-4001: Fixed OOB access in Stellaris enet emulated nic (bsc#975128)\n\n - CVE-2016-4002: Fixed OOB access in MIPSnet emulated controller (bsc#975136)\n\n - CVE-2016-4020: Fixed possible host data leakage to guest from TPR access (bsc#975700)\n\n - CVE-2015-3214: Fixed OOB read in i8254 PIC (bsc#934069)\n\n - CVE-2014-9718: Fixed the handling of malformed or short ide PRDTs to avoid any opportunity for guest to cause DoS by abusing that interface (bsc#928393)\n\n - CVE-2014-3689: Fixed insufficient parameter validation in rectangle functions (bsc#901508)\n\n - CVE-2014-3615: The VGA emulator in QEMU allowed local guest users to read host memory by setting the display to a high resolution (bsc#895528).\n\n - CVE-2015-5239: Integer overflow in vnc_client_read() and protocol_client_msg() (bsc#944463).\n\n - CVE-2015-5278: Infinite loop in ne2000_receive() function (bsc#945989).\n\n - CVE-2015-5279: Heap-based buffer overflow in the ne2000_receive function in hw/net/ne2000.c in QEMU allowed guest OS users to cause a denial of service (instance crash) or possibly execute arbitrary code via vectors related to receiving packets (bsc#945987).\n\n - CVE-2015-5745: Buffer overflow in virtio-serial (bsc#940929).\n\n - CVE-2015-6855: hw/ide/core.c in QEMU did not properly restrict the commands accepted by an ATAPI device, which allowed guest users to cause a denial of service or possibly have unspecified other impact via certain IDE commands, as demonstrated by a WIN_READ_NATIVE_MAX command to an empty drive, which triggers a divide-by-zero error and instance crash (bsc#945404).\n\n - CVE-2015-7295: hw/virtio/virtio.c in the Virtual Network Device (virtio-net) support in QEMU, when big or mergeable receive buffers are not supported, allowed remote attackers to cause a denial of service (guest network consumption) via a flood of jumbo frames on the (1) tuntap or (2) macvtap interface (bsc#947159).\n\n - CVE-2015-7549: PCI NULL pointer dereferences (bsc#958917).\n\n - CVE-2015-8504: VNC floating point exception (bsc#958491).\n\n - CVE-2015-8558: Infinite loop in ehci_advance_state resulting in DoS (bsc#959005).\n\n - CVE-2015-8613: Wrong sized memset in megasas command handler (bsc#961358).\n\n - CVE-2015-8619: Potential DoS for long HMP sendkey command argument (bsc#960334).\n\n - CVE-2015-8743: OOB memory access in ne2000 ioport r/w functions (bsc#960725).\n\n - CVE-2016-1568: AHCI use-after-free in aio port commands (bsc#961332).\n\n - CVE-2016-1714: Potential OOB memory access in processing firmware configuration (bsc#961691).\n\n - CVE-2016-1922: NULL pointer dereference when processing hmp i/o command (bsc#962320).\n\n - CVE-2016-1981: Potential DoS (infinite loop) in e1000 device emulation by malicious privileged user within guest (bsc#963782).\n\n - CVE-2016-2198: Malicious privileged guest user were able to cause DoS by writing to read-only EHCI capabilities registers (bsc#964413).\n\nThe update package also includes non-security fixes. See advisory for details.\n\nNote that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"score": 9, "vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H"}, "published": "2016-08-29T00:00:00", "type": "nessus", "title": "SUSE SLES11 Security Update : kvm (SUSE-SU-2016:1698-1)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2014-3615", "CVE-2014-3689", "CVE-2014-9718", "CVE-2015-3214", "CVE-2015-5239", "CVE-2015-5278", "CVE-2015-5279", "CVE-2015-5745", "CVE-2015-6855", "CVE-2015-7295", "CVE-2015-7549", "CVE-2015-8504", "CVE-2015-8558", "CVE-2015-8613", "CVE-2015-8619", "CVE-2015-8743", "CVE-2016-1568", "CVE-2016-1714", "CVE-2016-1922", "CVE-2016-1981", "CVE-2016-2198", "CVE-2016-2538", "CVE-2016-2841", "CVE-2016-2857", "CVE-2016-2858", "CVE-2016-3710", "CVE-2016-3712", "CVE-2016-4001", "CVE-2016-4002", "CVE-2016-4020", "CVE-2016-4037", "CVE-2016-4439", "CVE-2016-4441"], "modified": "2021-01-19T00:00:00", "cpe": ["p-cpe:/a:novell:suse_linux:kvm", "cpe:/o:novell:suse_linux:11"], "id": "SUSE_SU-2016-1698-1.NASL", "href": "https://www.tenable.com/plugins/nessus/93169", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from SUSE update advisory SUSE-SU-2016:1698-1.\n# The text itself is copyright (C) SUSE.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(93169);\n script_version(\"2.11\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/19\");\n\n script_cve_id(\"CVE-2014-3615\", \"CVE-2014-3689\", \"CVE-2014-9718\", \"CVE-2015-3214\", \"CVE-2015-5239\", \"CVE-2015-5278\", \"CVE-2015-5279\", \"CVE-2015-5745\", \"CVE-2015-6855\", \"CVE-2015-7295\", \"CVE-2015-7549\", \"CVE-2015-8504\", \"CVE-2015-8558\", \"CVE-2015-8613\", \"CVE-2015-8619\", \"CVE-2015-8743\", \"CVE-2016-1568\", \"CVE-2016-1714\", \"CVE-2016-1922\", \"CVE-2016-1981\", \"CVE-2016-2198\", \"CVE-2016-2538\", \"CVE-2016-2841\", \"CVE-2016-2857\", \"CVE-2016-2858\", \"CVE-2016-3710\", \"CVE-2016-3712\", \"CVE-2016-4001\", \"CVE-2016-4002\", \"CVE-2016-4020\", \"CVE-2016-4037\", \"CVE-2016-4439\", \"CVE-2016-4441\");\n script_bugtraq_id(69654, 70997, 73316, 75273);\n\n script_name(english:\"SUSE SLES11 Security Update : kvm (SUSE-SU-2016:1698-1)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\"The remote SUSE host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"kvm was updated to fix 33 security issues.\n\nThese security issues were fixed :\n\n - CVE-2016-4439: Avoid OOB access in 53C9X emulation\n (bsc#980711)\n\n - CVE-2016-4441: Avoid OOB access in 53C9X emulation\n (bsc#980723)\n\n - CVE-2016-3710: Fixed VGA emulation based OOB access with\n potential for guest escape (bsc#978158)\n\n - CVE-2016-3712: Fixed VGa emulation based DOS and OOB\n read access exploit (bsc#978160)\n\n - CVE-2016-4037: Fixed USB ehci based DOS (bsc#976109)\n\n - CVE-2016-2538: Fixed potential OOB access in USB net\n device emulation (bsc#967969)\n\n - CVE-2016-2841: Fixed OOB access / hang in ne2000\n emulation (bsc#969350)\n\n - CVE-2016-2858: Avoid potential DOS when using QEMU\n pseudo random number generator (bsc#970036)\n\n - CVE-2016-2857: Fixed OOB access when processing IP\n checksums (bsc#970037)\n\n - CVE-2016-4001: Fixed OOB access in Stellaris enet\n emulated nic (bsc#975128)\n\n - CVE-2016-4002: Fixed OOB access in MIPSnet emulated\n controller (bsc#975136)\n\n - CVE-2016-4020: Fixed possible host data leakage to guest\n from TPR access (bsc#975700)\n\n - CVE-2015-3214: Fixed OOB read in i8254 PIC (bsc#934069)\n\n - CVE-2014-9718: Fixed the handling of malformed or short\n ide PRDTs to avoid any opportunity for guest to cause\n DoS by abusing that interface (bsc#928393)\n\n - CVE-2014-3689: Fixed insufficient parameter validation\n in rectangle functions (bsc#901508)\n\n - CVE-2014-3615: The VGA emulator in QEMU allowed local\n guest users to read host memory by setting the display\n to a high resolution (bsc#895528).\n\n - CVE-2015-5239: Integer overflow in vnc_client_read() and\n protocol_client_msg() (bsc#944463).\n\n - CVE-2015-5278: Infinite loop in ne2000_receive()\n function (bsc#945989).\n\n - CVE-2015-5279: Heap-based buffer overflow in the\n ne2000_receive function in hw/net/ne2000.c in QEMU\n allowed guest OS users to cause a denial of service\n (instance crash) or possibly execute arbitrary code via\n vectors related to receiving packets (bsc#945987).\n\n - CVE-2015-5745: Buffer overflow in virtio-serial\n (bsc#940929).\n\n - CVE-2015-6855: hw/ide/core.c in QEMU did not properly\n restrict the commands accepted by an ATAPI device, which\n allowed guest users to cause a denial of service or\n possibly have unspecified other impact via certain IDE\n commands, as demonstrated by a WIN_READ_NATIVE_MAX\n command to an empty drive, which triggers a\n divide-by-zero error and instance crash (bsc#945404).\n\n - CVE-2015-7295: hw/virtio/virtio.c in the Virtual Network\n Device (virtio-net) support in QEMU, when big or\n mergeable receive buffers are not supported, allowed\n remote attackers to cause a denial of service (guest\n network consumption) via a flood of jumbo frames on the\n (1) tuntap or (2) macvtap interface (bsc#947159).\n\n - CVE-2015-7549: PCI NULL pointer dereferences\n (bsc#958917).\n\n - CVE-2015-8504: VNC floating point exception\n (bsc#958491).\n\n - CVE-2015-8558: Infinite loop in ehci_advance_state\n resulting in DoS (bsc#959005).\n\n - CVE-2015-8613: Wrong sized memset in megasas command\n handler (bsc#961358).\n\n - CVE-2015-8619: Potential DoS for long HMP sendkey\n command argument (bsc#960334).\n\n - CVE-2015-8743: OOB memory access in ne2000 ioport r/w\n functions (bsc#960725).\n\n - CVE-2016-1568: AHCI use-after-free in aio port commands\n (bsc#961332).\n\n - CVE-2016-1714: Potential OOB memory access in processing\n firmware configuration (bsc#961691).\n\n - CVE-2016-1922: NULL pointer dereference when processing\n hmp i/o command (bsc#962320).\n\n - CVE-2016-1981: Potential DoS (infinite loop) in e1000\n device emulation by malicious privileged user within\n guest (bsc#963782).\n\n - CVE-2016-2198: Malicious privileged guest user were able\n to cause DoS by writing to read-only EHCI capabilities\n registers (bsc#964413).\n\nThe update package also includes non-security fixes. See advisory for\ndetails.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=895528\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=901508\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=928393\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=934069\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=936132\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=940929\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=944463\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=945404\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=945987\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=945989\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=947159\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=958491\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=958917\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=959005\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=960334\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=960725\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=961332\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=961333\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=961358\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=961556\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=961691\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=962320\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=963782\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=964413\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=967969\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=969350\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=970036\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=970037\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=975128\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=975136\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=975700\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=976109\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=978158\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=978160\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=980711\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=980723\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2014-3615/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2014-3689/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2014-9718/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-3214/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-5239/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-5278/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-5279/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-5745/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-6855/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-7295/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-7549/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8504/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8558/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8613/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8619/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8743/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-1568/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-1714/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-1922/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-1981/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-2198/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-2538/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-2841/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-2857/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-2858/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-3710/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-3712/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-4001/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-4002/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-4020/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-4037/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-4439/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-4441/\"\n );\n # https://www.suse.com/support/update/announcement/2016/suse-su-20161698-1/\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?4851fc1e\"\n );\n script_set_attribute(\n attribute:\"solution\",\n value:\n\"To install this SUSE Security Update use YaST online_update.\nAlternatively you can run the command listed for your product :\n\nSUSE Linux Enterprise Server 11-SP3-LTSS :\n\nzypper in -t patch slessp3-kvm-12634=1\n\nTo bring your system up-to-date, use 'zypper patch'.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kvm\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:11\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2014/11/01\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/06/28\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/08/29\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nos_ver = pregmatch(pattern: \"^(SLE(S|D)\\d+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"SUSE\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLES11)$\", string:os_ver)) audit(AUDIT_OS_NOT, \"SUSE SLES11\", \"SUSE \" + os_ver);\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^i[3-6]86$\" && \"x86_64\" >!< cpu && \"s390x\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"SUSE \" + os_ver, cpu);\n\nsp = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(sp)) sp = \"0\";\nif (os_ver == \"SLES11\" && (! preg(pattern:\"^(3)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLES11 SP3\", os_ver + \" SP\" + sp);\n\n\nflag = 0;\nif (rpm_check(release:\"SLES11\", sp:\"3\", reference:\"kvm-1.4.2-46.1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"kvm\");\n}\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-11T16:36:27", "description": "xen was updated to version 4.4.4 to fix 33 security issues.\n\nThese security issues were fixed :\n\n - CVE-2016-2392: NULL pointer dereference in remote NDIS control message handling (bsc#967012).\n\n - CVE-2015-5239: Integer overflow in vnc_client_read() and protocol_client_msg() (bsc#944463).\n\n - CVE-2016-2270: Xen allowed local guest administrators to cause a denial of service (host reboot) via vectors related to multiple mappings of MMIO pages with different cachability settings (boo#965315).\n\n - CVE-2016-2538: Integer overflow in remote NDIS control message handling (bsc#967969).\n\n - CVE-2015-7512: Buffer overflow in the pcnet_receive function in hw/net/pcnet.c, when a guest NIC has a larger MTU, allowed remote attackers to cause a denial of service (guest OS crash) or execute arbitrary code via a large packet (boo#962360).\n\n - CVE-2014-3689: The vmware-vga driver (hw/display/vmware_vga.c) allowed local guest users to write to qemu memory locations and gain privileges via unspecified parameters related to rectangle handling (boo#962611).\n\n - CVE-2015-5278: Infinite loop in ne2000_receive() function (bsc#945989).\n\n - CVE-2016-1568: AHCI use-after-free vulnerability in aio port commands (bsc#961332).\n\n - CVE-2016-1981: e1000 infinite loop in start_xmit and e1000_receive_iov routines (bsc#963782).\n\n - CVE-2016-2198: EHCI NULL pointer dereference in ehci_caps_write (bsc#964413).\n\n - CVE-2015-6815: e1000: infinite loop issue (bsc#944697).\n\n - CVE-2014-0222: Integer overflow in the qcow_open function in block/qcow.c allowed remote attackers to cause a denial of service (crash) via a large L2 table in a QCOW version 1 image (boo#964925).\n\n - CVE-2015-6855: hw/ide/core.c did not properly restrict the commands accepted by an ATAPI device, which allowed guest users to cause a denial of service or possibly have unspecified other impact via certain IDE commands, as demonstrated by a WIN_READ_NATIVE_MAX command to an empty drive, which triggers a divide-by-zero error and instance crash (boo#965156).\n\n - CVE-2016-2271: VMX in using an Intel or Cyrix CPU, allowed local HVM guest users to cause a denial of service (guest crash) via vectors related to a non-canonical RIP (boo#965317).\n\n - CVE-2013-4534: Buffer overflow in hw/intc/openpic.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via vectors related to IRQDest elements (boo#964452).\n\n - CVE-2013-4537: The ssi_sd_transfer function in hw/sd/ssi-sd.c allowed remote attackers to execute arbitrary code via a crafted arglen value in a savevm image (boo#962642).\n\n - CVE-2015-1779: The VNC websocket frame decoder allowed remote attackers to cause a denial of service (memory and CPU consumption) via a large (1) websocket payload or (2) HTTP headers section (boo#962632).\n\n - CVE-2013-4530: Buffer overflow in hw/ssi/pl022.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via crafted tx_fifo_head and rx_fifo_head values in a savevm image (boo#964950).\n\n - CVE-2013-4533: Buffer overflow in the pxa2xx_ssp_load function in hw/arm/pxa2xx.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted s->rx_level value in a savevm image (boo#964644).\n\n - CVE-2013-4539: Multiple buffer overflows in the tsc210x_load function in hw/input/tsc210x.c allowed remote attackers to execute arbitrary code via a crafted (1) precision, (2) nextprecision, (3) function, or (4) nextfunction value in a savevm image (boo#962758).\n\n - CVE-2013-4538: Multiple buffer overflows in the ssd0323_load function in hw/display/ssd0323.c allowed remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via crafted (1) cmd_len, (2) row, or (3) col values; (4) row_start and row_end values; or (5) col_star and col_end values in a savevm image (boo#962335).\n\n - CVE-2015-8345: eepro100: infinite loop in processing command block list (bsc#956829).\n\n - CVE-2015-8613: scsi: stack based buffer overflow in megasas_ctrl_get_info (bsc#961358).\n\n - CVE-2015-8619: Stack based OOB write in hmp_sendkey routine (bsc#960334).\n\n - CVE-2016-1571: The paging_invlpg function in include/asm-x86/paging.h, when using shadow mode paging or nested virtualization is enabled, allowed local HVM guest users to cause a denial of service (host crash) via a non-canonical guest address in an INVVPID instruction, which triggers a hypervisor bug check (boo#960862).\n\n - CVE-2016-1570: The PV superpage functionality in arch/x86/mm.c allowed local PV guests to obtain sensitive information, cause a denial of service, gain privileges, or have unspecified other impact via a crafted page identifier (MFN) to the (1) MMUEXT_MARK_SUPER or (2) MMUEXT_UNMARK_SUPER sub-op in the HYPERVISOR_mmuext_op hypercall or (3) unknown vectors related to page table updates (boo#960861).\n\n - CVE-2014-9718: The (1) BMDMA and (2) AHCI HBA interfaces in the IDE functionality had multiple interpretations of a function's return value, which allowed guest OS users to cause a host OS denial of service (memory consumption or infinite loop, and system crash) via a PRDT with zero complete sectors, related to the bmdma_prepare_buf and ahci_dma_prepare_buf functions (boo#964431).\n\n - CVE-2016-1714: nvram: OOB r/w access in processing firmware configurations (bsc#961691).\n\n - CVE-2015-8743: ne2000: OOB memory access in ioport r/w functions (bsc#960725).\n\n - CVE-2015-8744: vmxnet3: incorrect l2 header validation leads to a crash via assert(2) call (bsc#960835).\n\n - CVE-2015-8745: Reading IMR registers could have lead to a crash via assert(2) call (bsc#960707).\n\n - CVE-2014-7815: The set_pixel_format function in ui/vnc.c allowed remote attackers to cause a denial of service (crash) via a small bytes_per_pixel value (boo#962627).\n\n - CVE-2013-4529: Buffer overflow in hw/pci/pcie_aer.c allowed remote attackers to cause a denial of service and possibly execute arbitrary code via a large log_num value in a savevm image (boo#964929).", "cvss3": {"exploitabilityScore": 2.2, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 9.0, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 6.0}, "published": "2016-04-13T00:00:00", "type": "nessus", "title": "openSUSE Security Update : xen (openSUSE-2016-439)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "COMPLETE", "integrityImpact": "NONE", "baseScore": 7.8, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-4529", "CVE-2013-4530", "CVE-2013-4533", "CVE-2013-4534", "CVE-2013-4537", "CVE-2013-4538", "CVE-2013-4539", "CVE-2014-0222", "CVE-2014-3689", "CVE-2014-7815", "CVE-2014-9718", "CVE-2015-1779", "CVE-2015-5239", "CVE-2015-5278", "CVE-2015-6815", "CVE-2015-6855", "CVE-2015-7512", "CVE-2015-8345", "CVE-2015-8613", "CVE-2015-8619", "CVE-2015-8743", "CVE-2015-8744", "CVE-2015-8745", "CVE-2016-1568", "CVE-2016-1570", "CVE-2016-1571", "CVE-2016-1714", "CVE-2016-1981", "CVE-2016-2198", "CVE-2016-2270", "CVE-2016-2271", "CVE-2016-2392", "CVE-2016-2538"], "modified": "2021-01-19T00:00:00", "cpe": ["p-cpe:/a:novell:opensuse:xen", "p-cpe:/a:novell:opensuse:xen-debugsource", "p-cpe:/a:novell:opensuse:xen-devel", "p-cpe:/a:novell:opensuse:xen-doc-html", "p-cpe:/a:novell:opensuse:xen-kmp-default", "p-cpe:/a:novell:opensuse:xen-kmp-default-debuginfo", "p-cpe:/a:novell:opensuse:xen-kmp-desktop", "p-cpe:/a:novell:opensuse:xen-kmp-desktop-debuginfo", "p-cpe:/a:novell:opensuse:xen-libs", "p-cpe:/a:novell:opensuse:xen-libs-32bit", "p-cpe:/a:novell:opensuse:xen-libs-debuginfo", "p-cpe:/a:novell:opensuse:xen-libs-debuginfo-32bit", "p-cpe:/a:novell:opensuse:xen-tools", "p-cpe:/a:novell:opensuse:xen-tools-debuginfo", "p-cpe:/a:novell:opensuse:xen-tools-domU", "p-cpe:/a:novell:opensuse:xen-tools-domU-debuginfo", "cpe:/o:novell:opensuse:13.2"], "id": "OPENSUSE-2016-439.NASL", "href": "https://www.tenable.com/plugins/nessus/90478", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update openSUSE-2016-439.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(90478);\n script_version(\"2.4\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/19\");\n\n script_cve_id(\"CVE-2013-4529\", \"CVE-2013-4530\", \"CVE-2013-4533\", \"CVE-2013-4534\", \"CVE-2013-4537\", \"CVE-2013-4538\", \"CVE-2013-4539\", \"CVE-2014-0222\", \"CVE-2014-3689\", \"CVE-2014-7815\", \"CVE-2014-9718\", \"CVE-2015-1779\", \"CVE-2015-5239\", \"CVE-2015-5278\", \"CVE-2015-6815\", \"CVE-2015-6855\", \"CVE-2015-7512\", \"CVE-2015-8345\", \"CVE-2015-8613\", \"CVE-2015-8619\", \"CVE-2015-8743\", \"CVE-2015-8744\", \"CVE-2015-8745\", \"CVE-2016-1568\", \"CVE-2016-1570\", \"CVE-2016-1571\", \"CVE-2016-1714\", \"CVE-2016-1981\", \"CVE-2016-2198\", \"CVE-2016-2270\", \"CVE-2016-2271\", \"CVE-2016-2392\", \"CVE-2016-2538\");\n\n script_name(english:\"openSUSE Security Update : xen (openSUSE-2016-439)\");\n script_summary(english:\"Check for the openSUSE-2016-439 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"xen was updated to version 4.4.4 to fix 33 security issues.\n\nThese security issues were fixed :\n\n - CVE-2016-2392: NULL pointer dereference in remote NDIS\n control message handling (bsc#967012).\n\n - CVE-2015-5239: Integer overflow in vnc_client_read() and\n protocol_client_msg() (bsc#944463).\n\n - CVE-2016-2270: Xen allowed local guest administrators to\n cause a denial of service (host reboot) via vectors\n related to multiple mappings of MMIO pages with\n different cachability settings (boo#965315).\n\n - CVE-2016-2538: Integer overflow in remote NDIS control\n message handling (bsc#967969).\n\n - CVE-2015-7512: Buffer overflow in the pcnet_receive\n function in hw/net/pcnet.c, when a guest NIC has a\n larger MTU, allowed remote attackers to cause a denial\n of service (guest OS crash) or execute arbitrary code\n via a large packet (boo#962360).\n\n - CVE-2014-3689: The vmware-vga driver\n (hw/display/vmware_vga.c) allowed local guest users to\n write to qemu memory locations and gain privileges via\n unspecified parameters related to rectangle handling\n (boo#962611).\n\n - CVE-2015-5278: Infinite loop in ne2000_receive()\n function (bsc#945989).\n\n - CVE-2016-1568: AHCI use-after-free vulnerability in aio\n port commands (bsc#961332).\n\n - CVE-2016-1981: e1000 infinite loop in start_xmit and\n e1000_receive_iov routines (bsc#963782).\n\n - CVE-2016-2198: EHCI NULL pointer dereference in\n ehci_caps_write (bsc#964413).\n\n - CVE-2015-6815: e1000: infinite loop issue (bsc#944697).\n\n - CVE-2014-0222: Integer overflow in the qcow_open\n function in block/qcow.c allowed remote attackers to\n cause a denial of service (crash) via a large L2 table\n in a QCOW version 1 image (boo#964925).\n\n - CVE-2015-6855: hw/ide/core.c did not properly restrict\n the commands accepted by an ATAPI device, which allowed\n guest users to cause a denial of service or possibly\n have unspecified other impact via certain IDE commands,\n as demonstrated by a WIN_READ_NATIVE_MAX command to an\n empty drive, which triggers a divide-by-zero error and\n instance crash (boo#965156).\n\n - CVE-2016-2271: VMX in using an Intel or Cyrix CPU,\n allowed local HVM guest users to cause a denial of\n service (guest crash) via vectors related to a\n non-canonical RIP (boo#965317).\n\n - CVE-2013-4534: Buffer overflow in hw/intc/openpic.c\n allowed remote attackers to cause a denial of service or\n possibly execute arbitrary code via vectors related to\n IRQDest elements (boo#964452).\n\n - CVE-2013-4537: The ssi_sd_transfer function in\n hw/sd/ssi-sd.c allowed remote attackers to execute\n arbitrary code via a crafted arglen value in a savevm\n image (boo#962642).\n\n - CVE-2015-1779: The VNC websocket frame decoder allowed\n remote attackers to cause a denial of service (memory\n and CPU consumption) via a large (1) websocket payload\n or (2) HTTP headers section (boo#962632).\n\n - CVE-2013-4530: Buffer overflow in hw/ssi/pl022.c allowed\n remote attackers to cause a denial of service or\n possibly execute arbitrary code via crafted tx_fifo_head\n and rx_fifo_head values in a savevm image (boo#964950).\n\n - CVE-2013-4533: Buffer overflow in the pxa2xx_ssp_load\n function in hw/arm/pxa2xx.c allowed remote attackers to\n cause a denial of service or possibly execute arbitrary\n code via a crafted s->rx_level value in a savevm image\n (boo#964644).\n\n - CVE-2013-4539: Multiple buffer overflows in the\n tsc210x_load function in hw/input/tsc210x.c allowed\n remote attackers to execute arbitrary code via a crafted\n (1) precision, (2) nextprecision, (3) function, or (4)\n nextfunction value in a savevm image (boo#962758).\n\n - CVE-2013-4538: Multiple buffer overflows in the\n ssd0323_load function in hw/display/ssd0323.c allowed\n remote attackers to cause a denial of service (memory\n corruption) or possibly execute arbitrary code via\n crafted (1) cmd_len, (2) row, or (3) col values; (4)\n row_start and row_end values; or (5) col_star and\n col_end values in a savevm image (boo#962335).\n\n - CVE-2015-8345: eepro100: infinite loop in processing\n command block list (bsc#956829).\n\n - CVE-2015-8613: scsi: stack based buffer overflow in\n megasas_ctrl_get_info (bsc#961358).\n\n - CVE-2015-8619: Stack based OOB write in hmp_sendkey\n routine (bsc#960334).\n\n - CVE-2016-1571: The paging_invlpg function in\n include/asm-x86/paging.h, when using shadow mode paging\n or nested virtualization is enabled, allowed local HVM\n guest users to cause a denial of service (host crash)\n via a non-canonical guest address in an INVVPID\n instruction, which triggers a hypervisor bug check\n (boo#960862).\n\n - CVE-2016-1570: The PV superpage functionality in\n arch/x86/mm.c allowed local PV guests to obtain\n sensitive information, cause a denial of service, gain\n privileges, or have unspecified other impact via a\n crafted page identifier (MFN) to the (1)\n MMUEXT_MARK_SUPER or (2) MMUEXT_UNMARK_SUPER sub-op in\n the HYPERVISOR_mmuext_op hypercall or (3) unknown\n vectors related to page table updates (boo#960861).\n\n - CVE-2014-9718: The (1) BMDMA and (2) AHCI HBA interfaces\n in the IDE functionality had multiple interpretations of\n a function's return value, which allowed guest OS users\n to cause a host OS denial of service (memory consumption\n or infinite loop, and system crash) via a PRDT with zero\n complete sectors, related to the bmdma_prepare_buf and\n ahci_dma_prepare_buf functions (boo#964431).\n\n - CVE-2016-1714: nvram: OOB r/w access in processing\n firmware configurations (bsc#961691).\n\n - CVE-2015-8743: ne2000: OOB memory access in ioport r/w\n functions (bsc#960725).\n\n - CVE-2015-8744: vmxnet3: incorrect l2 header validation\n leads to a crash via assert(2) call (bsc#960835).\n\n - CVE-2015-8745: Reading IMR registers could have lead to\n a crash via assert(2) call (bsc#960707).\n\n - CVE-2014-7815: The set_pixel_format function in ui/vnc.c\n allowed remote attackers to cause a denial of service\n (crash) via a small bytes_per_pixel value (boo#962627).\n\n - CVE-2013-4529: Buffer overflow in hw/pci/pcie_aer.c\n allowed remote attackers to cause a denial of service\n and possibly execute arbitrary code via a large log_num\n value in a savevm image (boo#964929).\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=944463\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=944697\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=945989\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=956829\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=960334\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=960707\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=960725\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=960835\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=960861\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=960862\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=961332\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=961358\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=961691\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=962335\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=962360\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=962611\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=962627\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=962632\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=962642\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=962758\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=963782\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=964413\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=964431\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=964452\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=964644\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=964925\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=964929\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=964950\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=965156\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=965315\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=965317\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=967012\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=967969\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected xen packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:xen\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:xen-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:xen-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:xen-doc-html\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:xen-kmp-default\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:xen-kmp-default-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:xen-kmp-desktop\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:xen-kmp-desktop-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:xen-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:xen-libs-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:xen-libs-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:xen-libs-debuginfo-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:xen-tools\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:xen-tools-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:xen-tools-domU\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:xen-tools-domU-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:13.2\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/04/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/04/13\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2021 Tenable Network Security, Inc.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE13\\.2)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"13.2\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(i586|i686|x86_64)$\") audit(AUDIT_ARCH_NOT, \"i586 / i686 / x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE13.2\", reference:\"xen-debugsource-4.4.4_02-43.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", reference:\"xen-devel-4.4.4_02-43.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", reference:\"xen-libs-4.4.4_02-43.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", reference:\"xen-libs-debuginfo-4.4.4_02-43.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", reference:\"xen-tools-domU-4.4.4_02-43.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", reference:\"xen-tools-domU-debuginfo-4.4.4_02-43.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", cpu:\"x86_64\", reference:\"xen-4.4.4_02-43.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", cpu:\"x86_64\", reference:\"xen-doc-html-4.4.4_02-43.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", cpu:\"x86_64\", reference:\"xen-kmp-default-4.4.4_02_k3.16.7_35-43.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", cpu:\"x86_64\", reference:\"xen-kmp-default-debuginfo-4.4.4_02_k3.16.7_35-43.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", cpu:\"x86_64\", reference:\"xen-kmp-desktop-4.4.4_02_k3.16.7_35-43.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", cpu:\"x86_64\", reference:\"xen-kmp-desktop-debuginfo-4.4.4_02_k3.16.7_35-43.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", cpu:\"x86_64\", reference:\"xen-libs-32bit-4.4.4_02-43.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", cpu:\"x86_64\", reference:\"xen-libs-debuginfo-32bit-4.4.4_02-43.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", cpu:\"x86_64\", reference:\"xen-tools-4.4.4_02-43.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", cpu:\"x86_64\", reference:\"xen-tools-debuginfo-4.4.4_02-43.1\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"xen-debugsource / xen-devel / xen-libs-32bit / xen-libs / etc\");\n}\n", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2023-01-17T14:22:30", "description": "qemu was updated to fix 29 security issues.\n\nThese security issues were fixed :\n\n - CVE-2016-4439: Avoid OOB access in 53C9X emulation (bsc#980711)\n\n - CVE-2016-4441: Avoid OOB access in 53C9X emulation (bsc#980723)\n\n - CVE-2016-4952: Avoid OOB access in Vmware PV SCSI emulation (bsc#981266)\n\n - CVE-2015-8817: Avoid OOB access in PCI dma I/O (bsc#969121)\n\n - CVE-2015-8818: Avoid OOB access in PCI dma I/O (bsc#969122)\n\n - CVE-2016-3710: Fixed VGA emulation based OOB access with potential for guest escape (bsc#978158)\n\n - CVE-2016-3712: Fixed VGa emulation based DOS and OOB read access exploit (bsc#978160)\n\n - CVE-2016-4037: Fixed USB ehci based DOS (bsc#976109)\n\n - CVE-2016-2538: Fixed potential OOB access in USB net device emulation (bsc#967969)\n\n - CVE-2016-2841: Fixed OOB access / hang in ne2000 emulation (bsc#969350)\n\n - CVE-2016-2858: Avoid potential DOS when using QEMU pseudo random number generator (bsc#970036)\n\n - CVE-2016-2857: Fixed OOB access when processing IP checksums (bsc#970037)\n\n - CVE-2016-4001: Fixed OOB access in Stellaris enet emulated nic (bsc#975128)\n\n - CVE-2016-4002: Fixed OOB access in MIPSnet emulated controller (bsc#975136)\n\n - CVE-2016-4020: Fixed possible host data leakage to guest from TPR access (bsc#975700)\n\n - CVE-2016-2197: Prevent AHCI NULL pointer dereference when using FIS CLB engine (bsc#964411)\n\n - CVE-2015-5745: Buffer overflow in virtio-serial (bsc#940929).\n\n - CVE-2015-7549: PCI NULL pointer dereferences (bsc#958917).\n\n - CVE-2015-8504: VNC floating point exception (bsc#958491).\n\n - CVE-2015-8558: Infinite loop in ehci_advance_state resulting in DoS (bsc#959005).\n\n - CVE-2015-8567: A guest repeatedly activating a vmxnet3 device can leak host memory (bsc#959386).\n\n - CVE-2015-8568: A guest repeatedly activating a vmxnet3 device can leak host memory (bsc#959386).\n\n - CVE-2015-8613: Wrong sized memset in megasas command handler (bsc#961358).\n\n - CVE-2015-8619: Potential DoS for long HMP sendkey command argument (bsc#960334).\n\n - CVE-2015-8743: OOB memory access in ne2000 ioport r/w functions (bsc#960725).\n\n - CVE-2015-8744: Incorrect l2 header validation could have lead to a crash via assert(2) call (bsc#960835).\n\n - CVE-2015-8745: Reading IMR registers could have lead to a crash via assert(2) call (bsc#960708).\n\n - CVE-2016-1568: AHCI use-after-free in aio port commands (bsc#961332).\n\n - CVE-2016-1714: Potential OOB memory access in processing firmware configuration (bsc#961691).\n\n - CVE-2016-1922: NULL pointer dereference when processing hmp i/o command (bsc#962320).\n\n - CVE-2016-1981: Potential DoS (infinite loop) in e1000 device emulation by malicious privileged user within guest (bsc#963782).\n\n - CVE-2016-2198: Malicious privileged guest user were able to cause DoS by writing to read-only EHCI capabilities registers (bsc#964413).\n\nThis non-security issue was fixed\n\n - bsc#886378: qemu truncates vhd images in virt-rescue\n\nThis update was imported from the SUSE:SLE-12-SP1:Update update project.", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2016-07-08T00:00:00", "type": "nessus", "title": "openSUSE Security Update : qemu (openSUSE-2016-839)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.2, "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-5745", "CVE-2015-7549", "CVE-2015-8504", "CVE-2015-8558", "CVE-2015-8567", "CVE-2015-8568", "CVE-2015-8613", "CVE-2015-8619", "CVE-2015-8743", "CVE-2015-8744", "CVE-2015-8745", "CVE-2015-8817", "CVE-2015-8818", "CVE-2016-1568", "CVE-2016-1714", "CVE-2016-1922", "CVE-2016-1981", "CVE-2016-2197", "CVE-2016-2198", "CVE-2016-2538", "CVE-2016-2841", "CVE-2016-2857", "CVE-2016-2858", "CVE-2016-3710", "CVE-2016-3712", "CVE-2016-4001", "CVE-2016-4002", "CVE-2016-4020", "CVE-2016-4037", "CVE-2016-4439", "CVE-2016-4441", "CVE-2016-4952"], "modified": "2021-01-19T00:00:00", "cpe": ["p-cpe:/a:novell:opensuse:qemu", "p-cpe:/a:novell:opensuse:qemu-arm", "p-cpe:/a:novell:opensuse:qemu-arm-debuginfo", "p-cpe:/a:novell:opensuse:qemu-block-curl", "p-cpe:/a:novell:opensuse:qemu-block-curl-debuginfo", "p-cpe:/a:novell:opensuse:qemu-block-rbd", "p-cpe:/a:novell:opensuse:qemu-block-rbd-debuginfo", "p-cpe:/a:novell:opensuse:qemu-debugsource", "p-cpe:/a:novell:opensuse:qemu-extra", "p-cpe:/a:novell:opensuse:qemu-extra-debuginfo", "p-cpe:/a:novell:opensuse:qemu-guest-agent", "p-cpe:/a:novell:opensuse:qemu-guest-agent-debuginfo", "p-cpe:/a:novell:opensuse:qemu-ipxe", "p-cpe:/a:novell:opensuse:qemu-kvm", "p-cpe:/a:novell:opensuse:qemu-lang", "p-cpe:/a:novell:opensuse:qemu-linux-user", "p-cpe:/a:novell:opensuse:qemu-linux-user-debuginfo", "p-cpe:/a:novell:opensuse:qemu-linux-user-debugsource", "p-cpe:/a:novell:opensuse:qemu-ppc", "p-cpe:/a:novell:opensuse:qemu-ppc-debuginfo", "p-cpe:/a:novell:opensuse:qemu-s390", "p-cpe:/a:novell:opensuse:qemu-s390-debuginfo", "p-cpe:/a:novell:opensuse:qemu-seabios", "p-cpe:/a:novell:opensuse:qemu-sgabios", "p-cpe:/a:novell:opensuse:qemu-testsuite", "p-cpe:/a:novell:opensuse:qemu-tools", "p-cpe:/a:novell:opensuse:qemu-tools-debuginfo", "p-cpe:/a:novell:opensuse:qemu-vgabios", "p-cpe:/a:novell:opensuse:qemu-x86", "p-cpe:/a:novell:opensuse:qemu-x86-debuginfo", "cpe:/o:novell:opensuse:42.1"], "id": "OPENSUSE-2016-839.NASL", "href": "https://www.tenable.com/plugins/nessus/91980", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update openSUSE-2016-839.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(91980);\n script_version(\"2.4\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/19\");\n\n script_cve_id(\"CVE-2015-5745\", \"CVE-2015-7549\", \"CVE-2015-8504\", \"CVE-2015-8558\", \"CVE-2015-8567\", \"CVE-2015-8568\", \"CVE-2015-8613\", \"CVE-2015-8619\", \"CVE-2015-8743\", \"CVE-2015-8744\", \"CVE-2015-8745\", \"CVE-2015-8817\", \"CVE-2015-8818\", \"CVE-2016-1568\", \"CVE-2016-1714\", \"CVE-2016-1922\", \"CVE-2016-1981\", \"CVE-2016-2197\", \"CVE-2016-2198\", \"CVE-2016-2538\", \"CVE-2016-2841\", \"CVE-2016-2857\", \"CVE-2016-2858\", \"CVE-2016-3710\", \"CVE-2016-3712\", \"CVE-2016-4001\", \"CVE-2016-4002\", \"CVE-2016-4020\", \"CVE-2016-4037\", \"CVE-2016-4439\", \"CVE-2016-4441\", \"CVE-2016-4952\");\n\n script_name(english:\"openSUSE Security Update : qemu (openSUSE-2016-839)\");\n script_summary(english:\"Check for the openSUSE-2016-839 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"qemu was updated to fix 29 security issues.\n\nThese security issues were fixed :\n\n - CVE-2016-4439: Avoid OOB access in 53C9X emulation\n (bsc#980711)\n\n - CVE-2016-4441: Avoid OOB access in 53C9X emulation\n (bsc#980723)\n\n - CVE-2016-4952: Avoid OOB access in Vmware PV SCSI\n emulation (bsc#981266)\n\n - CVE-2015-8817: Avoid OOB access in PCI dma I/O\n (bsc#969121)\n\n - CVE-2015-8818: Avoid OOB access in PCI dma I/O\n (bsc#969122)\n\n - CVE-2016-3710: Fixed VGA emulation based OOB access with\n potential for guest escape (bsc#978158)\n\n - CVE-2016-3712: Fixed VGa emulation based DOS and OOB\n read access exploit (bsc#978160)\n\n - CVE-2016-4037: Fixed USB ehci based DOS (bsc#976109)\n\n - CVE-2016-2538: Fixed potential OOB access in USB net\n device emulation (bsc#967969)\n\n - CVE-2016-2841: Fixed OOB access / hang in ne2000\n emulation (bsc#969350)\n\n - CVE-2016-2858: Avoid potential DOS when using QEMU\n pseudo random number generator (bsc#970036)\n\n - CVE-2016-2857: Fixed OOB access when processing IP\n checksums (bsc#970037)\n\n - CVE-2016-4001: Fixed OOB access in Stellaris enet\n emulated nic (bsc#975128)\n\n - CVE-2016-4002: Fixed OOB access in MIPSnet emulated\n controller (bsc#975136)\n\n - CVE-2016-4020: Fixed possible host data leakage to guest\n from TPR access (bsc#975700)\n\n - CVE-2016-2197: Prevent AHCI NULL pointer dereference\n when using FIS CLB engine (bsc#964411)\n\n - CVE-2015-5745: Buffer overflow in virtio-serial\n (bsc#940929).\n\n - CVE-2015-7549: PCI NULL pointer dereferences\n (bsc#958917).\n\n - CVE-2015-8504: VNC floating point exception\n (bsc#958491).\n\n - CVE-2015-8558: Infinite loop in ehci_advance_state\n resulting in DoS (bsc#959005).\n\n - CVE-2015-8567: A guest repeatedly activating a vmxnet3\n device can leak host memory (bsc#959386).\n\n - CVE-2015-8568: A guest repeatedly activating a vmxnet3\n device can leak host memory (bsc#959386).\n\n - CVE-2015-8613: Wrong sized memset in megasas command\n handler (bsc#961358).\n\n - CVE-2015-8619: Potential DoS for long HMP sendkey\n command argument (bsc#960334).\n\n - CVE-2015-8743: OOB memory access in ne2000 ioport r/w\n functions (bsc#960725).\n\n - CVE-2015-8744: Incorrect l2 header validation could have\n lead to a crash via assert(2) call (bsc#960835).\n\n - CVE-2015-8745: Reading IMR registers could have lead to\n a crash via assert(2) call (bsc#960708).\n\n - CVE-2016-1568: AHCI use-after-free in aio port commands\n (bsc#961332).\n\n - CVE-2016-1714: Potential OOB memory access in processing\n firmware configuration (bsc#961691).\n\n - CVE-2016-1922: NULL pointer dereference when processing\n hmp i/o command (bsc#962320).\n\n - CVE-2016-1981: Potential DoS (infinite loop) in e1000\n device emulation by malicious privileged user within\n guest (bsc#963782).\n\n - CVE-2016-2198: Malicious privileged guest user were able\n to cause DoS by writing to read-only EHCI capabilities\n registers (bsc#964413).\n\nThis non-security issue was fixed\n\n - bsc#886378: qemu truncates vhd images in virt-rescue\n\nThis update was imported from the SUSE:SLE-12-SP1:Update update\nproject.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=886378\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=940929\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=958491\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=958917\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=959005\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=959386\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=960334\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=960708\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=960725\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=960835\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=961332\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=961333\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=961358\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=961556\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=961691\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=962320\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=963782\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=964411\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=964413\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=967969\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=969121\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=969122\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=969350\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=970036\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=970037\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=975128\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=975136\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=975700\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=976109\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=978158\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=978160\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=980711\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=980723\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=981266\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected qemu packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:qemu\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:qemu-arm\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:qemu-arm-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:qemu-block-curl\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:qemu-block-curl-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:qemu-block-rbd\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:qemu-block-rbd-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:qemu-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:qemu-extra\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:qemu-extra-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:qemu-guest-agent\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:qemu-guest-agent-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:qemu-ipxe\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:qemu-kvm\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:qemu-lang\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:qemu-linux-user\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:qemu-linux-user-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:qemu-linux-user-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:qemu-ppc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:qemu-ppc-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:qemu-s390\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:qemu-s390-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:qemu-seabios\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:qemu-sgabios\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:qemu-testsuite\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:qemu-tools\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:qemu-tools-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:qemu-vgabios\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:qemu-x86\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:qemu-x86-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:42.1\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/07/06\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/07/08\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2021 Tenable Network Security, Inc.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE42\\.1)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"42.1\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(i586|i686|x86_64)$\") audit(AUDIT_ARCH_NOT, \"i586 / i686 / x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE42.1\", reference:\"qemu-2.3.1-15.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"qemu-arm-2.3.1-15.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"qemu-arm-debuginfo-2.3.1-15.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"qemu-block-curl-2.3.1-15.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"qemu-block-curl-debuginfo-2.3.1-15.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"qemu-debugsource-2.3.1-15.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"qemu-extra-2.3.1-15.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"qemu-extra-debuginfo-2.3.1-15.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"qemu-guest-agent-2.3.1-15.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"qemu-guest-agent-debuginfo-2.3.1-15.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"qemu-ipxe-1.0.0-15.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"qemu-kvm-2.3.1-15.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"qemu-lang-2.3.1-15.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"qemu-linux-user-2.3.1-15.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"qemu-linux-user-debuginfo-2.3.1-15.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"qemu-linux-user-debugsource-2.3.1-15.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"qemu-ppc-2.3.1-15.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"qemu-ppc-debuginfo-2.3.1-15.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"qemu-s390-2.3.1-15.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"qemu-s390-debuginfo-2.3.1-15.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"qemu-seabios-1.8.1-15.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"qemu-sgabios-8-15.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"qemu-tools-2.3.1-15.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"qemu-tools-debuginfo-2.3.1-15.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"qemu-vgabios-1.8.1-15.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"qemu-x86-2.3.1-15.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"qemu-x86-debuginfo-2.3.1-15.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"qemu-block-rbd-2.3.1-15.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"qemu-block-rbd-debuginfo-2.3.1-15.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"qemu-testsuite-2.3.1-15.2\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"qemu-linux-user / qemu-linux-user-debuginfo / etc\");\n}\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-26T14:20:51", "description": "qemu was updated to fix 29 security issues.\n\nThese security issues were fixed :\n\n - CVE-2016-4439: Avoid OOB access in 53C9X emulation (bsc#980711)\n\n - CVE-2016-4441: Avoid OOB access in 53C9X emulation (bsc#980723)\n\n - CVE-2016-4952: Avoid OOB access in Vmware PV SCSI emulation (bsc#981266)\n\n - CVE-2015-8817: Avoid OOB access in PCI dma I/O (bsc#969121)\n\n - CVE-2015-8818: Avoid OOB access in PCI dma I/O (bsc#969122)\n\n - CVE-2016-3710: Fixed VGA emulation based OOB access with potential for guest escape (bsc#978158)\n\n - CVE-2016-3712: Fixed VGa emulation based DOS and OOB read access exploit (bsc#978160)\n\n - CVE-2016-4037: Fixed USB ehci based DOS (bsc#976109)\n\n - CVE-2016-2538: Fixed potential OOB access in USB net device emulation (bsc#967969)\n\n - CVE-2016-2841: Fixed OOB access / hang in ne2000 emulation (bsc#969350)\n\n - CVE-2016-2858: Avoid potential DOS when using QEMU pseudo random number generator (bsc#970036)\n\n - CVE-2016-2857: Fixed OOB access when processing IP checksums (bsc#970037)\n\n - CVE-2016-4001: Fixed OOB access in Stellaris enet emulated nic (bsc#975128)\n\n - CVE-2016-4002: Fixed OOB access in MIPSnet emulated controller (bsc#975136)\n\n - CVE-2016-4020: Fixed possible host data leakage to guest from TPR access (bsc#975700)\n\n - CVE-2016-2197: Prevent AHCI NULL pointer dereference when using FIS CLB engine (bsc#964411)\n\n - CVE-2015-5745: Buffer overflow in virtio-serial (bsc#940929).\n\n - CVE-2015-7549: PCI NULL pointer dereferences (bsc#958917).\n\n - CVE-2015-8504: VNC floating point exception (bsc#958491).\n\n - CVE-2015-8558: Infinite loop in ehci_advance_state resulting in DoS (bsc#959005).\n\n - CVE-2015-8567: A guest repeatedly activating a vmxnet3 device can leak host memory (bsc#959386).\n\n - CVE-2015-8568: A guest repeatedly activating a vmxnet3 device can leak host memory (bsc#959386).\n\n - CVE-2015-8613: Wrong sized memset in megasas command handler (bsc#961358).\n\n - CVE-2015-8619: Potential DoS for long HMP sendkey command argument (bsc#960334).\n\n - CVE-2015-8743: OOB memory access in ne2000 ioport r/w functions (bsc#960725).\n\n - CVE-2015-8744: Incorrect l2 header validation could have lead to a crash via assert(2) call (bsc#960835).\n\n - CVE-2015-8745: Reading IMR registers could have lead to a crash via assert(2) call (bsc#960708).\n\n - CVE-2016-1568: AHCI use-after-free in aio port commands (bsc#961332).\n\n - CVE-2016-1714: Potential OOB memory access in processing firmware configuration (bsc#961691).\n\n - CVE-2016-1922: NULL pointer dereference when processing hmp i/o command (bsc#962320).\n\n - CVE-2016-1981: Potential DoS (infinite loop) in e1000 device emulation by malicious privileged user within guest (bsc#963782).\n\n - CVE-2016-2198: Malicious privileged guest user were able to cause DoS by writing to read-only EHCI capabilities registers (bsc#964413).\n\nThis non-security issue was fixed\n\n - bsc#886378: qemu truncates vhd images in virt-rescue\n\nNote that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2016-08-29T00:00:00", "type": "nessus", "title": "SUSE SLED12 / SLES12 Security Update : qemu (SUSE-SU-2016:1703-1)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.2, "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-5745", "CVE-2015-7549", "CVE-2015-8504", "CVE-2015-8558", "CVE-2015-8567", "CVE-2015-8568", "CVE-2015-8613", "CVE-2015-8619", "CVE-2015-8743", "CVE-2015-8744", "CVE-2015-8745", "CVE-2015-8817", "CVE-2015-8818", "CVE-2016-1568", "CVE-2016-1714", "CVE-2016-1922", "CVE-2016-1981", "CVE-2016-2197", "CVE-2016-2198", "CVE-2016-2538", "CVE-2016-2841", "CVE-2016-2857", "CVE-2016-2858", "CVE-2016-3710", "CVE-2016-3712", "CVE-2016-4001", "CVE-2016-4002", "CVE-2016-4020", "CVE-2016-4037", "CVE-2016-4439", "CVE-2016-4441", "CVE-2016-4952"], "modified": "2021-01-06T00:00:00", "cpe": ["p-cpe:/a:novell:suse_linux:qemu", "p-cpe:/a:novell:suse_linux:qemu-block-curl", "p-cpe:/a:novell:suse_linux:qemu-block-curl-debuginfo", "p-cpe:/a:novell:suse_linux:qemu-block-rbd", "p-cpe:/a:novell:suse_linux:qemu-block-rbd-debuginfo", "p-cpe:/a:novell:suse_linux:qemu-debugsource", "p-cpe:/a:novell:suse_linux:qemu-guest-agent", "p-cpe:/a:novell:suse_linux:qemu-guest-agent-debuginfo", "p-cpe:/a:novell:suse_linux:qemu-kvm", "p-cpe:/a:novell:suse_linux:qemu-lang", "p-cpe:/a:novell:suse_linux:qemu-s390", "p-cpe:/a:novell:suse_linux:qemu-s390-debuginfo", "p-cpe:/a:novell:suse_linux:qemu-tools", "p-cpe:/a:novell:suse_linux:qemu-tools-debuginfo", "p-cpe:/a:novell:suse_linux:qemu-x86", "cpe:/o:novell:suse_linux:12"], "id": "SUSE_SU-2016-1703-1.NASL", "href": "https://www.tenable.com/plugins/nessus/93170", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from SUSE update advisory SUSE-SU-2016:1703-1.\n# The text itself is copyright (C) SUSE.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(93170);\n script_version(\"2.12\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2015-5745\", \"CVE-2015-7549\", \"CVE-2015-8504\", \"CVE-2015-8558\", \"CVE-2015-8567\", \"CVE-2015-8568\", \"CVE-2015-8613\", \"CVE-2015-8619\", \"CVE-2015-8743\", \"CVE-2015-8744\", \"CVE-2015-8745\", \"CVE-2015-8817\", \"CVE-2015-8818\", \"CVE-2016-1568\", \"CVE-2016-1714\", \"CVE-2016-1922\", \"CVE-2016-1981\", \"CVE-2016-2197\", \"CVE-2016-2198\", \"CVE-2016-2538\", \"CVE-2016-2841\", \"CVE-2016-2857\", \"CVE-2016-2858\", \"CVE-2016-3710\", \"CVE-2016-3712\", \"CVE-2016-4001\", \"CVE-2016-4002\", \"CVE-2016-4020\", \"CVE-2016-4037\", \"CVE-2016-4439\", \"CVE-2016-4441\", \"CVE-2016-4952\");\n\n script_name(english:\"SUSE SLED12 / SLES12 Security Update : qemu (SUSE-SU-2016:1703-1)\");\n script_summary(english:\"Checks rpm output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\"The remote SUSE host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"qemu was updated to fix 29 security issues.\n\nThese security issues were fixed :\n\n - CVE-2016-4439: Avoid OOB access in 53C9X emulation\n (bsc#980711)\n\n - CVE-2016-4441: Avoid OOB access in 53C9X emulation\n (bsc#980723)\n\n - CVE-2016-4952: Avoid OOB access in Vmware PV SCSI\n emulation (bsc#981266)\n\n - CVE-2015-8817: Avoid OOB access in PCI dma I/O\n (bsc#969121)\n\n - CVE-2015-8818: Avoid OOB access in PCI dma I/O\n (bsc#969122)\n\n - CVE-2016-3710: Fixed VGA emulation based OOB access with\n potential for guest escape (bsc#978158)\n\n - CVE-2016-3712: Fixed VGa emulation based DOS and OOB\n read access exploit (bsc#978160)\n\n - CVE-2016-4037: Fixed USB ehci based DOS (bsc#976109)\n\n - CVE-2016-2538: Fixed potential OOB access in USB net\n device emulation (bsc#967969)\n\n - CVE-2016-2841: Fixed OOB access / hang in ne2000\n emulation (bsc#969350)\n\n - CVE-2016-2858: Avoid potential DOS when using QEMU\n pseudo random number generator (bsc#970036)\n\n - CVE-2016-2857: Fixed OOB access when processing IP\n checksums (bsc#970037)\n\n - CVE-2016-4001: Fixed OOB access in Stellaris enet\n emulated nic (bsc#975128)\n\n - CVE-2016-4002: Fixed OOB access in MIPSnet emulated\n controller (bsc#975136)\n\n - CVE-2016-4020: Fixed possible host data leakage to guest\n from TPR access (bsc#975700)\n\n - CVE-2016-2197: Prevent AHCI NULL pointer dereference\n when using FIS CLB engine (bsc#964411)\n\n - CVE-2015-5745: Buffer overflow in virtio-serial\n (bsc#940929).\n\n - CVE-2015-7549: PCI NULL pointer dereferences\n (bsc#958917).\n\n - CVE-2015-8504: VNC floating point exception\n (bsc#958491).\n\n - CVE-2015-8558: Infinite loop in ehci_advance_state\n resulting in DoS (bsc#959005).\n\n - CVE-2015-8567: A guest repeatedly activating a vmxnet3\n device can leak host memory (bsc#959386).\n\n - CVE-2015-8568: A guest repeatedly activating a vmxnet3\n device can leak host memory (bsc#959386).\n\n - CVE-2015-8613: Wrong sized memset in megasas command\n handler (bsc#961358).\n\n - CVE-2015-8619: Potential DoS for long HMP sendkey\n command argument (bsc#960334).\n\n - CVE-2015-8743: OOB memory access in ne2000 ioport r/w\n functions (bsc#960725).\n\n - CVE-2015-8744: Incorrect l2 header validation could have\n lead to a crash via assert(2) call (bsc#960835).\n\n - CVE-2015-8745: Reading IMR registers could have lead to\n a crash via assert(2) call (bsc#960708).\n\n - CVE-2016-1568: AHCI use-after-free in aio port commands\n (bsc#961332).\n\n - CVE-2016-1714: Potential OOB memory access in processing\n firmware configuration (bsc#961691).\n\n - CVE-2016-1922: NULL pointer dereference when processing\n hmp i/o command (bsc#962320).\n\n - CVE-2016-1981: Potential DoS (infinite loop) in e1000\n device emulation by malicious privileged user within\n guest (bsc#963782).\n\n - CVE-2016-2198: Malicious privileged guest user were able\n to cause DoS by writing to read-only EHCI capabilities\n registers (bsc#964413).\n\nThis non-security issue was fixed\n\n - bsc#886378: qemu truncates vhd images in virt-rescue\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=886378\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=940929\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=958491\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=958917\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=959005\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=959386\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=960334\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=960708\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=960725\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=960835\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=961332\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=961333\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=961358\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=961556\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=961691\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=962320\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=963782\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=964411\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=964413\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=967969\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=969121\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=969122\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=969350\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=970036\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=970037\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=975128\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=975136\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=975700\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=976109\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=978158\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=978160\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=980711\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=980723\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=981266\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-5745/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-7549/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8504/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8558/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8567/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8568/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8613/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8619/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8743/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8744/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8745/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8817/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8818/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-1568/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-1714/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-1922/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-1981/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-2197/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-2198/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-2538/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-2841/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-2857/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-2858/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-3710/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-3712/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-4001/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-4002/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-4020/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-4037/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-4439/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-4441/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-4952/\"\n );\n # https://www.suse.com/support/update/announcement/2016/suse-su-20161703-1/\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?0f03d2ce\"\n );\n script_set_attribute(\n attribute:\"solution\",\n value:\n\"To install this SUSE Security Update use YaST online_update.\nAlternatively you can run the command listed for your product :\n\nSUSE Linux Enterprise Server 12-SP1 :\n\nzypper in -t patch SUSE-SLE-SERVER-12-SP1-2016-1007=1\n\nSUSE Linux Enterprise Desktop 12-SP1 :\n\nzypper in -t patch SUSE-SLE-DESKTOP-12-SP1-2016-1007=1\n\nTo bring your system up-to-date, use 'zypper patch'.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:qemu\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:qemu-block-curl\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:qemu-block-curl-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:qemu-block-rbd\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:qemu-block-rbd-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:qemu-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:qemu-guest-agent\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:qemu-guest-agent-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:qemu-kvm\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:qemu-lang\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:qemu-s390\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:qemu-s390-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:qemu-tools\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:qemu-tools-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:qemu-x86\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:12\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2016/04/07\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/06/28\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/08/29\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nos_ver = pregmatch(pattern: \"^(SLE(S|D)\\d+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"SUSE\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLED12|SLES12)$\", string:os_ver)) audit(AUDIT_OS_NOT, \"SUSE SLED12 / SLES12\", \"SUSE \" + os_ver);\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^i[3-6]86$\" && \"x86_64\" >!< cpu && \"s390x\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"SUSE \" + os_ver, cpu);\n\nsp = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(sp)) sp = \"0\";\nif (os_ver == \"SLES12\" && (! preg(pattern:\"^(1)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLES12 SP1\", os_ver + \" SP\" + sp);\nif (os_ver == \"SLED12\" && (! preg(pattern:\"^(1)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLED12 SP1\", os_ver + \" SP\" + sp);\n\n\nflag = 0;\nif (rpm_check(release:\"SLES12\", sp:\"1\", cpu:\"x86_64\", reference:\"qemu-block-rbd-2.3.1-14.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", cpu:\"x86_64\", reference:\"qemu-block-rbd-debuginfo-2.3.1-14.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", cpu:\"x86_64\", reference:\"qemu-x86-2.3.1-14.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", cpu:\"s390x\", reference:\"qemu-s390-2.3.1-14.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", cpu:\"s390x\", reference:\"qemu-s390-debuginfo-2.3.1-14.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", reference:\"qemu-2.3.1-14.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", reference:\"qemu-block-curl-2.3.1-14.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", reference:\"qemu-block-curl-debuginfo-2.3.1-14.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", reference:\"qemu-debugsource-2.3.1-14.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", reference:\"qemu-guest-agent-2.3.1-14.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", reference:\"qemu-guest-agent-debuginfo-2.3.1-14.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", reference:\"qemu-lang-2.3.1-14.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", reference:\"qemu-tools-2.3.1-14.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", reference:\"qemu-tools-debuginfo-2.3.1-14.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", reference:\"qemu-kvm-2.3.1-14.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"1\", cpu:\"x86_64\", reference:\"qemu-2.3.1-14.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"1\", cpu:\"x86_64\", reference:\"qemu-block-curl-2.3.1-14.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"1\", cpu:\"x86_64\", reference:\"qemu-block-curl-debuginfo-2.3.1-14.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"1\", cpu:\"x86_64\", reference:\"qemu-debugsource-2.3.1-14.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"1\", cpu:\"x86_64\", reference:\"qemu-kvm-2.3.1-14.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"1\", cpu:\"x86_64\", reference:\"qemu-tools-2.3.1-14.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"1\", cpu:\"x86_64\", reference:\"qemu-tools-debuginfo-2.3.1-14.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"1\", cpu:\"x86_64\", reference:\"qemu-x86-2.3.1-14.1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"qemu\");\n}\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-26T14:20:52", "description": "kvm was updated to fix 33 security issues.\n\nThese security issues were fixed :\n\n - CVE-2016-4439: Avoid OOB access in 53C9X emulation (bsc#980711)\n\n - CVE-2016-4441: Avoid OOB access in 53C9X emulation (bsc#980723)\n\n - CVE-2016-3710: Fixed VGA emulation based OOB access with potential for guest escape (bsc#978158)\n\n - CVE-2016-3712: Fixed VGa emulation based DOS and OOB read access exploit (bsc#978160)\n\n - CVE-2016-4037: Fixed USB ehci based DOS (bsc#976109)\n\n - CVE-2016-2538: Fixed potential OOB access in USB net device emulation (bsc#967969)\n\n - CVE-2016-2841: Fixed OOB access / hang in ne2000 emulation (bsc#969350)\n\n - CVE-2016-2858: Avoid potential DOS when using QEMU pseudo random number generator (bsc#970036)\n\n - CVE-2016-2857: Fixed OOB access when processing IP checksums (bsc#970037)\n\n - CVE-2016-4001: Fixed OOB access in Stellaris enet emulated nic (bsc#975128)\n\n - CVE-2016-4002: Fixed OOB access in MIPSnet emulated controller (bsc#975136)\n\n - CVE-2016-4020: Fixed possible host data leakage to guest from TPR access (bsc#975700)\n\n - CVE-2015-3214: Fixed OOB read in i8254 PIC (bsc#934069)\n\n - CVE-2014-9718: Fixed the handling of malformed or short ide PRDTs to avoid any opportunity for guest to cause DoS by abusing that interface (bsc#928393)\n\n - CVE-2014-3689: Fixed insufficient parameter validation in rectangle functions (bsc#901508)\n\n - CVE-2014-3615: The VGA emulator in QEMU allowed local guest users to read host memory by setting the display to a high resolution (bsc#895528).\n\n - CVE-2015-5239: Integer overflow in vnc_client_read() and protocol_client_msg() (bsc#944463).\n\n - CVE-2015-5278: Infinite loop in ne2000_receive() function (bsc#945989).\n\n - CVE-2015-5279: Heap-based buffer overflow in the ne2000_receive function in hw/net/ne2000.c in QEMU allowed guest OS users to cause a denial of service (instance crash) or possibly execute arbitrary code via vectors related to receiving packets (bsc#945987).\n\n - CVE-2015-5745: Buffer overflow in virtio-serial (bsc#940929).\n\n - CVE-2015-6855: hw/ide/core.c in QEMU did not properly restrict the commands accepted by an ATAPI device, which allowed guest users to cause a denial of service or possibly have unspecified other impact via certain IDE commands, as demonstrated by a WIN_READ_NATIVE_MAX command to an empty drive, which triggers a divide-by-zero error and instance crash (bsc#945404).\n\n - CVE-2015-7295: hw/virtio/virtio.c in the Virtual Network Device (virtio-net) support in QEMU, when big or mergeable receive buffers are not supported, allowed remote attackers to cause a denial of service (guest network consumption) via a flood of jumbo frames on the (1) tuntap or (2) macvtap interface (bsc#947159).\n\n - CVE-2015-7549: PCI NULL pointer dereferences (bsc#958917).\n\n - CVE-2015-8504: VNC floating point exception (bsc#958491).\n\n - CVE-2015-8558: Infinite loop in ehci_advance_state resulting in DoS (bsc#959005).\n\n - CVE-2015-8613: Wrong sized memset in megasas command handler (bsc#961358).\n\n - CVE-2015-8619: Potential DoS for long HMP sendkey command argument (bsc#960334).\n\n - CVE-2015-8743: OOB memory access in ne2000 ioport r/w functions (bsc#960725).\n\n - CVE-2016-1568: AHCI use-after-free in aio port commands (bsc#961332).\n\n - CVE-2016-1714: Potential OOB memory access in processing firmware configuration (bsc#961691).\n\n - CVE-2016-1922: NULL pointer dereference when processing hmp i/o command (bsc#962320).\n\n - CVE-2016-1981: Potential DoS (infinite loop) in e1000 device emulation by malicious privileged user within guest (bsc#963782).\n\n - CVE-2016-2198: Malicious privileged guest user were able to cause DoS by writing to read-only EHCI capabilities registers (bsc#964413).\n\nThe update package also includes non-security fixes. See advisory for details.\n\nNote that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2016-08-29T00:00:00", "type": "nessus", "title": "SUSE SLES11 Security Update : kvm (SUSE-SU-2016:1785-1)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.2, "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2014-3615", "CVE-2014-3689", "CVE-2014-9718", "CVE-2015-3214", "CVE-2015-5239", "CVE-2015-5278", "CVE-2015-5279", "CVE-2015-5745", "CVE-2015-6855", "CVE-2015-7295", "CVE-2015-7549", "CVE-2015-8504", "CVE-2015-8558", "CVE-2015-8613", "CVE-2015-8619", "CVE-2015-8743", "CVE-2016-1568", "CVE-2016-1714", "CVE-2016-1922", "CVE-2016-1981", "CVE-2016-2198", "CVE-2016-2538", "CVE-2016-2841", "CVE-2016-2857", "CVE-2016-2858", "CVE-2016-3710", "CVE-2016-3712", "CVE-2016-4001", "CVE-2016-4002", "CVE-2016-4020", "CVE-2016-4037", "CVE-2016-4439", "CVE-2016-4441"], "modified": "2021-01-19T00:00:00", "cpe": ["p-cpe:/a:novell:suse_linux:kvm", "cpe:/o:novell:suse_linux:11"], "id": "SUSE_SU-2016-1785-1.NASL", "href": "https://www.tenable.com/plugins/nessus/93180", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from SUSE update advisory SUSE-SU-2016:1785-1.\n# The text itself is copyright (C) SUSE.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(93180);\n script_version(\"2.11\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/19\");\n\n script_cve_id(\"CVE-2014-3615\", \"CVE-2014-3689\", \"CVE-2014-9718\", \"CVE-2015-3214\", \"CVE-2015-5239\", \"CVE-2015-5278\", \"CVE-2015-5279\", \"CVE-2015-5745\", \"CVE-2015-6855\", \"CVE-2015-7295\", \"CVE-2015-7549\", \"CVE-2015-8504\", \"CVE-2015-8558\", \"CVE-2015-8613\", \"CVE-2015-8619\", \"CVE-2015-8743\", \"CVE-2016-1568\", \"CVE-2016-1714\", \"CVE-2016-1922\", \"CVE-2016-1981\", \"CVE-2016-2198\", \"CVE-2016-2538\", \"CVE-2016-2841\", \"CVE-2016-2857\", \"CVE-2016-2858\", \"CVE-2016-3710\", \"CVE-2016-3712\", \"CVE-2016-4001\", \"CVE-2016-4002\", \"CVE-2016-4020\", \"CVE-2016-4037\", \"CVE-2016-4439\", \"CVE-2016-4441\");\n script_bugtraq_id(69654, 70997, 73316, 75273);\n\n script_name(english:\"SUSE SLES11 Security Update : kvm (SUSE-SU-2016:1785-1)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\"The remote SUSE host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"kvm was updated to fix 33 security issues.\n\nThese security issues were fixed :\n\n - CVE-2016-4439: Avoid OOB access in 53C9X emulation\n (bsc#980711)\n\n - CVE-2016-4441: Avoid OOB access in 53C9X emulation\n (bsc#980723)\n\n - CVE-2016-3710: Fixed VGA emulation based OOB access with\n potential for guest escape (bsc#978158)\n\n - CVE-2016-3712: Fixed VGa emulation based DOS and OOB\n read access exploit (bsc#978160)\n\n - CVE-2016-4037: Fixed USB ehci based DOS (bsc#976109)\n\n - CVE-2016-2538: Fixed potential OOB access in USB net\n device emulation (bsc#967969)\n\n - CVE-2016-2841: Fixed OOB access / hang in ne2000\n emulation (bsc#969350)\n\n - CVE-2016-2858: Avoid potential DOS when using QEMU\n pseudo random number generator (bsc#970036)\n\n - CVE-2016-2857: Fixed OOB access when processing IP\n checksums (bsc#970037)\n\n - CVE-2016-4001: Fixed OOB access in Stellaris enet\n emulated nic (bsc#975128)\n\n - CVE-2016-4002: Fixed OOB access in MIPSnet emulated\n controller (bsc#975136)\n\n - CVE-2016-4020: Fixed possible host data leakage to guest\n from TPR access (bsc#975700)\n\n - CVE-2015-3214: Fixed OOB read in i8254 PIC (bsc#934069)\n\n - CVE-2014-9718: Fixed the handling of malformed or short\n ide PRDTs to avoid any opportunity for guest to cause\n DoS by abusing that interface (bsc#928393)\n\n - CVE-2014-3689: Fixed insufficient parameter validation\n in rectangle functions (bsc#901508)\n\n - CVE-2014-3615: The VGA emulator in QEMU allowed local\n guest users to read host memory by setting the display\n to a high resolution (bsc#895528).\n\n - CVE-2015-5239: Integer overflow in vnc_client_read() and\n protocol_client_msg() (bsc#944463).\n\n - CVE-2015-5278: Infinite loop in ne2000_receive()\n function (bsc#945989).\n\n - CVE-2015-5279: Heap-based buffer overflow in the\n ne2000_receive function in hw/net/ne2000.c in QEMU\n allowed guest OS users to cause a denial of service\n (instance crash) or possibly execute arbitrary code via\n vectors related to receiving packets (bsc#945987).\n\n - CVE-2015-5745: Buffer overflow in virtio-serial\n (bsc#940929).\n\n - CVE-2015-6855: hw/ide/core.c in QEMU did not properly\n restrict the commands accepted by an ATAPI device, which\n allowed guest users to cause a denial of service or\n possibly have unspecified other impact via certain IDE\n commands, as demonstrated by a WIN_READ_NATIVE_MAX\n command to an empty drive, which triggers a\n divide-by-zero error and instance crash (bsc#945404).\n\n - CVE-2015-7295: hw/virtio/virtio.c in the Virtual Network\n Device (virtio-net) support in QEMU, when big or\n mergeable receive buffers are not supported, allowed\n remote attackers to cause a denial of service (guest\n network consumption) via a flood of jumbo frames on the\n (1) tuntap or (2) macvtap interface (bsc#947159).\n\n - CVE-2015-7549: PCI NULL pointer dereferences\n (bsc#958917).\n\n - CVE-2015-8504: VNC floating point exception\n (bsc#958491).\n\n - CVE-2015-8558: Infinite loop in ehci_advance_state\n resulting in DoS (bsc#959005).\n\n - CVE-2015-8613: Wrong sized memset in megasas command\n handler (bsc#961358).\n\n - CVE-2015-8619: Potential DoS for long HMP sendkey\n command argument (bsc#960334).\n\n - CVE-2015-8743: OOB memory access in ne2000 ioport r/w\n functions (bsc#960725).\n\n - CVE-2016-1568: AHCI use-after-free in aio port commands\n (bsc#961332).\n\n - CVE-2016-1714: Potential OOB memory access in processing\n firmware configuration (bsc#961691).\n\n - CVE-2016-1922: NULL pointer dereference when processing\n hmp i/o command (bsc#962320).\n\n - CVE-2016-1981: Potential DoS (infinite loop) in e1000\n device emulation by malicious privileged user within\n guest (bsc#963782).\n\n - CVE-2016-2198: Malicious privileged guest user were able\n to cause DoS by writing to read-only EHCI capabilities\n registers (bsc#964413).\n\nThe update package also includes non-security fixes. See advisory for\ndetails.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=895528\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=901508\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=928393\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=934069\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=936132\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=940929\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=944463\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=945404\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=945987\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=945989\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=947159\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=958491\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=958917\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=959005\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=960334\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=960725\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=961332\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=961333\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=961358\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=961556\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=961691\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=962320\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=963782\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=964413\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=967969\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=969350\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=970036\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=970037\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=975128\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=975136\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=975700\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=976109\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=978158\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=978160\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=980711\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=980723\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2014-3615/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2014-3689/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2014-9718/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-3214/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-5239/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-5278/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-5279/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-5745/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-6855/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-7295/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-7549/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8504/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8558/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8613/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8619/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8743/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-1568/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-1714/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-1922/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-1981/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-2198/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-2538/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-2841/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-2857/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-2858/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-3710/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-3712/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-4001/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-4002/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-4020/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-4037/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-4439/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-4441/\"\n );\n # https://www.suse.com/support/update/announcement/2016/suse-su-20161785-1/\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?7e8d0dd2\"\n );\n script_set_attribute(\n attribute:\"solution\",\n value:\n\"To install this SUSE Security Update use YaST online_update.\nAlternatively you can run the command listed for your product :\n\nSUSE Linux Enterprise Server 11-SP4 :\n\nzypper in -t patch slessp4-kvm-12645=1\n\nTo bring your system up-to-date, use 'zypper patch'.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kvm\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:11\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2014/11/01\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/07/11\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/08/29\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nos_ver = pregmatch(pattern: \"^(SLE(S|D)\\d+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"SUSE\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLES11)$\", string:os_ver)) audit(AUDIT_OS_NOT, \"SUSE SLES11\", \"SUSE \" + os_ver);\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^i[3-6]86$\" && \"x86_64\" >!< cpu && \"s390x\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"SUSE \" + os_ver, cpu);\n\nsp = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(sp)) sp = \"0\";\nif (os_ver == \"SLES11\" && (! preg(pattern:\"^(4)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLES11 SP4\", os_ver + \" SP\" + sp);\n\n\nflag = 0;\nif (rpm_check(release:\"SLES11\", sp:\"4\", reference:\"kvm-1.4.2-44.1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"kvm\");\n}\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-11T16:40:08", "description": "qemu was updated to fix 37 security issues.\n\nThese security issues were fixed :\n\n - CVE-2016-4439: Avoid OOB access in 53C9X emulation (bsc#980711)\n\n - CVE-2016-4441: Avoid OOB access in 53C9X emulation (bsc#980723)\n\n - CVE-2016-4952: Avoid OOB access in Vmware PV SCSI emulation (bsc#981266)\n\n - CVE-2015-8817: Avoid OOB access in PCI DMA I/O (bsc#969121)\n\n - CVE-2015-8818: Avoid OOB access in PCI DMA I/O (bsc#969122)\n\n - CVE-2016-3710: Fixed VGA emulation based OOB access with potential for guest escape (bsc#978158)\n\n - CVE-2016-3712: Fixed VGa emulation based DOS and OOB read access exploit (bsc#978160)\n\n - CVE-2016-4037: Fixed USB ehci based DOS (bsc#976109)\n\n - CVE-2016-2538: Fixed potential OOB access in USB net device emulation (bsc#967969)\n\n - CVE-2016-2841: Fixed OOB access / hang in ne2000 emulation (bsc#969350)\n\n - CVE-2016-2858: Avoid potential DOS when using QEMU pseudo random number generator (bsc#970036)\n\n - CVE-2016-2857: Fixed OOB access when processing IP checksums (bsc#970037)\n\n - CVE-2016-4001: Fixed OOB access in Stellaris enet emulated nic (bsc#975128)\n\n - CVE-2016-4002: Fixed OOB access in MIPSnet emulated controller (bsc#975136)\n\n - CVE-2016-4020: Fixed possible host data leakage to guest from TPR access (bsc#975700)\n\n - CVE-2015-3214: Fixed OOB read in i8254 PIC (bsc#934069)\n\n - CVE-2014-9718: Fixed the handling of malformed or short ide PRDTs to avoid any opportunity for guest to cause DoS by abusing that interface (bsc#928393)\n\n - CVE-2014-3689: Fixed insufficient parameter validation in rectangle functions (bsc#901508)\n\n - CVE-2014-3615: The VGA emulator in QEMU allowed local guest users to read host memory by setting the display to a high resolution (bsc#895528).\n\n - CVE-2015-5239: Integer overflow in vnc_client_read() and protocol_client_msg() (bsc#944463).\n\n - CVE-2015-5745: Buffer overflow in virtio-serial (bsc#940929).\n\n - CVE-2015-7295: hw/virtio/virtio.c in the Virtual Network Device (virtio-net) support in QEMU, when big or mergeable receive buffers are not supported, allowed remote attackers to cause a denial of service (guest network consumption) via a flood of jumbo frames on the (1) tuntap or (2) macvtap interface (bsc#947159).\n\n - CVE-2015-7549: PCI NULL pointer dereferences (bsc#958917).\n\n - CVE-2015-8504: VNC floating point exception (bsc#958491).\n\n - CVE-2015-8558: Infinite loop in ehci_advance_state resulting in DoS (bsc#959005).\n\n - CVE-2015-8567: A guest repeatedly activating a vmxnet3 device can leak host memory (bsc#959386).\n\n - CVE-2015-8568: A guest repeatedly activating a vmxnet3 device can leak host memory (bsc#959386).\n\n - CVE-2015-8613: Wrong sized memset in megasas command handler (bsc#961358).\n\n - CVE-2015-8619: Potential DoS for long HMP sendkey command argument (bsc#960334).\n\n - CVE-2015-8743: OOB memory access in ne2000 ioport r/w functions (bsc#960725).\n\n - CVE-2015-8744: Incorrect l2 header validation could have lead to a crash via assert(2) call (bsc#960835).\n\n - CVE-2015-8745: Reading IMR registers could have lead to a crash via assert(2) call (bsc#960708).\n\n - CVE-2016-1568: AHCI use-after-free in aio port commands (bsc#961332).\n\n - CVE-2016-1714: Potential OOB memory access in processing firmware configuration (bsc#961691).\n\n - CVE-2016-1922: NULL pointer dereference when processing hmp i/o command (bsc#962320).\n\n - CVE-2016-1981: Potential DoS (infinite loop) in e1000 device emulation by malicious privileged user within guest (bsc#963782).\n\n - CVE-2016-2198: Malicious privileged guest user were able to cause DoS by writing to read-only EHCI capabilities registers (bsc#964413).\n\nThis non-security issue was fixed\n\n - bsc#886378: qemu truncates vhd images in virt-rescue\n\nNote that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2016-06-17T00:00:00", "type": "nessus", "title": "SUSE SLED12 / SLES12 Security Update : qemu (SUSE-SU-2016:1560-1)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.2, "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2014-3615", "CVE-2014-3689", "CVE-2014-9718", "CVE-2015-3214", "CVE-2015-5239", "CVE-2015-5745", "CVE-2015-7295", "CVE-2015-7549", "CVE-2015-8504", "CVE-2015-8558", "CVE-2015-8567", "CVE-2015-8568", "CVE-2015-8613", "CVE-2015-8619", "CVE-2015-8743", "CVE-2015-8744", "CVE-2015-8745", "CVE-2015-8817", "CVE-2015-8818", "CVE-2016-1568", "CVE-2016-1714", "CVE-2016-1922", "CVE-2016-1981", "CVE-2016-2198", "CVE-2016-2538", "CVE-2016-2841", "CVE-2016-2857", "CVE-2016-2858", "CVE-2016-3710", "CVE-2016-3712", "CVE-2016-4001", "CVE-2016-4002", "CVE-2016-4020", "CVE-2016-4037", "CVE-2016-4439", "CVE-2016-4441", "CVE-2016-4952"], "modified": "2021-01-06T00:00:00", "cpe": ["p-cpe:/a:novell:suse_linux:qemu", "p-cpe:/a:novell:suse_linux:qemu-block-curl", "p-cpe:/a:novell:suse_linux:qemu-block-curl-debuginfo", "p-cpe:/a:novell:suse_linux:qemu-block-rbd", "p-cpe:/a:novell:suse_linux:qemu-block-rbd-debuginfo", "p-cpe:/a:novell:suse_linux:qemu-debugsource", "p-cpe:/a:novell:suse_linux:qemu-guest-agent", "p-cpe:/a:novell:suse_linux:qemu-guest-agent-debuginfo", "p-cpe:/a:novell:suse_linux:qemu-kvm", "p-cpe:/a:novell:suse_linux:qemu-lang", "p-cpe:/a:novell:suse_linux:qemu-s390", "p-cpe:/a:novell:suse_linux:qemu-s390-debuginfo", "p-cpe:/a:novell:suse_linux:qemu-tools", "p-cpe:/a:novell:suse_linux:qemu-tools-debuginfo", "p-cpe:/a:novell:suse_linux:qemu-x86", "p-cpe:/a:novell:suse_linux:qemu-x86-debuginfo", "cpe:/o:novell:suse_linux:12"], "id": "SUSE_SU-2016-1560-1.NASL", "href": "https://www.tenable.com/plugins/nessus/91660", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from SUSE update advisory SUSE-SU-2016:1560-1.\n# The text itself is copyright (C) SUSE.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(91660);\n script_version(\"2.12\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2014-3615\", \"CVE-2014-3689\", \"CVE-2014-9718\", \"CVE-2015-3214\", \"CVE-2015-5239\", \"CVE-2015-5745\", \"CVE-2015-7295\", \"CVE-2015-7549\", \"CVE-2015-8504\", \"CVE-2015-8558\", \"CVE-2015-8567\", \"CVE-2015-8568\", \"CVE-2015-8613\", \"CVE-2015-8619\", \"CVE-2015-8743\", \"CVE-2015-8744\", \"CVE-2015-8745\", \"CVE-2015-8817\", \"CVE-2015-8818\", \"CVE-2016-1568\", \"CVE-2016-1714\", \"CVE-2016-1922\", \"CVE-2016-1981\", \"CVE-2016-2198\", \"CVE-2016-2538\", \"CVE-2016-2841\", \"CVE-2016-2857\", \"CVE-2016-2858\", \"CVE-2016-3710\", \"CVE-2016-3712\", \"CVE-2016-4001\", \"CVE-2016-4002\", \"CVE-2016-4020\", \"CVE-2016-4037\", \"CVE-2016-4439\", \"CVE-2016-4441\", \"CVE-2016-4952\");\n script_bugtraq_id(69654, 70997, 73316, 75273);\n\n script_name(english:\"SUSE SLED12 / SLES12 Security Update : qemu (SUSE-SU-2016:1560-1)\");\n script_summary(english:\"Checks rpm output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\"The remote SUSE host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"qemu was updated to fix 37 security issues.\n\nThese security issues were fixed :\n\n - CVE-2016-4439: Avoid OOB access in 53C9X emulation\n (bsc#980711)\n\n - CVE-2016-4441: Avoid OOB access in 53C9X emulation\n (bsc#980723)\n\n - CVE-2016-4952: Avoid OOB access in Vmware PV SCSI\n emulation (bsc#981266)\n\n - CVE-2015-8817: Avoid OOB access in PCI DMA I/O\n (bsc#969121)\n\n - CVE-2015-8818: Avoid OOB access in PCI DMA I/O\n (bsc#969122)\n\n - CVE-2016-3710: Fixed VGA emulation based OOB access with\n potential for guest escape (bsc#978158)\n\n - CVE-2016-3712: Fixed VGa emulation based DOS and OOB\n read access exploit (bsc#978160)\n\n - CVE-2016-4037: Fixed USB ehci based DOS (bsc#976109)\n\n - CVE-2016-2538: Fixed potential OOB access in USB net\n device emulation (bsc#967969)\n\n - CVE-2016-2841: Fixed OOB access / hang in ne2000\n emulation (bsc#969350)\n\n - CVE-2016-2858: Avoid potential DOS when using QEMU\n pseudo random number generator (bsc#970036)\n\n - CVE-2016-2857: Fixed OOB access when processing IP\n checksums (bsc#970037)\n\n - CVE-2016-4001: Fixed OOB access in Stellaris enet\n emulated nic (bsc#975128)\n\n - CVE-2016-4002: Fixed OOB access in MIPSnet emulated\n controller (bsc#975136)\n\n - CVE-2016-4020: Fixed possible host data leakage to guest\n from TPR access (bsc#975700)\n\n - CVE-2015-3214: Fixed OOB read in i8254 PIC (bsc#934069)\n\n - CVE-2014-9718: Fixed the handling of malformed or short\n ide PRDTs to avoid any opportunity for guest to cause\n DoS by abusing that interface (bsc#928393)\n\n - CVE-2014-3689: Fixed insufficient parameter validation\n in rectangle functions (bsc#901508)\n\n - CVE-2014-3615: The VGA emulator in QEMU allowed local\n guest users to read host memory by setting the display\n to a high resolution (bsc#895528).\n\n - CVE-2015-5239: Integer overflow in vnc_client_read() and\n protocol_client_msg() (bsc#944463).\n\n - CVE-2015-5745: Buffer overflow in virtio-serial\n (bsc#940929).\n\n - CVE-2015-7295: hw/virtio/virtio.c in the Virtual Network\n Device (virtio-net) support in QEMU, when big or\n mergeable receive buffers are not supported, allowed\n remote attackers to cause a denial of service (guest\n network consumption) via a flood of jumbo frames on the\n (1) tuntap or (2) macvtap interface (bsc#947159).\n\n - CVE-2015-7549: PCI NULL pointer dereferences\n (bsc#958917).\n\n - CVE-2015-8504: VNC floating point exception\n (bsc#958491).\n\n - CVE-2015-8558: Infinite loop in ehci_advance_state\n resulting in DoS (bsc#959005).\n\n - CVE-2015-8567: A guest repeatedly activating a vmxnet3\n device can leak host memory (bsc#959386).\n\n - CVE-2015-8568: A guest repeatedly activating a vmxnet3\n device can leak host memory (bsc#959386).\n\n - CVE-2015-8613: Wrong sized memset in megasas command\n handler (bsc#961358).\n\n - CVE-2015-8619: Potential DoS for long HMP sendkey\n command argument (bsc#960334).\n\n - CVE-2015-8743: OOB memory access in ne2000 ioport r/w\n functions (bsc#960725).\n\n - CVE-2015-8744: Incorrect l2 header validation could have\n lead to a crash via assert(2) call (bsc#960835).\n\n - CVE-2015-8745: Reading IMR registers could have lead to\n a crash via assert(2) call (bsc#960708).\n\n - CVE-2016-1568: AHCI use-after-free in aio port commands\n (bsc#961332).\n\n - CVE-2016-1714: Potential OOB memory access in processing\n firmware configuration (bsc#961691).\n\n - CVE-2016-1922: NULL pointer dereference when processing\n hmp i/o command (bsc#962320).\n\n - CVE-2016-1981: Potential DoS (infinite loop) in e1000\n device emulation by malicious privileged user within\n guest (bsc#963782).\n\n - CVE-2016-2198: Malicious privileged guest user were able\n to cause DoS by writing to read-only EHCI capabilities\n registers (bsc#964413).\n\nThis non-security issue was fixed\n\n - bsc#886378: qemu truncates vhd images in virt-rescue\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=886378\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=895528\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=901508\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=928393\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=934069\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=940929\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=944463\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=947159\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=958491\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=958917\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=959005\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=959386\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=960334\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=960708\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=960725\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=960835\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=961332\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=961333\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=961358\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=961556\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=961691\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=962320\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=963782\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=964413\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=967969\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=969121\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=969122\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=969350\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=970036\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=970037\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=975128\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=975136\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=975700\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=976109\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=978158\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=978160\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=980711\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=980723\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=981266\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2014-3615/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2014-3689/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2014-9718/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-3214/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-5239/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-5745/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-7295/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-7549/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8504/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8558/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8567/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8568/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8613/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8619/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8743/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8744/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8745/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8817/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8818/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-1568/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-1714/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-1922/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-1981/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-2198/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-2538/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-2841/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-2857/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-2858/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-3710/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-3712/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-4001/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-4002/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-4020/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-4037/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-4439/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-4441/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-4952/\"\n );\n # https://www.suse.com/support/update/announcement/2016/suse-su-20161560-1/\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?e8098092\"\n );\n script_set_attribute(\n attribute:\"solution\",\n value:\n\"To install this SUSE Security Update use YaST online_update.\nAlternatively you can run the command listed for your product :\n\nSUSE Linux Enterprise Server 12 :\n\nzypper in -t patch SUSE-SLE-SERVER-12-2016-924=1\n\nSUSE Linux Enterprise Desktop 12 :\n\nzypper in -t patch SUSE-SLE-DESKTOP-12-2016-924=1\n\nTo bring your system up-to-date, use 'zypper patch'.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:qemu\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:qemu-block-curl\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:qemu-block-curl-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:qemu-block-rbd\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:qemu-block-rbd-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:qemu-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:qemu-guest-agent\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:qemu-guest-agent-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:qemu-kvm\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:qemu-lang\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:qemu-s390\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:qemu-s390-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:qemu-tools\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:qemu-tools-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:qemu-x86\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:qemu-x86-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:12\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2014/11/01\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/06/13\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/06/17\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nos_ver = pregmatch(pattern: \"^(SLE(S|D)\\d+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"SUSE\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLED12|SLES12)$\", string:os_ver)) audit(AUDIT_OS_NOT, \"SUSE SLED12 / SLES12\", \"SUSE \" + os_ver);\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^i[3-6]86$\" && \"x86_64\" >!< cpu && \"s390x\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"SUSE \" + os_ver, cpu);\n\nsp = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(sp)) sp = \"0\";\nif (os_ver == \"SLES12\" && (! preg(pattern:\"^(0)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLES12 SP0\", os_ver + \" SP\" + sp);\nif (os_ver == \"SLED12\" && (! preg(pattern:\"^(0)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLED12 SP0\", os_ver + \" SP\" + sp);\n\n\nflag = 0;\nif (rpm_check(release:\"SLES12\", sp:\"0\", cpu:\"x86_64\", reference:\"qemu-block-rbd-2.0.2-48.19.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", cpu:\"x86_64\", reference:\"qemu-block-rbd-debuginfo-2.0.2-48.19.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", cpu:\"x86_64\", reference:\"qemu-x86-2.0.2-48.19.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", cpu:\"x86_64\", reference:\"qemu-x86-debuginfo-2.0.2-48.19.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", cpu:\"s390x\", reference:\"qemu-s390-2.0.2-48.19.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", cpu:\"s390x\", reference:\"qemu-s390-debuginfo-2.0.2-48.19.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"qemu-2.0.2-48.19.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"qemu-block-curl-2.0.2-48.19.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"qemu-block-curl-debuginfo-2.0.2-48.19.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"qemu-debugsource-2.0.2-48.19.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"qemu-guest-agent-2.0.2-48.19.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"qemu-guest-agent-debuginfo-2.0.2-48.19.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"qemu-lang-2.0.2-48.19.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"qemu-tools-2.0.2-48.19.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"qemu-tools-debuginfo-2.0.2-48.19.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"qemu-kvm-2.0.2-48.19.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"0\", cpu:\"x86_64\", reference:\"qemu-2.0.2-48.19.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"0\", cpu:\"x86_64\", reference:\"qemu-block-curl-2.0.2-48.19.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"0\", cpu:\"x86_64\", reference:\"qemu-block-curl-debuginfo-2.0.2-48.19.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"0\", cpu:\"x86_64\", reference:\"qemu-debugsource-2.0.2-48.19.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"0\", cpu:\"x86_64\", reference:\"qemu-kvm-2.0.2-48.19.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"0\", cpu:\"x86_64\", reference:\"qemu-tools-2.0.2-48.19.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"0\", cpu:\"x86_64\", reference:\"qemu-tools-debuginfo-2.0.2-48.19.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"0\", cpu:\"x86_64\", reference:\"qemu-x86-2.0.2-48.19.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"0\", cpu:\"x86_64\", reference:\"qemu-x86-debuginfo-2.0.2-48.19.1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"qemu\");\n}\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-26T14:20:32", "description": "xen was updated to fix 36 security issues.\n\nThese security issues were fixed :\n\n - CVE-2013-4527: Buffer overflow in hw/timer/hpet.c might have allowed remote attackers to execute arbitrary code via vectors related to the number of timers (bnc#864673).\n\n - CVE-2013-4529: Buffer overflow in hw/pci/pcie_aer.c allowed remote attackers to cause a denial of service and possibly execute arbitrary code via a large log_num value in a savevm image (bnc#864678).\n\n - CVE-2013-4530: Buffer overflow in hw/ssi/pl022.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via crafted tx_fifo_head and rx_fifo_head values in a savevm image (bnc#864682).\n\n - CVE-2013-4533: Buffer overflow in the pxa2xx_ssp_load function in hw/arm/pxa2xx.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted s->rx_level value in a savevm image (bsc#864655).\n\n - CVE-2013-4534: Buffer overflow in hw/intc/openpic.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via vectors related to IRQDest elements (bsc#864811).\n\n - CVE-2013-4537: The ssi_sd_transfer function in hw/sd/ssi-sd.c allowed remote attackers to execute arbitrary code via a crafted arglen value in a savevm image (bsc#864391).\n\n - CVE-2013-4538: Multiple buffer overflows in the ssd0323_load function in hw/display/ssd0323.c allowed remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via crafted (1) cmd_len, (2) row, or (3) col values; (4) row_start and row_end values; or (5) col_star and col_end values in a savevm image (bsc#864769).\n\n - CVE-2013-4539: Multiple buffer overflows in the tsc210x_load function in hw/input/tsc210x.c might have allowed remote attackers to execute arbitrary code via a crafted (1) precision, (2) nextprecision, (3) function, or (4) nextfunction value in a savevm image (bsc#864805).\n\n - CVE-2014-0222: Integer overflow in the qcow_open function in block/qcow.c allowed remote attackers to cause a denial of service (crash) via a large L2 table in a QCOW version 1 image (bsc#877642).\n\n - CVE-2014-3640: The sosendto function in slirp/udp.c allowed local users to cause a denial of service (NULL pointer dereference) by sending a udp packet with a value of 0 in the source port and address, which triggers access of an uninitialized socket (bsc#897654).\n\n - CVE-2014-3689: The vmware-vga driver (hw/display/vmware_vga.c) allowed local guest users to write to qemu memory locations and gain privileges via unspecified parameters related to rectangle handling (bsc#901508).\n\n - CVE-2014-7815: The set_pixel_format function in ui/vnc.c allowed remote attackers to cause a denial of service (crash) via a small bytes_per_pixel value (bsc#902737).\n\n - CVE-2014-9718: The (1) BMDMA and (2) AHCI HBA interfaces in the IDE functionality had multiple interpretations of a function's return value, which allowed guest OS users to cause a host OS denial of service (memory consumption or infinite loop, and system crash) via a PRDT with zero complete sectors, related to the bmdma_prepare_buf and ahci_dma_prepare_buf functions (bsc#928393).\n\n - CVE-2015-5278: Infinite loop in ne2000_receive() function (bsc#945989).\n\n - CVE-2015-6855: hw/ide/core.c did not properly restrict the commands accepted by an ATAPI device, which allowed guest users to cause a denial of service or possibly have unspecified other impact via certain IDE commands, as demonstrated by a WIN_READ_NATIVE_MAX command to an empty drive, which triggers a divide-by-zero error and instance crash (bsc#945404).\n\n - CVE-2015-7512: Buffer overflow in the pcnet_receive function in hw/net/pcnet.c, when a guest NIC has a larger MTU, allowed remote attackers to cause a denial of service (guest OS crash) or execute arbitrary code via a large packet (bsc#957162).\n\n - CVE-2015-8345: eepro100: infinite loop in processing command block list (bsc#956829).\n\n - CVE-2015-8504: VNC: floating point exception (bsc#958491).\n\n - CVE-2015-8550: Paravirtualized drivers were incautious about shared memory contents (XSA-155) (bsc#957988).\n\n - CVE-2015-8554: qemu-dm buffer overrun in MSI-X handling (XSA-164) (bsc#958007).\n\n - CVE-2015-8555: Information leak in legacy x86 FPU/XMM initialization (XSA-165) (bsc#958009).\n\n - CVE-2015-8558: Infinite loop in ehci_advance_state resulted in DoS (bsc#959005).\n\n - CVE-2015-8743: ne2000: OOB memory access in ioport r/w functions (bsc#960725).\n\n - CVE-2015-8745: Reading IMR registers lead to a crash via assert(2) call (bsc#960707).\n\n - CVE-2016-1568: AHCI use-after-free vulnerability in aio port commands (bsc#961332).\n\n - CVE-2016-1570: The PV superpage functionality in arch/x86/mm.c allowed local PV guests to obtain sensitive information, cause a denial of service, gain privileges, or have unspecified other impact via a crafted page identifier (MFN) to the (1) MMUEXT_MARK_SUPER or (2) MMUEXT_UNMARK_SUPER sub-op in the HYPERVISOR_mmuext_op hypercall or (3) unknown vectors related to page table updates (bsc#960861).\n\n - CVE-2016-1571: VMX: intercept issue with INVLPG on non-canonical address (XSA-168) (bsc#960862).\n\n - CVE-2016-1714: nvram: OOB r/w access in processing firmware configurations (bsc#961691).\n\n - CVE-2016-1981: e1000 infinite loop in start_xmit and e1000_receive_iov routines (bsc#963782).\n\n - CVE-2016-2270: Xen allowed local guest administrators to cause a denial of service (host reboot) via vectors related to multiple mappings of MMIO pages with different cachability settings (bsc#965315).\n\n - CVE-2016-2271: VMX when using an Intel or Cyrix CPU, allowed local HVM guest users to cause a denial of service (guest crash) via vectors related to a non-canonical RIP (bsc#965317).\n\n - CVE-2016-2391: usb: multiple eof_timers in ohci module lead to NULL pointer dereference (bsc#967013).\n\n - CVE-2016-2392: NULL pointer dereference in remote NDIS control message handling (bsc#967012).\n\n - CVE-2016-2538: Integer overflow in remote NDIS control message handling (bsc#967969).\n\n - CVE-2016-2841: ne2000: Infinite loop in ne2000_receive (bsc#969350).\n\n - XSA-166: ioreq handling possibly susceptible to multiple read issue (bsc#958523).\n\nThe update package also includes non-security fixes. See advisory for details.\n\nNote that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"exploitabilityScore": 2.2, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 9.0, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 6.0}, "published": "2016-08-29T00:00:00", "type": "nessus", "title": "SUSE SLES11 Security Update : xen (SUSE-SU-2016:1745-1)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-4527", "CVE-2013-4529", "CVE-2013-4530", "CVE-2013-4533", "CVE-2013-4534", "CVE-2013-4537", "CVE-2013-4538", "CVE-2013-4539", "CVE-2014-0222", "CVE-2014-3640", "CVE-2014-3689", "CVE-2014-7815", "CVE-2014-9718", "CVE-2015-5278", "CVE-2015-6855", "CVE-2015-7512", "CVE-2015-8345", "CVE-2015-8504", "CVE-2015-8550", "CVE-2015-8554", "CVE-2015-8555", "CVE-2015-8558", "CVE-2015-8743", "CVE-2015-8745", "CVE-2016-1568", "CVE-2016-1570", "CVE-2016-1571", "CVE-2016-1714", "CVE-2016-1981", "CVE-2016-2270", "CVE-2016-2271", "CVE-2016-2391", "CVE-2016-2392", "CVE-2016-2538", "CVE-2016-2841"], "modified": "2021-01-19T00:00:00", "cpe": ["p-cpe:/a:novell:suse_linux:xen", "p-cpe:/a:novell:suse_linux:xen-doc-html", "p-cpe:/a:novell:suse_linux:xen-doc-pdf", "p-cpe:/a:novell:suse_linux:xen-kmp-default", "p-cpe:/a:novell:suse_linux:xen-kmp-pae", "p-cpe:/a:novell:suse_linux:xen-libs", "p-cpe:/a:novell:suse_linux:xen-tools", "p-cpe:/a:novell:suse_linux:xen-tools-domU", "cpe:/o:novell:suse_linux:11"], "id": "SUSE_SU-2016-1745-1.NASL", "href": "https://www.tenable.com/plugins/nessus/93177", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from SUSE update advisory SUSE-SU-2016:1745-1.\n# The text itself is copyright (C) SUSE.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(93177);\n script_version(\"2.11\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/19\");\n\n script_cve_id(\"CVE-2013-4527\", \"CVE-2013-4529\", \"CVE-2013-4530\", \"CVE-2013-4533\", \"CVE-2013-4534\", \"CVE-2013-4537\", \"CVE-2013-4538\", \"CVE-2013-4539\", \"CVE-2014-0222\", \"CVE-2014-3640\", \"CVE-2014-3689\", \"CVE-2014-7815\", \"CVE-2014-9718\", \"CVE-2015-5278\", \"CVE-2015-6855\", \"CVE-2015-7512\", \"CVE-2015-8345\", \"CVE-2015-8504\", \"CVE-2015-8550\", \"CVE-2015-8554\", \"CVE-2015-8555\", \"CVE-2015-8558\", \"CVE-2015-8743\", \"CVE-2015-8745\", \"CVE-2016-1568\", \"CVE-2016-1570\", \"CVE-2016-1571\", \"CVE-2016-1714\", \"CVE-2016-1981\", \"CVE-2016-2270\", \"CVE-2016-2271\", \"CVE-2016-2391\", \"CVE-2016-2392\", \"CVE-2016-2538\", \"CVE-2016-2841\");\n script_bugtraq_id(67357, 67483, 70237, 70997, 70998, 73316);\n\n script_name(english:\"SUSE SLES11 Security Update : xen (SUSE-SU-2016:1745-1)\");\n script_summary(english:\"Checks rpm output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\"The remote SUSE host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"xen was updated to fix 36 security issues.\n\nThese security issues were fixed :\n\n - CVE-2013-4527: Buffer overflow in hw/timer/hpet.c might\n have allowed remote attackers to execute arbitrary code\n via vectors related to the number of timers\n (bnc#864673).\n\n - CVE-2013-4529: Buffer overflow in hw/pci/pcie_aer.c\n allowed remote attackers to cause a denial of service\n and possibly execute arbitrary code via a large log_num\n value in a savevm image (bnc#864678).\n\n - CVE-2013-4530: Buffer overflow in hw/ssi/pl022.c allowed\n remote attackers to cause a denial of service or\n possibly execute arbitrary code via crafted tx_fifo_head\n and rx_fifo_head values in a savevm image (bnc#864682).\n\n - CVE-2013-4533: Buffer overflow in the pxa2xx_ssp_load\n function in hw/arm/pxa2xx.c allowed remote attackers to\n cause a denial of service or possibly execute arbitrary\n code via a crafted s->rx_level value in a savevm image\n (bsc#864655).\n\n - CVE-2013-4534: Buffer overflow in hw/intc/openpic.c\n allowed remote attackers to cause a denial of service or\n possibly execute arbitrary code via vectors related to\n IRQDest elements (bsc#864811).\n\n - CVE-2013-4537: The ssi_sd_transfer function in\n hw/sd/ssi-sd.c allowed remote attackers to execute\n arbitrary code via a crafted arglen value in a savevm\n image (bsc#864391).\n\n - CVE-2013-4538: Multiple buffer overflows in the\n ssd0323_load function in hw/display/ssd0323.c allowed\n remote attackers to cause a denial of service (memory\n corruption) or possibly execute arbitrary code via\n crafted (1) cmd_len, (2) row, or (3) col values; (4)\n row_start and row_end values; or (5) col_star and\n col_end values in a savevm image (bsc#864769).\n\n - CVE-2013-4539: Multiple buffer overflows in the\n tsc210x_load function in hw/input/tsc210x.c might have\n allowed remote attackers to execute arbitrary code via a\n crafted (1) precision, (2) nextprecision, (3) function,\n or (4) nextfunction value in a savevm image\n (bsc#864805).\n\n - CVE-2014-0222: Integer overflow in the qcow_open\n function in block/qcow.c allowed remote attackers to\n cause a denial of service (crash) via a large L2 table\n in a QCOW version 1 image (bsc#877642).\n\n - CVE-2014-3640: The sosendto function in slirp/udp.c\n allowed local users to cause a denial of service (NULL\n pointer dereference) by sending a udp packet with a\n value of 0 in the source port and address, which\n triggers access of an uninitialized socket (bsc#897654).\n\n - CVE-2014-3689: The vmware-vga driver\n (hw/display/vmware_vga.c) allowed local guest users to\n write to qemu memory locations and gain privileges via\n unspecified parameters related to rectangle handling\n (bsc#901508).\n\n - CVE-2014-7815: The set_pixel_format function in ui/vnc.c\n allowed remote attackers to cause a denial of service\n (crash) via a small bytes_per_pixel value (bsc#902737).\n\n - CVE-2014-9718: The (1) BMDMA and (2) AHCI HBA interfaces\n in the IDE functionality had multiple interpretations of\n a function's return value, which allowed guest OS users\n to cause a host OS denial of service (memory consumption\n or infinite loop, and system crash) via a PRDT with zero\n complete sectors, related to the bmdma_prepare_buf and\n ahci_dma_prepare_buf functions (bsc#928393).\n\n - CVE-2015-5278: Infinite loop in ne2000_receive()\n function (bsc#945989).\n\n - CVE-2015-6855: hw/ide/core.c did not properly restrict\n the commands accepted by an ATAPI device, which allowed\n guest users to cause a denial of service or possibly\n have unspecified other impact via certain IDE commands,\n as demonstrated by a WIN_READ_NATIVE_MAX command to an\n empty drive, which triggers a divide-by-zero error and\n instance crash (bsc#945404).\n\n - CVE-2015-7512: Buffer overflow in the pcnet_receive\n function in hw/net/pcnet.c, when a guest NIC has a\n larger MTU, allowed remote attackers to cause a denial\n of service (guest OS crash) or execute arbitrary code\n via a large packet (bsc#957162).\n\n - CVE-2015-8345: eepro100: infinite loop in processing\n command block list (bsc#956829).\n\n - CVE-2015-8504: VNC: floating point exception\n (bsc#958491).\n\n - CVE-2015-8550: Paravirtualized drivers were incautious\n about shared memory contents (XSA-155) (bsc#957988).\n\n - CVE-2015-8554: qemu-dm buffer overrun in MSI-X handling\n (XSA-164) (bsc#958007).\n\n - CVE-2015-8555: Information leak in legacy x86 FPU/XMM\n initialization (XSA-165) (bsc#958009).\n\n - CVE-2015-8558: Infinite loop in ehci_advance_state\n resulted in DoS (bsc#959005).\n\n - CVE-2015-8743: ne2000: OOB memory access in ioport r/w\n functions (bsc#960725).\n\n - CVE-2015-8745: Reading IMR registers lead to a crash via\n assert(2) call (bsc#960707).\n\n - CVE-2016-1568: AHCI use-after-free vulnerability in aio\n port commands (bsc#961332).\n\n - CVE-2016-1570: The PV superpage functionality in\n arch/x86/mm.c allowed local PV guests to obtain\n sensitive information, cause a denial of service, gain\n privileges, or have unspecified other impact via a\n crafted page identifier (MFN) to the (1)\n MMUEXT_MARK_SUPER or (2) MMUEXT_UNMARK_SUPER sub-op in\n the HYPERVISOR_mmuext_op hypercall or (3) unknown\n vectors related to page table updates (bsc#960861).\n\n - CVE-2016-1571: VMX: intercept issue with INVLPG on\n non-canonical address (XSA-168) (bsc#960862).\n\n - CVE-2016-1714: nvram: OOB r/w access in processing\n firmware configurations (bsc#961691).\n\n - CVE-2016-1981: e1000 infinite loop in start_xmit and\n e1000_receive_iov routines (bsc#963782).\n\n - CVE-2016-2270: Xen allowed local guest administrators to\n cause a denial of service (host reboot) via vectors\n related to multiple mappings of MMIO pages with\n different cachability settings (bsc#965315).\n\n - CVE-2016-2271: VMX when using an Intel or Cyrix CPU,\n allowed local HVM guest users to cause a denial of\n service (guest crash) via vectors related to a\n non-canonical RIP (bsc#965317).\n\n - CVE-2016-2391: usb: multiple eof_timers in ohci module\n lead to NULL pointer dereference (bsc#967013).\n\n - CVE-2016-2392: NULL pointer dereference in remote NDIS\n control message handling (bsc#967012).\n\n - CVE-2016-2538: Integer overflow in remote NDIS control\n message handling (bsc#967969).\n\n - CVE-2016-2841: ne2000: Infinite loop in ne2000_receive\n (bsc#969350).\n\n - XSA-166: ioreq handling possibly susceptible to multiple\n read issue (bsc#958523).\n\nThe update package also includes non-security fixes. See advisory for\ndetails.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=864391\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=864655\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=864673\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=864678\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=864682\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=864769\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=864805\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=864811\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=877642\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=897654\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=901508\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=902737\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=928393\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=945404\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=945989\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=954872\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=956829\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=957162\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=957988\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=958007\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=958009\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=958491\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=958523\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=959005\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=959695\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=959928\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=960707\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=960725\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=960861\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=960862\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=961332\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=961691\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=963782\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=965315\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=965317\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=967012\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=967013\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=967630\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=967969\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=969350\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2013-4527/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2013-4529/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2013-4530/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2013-4533/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2013-4534/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2013-4537/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2013-4538/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2013-4539/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2014-0222/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2014-3640/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2014-3689/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2014-7815/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2014-9718/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-5278/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-6855/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-7512/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8345/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8504/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8550/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8554/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8555/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8558/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8743/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8745/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-1568/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-1570/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-1571/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-1714/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-1981/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-2270/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-2271/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-2391/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-2392/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-2538/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-2841/\"\n );\n # https://www.suse.com/support/update/announcement/2016/suse-su-20161745-1/\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?42a78103\"\n );\n script_set_attribute(\n attribute:\"solution\",\n value:\n\"To install this SUSE Security Update use YaST online_update.\nAlternatively you can run the command listed for your product :\n\nSUSE Linux Enterprise Server 11-SP3-LTSS :\n\nzypper in -t patch slessp3-xen-12639=1\n\nSUSE Linux Enterprise Debuginfo 11-SP3 :\n\nzypper in -t patch dbgsp3-xen-12639=1\n\nTo bring your system up-to-date, use 'zypper patch'.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:xen\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:xen-doc-html\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:xen-doc-pdf\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:xen-kmp-default\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:xen-kmp-pae\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:xen-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:xen-tools\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:xen-tools-domU\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:11\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2014/11/04\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/07/05\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/08/29\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nos_ver = pregmatch(pattern: \"^(SLE(S|D)\\d+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"SUSE\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLES11)$\", string:os_ver)) audit(AUDIT_OS_NOT, \"SUSE SLES11\", \"SUSE \" + os_ver);\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^i[3-6]86$\" && \"x86_64\" >!< cpu && \"s390x\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"SUSE \" + os_ver, cpu);\nif (cpu >!< \"i386|i486|i586|i686|x86_64\") audit(AUDIT_ARCH_NOT, \"i386 / i486 / i586 / i686 / x86_64\", cpu);\n\n\nsp = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(sp)) sp = \"0\";\nif (os_ver == \"SLES11\" && (! preg(pattern:\"^(3)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLES11 SP3\", os_ver + \" SP\" + sp);\n\n\nflag = 0;\nif (rpm_check(release:\"SLES11\", sp:\"3\", cpu:\"x86_64\", reference:\"xen-kmp-default-4.2.5_20_3.0.101_0.47.79-24.9\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"3\", cpu:\"x86_64\", reference:\"xen-libs-4.2.5_20-24.9\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"3\", cpu:\"x86_64\", reference:\"xen-tools-domU-4.2.5_20-24.9\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"3\", cpu:\"x86_64\", reference:\"xen-4.2.5_20-24.9\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"3\", cpu:\"x86_64\", reference:\"xen-doc-html-4.2.5_20-24.9\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"3\", cpu:\"x86_64\", reference:\"xen-doc-pdf-4.2.5_20-24.9\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"3\", cpu:\"x86_64\", reference:\"xen-libs-32bit-4.2.5_20-24.9\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"3\", cpu:\"x86_64\", reference:\"xen-tools-4.2.5_20-24.9\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"3\", cpu:\"x86_64\", reference:\"xen-kmp-pae-4.2.5_20_3.0.101_0.47.79-24.9\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"3\", cpu:\"i586\", reference:\"xen-kmp-default-4.2.5_20_3.0.101_0.47.79-24.9\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"3\", cpu:\"i586\", reference:\"xen-libs-4.2.5_20-24.9\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"3\", cpu:\"i586\", reference:\"xen-tools-domU-4.2.5_20-24.9\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"3\", cpu:\"i586\", reference:\"xen-kmp-pae-4.2.5_20_3.0.101_0.47.79-24.9\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"xen\");\n}\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-01-11T16:34:09", "description": "xen was updated to fix 44 security issues.\n\nThese security issues were fixed :\n\n - CVE-2013-4533: Buffer overflow in the pxa2xx_ssp_load function in hw/arm/pxa2xx.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted s->rx_level value in a savevm image (bsc#864655).\n\n - CVE-2013-4534: Buffer overflow in hw/intc/openpic.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via vectors related to IRQDest elements (bsc#864811).\n\n - CVE-2013-4537: The ssi_sd_transfer function in hw/sd/ssi-sd.c allowed remote attackers to execute arbitrary code via a crafted arglen value in a savevm image (bsc#864391).\n\n - CVE-2013-4538: Multiple buffer overflows in the ssd0323_load function in hw/display/ssd0323.c allowed remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via crafted (1) cmd_len, (2) row, or (3) col values; (4) row_start and row_end values; or (5) col_star and col_end values in a savevm image (bsc#864769).\n\n - CVE-2013-4539: Multiple buffer overflows in the tsc210x_load function in hw/input/tsc210x.c might have allowed remote attackers to execute arbitrary code via a crafted (1) precision, (2) nextprecision, (3) function, or (4) nextfunction value in a savevm image (bsc#864805).\n\n - CVE-2014-0222: Integer overflow in the qcow_open function in block/qcow.c allowed remote attackers to cause a denial of service (crash) via a large L2 table in a QCOW version 1 image (bsc#877642).\n\n - CVE-2014-3640: The sosendto function in slirp/udp.c allowed local users to cause a denial of service (NULL pointer dereference) by sending a udp packet with a value of 0 in the source port and address, which triggers access of an uninitialized socket (bsc#897654).\n\n - CVE-2014-3689: The vmware-vga driver (hw/display/vmware_vga.c) allowed local guest users to write to qemu memory locations and gain privileges via unspecified parameters related to rectangle handling (bsc#901508).\n\n - CVE-2014-7815: The set_pixel_format function in ui/vnc.c allowed remote attackers to cause a denial of service (crash) via a small bytes_per_pixel value (bsc#902737).\n\n - CVE-2014-9718: The (1) BMDMA and (2) AHCI HBA interfaces in the IDE functionality had multiple interpretations of a function's return value, which allowed guest OS users to cause a host OS denial of service (memory consumption or infinite loop, and system crash) via a PRDT with zero complete sectors, related to the bmdma_prepare_buf and ahci_dma_prepare_buf functions (bsc#928393).\n\n - CVE-2015-1779: The VNC websocket frame decoder allowed remote attackers to cause a denial of service (memory and CPU consumption) via a large (1) websocket payload or (2) HTTP headers section (bsc#924018).\n\n - CVE-2015-5278: Infinite loop in ne2000_receive() function (bsc#945989).\n\n - CVE-2015-6855: hw/ide/core.c did not properly restrict the commands accepted by an ATAPI device, which allowed guest users to cause a denial of service or possibly have unspecified other impact via certain IDE commands, as demonstrated by a WIN_READ_NATIVE_MAX command to an empty drive, which triggers a divide-by-zero error and instance crash (bsc#945404).\n\n - CVE-2015-7512: Buffer overflow in the pcnet_receive function in hw/net/pcnet.c, when a guest NIC has a larger MTU, allowed remote attackers to cause a denial of service (guest OS crash) or execute arbitrary code via a large packet (bsc#957162).\n\n - CVE-2015-7549: pci: NULL pointer dereference issue (bsc#958917).\n\n - CVE-2015-8345: eepro100: infinite loop in processing command block list (bsc#956829).\n\n - CVE-2015-8504: VNC: floating point exception (bsc#958491).\n\n - CVE-2015-8550: Paravirtualized drivers were incautious about shared memory contents (XSA-155) (bsc#957988).\n\n - CVE-2015-8554: qemu-dm buffer overrun in MSI-X handling (XSA-164) (bsc#958007).\n\n - CVE-2015-8555: Information leak in legacy x86 FPU/XMM initialization (XSA-165) (bsc#958009).\n\n - CVE-2015-8558: Infinite loop in ehci_advance_state resulted in DoS (bsc#959005).\n\n - CVE-2015-8567: vmxnet3: host memory leakage (bsc#959387).\n\n - CVE-2015-8568: vmxnet3: host memory leakage (bsc#959387).\n\n - CVE-2015-8613: SCSI: stack-based buffer overflow in megasas_ctrl_get_info (bsc#961358).\n\n - CVE-2015-8619: Stack based OOB write in hmp_sendkey routine (bsc#960334).\n\n - CVE-2015-8743: ne2000: OOB memory access in ioport r/w functions (bsc#960725).\n\n - CVE-2015-8744: vmxnet3: Incorrect l2 header validation lead to a crash via assert(2) call (bsc#960835).\n\n - CVE-2015-8745: Reading IMR registers lead to a crash via assert(2) call (bsc#960707).\n\n - CVE-2015-8817: OOB access in address_space_rw lead to segmentation fault (I) (bsc#969121).\n\n - CVE-2015-8818: OOB access in address_space_rw lead to segmentation fault (II) (bsc#969122).\n\n - CVE-2016-1568: AHCI use-after-free vulnerability in aio port commands (bsc#961332).\n\n - CVE-2016-1570: The PV superpage functionality in arch/x86/mm.c allowed local PV guests to obtain sensitive information, cause a denial of service, gain privileges, or have unspecified other impact via a crafted page identifier (MFN) to the (1) MMUEXT_MARK_SUPER or (2) MMUEXT_UNMARK_SUPER sub-op in the HYPERVISOR_mmuext_op hypercall or (3) unknown vectors related to page table updates (bsc#960861).\n\n - CVE-2016-1571: VMX: intercept issue with INVLPG on non-canonical address (XSA-168) (bsc#960862).\n\n - CVE-2016-1714: nvram: OOB r/w access in processing firmware configurations (bsc#961691).\n\n - CVE-2016-1922: NULL pointer dereference in vapic_write() (bsc#962320).\n\n - CVE-2016-1981: e1000 infinite loop in start_xmit and e1000_receive_iov routines (bsc#963782).\n\n - CVE-2016-2198: EHCI NULL pointer dereference in ehci_caps_write (bsc#964413).\n\n - CVE-2016-2270: Xen allowed local guest administrators to cause a denial of service (host reboot) via vectors related to multiple mappings of MMIO pages with different cachability settings (bsc#965315).\n\n - CVE-2016-2271: VMX when using an Intel or Cyrix CPU, allowed local HVM guest users to cause a denial of service (guest crash) via vectors related to a non-canonical RIP (bsc#965317).\n\n - CVE-2016-2391: usb: multiple eof_timers in ohci module lead to NULL pointer dereference (bsc#967013).\n\n - CVE-2016-2392: NULL pointer dereference in remote NDIS control message handling (bsc#967012).\n\n - CVE-2016-2538: Integer overflow in remote NDIS control message handling (bsc#967969).\n\n - CVE-2016-2841: ne2000: Infinite loop in ne2000_receive (bsc#969350).\n\n - XSA-166: ioreq handling possibly susceptible to multiple read issue (bsc#958523).\n\nThe update package also includes non-security fixes. See advisory for details.\n\nNote that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"exploitabilityScore": 2.2, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 9.0, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 6.0}, "published": "2016-03-25T00:00:00", "type": "nessus", "title": "SUSE SLED12 / SLES12 Security Update : xen (SUSE-SU-2016:0873-1)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "COMPLETE", "integrityImpact": "NONE", "baseScore": 7.8, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-4533", "CVE-2013-4534", "CVE-2013-4537", "CVE-2013-4538", "CVE-2013-4539", "CVE-2014-0222", "CVE-2014-3640", "CVE-2014-3689", "CVE-2014-7815", "CVE-2014-9718", "CVE-2015-1779", "CVE-2015-5278", "CVE-2015-6855", "CVE-2015-7512", "CVE-2015-7549", "CVE-2015-8345", "CVE-2015-8504", "CVE-2015-8550", "CVE-2015-8554", "CVE-2015-8555", "CVE-2015-8558", "CVE-2015-8567", "CVE-2015-8568", "CVE-2015-8613", "CVE-2015-8619", "CVE-2015-8743", "CVE-2015-8744", "CVE-2015-8745", "CVE-2015-8817", "CVE-2015-8818", "CVE-2016-1568", "CVE-2016-1570", "CVE-2016-1571", "CVE-2016-1714", "CVE-2016-1922", "CVE-2016-1981", "CVE-2016-2198", "CVE-2016-2270", "CVE-2016-2271", "CVE-2016-2391", "CVE-2016-2392", "CVE-2016-2538", "CVE-2016-2841"], "modified": "2021-01-06T00:00:00", "cpe": ["p-cpe:/a:novell:suse_linux:xen", "p-cpe:/a:novell:suse_linux:xen-debugsource", "p-cpe:/a:novell:suse_linux:xen-doc-html", "p-cpe:/a:novell:suse_linux:xen-kmp-default", "p-cpe:/a:novell:suse_linux:xen-kmp-default-debuginfo", "p-cpe:/a:novell:suse_linux:xen-libs", "p-cpe:/a:novell:suse_linux:xen-libs-debuginfo", "p-cpe:/a:novell:suse_linux:xen-tools", "p-cpe:/a:novell:suse_linux:xen-tools-debuginfo", "p-cpe:/a:novell:suse_linux:xen-tools-domU", "p-cpe:/a:novell:suse_linux:xen-tools-domU-debuginfo", "cpe:/o:novell:suse_linux:12"], "id": "SUSE_SU-2016-0873-1.NASL", "href": "https://www.tenable.com/plugins/nessus/90186", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from SUSE update advisory SUSE-SU-2016:0873-1.\n# The text itself is copyright (C) SUSE.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(90186);\n script_version(\"2.13\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2013-4533\", \"CVE-2013-4534\", \"CVE-2013-4537\", \"CVE-2013-4538\", \"CVE-2013-4539\", \"CVE-2014-0222\", \"CVE-2014-3640\", \"CVE-2014-3689\", \"CVE-2014-7815\", \"CVE-2014-9718\", \"CVE-2015-1779\", \"CVE-2015-5278\", \"CVE-2015-6855\", \"CVE-2015-7512\", \"CVE-2015-7549\", \"CVE-2015-8345\", \"CVE-2015-8504\", \"CVE-2015-8550\", \"CVE-2015-8554\", \"CVE-2015-8555\", \"CVE-2015-8558\", \"CVE-2015-8567\", \"CVE-2015-8568\", \"CVE-2015-8613\", \"CVE-2015-8619\", \"CVE-2015-8743\", \"CVE-2015-8744\", \"CVE-2015-8745\", \"CVE-2015-8817\", \"CVE-2015-8818\", \"CVE-2016-1568\", \"CVE-2016-1570\", \"CVE-2016-1571\", \"CVE-2016-1714\", \"CVE-2016-1922\", \"CVE-2016-1981\", \"CVE-2016-2198\", \"CVE-2016-2270\", \"CVE-2016-2271\", \"CVE-2016-2391\", \"CVE-2016-2392\", \"CVE-2016-2538\", \"CVE-2016-2841\");\n script_bugtraq_id(67357, 67483, 70237, 70997, 70998, 73303, 73316);\n\n script_name(english:\"SUSE SLED12 / SLES12 Security Update : xen (SUSE-SU-2016:0873-1)\");\n script_summary(english:\"Checks rpm output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\"The remote SUSE host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"xen was updated to fix 44 security issues.\n\nThese security issues were fixed :\n\n - CVE-2013-4533: Buffer overflow in the pxa2xx_ssp_load\n function in hw/arm/pxa2xx.c allowed remote attackers to\n cause a denial of service or possibly execute arbitrary\n code via a crafted s->rx_level value in a savevm image\n (bsc#864655).\n\n - CVE-2013-4534: Buffer overflow in hw/intc/openpic.c\n allowed remote attackers to cause a denial of service or\n possibly execute arbitrary code via vectors related to\n IRQDest elements (bsc#864811).\n\n - CVE-2013-4537: The ssi_sd_transfer function in\n hw/sd/ssi-sd.c allowed remote attackers to execute\n arbitrary code via a crafted arglen value in a savevm\n image (bsc#864391).\n\n - CVE-2013-4538: Multiple buffer overflows in the\n ssd0323_load function in hw/display/ssd0323.c allowed\n remote attackers to cause a denial of service (memory\n corruption) or possibly execute arbitrary code via\n crafted (1) cmd_len, (2) row, or (3) col values; (4)\n row_start and row_end values; or (5) col_star and\n col_end values in a savevm image (bsc#864769).\n\n - CVE-2013-4539: Multiple buffer overflows in the\n tsc210x_load function in hw/input/tsc210x.c might have\n allowed remote attackers to execute arbitrary code via a\n crafted (1) precision, (2) nextprecision, (3) function,\n or (4) nextfunction value in a savevm image\n (bsc#864805).\n\n - CVE-2014-0222: Integer overflow in the qcow_open\n function in block/qcow.c allowed remote attackers to\n cause a denial of service (crash) via a large L2 table\n in a QCOW version 1 image (bsc#877642).\n\n - CVE-2014-3640: The sosendto function in slirp/udp.c\n allowed local users to cause a denial of service (NULL\n pointer dereference) by sending a udp packet with a\n value of 0 in the source port and address, which\n triggers access of an uninitialized socket (bsc#897654).\n\n - CVE-2014-3689: The vmware-vga driver\n (hw/display/vmware_vga.c) allowed local guest users to\n write to qemu memory locations and gain privileges via\n unspecified parameters related to rectangle handling\n (bsc#901508).\n\n - CVE-2014-7815: The set_pixel_format function in ui/vnc.c\n allowed remote attackers to cause a denial of service\n (crash) via a small bytes_per_pixel value (bsc#902737).\n\n - CVE-2014-9718: The (1) BMDMA and (2) AHCI HBA interfaces\n in the IDE functionality had multiple interpretations of\n a function's return value, which allowed guest OS users\n to cause a host OS denial of service (memory consumption\n or infinite loop, and system crash) via a PRDT with zero\n complete sectors, related to the bmdma_prepare_buf and\n ahci_dma_prepare_buf functions (bsc#928393).\n\n - CVE-2015-1779: The VNC websocket frame decoder allowed\n remote attackers to cause a denial of service (memory\n and CPU consumption) via a large (1) websocket payload\n or (2) HTTP headers section (bsc#924018).\n\n - CVE-2015-5278: Infinite loop in ne2000_receive()\n function (bsc#945989).\n\n - CVE-2015-6855: hw/ide/core.c did not properly restrict\n the commands accepted by an ATAPI device, which allowed\n guest users to cause a denial of service or possibly\n have unspecified other impact via certain IDE commands,\n as demonstrated by a WIN_READ_NATIVE_MAX command to an\n empty drive, which triggers a divide-by-zero error and\n instance crash (bsc#945404).\n\n - CVE-2015-7512: Buffer overflow in the pcnet_receive\n function in hw/net/pcnet.c, when a guest NIC has a\n larger MTU, allowed remote attackers to cause a denial\n of service (guest OS crash) or execute arbitrary code\n via a large packet (bsc#957162).\n\n - CVE-2015-7549: pci: NULL pointer dereference issue\n (bsc#958917).\n\n - CVE-2015-8345: eepro100: infinite loop in processing\n command block list (bsc#956829).\n\n - CVE-2015-8504: VNC: floating point exception\n (bsc#958491).\n\n - CVE-2015-8550: Paravirtualized drivers were incautious\n about shared memory contents (XSA-155) (bsc#957988).\n\n - CVE-2015-8554: qemu-dm buffer overrun in MSI-X handling\n (XSA-164) (bsc#958007).\n\n - CVE-2015-8555: Information leak in legacy x86 FPU/XMM\n initialization (XSA-165) (bsc#958009).\n\n - CVE-2015-8558: Infinite loop in ehci_advance_state\n resulted in DoS (bsc#959005).\n\n - CVE-2015-8567: vmxnet3: host memory leakage\n (bsc#959387).\n\n - CVE-2015-8568: vmxnet3: host memory leakage\n (bsc#959387).\n\n - CVE-2015-8613: SCSI: stack-based buffer overflow in\n megasas_ctrl_get_info (bsc#961358).\n\n - CVE-2015-8619: Stack based OOB write in hmp_sendkey\n routine (bsc#960334).\n\n - CVE-2015-8743: ne2000: OOB memory access in ioport r/w\n functions (bsc#960725).\n\n - CVE-2015-8744: vmxnet3: Incorrect l2 header validation\n lead to a crash via assert(2) call (bsc#960835).\n\n - CVE-2015-8745: Reading IMR registers lead to a crash via\n assert(2) call (bsc#960707).\n\n - CVE-2015-8817: OOB access in address_space_rw lead to\n segmentation fault (I) (bsc#969121).\n\n - CVE-2015-8818: OOB access in address_space_rw lead to\n segmentation fault (II) (bsc#969122).\n\n - CVE-2016-1568: AHCI use-after-free vulnerability in aio\n port commands (bsc#961332).\n\n - CVE-2016-1570: The PV superpage functionality in\n arch/x86/mm.c allowed local PV guests to obtain\n sensitive information, cause a denial of service, gain\n privileges, or have unspecified other impact via a\n crafted page identifier (MFN) to the (1)\n MMUEXT_MARK_SUPER or (2) MMUEXT_UNMARK_SUPER sub-op in\n the HYPERVISOR_mmuext_op hypercall or (3) unknown\n vectors related to page table updates (bsc#960861).\n\n - CVE-2016-1571: VMX: intercept issue with INVLPG on\n non-canonical address (XSA-168) (bsc#960862).\n\n - CVE-2016-1714: nvram: OOB r/w access in processing\n firmware configurations (bsc#961691).\n\n - CVE-2016-1922: NULL pointer dereference in vapic_write()\n (bsc#962320).\n\n - CVE-2016-1981: e1000 infinite loop in start_xmit and\n e1000_receive_iov routines (bsc#963782).\n\n - CVE-2016-2198: EHCI NULL pointer dereference in\n ehci_caps_write (bsc#964413).\n\n - CVE-2016-2270: Xen allowed local guest administrators to\n cause a denial of service (host reboot) via vectors\n related to multiple mappings of MMIO pages with\n different cachability settings (bsc#965315).\n\n - CVE-2016-2271: VMX when using an Intel or Cyrix CPU,\n allowed local HVM guest users to cause a denial of\n service (guest crash) via vectors related to a\n non-canonical RIP (bsc#965317).\n\n - CVE-2016-2391: usb: multiple eof_timers in ohci module\n lead to NULL pointer dereference (bsc#967013).\n\n - CVE-2016-2392: NULL pointer dereference in remote NDIS\n control message handling (bsc#967012).\n\n - CVE-2016-2538: Integer overflow in remote NDIS control\n message handling (bsc#967969).\n\n - CVE-2016-2841: ne2000: Infinite loop in ne2000_receive\n (bsc#969350).\n\n - XSA-166: ioreq handling possibly susceptible to multiple\n read issue (bsc#958523).\n\nThe update package also includes non-security fixes. See advisory for\ndetails.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=864391\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=864655\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=864769\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=864805\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=864811\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=877642\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=897654\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=901508\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=902737\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=924018\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=928393\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=945404\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=945989\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=954872\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=956829\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=957162\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=957698\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=957988\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=958007\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=958009\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=958491\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=958523\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=958917\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=959005\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=959332\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=959387\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=959695\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=960334\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=960707\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=960725\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=960835\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=960861\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=960862\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=961332\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=961358\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=961691\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=962320\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=963782\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=963923\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=964413\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=965315\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=965317\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=967012\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=967013\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=967969\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=969121\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=969122\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=969350\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2013-4533/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2013-4534/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2013-4537/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2013-4538/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2013-4539/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2014-0222/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2014-3640/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2014-3689/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2014-7815/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2014-9718/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-1779/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-5278/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-6855/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-7512/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-7549/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8345/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8504/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8550/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8554/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8555/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8558/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8567/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8568/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8613/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8619/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8743/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8744/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8745/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8817/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8818/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-1568/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-1570/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-1571/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-1714/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-1922/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-1981/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-2198/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-2270/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-2271/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-2391/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-2392/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-2538/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-2841/\"\n );\n # https://www.suse.com/support/update/announcement/2016/suse-su-20160873-1/\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?436e8f55\"\n );\n script_set_attribute(\n attribute:\"solution\",\n value:\n\"To install this SUSE Security Update use YaST online_update.\nAlternatively you can run the command listed for your product :\n\nSUSE Linux Enterprise Software Development Kit 12-SP1 :\n\nzypper in -t patch SUSE-SLE-SDK-12-SP1-2016-508=1\n\nSUSE Linux Enterprise Server 12-SP1 :\n\nzypper in -t patch SUSE-SLE-SERVER-12-SP1-2016-508=1\n\nSUSE Linux Enterprise Desktop 12-SP1 :\n\nzypper in -t patch SUSE-SLE-DESKTOP-12-SP1-2016-508=1\n\nTo bring your system up-to-date, use 'zypper patch'.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:xen\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:xen-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:xen-doc-html\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:xen-kmp-default\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:xen-kmp-default-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:xen-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:xen-libs-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:xen-tools\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:xen-tools-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:xen-tools-domU\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:xen-tools-domU-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:12\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2014/11/04\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/03/24\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/03/25\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nos_ver = pregmatch(pattern: \"^(SLE(S|D)\\d+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"SUSE\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLED12|SLES12)$\", string:os_ver)) audit(AUDIT_OS_NOT, \"SUSE SLED12 / SLES12\", \"SUSE \" + os_ver);\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^i[3-6]86$\" && \"x86_64\" >!< cpu && \"s390x\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"SUSE \" + os_ver, cpu);\nif (cpu >!< \"x86_64\") audit(AUDIT_ARCH_NOT, \"x86_64\", cpu);\n\n\nsp = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(sp)) sp = \"0\";\nif (os_ver == \"SLES12\" && (! preg(pattern:\"^(1)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLES12 SP1\", os_ver + \" SP\" + sp);\nif (os_ver == \"SLED12\" && (! preg(pattern:\"^(1)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLED12 SP1\", os_ver + \" SP\" + sp);\n\n\nflag = 0;\nif (rpm_check(release:\"SLES12\", sp:\"1\", cpu:\"x86_64\", reference:\"xen-4.5.2_06-7.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", cpu:\"x86_64\", reference:\"xen-debugsource-4.5.2_06-7.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", cpu:\"x86_64\", reference:\"xen-doc-html-4.5.2_06-7.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", cpu:\"x86_64\", reference:\"xen-kmp-default-4.5.2_06_k3.12.53_60.30-7.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", cpu:\"x86_64\", reference:\"xen-kmp-default-debuginfo-4.5.2_06_k3.12.53_60.30-7.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", cpu:\"x86_64\", reference:\"xen-libs-32bit-4.5.2_06-7.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", cpu:\"x86_64\", reference:\"xen-libs-4.5.2_06-7.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", cpu:\"x86_64\", reference:\"xen-libs-debuginfo-32bit-4.5.2_06-7.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", cpu:\"x86_64\", reference:\"xen-libs-debuginfo-4.5.2_06-7.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", cpu:\"x86_64\", reference:\"xen-tools-4.5.2_06-7.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", cpu:\"x86_64\", reference:\"xen-tools-debuginfo-4.5.2_06-7.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", cpu:\"x86_64\", reference:\"xen-tools-domU-4.5.2_06-7.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", cpu:\"x86_64\", reference:\"xen-tools-domU-debuginfo-4.5.2_06-7.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"1\", cpu:\"x86_64\", reference:\"xen-4.5.2_06-7.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"1\", cpu:\"x86_64\", reference:\"xen-debugsource-4.5.2_06-7.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"1\", cpu:\"x86_64\", reference:\"xen-kmp-default-4.5.2_06_k3.12.53_60.30-7.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"1\", cpu:\"x86_64\", reference:\"xen-kmp-default-debuginfo-4.5.2_06_k3.12.53_60.30-7.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"1\", cpu:\"x86_64\", reference:\"xen-libs-32bit-4.5.2_06-7.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"1\", cpu:\"x86_64\", reference:\"xen-libs-4.5.2_06-7.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"1\", cpu:\"x86_64\", reference:\"xen-libs-debuginfo-32bit-4.5.2_06-7.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"1\", cpu:\"x86_64\", reference:\"xen-libs-debuginfo-4.5.2_06-7.1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"xen\");\n}\n", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2023-01-11T16:37:48", "description": "xen was updated to fix 46 security issues.\n\nThese security issues were fixed :\n\n - CVE-2013-4527: Buffer overflow in hw/timer/hpet.c might have allowed remote attackers to execute arbitrary code via vectors related to the number of timers (bsc#964746).\n\n - CVE-2013-4529: Buffer overflow in hw/pci/pcie_aer.c allowed remote attackers to cause a denial of service and possibly execute arbitrary code via a large log_num value in a savevm image (bsc#964929).\n\n - CVE-2013-4530: Buffer overflow in hw/ssi/pl022.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via crafted tx_fifo_head and rx_fifo_head values in a savevm image (bsc#964950).\n\n - CVE-2013-4533: Buffer overflow in the pxa2xx_ssp_load function in hw/arm/pxa2xx.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted s->rx_level value in a savevm image (bsc#964644).\n\n - CVE-2013-4534: Buffer overflow in hw/intc/openpic.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via vectors related to IRQDest elements (bsc#964452).\n\n - CVE-2013-4537: The ssi_sd_transfer function in hw/sd/ssi-sd.c allowed remote attackers to execute arbitrary code via a crafted arglen value in a savevm image (bsc#962642).\n\n - CVE-2013-4538: Multiple buffer overflows in the ssd0323_load function in hw/display/ssd0323.c allowed remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via crafted (1) cmd_len, (2) row, or (3) col values; (4) row_start and row_end values; or (5) col_star and col_end values in a savevm image (bsc#962335).\n\n - CVE-2013-4539: Multiple buffer overflows in the tsc210x_load function in hw/input/tsc210x.c might have allowed remote attackers to execute arbitrary code via a crafted (1) precision, (2) nextprecision, (3) function, or (4) nextfunction value in a savevm image (bsc#962758).\n\n - CVE-2014-0222: Integer overflow in the qcow_open function in block/qcow.c allowed remote attackers to cause a denial of service (crash) via a large L2 table in a QCOW version 1 image (bsc#964925).\n\n - CVE-2014-3640: The sosendto function in slirp/udp.c allowed local users to cause a denial of service (NULL pointer dereference) by sending a udp packet with a value of 0 in the source port and address, which triggers access of an uninitialized socket (bsc#965112).\n\n - CVE-2014-3689: The vmware-vga driver (hw/display/vmware_vga.c) allowed local guest users to write to qemu memory locations and gain privileges via unspecified parameters related to rectangle handling (bsc#962611).\n\n - CVE-2014-7815: The set_pixel_format function in ui/vnc.c allowed remote attackers to cause a denial of service (crash) via a small bytes_per_pixel value (bsc#962627).\n\n - CVE-2014-9718: The (1) BMDMA and (2) AHCI HBA interfaces in the IDE functionality had multiple interpretations of a function's return value, which allowed guest OS users to cause a host OS denial of service (memory consumption or infinite loop, and system crash) via a PRDT with zero complete sectors, related to the bmdma_prepare_buf and ahci_dma_prepare_buf functions (bsc#964431).\n\n - CVE-2015-1779: The VNC websocket frame decoder allowed remote attackers to cause a denial of service (memory and CPU consumption) via a large (1) websocket payload or (2) HTTP headers section (bsc#962632).\n\n - CVE-2015-5278: Infinite loop in ne2000_receive() function (bsc#964947).\n\n - CVE-2015-6855: hw/ide/core.c did not properly restrict the commands accepted by an ATAPI device, which allowed guest users to cause a denial of service or possibly have unspecified other impact via certain IDE commands, as demonstrated by a WIN_READ_NATIVE_MAX command to an empty drive, which triggers a divide-by-zero error and instance crash (bsc#965156).\n\n - CVE-2015-7512: Buffer overflow in the pcnet_receive function in hw/net/pcnet.c, when a guest NIC has a larger MTU, allowed remote attackers to cause a denial of service (guest OS crash) or execute arbitrary code via a large packet (bsc#962360).\n\n - CVE-2015-7549: pci: NULL pointer dereference issue (bsc#958918).\n\n - CVE-2015-8345: eepro100: infinite loop in processing command block list (bsc#956832).\n\n - CVE-2015-8504: VNC: floating point exception (bsc#958493).\n\n - CVE-2015-8550: Paravirtualized drivers were incautious about shared memory contents (XSA-155) (bsc#957988).\n\n - CVE-2015-8554: qemu-dm buffer overrun in MSI-X handling (XSA-164) (bsc#958007).\n\n - CVE-2015-8555: Information leak in legacy x86 FPU/XMM initialization (XSA-165) (bsc#958009).\n\n - CVE-2015-8558: Infinite loop in ehci_advance_state resulted in DoS (bsc#959006).\n\n - CVE-2015-8567: vmxnet3: host memory leakage (bsc#959387).\n\n - CVE-2015-8568: vmxnet3: host memory leakage (bsc#959387).\n\n - CVE-2015-8613: SCSI: stack-based buffer overflow in megasas_ctrl_get_info (bsc#961358).\n\n - CVE-2015-8619: Stack based OOB write in hmp_sendkey routine (bsc#965269).\n\n - CVE-2015-8743: ne2000: OOB memory access in ioport r/w functions (bsc#960726).\n\n - CVE-2015-8744: vmxnet3: Incorrect l2 header validation lead to a crash via assert(2) call (bsc#960836).\n\n - CVE-2015-8745: Reading IMR registers lead to a crash via assert(2) call (bsc#960707).\n\n - CVE-2015-8817: OOB access in address_space_rw lead to segmentation fault (I) (bsc#969125).\n\n - CVE-2015-8818: OOB access in address_space_rw lead to segmentation fault (II) (bsc#969126).\n\n - CVE-2016-1568: AHCI use-after-free vulnerability in aio port commands (bsc#961332).\n\n - CVE-2016-1570: The PV superpage functionality in arch/x86/mm.c allowed local PV guests to obtain sensitive information, cause a denial of service, gain privileges, or have unspecified other impact via a crafted page identifier (MFN) to the (1) MMUEXT_MARK_SUPER or (2) MMUEXT_UNMARK_SUPER sub-op in the HYPERVISOR_mmuext_op hypercall or (3) unknown vectors related to page table updates (bsc#960861).\n\n - CVE-2016-1571: VMX: intercept issue with INVLPG on non-canonical address (XSA-168) (bsc#960862).\n\n - CVE-2016-1714: nvram: OOB r/w access in processing firmware configurations (bsc#961692).\n\n - CVE-2016-1922: NULL pointer dereference in vapic_write() (bsc#962321).\n\n - CVE-2016-1981: e1000 infinite loop in start_xmit and e1000_receive_iov routines (bsc#963783).\n\n - CVE-2016-2198: EHCI NULL pointer dereference in ehci_caps_write (bsc#964415).\n\n - CVE-2016-2270: Xen allowed local guest administrators to cause a denial of service (host reboot) via vectors related to multiple mappings of MMIO pages with different cachability settings (bsc#965315).\n\n - CVE-2016-2271: VMX when using an Intel or Cyrix CPU, allowed local HVM guest users to cause a denial of service (guest crash) via vectors related to a non-canonical RIP (bsc#965317).\n\n - CVE-2016-2391: usb: multiple eof_timers in ohci module lead to NULL pointer dereference (bsc#967101).\n\n - CVE-2016-2392: NULL pointer dereference in remote NDIS control message handling (bsc#967090).\n\n - CVE-2016-2538: Integer overflow in remote NDIS control message handling (bsc#968004).\n\n - XSA-166: ioreq handling possibly susceptible to multiple read issue (bsc#958523).\n\nThe update package also includes non-security fixes. See advisory for details.\n\nNote that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"exploitabilityScore": 2.2, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 9.0, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 6.0}, "published": "2016-05-19T00:00:00", "type": "nessus", "title": "SUSE SLED12 / SLES12 Security Update : xen (SUSE-SU-2016:1318-1)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "COMPLETE", "integrityImpact": "NONE", "baseScore": 7.8, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-4527", "CVE-2013-4529", "CVE-2013-4530", "CVE-2013-4533", "CVE-2013-4534", "CVE-2013-4537", "CVE-2013-4538", "CVE-2013-4539", "CVE-2014-0222", "CVE-2014-3640", "CVE-2014-3689", "CVE-2014-7815", "CVE-2014-9718", "CVE-2015-1779", "CVE-2015-5278", "CVE-2015-6855", "CVE-2015-7512", "CVE-2015-7549", "CVE-2015-8345", "CVE-2015-8504", "CVE-2015-8550", "CVE-2015-8554", "CVE-2015-8555", "CVE-2015-8558", "CVE-2015-8567", "CVE-2015-8568", "CVE-2015-8613", "CVE-2015-8619", "CVE-2015-8743", "CVE-2015-8744", "CVE-2015-8745", "CVE-2015-8817", "CVE-2015-8818", "CVE-2016-1568", "CVE-2016-1570", "CVE-2016-1571", "CVE-2016-1714", "CVE-2016-1922", "CVE-2016-1981", "CVE-2016-2198", "CVE-2016-2270", "CVE-2016-2271", "CVE-2016-2391", "CVE-2016-2392", "CVE-2016-2538"], "modified": "2021-01-06T00:00:00", "cpe": ["p-cpe:/a:novell:suse_linux:xen", "p-cpe:/a:novell:suse_linux:xen-debugsource", "p-cpe:/a:novell:suse_linux:xen-doc-html", "p-cpe:/a:novell:suse_linux:xen-kmp-default", "p-cpe:/a:novell:suse_linux:xen-kmp-default-debuginfo", "p-cpe:/a:novell:suse_linux:xen-libs", "p-cpe:/a:novell:suse_linux:xen-libs-debuginfo", "p-cpe:/a:novell:suse_linux:xen-tools", "p-cpe:/a:novell:suse_linux:xen-tools-debuginfo", "p-cpe:/a:novell:suse_linux:xen-tools-domU", "p-cpe:/a:novell:suse_linux:xen-tools-domU-debuginfo", "cpe:/o:novell:suse_linux:12"], "id": "SUSE_SU-2016-1318-1.NASL", "href": "https://www.tenable.com/plugins/nessus/91249", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from SUSE update advisory SUSE-SU-2016:1318-1.\n# The text itself is copyright (C) SUSE.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(91249);\n script_version(\"2.11\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2013-4527\", \"CVE-2013-4529\", \"CVE-2013-4530\", \"CVE-2013-4533\", \"CVE-2013-4534\", \"CVE-2013-4537\", \"CVE-2013-4538\", \"CVE-2013-4539\", \"CVE-2014-0222\", \"CVE-2014-3640\", \"CVE-2014-3689\", \"CVE-2014-7815\", \"CVE-2014-9718\", \"CVE-2015-1779\", \"CVE-2015-5278\", \"CVE-2015-6855\", \"CVE-2015-7512\", \"CVE-2015-7549\", \"CVE-2015-8345\", \"CVE-2015-8504\", \"CVE-2015-8550\", \"CVE-2015-8554\", \"CVE-2015-8555\", \"CVE-2015-8558\", \"CVE-2015-8567\", \"CVE-2015-8568\", \"CVE-2015-8613\", \"CVE-2015-8619\", \"CVE-2015-8743\", \"CVE-2015-8744\", \"CVE-2015-8745\", \"CVE-2015-8817\", \"CVE-2015-8818\", \"CVE-2016-1568\", \"CVE-2016-1570\", \"CVE-2016-1571\", \"CVE-2016-1714\", \"CVE-2016-1922\", \"CVE-2016-1981\", \"CVE-2016-2198\", \"CVE-2016-2270\", \"CVE-2016-2271\", \"CVE-2016-2391\", \"CVE-2016-2392\", \"CVE-2016-2538\");\n script_bugtraq_id(67357, 67483, 70237, 70997, 70998, 73303, 73316);\n\n script_name(english:\"SUSE SLED12 / SLES12 Security Update : xen (SUSE-SU-2016:1318-1)\");\n script_summary(english:\"Checks rpm output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\"The remote SUSE host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"xen was updated to fix 46 security issues.\n\nThese security issues were fixed :\n\n - CVE-2013-4527: Buffer overflow in hw/timer/hpet.c might\n have allowed remote attackers to execute arbitrary code\n via vectors related to the number of timers\n (bsc#964746).\n\n - CVE-2013-4529: Buffer overflow in hw/pci/pcie_aer.c\n allowed remote attackers to cause a denial of service\n and possibly execute arbitrary code via a large log_num\n value in a savevm image (bsc#964929).\n\n - CVE-2013-4530: Buffer overflow in hw/ssi/pl022.c allowed\n remote attackers to cause a denial of service or\n possibly execute arbitrary code via crafted tx_fifo_head\n and rx_fifo_head values in a savevm image (bsc#964950).\n\n - CVE-2013-4533: Buffer overflow in the pxa2xx_ssp_load\n function in hw/arm/pxa2xx.c allowed remote attackers to\n cause a denial of service or possibly execute arbitrary\n code via a crafted s->rx_level value in a savevm image\n (bsc#964644).\n\n - CVE-2013-4534: Buffer overflow in hw/intc/openpic.c\n allowed remote attackers to cause a denial of service or\n possibly execute arbitrary code via vectors related to\n IRQDest elements (bsc#964452).\n\n - CVE-2013-4537: The ssi_sd_transfer function in\n hw/sd/ssi-sd.c allowed remote attackers to execute\n arbitrary code via a crafted arglen value in a savevm\n image (bsc#962642).\n\n - CVE-2013-4538: Multiple buffer overflows in the\n ssd0323_load function in hw/display/ssd0323.c allowed\n remote attackers to cause a denial of service (memory\n corruption) or possibly execute arbitrary code via\n crafted (1) cmd_len, (2) row, or (3) col values; (4)\n row_start and row_end values; or (5) col_star and\n col_end values in a savevm image (bsc#962335).\n\n - CVE-2013-4539: Multiple buffer overflows in the\n tsc210x_load function in hw/input/tsc210x.c might have\n allowed remote attackers to execute arbitrary code via a\n crafted (1) precision, (2) nextprecision, (3) function,\n or (4) nextfunction value in a savevm image\n (bsc#962758).\n\n - CVE-2014-0222: Integer overflow in the qcow_open\n function in block/qcow.c allowed remote attackers to\n cause a denial of service (crash) via a large L2 table\n in a QCOW version 1 image (bsc#964925).\n\n - CVE-2014-3640: The sosendto function in slirp/udp.c\n allowed local users to cause a denial of service (NULL\n pointer dereference) by sending a udp packet with a\n value of 0 in the source port and address, which\n triggers access of an uninitialized socket (bsc#965112).\n\n - CVE-2014-3689: The vmware-vga driver\n (hw/display/vmware_vga.c) allowed local guest users to\n write to qemu memory locations and gain privileges via\n unspecified parameters related to rectangle handling\n (bsc#962611).\n\n - CVE-2014-7815: The set_pixel_format function in ui/vnc.c\n allowed remote attackers to cause a denial of service\n (crash) via a small bytes_per_pixel value (bsc#962627).\n\n - CVE-2014-9718: The (1) BMDMA and (2) AHCI HBA interfaces\n in the IDE functionality had multiple interpretations of\n a function's return value, which allowed guest OS users\n to cause a host OS denial of service (memory consumption\n or infinite loop, and system crash) via a PRDT with zero\n complete sectors, related to the bmdma_prepare_buf and\n ahci_dma_prepare_buf functions (bsc#964431).\n\n - CVE-2015-1779: The VNC websocket frame decoder allowed\n remote attackers to cause a denial of service (memory\n and CPU consumption) via a large (1) websocket payload\n or (2) HTTP headers section (bsc#962632).\n\n - CVE-2015-5278: Infinite loop in ne2000_receive()\n function (bsc#964947).\n\n - CVE-2015-6855: hw/ide/core.c did not properly restrict\n the commands accepted by an ATAPI device, which allowed\n guest users to cause a denial of service or possibly\n have unspecified other impact via certain IDE commands,\n as demonstrated by a WIN_READ_NATIVE_MAX command to an\n empty drive, which triggers a divide-by-zero error and\n instance crash (bsc#965156).\n\n - CVE-2015-7512: Buffer overflow in the pcnet_receive\n function in hw/net/pcnet.c, when a guest NIC has a\n larger MTU, allowed remote attackers to cause a denial\n of service (guest OS crash) or execute arbitrary code\n via a large packet (bsc#962360).\n\n - CVE-2015-7549: pci: NULL pointer dereference issue\n (bsc#958918).\n\n - CVE-2015-8345: eepro100: infinite loop in processing\n command block list (bsc#956832).\n\n - CVE-2015-8504: VNC: floating point exception\n (bsc#958493).\n\n - CVE-2015-8550: Paravirtualized drivers were incautious\n about shared memory contents (XSA-155) (bsc#957988).\n\n - CVE-2015-8554: qemu-dm buffer overrun in MSI-X handling\n (XSA-164) (bsc#958007).\n\n - CVE-2015-8555: Information leak in legacy x86 FPU/XMM\n initialization (XSA-165) (bsc#958009).\n\n - CVE-2015-8558: Infinite loop in ehci_advance_state\n resulted in DoS (bsc#959006).\n\n - CVE-2015-8567: vmxnet3: host memory leakage\n (bsc#959387).\n\n - CVE-2015-8568: vmxnet3: host memory leakage\n (bsc#959387).\n\n - CVE-2015-8613: SCSI: stack-based buffer overflow in\n megasas_ctrl_get_info (bsc#961358).\n\n - CVE-2015-8619: Stack based OOB write in hmp_sendkey\n routine (bsc#965269).\n\n - CVE-2015-8743: ne2000: OOB memory access in ioport r/w\n functions (bsc#960726).\n\n - CVE-2015-8744: vmxnet3: Incorrect l2 header validation\n lead to a crash via assert(2) call (bsc#960836).\n\n - CVE-2015-8745: Reading IMR registers lead to a crash via\n assert(2) call (bsc#960707).\n\n - CVE-2015-8817: OOB access in address_space_rw lead to\n segmentation fault (I) (bsc#969125).\n\n - CVE-2015-8818: OOB access in address_space_rw lead to\n segmentation fault (II) (bsc#969126).\n\n - CVE-2016-1568: AHCI use-after-free vulnerability in aio\n port commands (bsc#961332).\n\n - CVE-2016-1570: The PV superpage functionality in\n arch/x86/mm.c allowed local PV guests to obtain\n sensitive information, cause a denial of service, gain\n privileges, or have unspecified other impact via a\n crafted page identifier (MFN) to the (1)\n MMUEXT_MARK_SUPER or (2) MMUEXT_UNMARK_SUPER sub-op in\n the HYPERVISOR_mmuext_op hypercall or (3) unknown\n vectors related to page table updates (bsc#960861).\n\n - CVE-2016-1571: VMX: intercept issue with INVLPG on\n non-canonical address (XSA-168) (bsc#960862).\n\n - CVE-2016-1714: nvram: OOB r/w access in processing\n firmware configurations (bsc#961692).\n\n - CVE-2016-1922: NULL pointer dereference in vapic_write()\n (bsc#962321).\n\n - CVE-2016-1981: e1000 infinite loop in start_xmit and\n e1000_receive_iov routines (bsc#963783).\n\n - CVE-2016-2198: EHCI NULL pointer dereference in\n ehci_caps_write (bsc#964415).\n\n - CVE-2016-2270: Xen allowed local guest administrators to\n cause a denial of service (host reboot) via vectors\n related to multiple mappings of MMIO pages with\n different cachability settings (bsc#965315).\n\n - CVE-2016-2271: VMX when using an Intel or Cyrix CPU,\n allowed local HVM guest users to cause a denial of\n service (guest crash) via vectors related to a\n non-canonical RIP (bsc#965317).\n\n - CVE-2016-2391: usb: multiple eof_timers in ohci module\n lead to NULL pointer dereference (bsc#967101).\n\n - CVE-2016-2392: NULL pointer dereference in remote NDIS\n control message handling (bsc#967090).\n\n - CVE-2016-2538: Integer overflow in remote NDIS control\n message handling (bsc#968004).\n\n - XSA-166: ioreq handling possibly susceptible to multiple\n read issue (bsc#958523).\n\nThe update package also includes non-security fixes. See advisory for\ndetails.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=954872\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=956832\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=957988\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=958007\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=958009\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=958493\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=958523\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=958918\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=959006\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=959387\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=959695\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=960707\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=960726\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=960836\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=960861\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=960862\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=961332\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=961358\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=961692\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=962321\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=962335\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=962360\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=962611\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=962627\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=962632\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=962642\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=962758\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=963783\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=963923\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=964415\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=964431\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=964452\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=964644\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=964746\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=964925\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=964929\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=964947\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=964950\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=965112\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=965156\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=965269\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=965315\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=965317\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=967090\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=967101\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=968004\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=969125\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=969126\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2013-4527/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2013-4529/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2013-4530/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2013-4533/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2013-4534/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2013-4537/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2013-4538/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2013-4539/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2014-0222/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2014-3640/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2014-3689/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2014-7815/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2014-9718/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-1779/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-5278/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-6855/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-7512/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-7549/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8345/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8504/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8550/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8554/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8555/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8558/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8567/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8568/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8613/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8619/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8743/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8744/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8745/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8817/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8818/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-1568/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-1570/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-1571/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-1714/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-1922/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-1981/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-2198/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-2270/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-2271/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-2391/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-2392/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-2538/\"\n );\n # https://www.suse.com/support/update/announcement/2016/suse-su-20161318-1/\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?0370e050\"\n );\n script_set_attribute(\n attribute:\"solution\",\n value:\n\"To install this SUSE Security Update use YaST online_update.\nAlternatively you can run the command listed for your product :\n\nSUSE Linux Enterprise Software Development Kit 12 :\n\nzypper in -t patch SUSE-SLE-SDK-12-2016-779=1\n\nSUSE Linux Enterprise Server 12 :\n\nzypper in -t patch SUSE-SLE-SERVER-12-2016-779=1\n\nSUSE Linux Enterprise Desktop 12 :\n\nzypper in -t patch SUSE-SLE-DESKTOP-12-2016-779=1\n\nTo bring your system up-to-date, use 'zypper patch'.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:xen\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:xen-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:xen-doc-html\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:xen-kmp-default\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:xen-kmp-default-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:xen-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:xen-libs-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:xen-tools\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:xen-tools-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:xen-tools-domU\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:xen-tools-domU-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:12\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2014/11/04\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/05/17\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/05/19\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nos_ver = pregmatch(pattern: \"^(SLE(S|D)\\d+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"SUSE\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLED12|SLES12)$\", string:os_ver)) audit(AUDIT_OS_NOT, \"SUSE SLED12 / SLES12\", \"SUSE \" + os_ver);\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^i[3-6]86$\" && \"x86_64\" >!< cpu && \"s390x\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"SUSE \" + os_ver, cpu);\nif (cpu >!< \"x86_64\") audit(AUDIT_ARCH_NOT, \"x86_64\", cpu);\n\n\nsp = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(sp)) sp = \"0\";\nif (os_ver == \"SLES12\" && (! preg(pattern:\"^(0)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLES12 SP0\", os_ver + \" SP\" + sp);\nif (os_ver == \"SLED12\" && (! preg(pattern:\"^(0)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLED12 SP0\", os_ver + \" SP\" + sp);\n\n\nflag = 0;\nif (rpm_check(release:\"SLES12\", sp:\"0\", cpu:\"x86_64\", reference:\"xen-4.4.4_02-22.19.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", cpu:\"x86_64\", reference:\"xen-debugsource-4.4.4_02-22.19.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", cpu:\"x86_64\", reference:\"xen-doc-html-4.4.4_02-22.19.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", cpu:\"x86_64\", reference:\"xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", cpu:\"x86_64\", reference:\"xen-kmp-default-debuginfo-4.4.4_02_k3.12.55_52.42-22.19.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", cpu:\"x86_64\", reference:\"xen-libs-32bit-4.4.4_02-22.19.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", cpu:\"x86_64\", reference:\"xen-libs-4.4.4_02-22.19.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", cpu:\"x86_64\", reference:\"xen-libs-debuginfo-32bit-4.4.4_02-22.19.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", cpu:\"x86_64\", reference:\"xen-libs-debuginfo-4.4.4_02-22.19.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", cpu:\"x86_64\", reference:\"xen-tools-4.4.4_02-22.19.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", cpu:\"x86_64\", reference:\"xen-tools-debuginfo-4.4.4_02-22.19.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", cpu:\"x86_64\", reference:\"xen-tools-domU-4.4.4_02-22.19.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", cpu:\"x86_64\", reference:\"xen-tools-domU-debuginfo-4.4.4_02-22.19.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"0\", cpu:\"x86_64\", reference:\"xen-4.4.4_02-22.19.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"0\", cpu:\"x86_64\", reference:\"xen-debugsource-4.4.4_02-22.19.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"0\", cpu:\"x86_64\", reference:\"xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"0\", cpu:\"x86_64\", reference:\"xen-kmp-default-debuginfo-4.4.4_02_k3.12.55_52.42-22.19.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"0\", cpu:\"x86_64\", reference:\"xen-libs-32bit-4.4.4_02-22.19.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"0\", cpu:\"x86_64\", reference:\"xen-libs-4.4.4_02-22.19.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"0\", cpu:\"x86_64\", reference:\"xen-libs-debuginfo-32bit-4.4.4_02-22.19.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"0\", cpu:\"x86_64\", reference:\"xen-libs-debuginfo-4.4.4_02-22.19.1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"xen\");\n}\n", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2023-01-11T16:37:10", "description": "xen was updated to fix 47 security issues.\n\nThese security issues were fixed :\n\n - CVE-2013-4527: Buffer overflow in hw/timer/hpet.c might have allowed remote attackers to execute arbitrary code via vectors related to the number of timers (bnc#864673).\n\n - CVE-2013-4529: Buffer overflow in hw/pci/pcie_aer.c allowed remote attackers to cause a denial of service and possibly execute arbitrary code via a large log_num value in a savevm image (bnc#864678).\n\n - CVE-2013-4530: Buffer overflow in hw/ssi/pl022.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via crafted tx_fifo_head and rx_fifo_head values in a savevm image (bnc#864682).\n\n - CVE-2013-4533: Buffer overflow in the pxa2xx_ssp_load function in hw/arm/pxa2xx.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted s->rx_level value in a savevm image (bsc#864655).\n\n - CVE-2013-4534: Buffer overflow in hw/intc/openpic.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via vectors related to IRQDest elements (bsc#864811).\n\n - CVE-2013-4537: The ssi_sd_transfer function in hw/sd/ssi-sd.c allowed remote attackers to execute arbitrary code via a crafted arglen value in a savevm image (bsc#864391).\n\n - CVE-2013-4538: Multiple buffer overflows in the ssd0323_load function in hw/display/ssd0323.c allowed remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via crafted (1) cmd_len, (2) row, or (3) col values; (4) row_start and row_end values; or (5) col_star and col_end values in a savevm image (bsc#864769).\n\n - CVE-2013-4539: Multiple buffer overflows in the tsc210x_load function in hw/input/tsc210x.c might have allowed remote attackers to execute arbitrary code via a crafted (1) precision, (2) nextprecision, (3) function, or (4) nextfunction value in a savevm image (bsc#864805).\n\n - CVE-2014-0222: Integer overflow in the qcow_open function in block/qcow.c allowed remote attackers to cause a denial of service (crash) via a large L2 table in a QCOW version 1 image (bsc#877642).\n\n - CVE-2014-3640: The sosendto function in slirp/udp.c allowed local users to cause a denial of service (NULL pointer dereference) by sending a udp packet with a value of 0 in the source port and address, which triggers access of an uninitialized socket (bsc#897654).\n\n - CVE-2014-3689: The vmware-vga driver (hw/display/vmware_vga.c) allowed local guest users to write to qemu memory locations and gain privileges via unspecified parameters related to rectangle handling (bsc#901508).\n\n - CVE-2014-7815: The set_pixel_format function in ui/vnc.c allowed remote attackers to cause a denial of service (crash) via a small bytes_per_pixel value (bsc#902737).\n\n - CVE-2014-9718: The (1) BMDMA and (2) AHCI HBA interfaces in the IDE functionality had multiple interpretations of a function's return value, which allowed guest OS users to cause a host OS denial of service (memory consumption or infinite loop, and system crash) via a PRDT with zero complete sectors, related to the bmdma_prepare_buf and ahci_dma_prepare_buf functions (bsc#928393).\n\n - CVE-2015-1779: The VNC websocket frame decoder allowed remote attackers to cause a denial of service (memory and CPU consumption) via a large (1) websocket payload or (2) HTTP headers section (bsc#924018).\n\n - CVE-2015-5278: Infinite loop in ne2000_receive() function (bsc#945989).\n\n - CVE-2015-6855: hw/ide/core.c did not properly restrict the commands accepted by an ATAPI device, which allowed guest users to cause a denial of service or possibly have unspecified other impact via certain IDE commands, as demonstrated by a WIN_READ_NATIVE_MAX command to an empty drive, which triggers a divide-by-zero error and instance crash (bsc#945404).\n\n - CVE-2015-7512: Buffer overflow in the pcnet_receive function in hw/net/pcnet.c, when a guest NIC has a larger MTU, allowed remote attackers to cause a denial of service (guest OS crash) or execute arbitrary code via a large packet (bsc#957162).\n\n - CVE-2015-7549: pci: NULL pointer dereference issue (bsc#958917).\n\n - CVE-2015-8345: eepro100: infinite loop in processing command block list (bsc#956829).\n\n - CVE-2015-8504: VNC: floating point exception (bsc#958491).\n\n - CVE-2015-8550: Paravirtualized drivers were incautious about shared memory contents (XSA-155) (bsc#957988).\n\n - CVE-2015-8554: qemu-dm buffer overrun in MSI-X handling (XSA-164) (bsc#958007).\n\n - CVE-2015-8555: Information leak in legacy x86 FPU/XMM initialization (XSA-165) (bsc#958009).\n\n - CVE-2015-8558: Infinite loop in ehci_advance_state resulted in DoS (bsc#959005).\n\n - CVE-2015-8567: vmxnet3: host memory leakage (bsc#959387).\n\n - CVE-2015-8568: vmxnet3: host memory leakage (bsc#959387).\n\n - CVE-2015-8613: SCSI: stack-based buffer overflow in megasas_ctrl_get_info (bsc#961358).\n\n - CVE-2015-8619: Stack based OOB write in hmp_sendkey routine (bsc#960334).\n\n - CVE-2015-8743: ne2000: OOB memory access in ioport r/w functions (bsc#960725).\n\n - CVE-2015-8744: vmxnet3: Incorrect l2 header validation lead to a crash via assert(2) call (bsc#960835).\n\n - CVE-2015-8745: Reading IMR registers lead to a crash via assert(2) call (bsc#960707).\n\n - CVE-2015-8817: OOB access in address_space_rw lead to segmentation fault (I) (bsc#969121).\n\n - CVE-2015-8818: OOB access in address_space_rw lead to segmentation fault (II) (bsc#969122).\n\n - CVE-2016-1568: AHCI use-after-free vulnerability in aio port commands (bsc#961332).\n\n - CVE-2016-1570: The PV superpage functionality in arch/x86/mm.c allowed local PV guests to obtain sensitive information, cause a denial of service, gain privileges, or have unspecified other impact via a crafted page identifier (MFN) to the (1) MMUEXT_MARK_SUPER or (2) MMUEXT_UNMARK_SUPER sub-op in the HYPERVISOR_mmuext_op hypercall or (3) unknown vectors related to page table updates (bsc#960861).\n\n - CVE-2016-1571: VMX: intercept issue with INVLPG on non-canonical address (XSA-168) (bsc#960862).\n\n - CVE-2016-1714: nvram: OOB r/w access in processing firmware configurations (bsc#961691).\n\n - CVE-2016-1922: NULL pointer dereference in vapic_write() (bsc#962320).\n\n - CVE-2016-1981: e1000 infinite loop in start_xmit and e1000_receive_iov routines (bsc#963782).\n\n - CVE-2016-2198: EHCI NULL pointer dereference in ehci_caps_write (bsc#964413).\n\n - CVE-2016-2270: Xen allowed local guest administrators to cause a denial of service (host reboot) via vectors related to multiple mappings of MMIO pages with different cachability settings (bsc#965315).\n\n - CVE-2016-2271: VMX when using an Intel or Cyrix CPU, allowed local HVM guest users to cause a denial of service (guest crash) via vectors related to a non-canonical RIP (bsc#965317).\n\n - CVE-2016-2391: usb: multiple eof_timers in ohci module lead to NULL pointer dereference (bsc#967013).\n\n - CVE-2016-2392: NULL pointer dereference in remote NDIS control message handling (bsc#967012).\n\n - CVE-2016-2538: Integer overflow in remote NDIS control message handling (bsc#967969).\n\n - CVE-2016-2841: ne2000: Infinite loop in ne2000_receive (bsc#969350).\n\n - XSA-166: ioreq handling possibly susceptible to multiple read issue (bsc#958523).\n\nThe update package also includes non-security fixes. See advisory for details.\n\nNote that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"exploitabilityScore": 2.2, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 9.0, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 6.0}, "published": "2016-04-07T00:00:00", "type": "nessus", "title": "SUSE SLED11 / SLES11 Security Update : xen (SUSE-SU-2016:0955-1)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "COMPLETE", "integrityImpact": "NONE", "baseScore": 7.8, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-4527", "CVE-2013-4529", "CVE-2013-4530", "CVE-2013-4533", "CVE-2013-4534", "CVE-2013-4537", "CVE-2013-4538", "CVE-2013-4539", "CVE-2014-0222", "CVE-2014-3640", "CVE-2014-3689", "CVE-2014-7815", "CVE-2014-9718", "CVE-2015-1779", "CVE-2015-5278", "CVE-2015-6855", "CVE-2015-7512", "CVE-2015-7549", "CVE-2015-8345", "CVE-2015-8504", "CVE-2015-8550", "CVE-2015-8554", "CVE-2015-8555", "CVE-2015-8558", "CVE-2015-8567", "CVE-2015-8568", "CVE-2015-8613", "CVE-2015-8619", "CVE-2015-8743", "CVE-2015-8744", "CVE-2015-8745", "CVE-2015-8817", "CVE-2015-8818", "CVE-2016-1568", "CVE-2016-1570", "CVE-2016-1571", "CVE-2016-1714", "CVE-2016-1922", "CVE-2016-1981", "CVE-2016-2198", "CVE-2016-2270", "CVE-2016-2271", "CVE-2016-2391", "CVE-2016-2392", "CVE-2016-2538", "CVE-2016-2841"], "modified": "2021-01-06T00:00:00", "cpe": ["p-cpe:/a:novell:suse_linux:xen", "p-cpe:/a:novell:suse_linux:xen-doc-html", "p-cpe:/a:novell:suse_linux:xen-kmp-default", "p-cpe:/a:novell:suse_linux:xen-kmp-pae", "p-cpe:/a:novell:suse_linux:xen-libs", "p-cpe:/a:novell:suse_linux:xen-tools", "p-cpe:/a:novell:suse_linux:xen-tools-domU", "cpe:/o:novell:suse_linux:11"], "id": "SUSE_SU-2016-0955-1.NASL", "href": "https://www.tenable.com/plugins/nessus/90396", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from SUSE update advisory SUSE-SU-2016:0955-1.\n# The text itself is copyright (C) SUSE.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(90396);\n script_version(\"2.13\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2013-4527\", \"CVE-2013-4529\", \"CVE-2013-4530\", \"CVE-2013-4533\", \"CVE-2013-4534\", \"CVE-2013-4537\", \"CVE-2013-4538\", \"CVE-2013-4539\", \"CVE-2014-0222\", \"CVE-2014-3640\", \"CVE-2014-3689\", \"CVE-2014-7815\", \"CVE-2014-9718\", \"CVE-2015-1779\", \"CVE-2015-5278\", \"CVE-2015-6855\", \"CVE-2015-7512\", \"CVE-2015-7549\", \"CVE-2015-8345\", \"CVE-2015-8504\", \"CVE-2015-8550\", \"CVE-2015-8554\", \"CVE-2015-8555\", \"CVE-2015-8558\", \"CVE-2015-8567\", \"CVE-2015-8568\", \"CVE-2015-8613\", \"CVE-2015-8619\", \"CVE-2015-8743\", \"CVE-2015-8744\", \"CVE-2015-8745\", \"CVE-2015-8817\", \"CVE-2015-8818\", \"CVE-2016-1568\", \"CVE-2016-1570\", \"CVE-2016-1571\", \"CVE-2016-1714\", \"CVE-2016-1922\", \"CVE-2016-1981\", \"CVE-2016-2198\", \"CVE-2016-2270\", \"CVE-2016-2271\", \"CVE-2016-2391\", \"CVE-2016-2392\", \"CVE-2016-2538\", \"CVE-2016-2841\");\n script_bugtraq_id(67357, 67483, 70237, 70997, 70998, 73303, 73316);\n\n script_name(english:\"SUSE SLED11 / SLES11 Security Update : xen (SUSE-SU-2016:0955-1)\");\n script_summary(english:\"Checks rpm output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\"The remote SUSE host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"xen was updated to fix 47 security issues.\n\nThese security issues were fixed :\n\n - CVE-2013-4527: Buffer overflow in hw/timer/hpet.c might\n have allowed remote attackers to execute arbitrary code\n via vectors related to the number of timers\n (bnc#864673).\n\n - CVE-2013-4529: Buffer overflow in hw/pci/pcie_aer.c\n allowed remote attackers to cause a denial of service\n and possibly execute arbitrary code via a large log_num\n value in a savevm image (bnc#864678).\n\n - CVE-2013-4530: Buffer overflow in hw/ssi/pl022.c allowed\n remote attackers to cause a denial of service or\n possibly execute arbitrary code via crafted tx_fifo_head\n and rx_fifo_head values in a savevm image (bnc#864682).\n\n - CVE-2013-4533: Buffer overflow in the pxa2xx_ssp_load\n function in hw/arm/pxa2xx.c allowed remote attackers to\n cause a denial of service or possibly execute arbitrary\n code via a crafted s->rx_level value in a savevm image\n (bsc#864655).\n\n - CVE-2013-4534: Buffer overflow in hw/intc/openpic.c\n allowed remote attackers to cause a denial of service or\n possibly execute arbitrary code via vectors related to\n IRQDest elements (bsc#864811).\n\n - CVE-2013-4537: The ssi_sd_transfer function in\n hw/sd/ssi-sd.c allowed remote attackers to execute\n arbitrary code via a crafted arglen value in a savevm\n image (bsc#864391).\n\n - CVE-2013-4538: Multiple buffer overflows in the\n ssd0323_load function in hw/display/ssd0323.c allowed\n remote attackers to cause a denial of service (memory\n corruption) or possibly execute arbitrary code via\n crafted (1) cmd_len, (2) row, or (3) col values; (4)\n row_start and row_end values; or (5) col_star and\n col_end values in a savevm image (bsc#864769).\n\n - CVE-2013-4539: Multiple buffer overflows in the\n tsc210x_load function in hw/input/tsc210x.c might have\n allowed remote attackers to execute arbitrary code via a\n crafted (1) precision, (2) nextprecision, (3) function,\n or (4) nextfunction value in a savevm image\n (bsc#864805).\n\n - CVE-2014-0222: Integer overflow in the qcow_open\n function in block/qcow.c allowed remote attackers to\n cause a denial of service (crash) via a large L2 table\n in a QCOW version 1 image (bsc#877642).\n\n - CVE-2014-3640: The sosendto function in slirp/udp.c\n allowed local users to cause a denial of service (NULL\n pointer dereference) by sending a udp packet with a\n value of 0 in the source port and address, which\n triggers access of an uninitialized socket (bsc#897654).\n\n - CVE-2014-3689: The vmware-vga driver\n (hw/display/vmware_vga.c) allowed local guest users to\n write to qemu memory locations and gain privileges via\n unspecified parameters related to rectangle handling\n (bsc#901508).\n\n - CVE-2014-7815: The set_pixel_format function in ui/vnc.c\n allowed remote attackers to cause a denial of service\n (crash) via a small bytes_per_pixel value (bsc#902737).\n\n - CVE-2014-9718: The (1) BMDMA and (2) AHCI HBA interfaces\n in the IDE functionality had multiple interpretations of\n a function's return value, which allowed guest OS users\n to cause a host OS denial of service (memory consumption\n or infinite loop, and system crash) via a PRDT with zero\n complete sectors, related to the bmdma_prepare_buf and\n ahci_dma_prepare_buf functions (bsc#928393).\n\n - CVE-2015-1779: The VNC websocket frame decoder allowed\n remote attackers to cause a denial of service (memory\n and CPU consumption) via a large (1) websocket payload\n or (2) HTTP headers section (bsc#924018).\n\n - CVE-2015-5278: Infinite loop in ne2000_receive()\n function (bsc#945989).\n\n - CVE-2015-6855: hw/ide/core.c did not properly restrict\n the commands accepted by an ATAPI device, which allowed\n guest users to cause a denial of service or possibly\n have unspecified other impact via certain IDE commands,\n as demonstrated by a WIN_READ_NATIVE_MAX command to an\n empty drive, which triggers a divide-by-zero error and\n instance crash (bsc#945404).\n\n - CVE-2015-7512: Buffer overflow in the pcnet_receive\n function in hw/net/pcnet.c, when a guest NIC has a\n larger MTU, allowed remote attackers to cause a denial\n of service (guest OS crash) or execute arbitrary code\n via a large packet (bsc#957162).\n\n - CVE-2015-7549: pci: NULL pointer dereference issue\n (bsc#958917).\n\n - CVE-2015-8345: eepro100: infinite loop in processing\n command block list (bsc#956829).\n\n - CVE-2015-8504: VNC: floating point exception\n (bsc#958491).\n\n - CVE-2015-8550: Paravirtualized drivers were incautious\n about shared memory contents (XSA-155) (bsc#957988).\n\n - CVE-2015-8554: qemu-dm buffer overrun in MSI-X handling\n (XSA-164) (bsc#958007).\n\n - CVE-2015-8555: Information leak in legacy x86 FPU/XMM\n initialization (XSA-165) (bsc#958009).\n\n - CVE-2015-8558: Infinite loop in ehci_advance_state\n resulted in DoS (bsc#959005).\n\n - CVE-2015-8567: vmxnet3: host memory leakage\n (bsc#959387).\n\n - CVE-2015-8568: vmxnet3: host memory leakage\n (bsc#959387).\n\n - CVE-2015-8613: SCSI: stack-based buffer overflow in\n megasas_ctrl_get_info (bsc#961358).\n\n - CVE-2015-8619: Stack based OOB write in hmp_sendkey\n routine (bsc#960334).\n\n - CVE-2015-8743: ne2000: OOB memory access in ioport r/w\n functions (bsc#960725).\n\n - CVE-2015-8744: vmxnet3: Incorrect l2 header validation\n lead to a crash via assert(2) call (bsc#960835).\n\n - CVE-2015-8745: Reading IMR registers lead to a crash via\n assert(2) call (bsc#960707).\n\n - CVE-2015-8817: OOB access in address_space_rw lead to\n segmentation fault (I) (bsc#969121).\n\n - CVE-2015-8818: OOB access in address_space_rw lead to\n segmentation fault (II) (bsc#969122).\n\n - CVE-2016-1568: AHCI use-after-free vulnerability in aio\n port commands (bsc#961332).\n\n - CVE-2016-1570: The PV superpage functionality in\n arch/x86/mm.c allowed local PV guests to obtain\n sensitive information, cause a denial of service, gain\n privileges, or have unspecified other impact via a\n crafted page identifier (MFN) to the (1)\n MMUEXT_MARK_SUPER or (2) MMUEXT_UNMARK_SUPER sub-op in\n the HYPERVISOR_mmuext_op hypercall or (3) unknown\n vectors related to page table updates (bsc#960861).\n\n - CVE-2016-1571: VMX: intercept issue with INVLPG on\n non-canonical address (XSA-168) (bsc#960862).\n\n - CVE-2016-1714: nvram: OOB r/w access in processing\n firmware configurations (bsc#961691).\n\n - CVE-2016-1922: NULL pointer dereference in vapic_write()\n (bsc#962320).\n\n - CVE-2016-1981: e1000 infinite loop in start_xmit and\n e1000_receive_iov routines (bsc#963782).\n\n - CVE-2016-2198: EHCI NULL pointer dereference in\n ehci_caps_write (bsc#964413).\n\n - CVE-2016-2270: Xen allowed local guest administrators to\n cause a denial of service (host reboot) via vectors\n related to multiple mappings of MMIO pages with\n different cachability settings (bsc#965315).\n\n - CVE-2016-2271: VMX when using an Intel or Cyrix CPU,\n allowed local HVM guest users to cause a denial of\n service (guest crash) via vectors related to a\n non-canonical RIP (bsc#965317).\n\n - CVE-2016-2391: usb: multiple eof_timers in ohci module\n lead to NULL pointer dereference (bsc#967013).\n\n - CVE-2016-2392: NULL pointer dereference in remote NDIS\n control message handling (bsc#967012).\n\n - CVE-2016-2538: Integer overflow in remote NDIS control\n message handling (bsc#967969).\n\n - CVE-2016-2841: ne2000: Infinite loop in ne2000_receive\n (bsc#969350).\n\n - XSA-166: ioreq handling possibly susceptible to multiple\n read issue (bsc#958523).\n\nThe update package also includes non-security fixes. See advisory for\ndetails.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=864391\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=864655\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=864673\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=864678\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=864682\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=864769\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=864805\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=864811\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=877642\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=897654\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=901508\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=902737\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=924018\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=928393\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=945404\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=945989\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=954872\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=956829\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=957162\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=957988\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=958007\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=958009\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=958491\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=958523\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=958917\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=959005\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=959387\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=959695\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=959928\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=960334\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=960707\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=960725\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=960835\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=960861\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=960862\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=961332\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=961358\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=961691\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=962320\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=963782\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=963923\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=964413\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=965315\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=965317\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=967012\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=967013\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=967630\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=967969\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=969121\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=969122\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=969350\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2013-4527/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2013-4529/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2013-4530/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2013-4533/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2013-4534/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2013-4537/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2013-4538/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2013-4539/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2014-0222/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2014-3640/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2014-3689/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2014-7815/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2014-9718/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-1779/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-5278/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-6855/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-7512/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-7549/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8345/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8504/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8550/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8554/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8555/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8558/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8567/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8568/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8613/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8619/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8743/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8744/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8745/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8817/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8818/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-1568/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-1570/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-1571/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-1714/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-1922/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-1981/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-2198/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-2270/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-2271/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-2391/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-2392/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-2538/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-2841/\"\n );\n # https://www.suse.com/support/update/announcement/2016/suse-su-20160955-1/\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?2a2bba1e\"\n );\n script_set_attribute(\n attribute:\"solution\",\n value:\n\"To install this SUSE Security Update use YaST online_update.\nAlternatively you can run the command listed for your product :\n\nSUSE Linux Enterprise Software Development Kit 11-SP4 :\n\nzypper in -t patch sdksp4-xen-12492=1\n\nSUSE Linux Enterprise Server 11-SP4 :\n\nzypper in -t patch slessp4-xen-12492=1\n\nSUSE Linux Enterprise Desktop 11-SP4 :\n\nzypper in -t patch sledsp4-xen-12492=1\n\nSUSE Linux Enterprise Debuginfo 11-SP4 :\n\nzypper in -t patch dbgsp4-xen-12492=1\n\nTo bring your system up-to-date, use 'zypper patch'.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:xen\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:xen-doc-html\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:xen-kmp-default\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:xen-kmp-pae\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:xen-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:xen-tools\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:xen-tools-domU\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:11\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2014/11/04\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/04/05\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/04/07\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nos_ver = pregmatch(pattern: \"^(SLE(S|D)\\d+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"SUSE\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLED11|SLES11)$\", string:os_ver)) audit(AUDIT_OS_NOT, \"SUSE SLED11 / SLES11\", \"SUSE \" + os_ver);\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^i[3-6]86$\" && \"x86_64\" >!< cpu && \"s390x\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"SUSE \" + os_ver, cpu);\nif (cpu >!< \"i386|i486|i586|i686|x86_64\") audit(AUDIT_ARCH_NOT, \"i386 / i486 / i586 / i686 / x86_64\", cpu);\n\n\nsp = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(sp)) sp = \"0\";\nif (os_ver == \"SLES11\" && (! preg(pattern:\"^(4)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLES11 SP4\", os_ver + \" SP\" + sp);\nif (os_ver == \"SLED11\" && (! preg(pattern:\"^(4)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLED11 SP4\", os_ver + \" SP\" + sp);\n\n\nflag = 0;\nif (rpm_check(release:\"SLES11\", sp:\"4\", cpu:\"x86_64\", reference:\"xen-kmp-default-4.4.4_02_3.0.101_68-32.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"4\", cpu:\"x86_64\", reference:\"xen-libs-4.4.4_02-32.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"4\", cpu:\"x86_64\", reference:\"xen-tools-domU-4.4.4_02-32.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"4\", cpu:\"x86_64\", reference:\"xen-4.4.4_02-32.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"4\", cpu:\"x86_64\", reference:\"xen-doc-html-4.4.4_02-32.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"4\", cpu:\"x86_64\", reference:\"xen-libs-32bit-4.4.4_02-32.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"4\", cpu:\"x86_64\", reference:\"xen-tools-4.4.4_02-32.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"4\", cpu:\"x86_64\", reference:\"xen-kmp-pae-4.4.4_02_3.0.101_68-32.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"4\", cpu:\"i586\", reference:\"xen-kmp-default-4.4.4_02_3.0.101_68-32.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"4\", cpu:\"i586\", reference:\"xen-libs-4.4.4_02-32.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"4\", cpu:\"i586\", reference:\"xen-tools-domU-4.4.4_02-32.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"4\", cpu:\"i586\", reference:\"xen-kmp-pae-4.4.4_02_3.0.101_68-32.1\")) flag++;\nif (rpm_check(release:\"SLED11\", sp:\"4\", cpu:\"x86_64\", reference:\"xen-kmp-default-4.4.4_02_3.0.101_68-32.1\")) flag++;\nif (rpm_check(release:\"SLED11\", sp:\"4\", cpu:\"x86_64\", reference:\"xen-libs-4.4.4_02-32.1\")) flag++;\nif (rpm_check(release:\"SLED11\", sp:\"4\", cpu:\"x86_64\", reference:\"xen-tools-domU-4.4.4_02-32.1\")) flag++;\nif (rpm_check(release:\"SLED11\", sp:\"4\", cpu:\"x86_64\", reference:\"xen-4.4.4_02-32.1\")) flag++;\nif (rpm_check(release:\"SLED11\", sp:\"4\", cpu:\"x86_64\", reference:\"xen-doc-html-4.4.4_02-32.1\")) flag++;\nif (rpm_check(release:\"SLED11\", sp:\"4\", cpu:\"x86_64\", reference:\"xen-libs-32bit-4.4.4_02-32.1\")) flag++;\nif (rpm_check(release:\"SLED11\", sp:\"4\", cpu:\"x86_64\", reference:\"xen-tools-4.4.4_02-32.1\")) flag++;\nif (rpm_check(release:\"SLED11\", sp:\"4\", cpu:\"x86_64\", reference:\"xen-kmp-pae-4.4.4_02_3.0.101_68-32.1\")) flag++;\nif (rpm_check(release:\"SLED11\", sp:\"4\", cpu:\"i586\", reference:\"xen-kmp-default-4.4.4_02_3.0.101_68-32.1\")) flag++;\nif (rpm_check(release:\"SLED11\", sp:\"4\", cpu:\"i586\", reference:\"xen-libs-4.4.4_02-32.1\")) flag++;\nif (rpm_check(release:\"SLED11\", sp:\"4\", cpu:\"i586\", reference:\"xen-tools-domU-4.4.4_02-32.1\")) flag++;\nif (rpm_check(release:\"SLED11\", sp:\"4\", cpu:\"i586\", reference:\"xen-kmp-pae-4.4.4_02_3.0.101_68-32.1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"xen\");\n}\n", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2023-01-11T16:32:49", "description": "The remote host is affected by the vulnerability described in GLSA-201602-01 (QEMU: Multiple vulnerabilities)\n\n Multiple vulnerabilities have been discovered in QEMU. Please review the CVE identifiers referenced below for details.\n Impact :\n\n A remote attacker might cause a Denial of Service or gain escalated privileges from a guest VM.\n Workaround :\n\n There is no known workaround at this time.", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 10.0, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.0", "userInteraction": "NONE"}, "impactScore": 6.0}, "published": "2016-02-05T00:00:00", "type": "nessus", "title": "GLSA-201602-01 : QEMU: Multiple vulnerabilities (Venom)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": true, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-1779", "CVE-2015-3456", "CVE-2015-5225", "CVE-2015-5278", "CVE-2015-5279", "CVE-2015-5745", "CVE-2015-6815", "CVE-2015-6855", "CVE-2015-7295", "CVE-2015-7504", "CVE-2015-7512", "CVE-2015-7549", "CVE-2015-8345", "CVE-2015-8504", "CVE-2015-8556", "CVE-2015-8558", "CVE-2015-8567", "CVE-2015-8568", "CVE-2015-8666", "CVE-2015-8701", "CVE-2015-8743", "CVE-2015-8744", "CVE-2015-8745", "CVE-2016-1568"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:gentoo:linux:qemu", "cpe:/o:gentoo:linux"], "id": "GENTOO_GLSA-201602-01.NASL", "href": "https://www.tenable.com/plugins/nessus/88587", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Gentoo Linux Security Advisory GLSA 201602-01.\n#\n# The advisory text is Copyright (C) 2001-2018 Gentoo Foundation, Inc.\n# and licensed under the Creative Commons - Attribution / Share Alike \n# license. See http://creativecommons.org/licenses/by-sa/3.0/\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(88587);\n script_version(\"2.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2015-1779\", \"CVE-2015-3456\", \"CVE-2015-5225\", \"CVE-2015-5278\", \"CVE-2015-5279\", \"CVE-2015-5745\", \"CVE-2015-6815\", \"CVE-2015-6855\", \"CVE-2015-7295\", \"CVE-2015-7504\", \"CVE-2015-7512\", \"CVE-2015-7549\", \"CVE-2015-8345\", \"CVE-2015-8504\", \"CVE-2015-8556\", \"CVE-2015-8558\", \"CVE-2015-8567\", \"CVE-2015-8568\", \"CVE-2015-8666\", \"CVE-2015-8701\", \"CVE-2015-8743\", \"CVE-2015-8744\", \"CVE-2015-8745\", \"CVE-2016-1568\");\n script_xref(name:\"GLSA\", value:\"201602-01\");\n\n script_name(english:\"GLSA-201602-01 : QEMU: Multiple vulnerabilities (Venom)\");\n script_summary(english:\"Checks for updated package(s) in /var/db/pkg\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Gentoo host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The remote host is affected by the vulnerability described in GLSA-201602-01\n(QEMU: Multiple vulnerabilities)\n\n Multiple vulnerabilities have been discovered in QEMU. Please review the\n CVE identifiers referenced below for details.\n \nImpact :\n\n A remote attacker might cause a Denial of Service or gain escalated\n privileges from a guest VM.\n \nWorkaround :\n\n There is no known workaround at this time.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security.gentoo.org/glsa/201602-01\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"All QEMU users should upgrade to the latest version:\n # emerge --sync\n # emerge --ask --oneshot --verbose '>=app-emulation/qemu-2.5.0-r1'\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:F/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_core\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:gentoo:linux:qemu\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:gentoo:linux\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/02/04\");\n script_set_attribute(attribute:\"in_the_news\", value:\"true\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/02/05\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Gentoo Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Gentoo/release\", \"Host/Gentoo/qpkg-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"qpkg.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Gentoo/release\")) audit(AUDIT_OS_NOT, \"Gentoo\");\nif (!get_kb_item(\"Host/Gentoo/qpkg-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (qpkg_check(package:\"app-emulation/qemu\", unaffected:make_list(\"ge 2.5.0-r1\"), vulnerable:make_list(\"lt 2.5.0-r1\"))) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = qpkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"QEMU\");\n}\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-11T16:37:10", "description": "xen was updated to fix 27 security issues.\n\nThese security issues were fixed :\n\n - CVE-2013-4533: Buffer overflow in the pxa2xx_ssp_load function in hw/arm/pxa2xx.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted s->rx_level value in a savevm image (bsc#864655).\n\n - CVE-2013-4534: Buffer overflow in hw/intc/openpic.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via vectors related to IRQDest elements (bsc#864811).\n\n - CVE-2013-4537: The ssi_sd_transfer function in hw/sd/ssi-sd.c allowed remote attackers to execute arbitrary code via a crafted arglen value in a savevm image (bsc#864391).\n\n - CVE-2013-4538: Multiple buffer overflows in the ssd0323_load function in hw/display/ssd0323.c allowed remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via crafted (1) cmd_len, (2) row, or (3) col values; (4) row_start and row_end values; or (5) col_star and col_end values in a savevm image (bsc#864769).\n\n - CVE-2013-4539: Multiple buffer overflows in the tsc210x_load function in hw/input/tsc210x.c might have allowed remote attackers to execute arbitrary code via a crafted (1) precision, (2) nextprecision, (3) function, or (4) nextfunction value in a savevm image (bsc#864805).\n\n - CVE-2014-0222: Integer overflow in the qcow_open function in block/qcow.c allowed remote attackers to cause a denial of service (crash) via a large L2 table in a QCOW version 1 image (bsc#877642).\n\n - CVE-2014-3640: The sosendto function in slirp/udp.c allowed local users to cause a denial of service (NULL pointer dereference) by sending a udp packet with a value of 0 in the source port and address, which triggers access of an uninitialized socket (bsc#897654).\n\n - CVE-2014-3689: The vmware-vga driver (hw/display/vmware_vga.c) allowed local guest users to write to qemu memory locations and gain privileges via unspecified parameters related to rectangle handling (bsc#901508).\n\n - CVE-2014-7815: The set_pixel_format function in ui/vnc.c allowed remote attackers to cause a denial of service (crash) via a small bytes_per_pixel value (bsc#902737).\n\n - CVE-2015-5278: Infinite loop in ne2000_receive() function (bsc#945989).\n\n - CVE-2015-7512: Buffer overflow in the pcnet_receive function in hw/net/pcnet.c, when a guest NIC has a larger MTU, allowed remote attackers to cause a denial of service (guest OS crash) or execute arbitrary code via a large packet (bsc#957162).\n\n - CVE-2015-8504: VNC: floating point exception (bsc#958491).\n\n - CVE-2015-8550: Paravirtualized drivers were incautious about shared memory contents (XSA-155) (bsc#957988).\n\n - CVE-2015-8554: qemu-dm buffer overrun in MSI-X handling (XSA-164) (bsc#958007).\n\n - CVE-2015-8555: Information leak in legacy x86 FPU/XMM initialization (XSA-165) (bsc#958009).\n\n - CVE-2015-8558: Infinite loop in ehci_advance_state resulted in DoS (bsc#959005).\n\n - CVE-2015-8743: ne2000: OOB memory access in ioport r/w functions (bsc#960725).\n\n - CVE-2015-8745: Reading IMR registers lead to a crash via assert(2) call (bsc#960707).\n\n - CVE-2016-1570: The PV superpage functionality in arch/x86/mm.c allowed local PV guests to obtain sensitive information, cause a denial of service, gain privileges, or have unspecified other impact via a crafted page identifier (MFN) to the (1) MMUEXT_MARK_SUPER or (2) MMUEXT_UNMARK_SUPER sub-op in the HYPERVISOR_mmuext_op hypercall or (3) unknown vectors related to page table updates (bsc#960861).\n\n - CVE-2016-1571: VMX: intercept issue with INVLPG on non-canonical address (XSA-168) (bsc#960862).\n\n - CVE-2016-1714: nvram: OOB r/w access in processing firmware configurations (bsc#961691).\n\n - CVE-2016-1981: e1000 infinite loop in start_xmit and e1000_receive_iov routines (bsc#963782).\n\n - CVE-2016-2270: Xen allowed local guest administrators to cause a denial of service (host reboot) via vectors related to multiple mappings of MMIO pages with different cachability settings (bsc#965315).\n\n - CVE-2016-2271: VMX when using an Intel or Cyrix CPU, allowed local HVM guest users to cause a denial of service (guest crash) via vectors related to a non-canonical RIP (bsc#965317).\n\n - CVE-2016-2391: usb: multiple eof_timers in ohci module lead to NULL pointer dereference (bsc#967013).\n\n - CVE-2016-2841: ne2000: Infinite loop in ne2000_receive (bsc#969350).\n\n - XSA-166: ioreq handling possibly susceptible to multiple read issue (bsc#958523).\n\nThe update package also includes non-security fixes. See advisory for details.\n\nNote that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"exploitabilityScore": 2.2, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 9.0, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 6.0}, "published": "2016-04-27T00:00:00", "type": "nessus", "title": "SUSE SLES11 Security Update : xen (SUSE-SU-2016:1154-1)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-4533", "CVE-2013-4534", "CVE-2013-4537", "CVE-2013-4538", "CVE-2013-4539", "CVE-2014-0222", "CVE-2014-3640", "CVE-2014-3689", "CVE-2014-7815", "CVE-2015-5278", "CVE-2015-7512", "CVE-2015-8504", "CVE-2015-8550", "CVE-2015-8554", "CVE-2015-8555", "CVE-2015-8558", "CVE-2015-8743", "CVE-2015-8745", "CVE-2016-1570", "CVE-2016-1571", "CVE-2016-1714", "CVE-2016-1981", "CVE-2016-2270", "CVE-2016-2271", "CVE-2016-2391", "CVE-2016-2841"], "modified": "2021-01-19T00:00:00", "cpe": ["p-cpe:/a:novell:suse_linux:xen", "p-cpe:/a:novell:suse_linux:xen-devel", "p-cpe:/a:novell:suse_linux:xen-doc-html", "p-cpe:/a:novell:suse_linux:xen-doc-pdf", "p-cpe:/a:novell:suse_linux:xen-kmp-default", "p-cpe:/a:novell:suse_linux:xen-kmp-pae", "p-cpe:/a:novell:suse_linux:xen-kmp-trace", "p-cpe:/a:novell:suse_linux:xen-libs", "p-cpe:/a:novell:suse_linux:xen-tools", "p-cpe:/a:novell:suse_linux:xen-tools-domU", "cpe:/o:novell:suse_linux:11"], "id": "SUSE_SU-2016-1154-1.NASL", "href": "https://www.tenable.com/plugins/nessus/90759", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from SUSE update advisory SUSE-SU-2016:1154-1.\n# The text itself is copyright (C) SUSE.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(90759);\n script_version(\"2.12\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/19\");\n\n script_cve_id(\"CVE-2013-4533\", \"CVE-2013-4534\", \"CVE-2013-4537\", \"CVE-2013-4538\", \"CVE-2013-4539\", \"CVE-2014-0222\", \"CVE-2014-3640\", \"CVE-2014-3689\", \"CVE-2014-7815\", \"CVE-2015-5278\", \"CVE-2015-7512\", \"CVE-2015-8504\", \"CVE-2015-8550\", \"CVE-2015-8554\", \"CVE-2015-8555\", \"CVE-2015-8558\", \"CVE-2015-8743\", \"CVE-2015-8745\", \"CVE-2016-1570\", \"CVE-2016-1571\", \"CVE-2016-1714\", \"CVE-2016-1981\", \"CVE-2016-2270\", \"CVE-2016-2271\", \"CVE-2016-2391\", \"CVE-2016-2841\");\n script_bugtraq_id(67357, 67483, 70237, 70997, 70998);\n\n script_name(english:\"SUSE SLES11 Security Update : xen (SUSE-SU-2016:1154-1)\");\n script_summary(english:\"Checks rpm output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote SUSE host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"xen was updated to fix 27 security issues.\n\nThese security issues were fixed :\n\n - CVE-2013-4533: Buffer overflow in the pxa2xx_ssp_load\n function in hw/arm/pxa2xx.c allowed remote attackers to\n cause a denial of service or possibly execute arbitrary\n code via a crafted s->rx_level value in a savevm image\n (bsc#864655).\n\n - CVE-2013-4534: Buffer overflow in hw/intc/openpic.c\n allowed remote attackers to cause a denial of service or\n possibly execute arbitrary code via vectors related to\n IRQDest elements (bsc#864811).\n\n - CVE-2013-4537: The ssi_sd_transfer function in\n hw/sd/ssi-sd.c allowed remote attackers to execute\n arbitrary code via a crafted arglen value in a savevm\n image (bsc#864391).\n\n - CVE-2013-4538: Multiple buffer overflows in the\n ssd0323_load function in hw/display/ssd0323.c allowed\n remote attackers to cause a denial of service (memory\n corruption) or possibly execute arbitrary code via\n crafted (1) cmd_len, (2) row, or (3) col values; (4)\n row_start and row_end values; or (5) col_star and\n col_end values in a savevm image (bsc#864769).\n\n - CVE-2013-4539: Multiple buffer overflows in the\n tsc210x_load function in hw/input/tsc210x.c might have\n allowed remote attackers to execute arbitrary code via a\n crafted (1) precision, (2) nextprecision, (3) function,\n or (4) nextfunction value in a savevm image\n (bsc#864805).\n\n - CVE-2014-0222: Integer overflow in the qcow_open\n function in block/qcow.c allowed remote attackers to\n cause a denial of service (crash) via a large L2 table\n in a QCOW version 1 image (bsc#877642).\n\n - CVE-2014-3640: The sosendto function in slirp/udp.c\n allowed local users to cause a denial of service (NULL\n pointer dereference) by sending a udp packet with a\n value of 0 in the source port and address, which\n triggers access of an uninitialized socket (bsc#897654).\n\n - CVE-2014-3689: The vmware-vga driver\n (hw/display/vmware_vga.c) allowed local guest users to\n write to qemu memory locations and gain privileges via\n unspecified parameters related to rectangle handling\n (bsc#901508).\n\n - CVE-2014-7815: The set_pixel_format function in ui/vnc.c\n allowed remote attackers to cause a denial of service\n (crash) via a small bytes_per_pixel value (bsc#902737).\n\n - CVE-2015-5278: Infinite loop in ne2000_receive()\n function (bsc#945989).\n\n - CVE-2015-7512: Buffer overflow in the pcnet_receive\n function in hw/net/pcnet.c, when a guest NIC has a\n larger MTU, allowed remote attackers to cause a denial\n of service (guest OS crash) or execute arbitrary code\n via a large packet (bsc#957162).\n\n - CVE-2015-8504: VNC: floating point exception\n (bsc#958491).\n\n - CVE-2015-8550: Paravirtualized drivers were incautious\n about shared memory contents (XSA-155) (bsc#957988).\n\n - CVE-2015-8554: qemu-dm buffer overrun in MSI-X handling\n (XSA-164) (bsc#958007).\n\n - CVE-2015-8555: Information leak in legacy x86 FPU/XMM\n initialization (XSA-165) (bsc#958009).\n\n - CVE-2015-8558: Infinite loop in ehci_advance_state\n resulted in DoS (bsc#959005).\n\n - CVE-2015-8743: ne2000: OOB memory access in ioport r/w\n functions (bsc#960725).\n\n - CVE-2015-8745: Reading IMR registers lead to a crash via\n assert(2) call (bsc#960707).\n\n - CVE-2016-1570: The PV superpage functionality in\n arch/x86/mm.c allowed local PV guests to obtain\n sensitive information, cause a denial of service, gain\n privileges, or have unspecified other impact via a\n crafted page identifier (MFN) to the (1)\n MMUEXT_MARK_SUPER or (2) MMUEXT_UNMARK_SUPER sub-op in\n the HYPERVISOR_mmuext_op hypercall or (3) unknown\n vectors related to page table updates (bsc#960861).\n\n - CVE-2016-1571: VMX: intercept issue with INVLPG on\n non-canonical address (XSA-168) (bsc#960862).\n\n - CVE-2016-1714: nvram: OOB r/w access in processing\n firmware configurations (bsc#961691).\n\n - CVE-2016-1981: e1000 infinite loop in start_xmit and\n e1000_receive_iov routines (bsc#963782).\n\n - CVE-2016-2270: Xen allowed local guest administrators to\n cause a denial of service (host reboot) via vectors\n related to multiple mappings of MMIO pages with\n different cachability settings (bsc#965315).\n\n - CVE-2016-2271: VMX when using an Intel or Cyrix CPU,\n allowed local HVM guest users to cause a denial of\n service (guest crash) via vectors related to a\n non-canonical RIP (bsc#965317).\n\n - CVE-2016-2391: usb: multiple eof_timers in ohci module\n lead to NULL pointer dereference (bsc#967013).\n\n - CVE-2016-2841: ne2000: Infinite loop in ne2000_receive\n (bsc#969350).\n\n - XSA-166: ioreq handling possibly susceptible to multiple\n read issue (bsc#958523).\n\nThe update package also includes non-security fixes. See advisory for\ndetails.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=864391\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=864655\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=864769\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=864805\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=864811\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=877642\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=897654\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=901508\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=902737\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=945989\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=957162\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=957988\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=958007\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=958009\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=958491\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=958523\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=959005\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=960707\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=960725\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=960861\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=960862\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=961691\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=963782\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=965315\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=965317\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=967013\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=967630\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=969350\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2013-4533/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2013-4534/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2013-4537/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2013-4538/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2013-4539/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2014-0222/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2014-3640/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2014-3689/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2014-7815/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-5278/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-7512/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8504/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8550/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8554/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8555/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8558/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8743/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8745/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-1570/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-1571/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-1714/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-1981/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-2270/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-2271/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-2391/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-2841/\"\n );\n # https://www.suse.com/support/update/announcement/2016/suse-su-20161154-1/\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?12440b99\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"To install this SUSE Security Update use YaST online_update.\nAlternatively you can run the command listed for your product :\n\nSUSE Linux Enterprise Server 11-SP2-LTSS :\n\nzypper in -t patch slessp2-xen-12530=1\n\nTo bring your system up-to-date, use 'zypper patch'.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:xen\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:xen-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:xen-doc-html\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:xen-doc-pdf\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:xen-kmp-default\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:xen-kmp-pae\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:xen-kmp-trace\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:xen-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:xen-tools\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:xen-tools-domU\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:11\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2014/11/04\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/04/26\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/04/27\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nos_ver = pregmatch(pattern: \"^(SLE(S|D)\\d+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"SUSE\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLES11)$\", string:os_ver)) audit(AUDIT_OS_NOT, \"SUSE SLES11\", \"SUSE \" + os_ver);\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^i[3-6]86$\" && \"x86_64\" >!< cpu && \"s390x\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"SUSE \" + os_ver, cpu);\nif (cpu >!< \"i386|i486|i586|i686|x86_64\") audit(AUDIT_ARCH_NOT, \"i386 / i486 / i586 / i686 / x86_64\", cpu);\n\n\nsp = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(sp)) sp = \"0\";\nif (os_ver == \"SLES11\" && (! preg(pattern:\"^(2)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLES11 SP2\", os_ver + \" SP\" + sp);\n\n\nflag = 0;\nif (rpm_check(release:\"SLES11\", sp:\"2\", cpu:\"x86_64\", reference:\"xen-devel-4.1.6_08-26.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"2\", cpu:\"x86_64\", reference:\"xen-kmp-default-4.1.6_08_3.0.101_0.7.37-26.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"2\", cpu:\"x86_64\", reference:\"xen-kmp-trace-4.1.6_08_3.0.101_0.7.37-26.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"2\", cpu:\"x86_64\", reference:\"xen-libs-4.1.6_08-26.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"2\", cpu:\"x86_64\", reference:\"xen-tools-domU-4.1.6_08-26.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"2\", cpu:\"x86_64\", reference:\"xen-4.1.6_08-26.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"2\", cpu:\"x86_64\", reference:\"xen-doc-html-4.1.6_08-26.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"2\", cpu:\"x86_64\", reference:\"xen-doc-pdf-4.1.6_08-26.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"2\", cpu:\"x86_64\", reference:\"xen-libs-32bit-4.1.6_08-26.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"2\", cpu:\"x86_64\", reference:\"xen-tools-4.1.6_08-26.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"2\", cpu:\"x86_64\", reference:\"xen-kmp-pae-4.1.6_08_3.0.101_0.7.37-26.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"2\", cpu:\"i586\", reference:\"xen-devel-4.1.6_08-26.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"2\", cpu:\"i586\", reference:\"xen-kmp-default-4.1.6_08_3.0.101_0.7.37-26.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"2\", cpu:\"i586\", reference:\"xen-kmp-trace-4.1.6_08_3.0.101_0.7.37-26.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"2\", cpu:\"i586\", reference:\"xen-libs-4.1.6_08-26.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"2\", cpu:\"i586\", reference:\"xen-tools-domU-4.1.6_08-26.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"2\", cpu:\"i586\", reference:\"xen-kmp-pae-4.1.6_08_3.0.101_0.7.37-26.1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"xen\");\n}\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2021-08-19T12:40:06", "description": "This update for xen fixes the following issues :\n\nThese security issues were fixed :\n\n - CVE-2016-7092: The get_page_from_l3e function in arch/x86/mm.c in Xen allowed local 32-bit PV guest OS administrators to gain host OS privileges via vectors related to L3 recursive pagetables (bsc#995785)\n\n - CVE-2016-7093: Xen allowed local HVM guest OS administrators to overwrite hypervisor memory and consequently gain host OS privileges by leveraging mishandling of instruction pointer truncation during emulation (bsc#995789)\n\n - CVE-2016-7094: Buffer overflow in Xen allowed local x86 HVM guest OS administrators on guests running with shadow paging to cause a denial of service via a pagetable update (bsc#995792)\n\n - CVE-2016-6836: VMWARE VMXNET3 NIC device support was leaging information leakage. A privileged user inside guest could have used this to leak host memory bytes to a guest (boo#994761)\n\n - CVE-2016-6888: Integer overflow in packet initialisation in VMXNET3 device driver. A privileged user inside guest could have used this flaw to crash the Qemu instance resulting in DoS (bsc#994772)\n\n - CVE-2016-6833: Use-after-free issue in the VMWARE VMXNET3 NIC device support. A privileged user inside guest could have used this issue to crash the Qemu instance resulting in DoS (boo#994775)\n\n - CVE-2016-6835: Buffer overflow in the VMWARE VMXNET3 NIC device support, causing an OOB read access (bsc#994625)\n\n - CVE-2016-6834: A infinite loop during packet fragmentation in the VMWARE VMXNET3 NIC device support allowed privileged user inside guest to crash the Qemu instance resulting in DoS (bsc#994421)\n\n - CVE-2016-6258: The PV pagetable code in arch/x86/mm.c in Xen allowed local 32-bit PV guest OS administrators to gain host OS privileges by leveraging fast-paths for updating pagetable entries (bsc#988675)\n\n - CVE-2016-6259: Xen did not implement Supervisor Mode Access Prevention (SMAP) whitelisting in 32-bit exception and event delivery, which allowed local 32-bit PV guest OS kernels to cause a denial of service (hypervisor and VM crash) by triggering a safety check (bsc#988676)\n\n - CVE-2016-5403: The virtqueue_pop function in hw/virtio/virtio.c in QEMU allowed local guest OS administrators to cause a denial of service (memory consumption and QEMU process crash) by submitting requests without waiting for completion (boo#990923)\n\n - CVE-2016-6351: The esp_do_dma function in hw/scsi/esp.c, when built with ESP/NCR53C9x controller emulation support, allowed local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) or execute arbitrary code on the host via vectors involving DMA read into ESP command buffer (bsc#990843)\n\n - CVE-2016-6258: The PV pagetable code in arch/x86/mm.c in Xen allowed local 32-bit PV guest OS administrators to gain host OS privileges by leveraging fast-paths for updating pagetable entries (bsc#988675)\n\n - CVE-2016-6259: Xen did not implement Supervisor Mode Access Prevention (SMAP) whitelisting in 32-bit exception and event delivery, which allowed local 32-bit PV guest OS kernels to cause a denial of service (hypervisor and VM crash) by triggering a safety check (bsc#988676)\n\n - CVE-2016-5337: The megasas_ctrl_get_info function in hw/scsi/megasas.c in QEMU allowed local guest OS administrators to obtain sensitive host memory information via vectors related to reading device control information (bsc#983973)\n\n - CVE-2016-5338: The (1) esp_reg_read and (2) esp_reg_write functions in hw/scsi/esp.c in QEMU allowed local guest OS administrators to cause a denial of service (QEMU process crash) or execute arbitrary code on the QEMU host via vectors related to the information transfer buffer (bsc#983984)\n\n - CVE-2016-5238: The get_cmd function in hw/scsi/esp.c in QEMU allowed local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) via vectors related to reading from the information transfer buffer in non-DMA mode (bsc#982960)\n\n - CVE-2016-4453: The vmsvga_fifo_run function in hw/display/vmware_vga.c in QEMU allowed local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via a VGA command (bsc#982225)\n\n - CVE-2016-4454: The vmsvga_fifo_read_raw function in hw/display/vmware_vga.c in QEMU allowed local guest OS administrators to obtain sensitive host memory information or cause a denial of service (QEMU process crash) by changing FIFO registers and issuing a VGA command, which triggers an out-of-bounds read (bsc#982224)\n\n - CVE-2016-5126: Heap-based buffer overflow in the iscsi_aio_ioctl function in block/iscsi.c in QEMU allowed local guest OS users to cause a denial of service (QEMU process crash) or possibly execute arbitrary code via a crafted iSCSI asynchronous I/O ioctl call (bsc#982286)\n\n - CVE-2016-5105: The megasas_dcmd_cfg_read function in hw/scsi/megasas.c in QEMU, when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, used an uninitialized variable, which allowed local guest administrators to read host memory via vectors involving a MegaRAID Firmware Interface (MFI) command (bsc#982024)\n\n - CVE-2016-5106: The megasas_dcmd_set_properties function in hw/scsi/megasas.c in QEMU, when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, allowed local guest administrators to cause a denial of service (out-of-bounds write access) via vectors involving a MegaRAID Firmware Interface (MFI) command (bsc#982025)\n\n - CVE-2016-5107: The megasas_lookup_frame function in QEMU, when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, allowed local guest OS administrators to cause a denial of service (out-of-bounds read and crash) via unspecified vectors (bsc#982026)\n\n - CVE-2016-4963: The libxl device-handling allowed local guest OS users with access to the driver domain to cause a denial of service (management tool confusion) by manipulating information in the backend directories in xenstore (bsc#979670)\n\n - CVE-2016-4962: The libxl device-handling allowed local OS guest administrators to cause a denial of service (resource consumption or management facility confusion) or gain host OS privileges by manipulating information in guest controlled areas of xenstore (bsc#979620)\n\n - CVE-2016-4952: Out-of-bounds access issue in pvsci_ring_init_msg/data routines (bsc#981276)\n\n - CVE-2016-3710: The VGA module improperly performed bounds checking on banked access to video memory, which allowed local guest OS administrators to execute arbitrary code on the host by changing access modes after setting the bank register, aka the 'Dark Portal' issue (bsc#978164)\n\n - CVE-2014-3672: The qemu implementation in libvirt Xen allowed local guest OS users to cause a denial of service (host disk consumption) by writing to stdout or stderr (bsc#981264)\n\n - CVE-2016-4441: The get_cmd function in the 53C9X Fast SCSI Controller (FSC) support did not properly check DMA length, which allowed local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) via unspecified vectors, involving an SCSI command (bsc#980724)\n\n - CVE-2016-4439: The esp_reg_write function in the 53C9X Fast SCSI Controller (FSC) support did not properly check command buffer length, which allowed local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) or potentially execute arbitrary code on the host via unspecified vectors (bsc#980716)\n\n - CVE-2016-3960: Integer overflow in the x86 shadow pagetable code allowed local guest OS users to cause a denial of service (host crash) or possibly gain privileges by shadowing a superpage mapping (bsc#974038)\n\n - CVE-2016-3158: The xrstor function did not properly handle writes to the hardware FSW.ES bit when running on AMD64 processors, which allowed local guest OS users to obtain sensitive register content information from another guest by leveraging pending exception and mask bits (bsc#973188)\n\n - CVE-2016-3159: The fpu_fxrstor function in arch/x86/i387.c did not properly handle writes to the hardware FSW.ES bit when running on AMD64 processors, which allowed local guest OS users to obtain sensitive register content information from another guest by leveraging pending exception and mask bits (bsc#973188)\n\n - CVE-2016-4037: The ehci_advance_state function in hw/usb/hcd-ehci.c allowed local guest OS administrators to cause a denial of service (infinite loop and CPU consumption) via a circular split isochronous transfer descriptor (siTD) list (bsc#976111)\n\n - CVE-2016-4020: The patch_instruction function did not initialize the imm32 variable, which allowed local guest OS administrators to obtain sensitive information from host stack memory by accessing the Task Priority Register (TPR) (bsc#975907)\n\n - CVE-2016-4001: Buffer overflow in the stellaris_enet_receive function, when the Stellaris ethernet controller is configured to accept large packets, allowed remote attackers to cause a denial of service (QEMU crash) via a large packet (bsc#975130)\n\n - CVE-2016-4002: Buffer overflow in the mipsnet_receive function, when the guest NIC is configured to accept large packets, allowed remote attackers to cause a denial of service (memory corruption and QEMU crash) or possibly execute arbitrary code via a packet larger than 1514 bytes (bsc#975138)\n\n - CVE-2016-4480: The guest_walk_tables function in arch/x86/mm/guest_walk.c in Xen did not properly handle the Page Size (PS) page table entry bit at the L4 and L3 page table levels, which might have allowed local guest OS users to gain privileges via a crafted mapping of memory (bsc#978295)\n\nThese non-security issues were fixed :\n\n - boo#991934: xen hypervisor crash in csched_acct\n\n - boo#992224: During boot of Xen Hypervisor, Failed to get contiguous memory for DMA from Xen\n\n - boo#955104: Virsh reports error 'one or more references were leaked after disconnect from hypervisor' when 'virsh save' failed due to 'no response from client after 6 keepalive messages'\n\n - boo#959552: Migration of HVM guest leads into libvirt segmentation fault\n\n - boo#993665: Migration of xen guests finishes in: One or more references were leaked after disconnect from the hypervisor\n\n - boo#959330: Guest migrations using virsh results in error 'Internal error: received hangup / error event on socket'\n\n - boo#990500: VM virsh migration fails with keepalive error: ':virKeepAliveTimerInternal:143 : No response from client'\n\n - boo#953518: Unplug also SCSI disks in qemu-xen-traditional for upstream unplug protocol\n\n - boo#953518: xen_platform: unplug also SCSI disks in qemu-xen\n\n - boo#971949: Support (by ignoring) xl migrate --live. xl migrations are always live \n\n - boo#970135: New virtualization project clock test randomly fails on Xen\n\n - boo#990970: Add PMU support for Intel E7-8867 v4 (fam=6, model=79)\n\n - boo#985503: vif-route broken\n\n - boo#961100: Migrate a fv guest from sles12 to sles12sp1 fails remove patch because it can not fix the bug\n\n - boo#978413: PV guest upgrade from sles11sp4 to sles12sp2 alpha3 failed on sles11sp4 xen host.\n\n - boo#986586: Out of memory (oom) during boot on 'modprobe xenblk' (non xen kernel) init.50-hvm-xen_conf\n\n - boo#900418: Dump cannot be performed on SLES12 XEN\n\n - boo#953339, boo#953362, boo#953518, boo#984981:\n Implement SUSE specific unplug protocol for emulated PCI devices in PVonHVM guests to qemu-xen-upstream \n\n - boo#954872: script block-dmmd not working as expected - libxl: error: libxl_dm.c (Additional fixes) block-dmmd\n\n - boo#982695: xen-4.5.2 qemu fails to boot HVM guest from xvda \n\n - boo#958848: HVM guest crash at /usr/src/packages/BUILD/ xen-4.4.2-testing/obj/default/balloon/balloon.c:407\n\n - boo#949889: Fail to install 32-bit paravirt VM under SLES12SP1Beta3 XEN\n\n - boo#954872: script block-dmmd not working as expected - libxl: error: libxl_dm.c (another modification) block-dmmd\n\n - boo#961600: Poor performance when Xen HVM domU configured with max memory greater than current memory\n\n - boo#963161: Windows VM getting stuck during load while a VF is assigned to it after upgrading to latest maintenance updates\n\n - boo#976058: Xen error running simple HVM guest (Post Alpha 2 xen+qemu)\n\n - boo#961100: Migrate a fv guest from sles12 to sles12sp1 on xen fails for 'Domain is not running on destination host'. qemu-ignore-kvm-tpr-opt-on-migration.patch \n\n - boo#973631: AWS EC2 kdump issue\n\n - boo#964427: Discarding device blocks: failed - Input/output error", "cvss3": {"score": 9, "vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H"}, "published": "2016-10-12T00:00:00", "type": "nessus", "title": "openSUSE Security Update : xen (openSUSE-2016-1170) (Bunker Buster)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2014-3615", "CVE-2014-3672", "CVE-2015-7512", "CVE-2015-8504", "CVE-2015-8558", "CVE-2015-8568", "CVE-2015-8613", "CVE-2015-8743", "CVE-2016-1714", "CVE-2016-1981", "CVE-2016-3158", "CVE-2016-3159", "CVE-2016-3710", "CVE-2016-3712", "CVE-2016-3960", "CVE-2016-4001", "CVE-2016-4002", "CVE-2016-4020", "CVE-2016-4037", "CVE-2016-4439", "CVE-2016-4441", "CVE-2016-4453", "CVE-2016-4454", "CVE-2016-4480", "CVE-2016-4952", "CVE-2016-4962", "CVE-2016-4963", "CVE-2016-5105", "CVE-2016-5106", "CVE-2016-5107", "CVE-2016-5126", "CVE-2016-5238", "CVE-2016-5337", "CVE-2016-5338", "CVE-2016-5403", "CVE-2016-6258", "CVE-2016-6259", "CVE-2016-6351", "CVE-2016-6833", "CVE-2016-6834", "CVE-2016-6835", "CVE-2016-6836", "CVE-2016-6888", "CVE-2016-7092", "CVE-2016-7093", "CVE-2016-7094"], "modified": "2021-01-19T00:00:00", "cpe": ["p-cpe:/a:novell:opensuse:xen", "p-cpe:/a:novell:opensuse:xen-debugsource", "p-cpe:/a:novell:opensuse:xen-devel", "p-cpe:/a:novell:opensuse:xen-doc-html", "p-cpe:/a:novell:opensuse:xen-kmp-default", "p-cpe:/a:novell:opensuse:xen-kmp-default-debuginfo", "p-cpe:/a:novell:opensuse:xen-libs", "p-cpe:/a:novell:opensuse:xen-libs-32bit", "p-cpe:/a:novell:opensuse:xen-libs-debuginfo", "p-cpe:/a:novell:opensuse:xen-libs-debuginfo-32bit", "p-cpe:/a:novell:opensuse:xen-tools", "p-cpe:/a:novell:opensuse:xen-tools-debuginfo", "p-cpe:/a:novell:opensuse:xen-tools-domU", "p-cpe:/a:novell:opensuse:xen-tools-domU-debuginfo", "cpe:/o:novell:opensuse:42.1"], "id": "OPENSUSE-2016-1170.NASL", "href": "https://www.tenable.com/plugins/nessus/94000", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update openSUSE-2016-1170.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(94000);\n script_version(\"2.8\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/19\");\n\n script_cve_id(\"CVE-2014-3615\", \"CVE-2014-3672\", \"CVE-2015-7512\", \"CVE-2015-8504\", \"CVE-2015-8558\", \"CVE-2015-8568\", \"CVE-2015-8613\", \"CVE-2015-8743\", \"CVE-2016-1714\", \"CVE-2016-1981\", \"CVE-2016-3158\", \"CVE-2016-3159\", \"CVE-2016-3710\", \"CVE-2016-3712\", \"CVE-2016-3960\", \"CVE-2016-4001\", \"CVE-2016-4002\", \"CVE-2016-4020\", \"CVE-2016-4037\", \"CVE-2016-4439\", \"CVE-2016-4441\", \"CVE-2016-4453\", \"CVE-2016-4454\", \"CVE-2016-4480\", \"CVE-2016-4952\", \"CVE-2016-4962\", \"CVE-2016-4963\", \"CVE-2016-5105\", \"CVE-2016-5106\", \"CVE-2016-5107\", \"CVE-2016-5126\", \"CVE-2016-5238\", \"CVE-2016-5337\", \"CVE-2016-5338\", \"CVE-2016-5403\", \"CVE-2016-6258\", \"CVE-2016-6259\", \"CVE-2016-6351\", \"CVE-2016-6833\", \"CVE-2016-6834\", \"CVE-2016-6835\", \"CVE-2016-6836\", \"CVE-2016-6888\", \"CVE-2016-7092\", \"CVE-2016-7093\", \"CVE-2016-7094\");\n script_xref(name:\"IAVB\", value:\"2016-B-0118-S\");\n script_xref(name:\"IAVB\", value:\"2016-B-0140-S\");\n\n script_name(english:\"openSUSE Security Update : xen (openSUSE-2016-1170) (Bunker Buster)\");\n script_summary(english:\"Check for the openSUSE-2016-1170 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update for xen fixes the following issues :\n\nThese security issues were fixed :\n\n - CVE-2016-7092: The get_page_from_l3e function in\n arch/x86/mm.c in Xen allowed local 32-bit PV guest OS\n administrators to gain host OS privileges via vectors\n related to L3 recursive pagetables (bsc#995785)\n\n - CVE-2016-7093: Xen allowed local HVM guest OS\n administrators to overwrite hypervisor memory and\n consequently gain host OS privileges by leveraging\n mishandling of instruction pointer truncation during\n emulation (bsc#995789)\n\n - CVE-2016-7094: Buffer overflow in Xen allowed local x86\n HVM guest OS administrators on guests running with\n shadow paging to cause a denial of service via a\n pagetable update (bsc#995792)\n\n - CVE-2016-6836: VMWARE VMXNET3 NIC device support was\n leaging information leakage. A privileged user inside\n guest could have used this to leak host memory bytes to\n a guest (boo#994761)\n\n - CVE-2016-6888: Integer overflow in packet initialisation\n in VMXNET3 device driver. A privileged user inside guest\n could have used this flaw to crash the Qemu instance\n resulting in DoS (bsc#994772)\n\n - CVE-2016-6833: Use-after-free issue in the VMWARE\n VMXNET3 NIC device support. A privileged user inside\n guest could have used this issue to crash the Qemu\n instance resulting in DoS (boo#994775)\n\n - CVE-2016-6835: Buffer overflow in the VMWARE VMXNET3 NIC\n device support, causing an OOB read access (bsc#994625)\n\n - CVE-2016-6834: A infinite loop during packet\n fragmentation in the VMWARE VMXNET3 NIC device support\n allowed privileged user inside guest to crash the Qemu\n instance resulting in DoS (bsc#994421)\n\n - CVE-2016-6258: The PV pagetable code in arch/x86/mm.c in\n Xen allowed local 32-bit PV guest OS administrators to\n gain host OS privileges by leveraging fast-paths for\n updating pagetable entries (bsc#988675)\n\n - CVE-2016-6259: Xen did not implement Supervisor Mode\n Access Prevention (SMAP) whitelisting in 32-bit\n exception and event delivery, which allowed local 32-bit\n PV guest OS kernels to cause a denial of service\n (hypervisor and VM crash) by triggering a safety check\n (bsc#988676)\n\n - CVE-2016-5403: The virtqueue_pop function in\n hw/virtio/virtio.c in QEMU allowed local guest OS\n administrators to cause a denial of service (memory\n consumption and QEMU process crash) by submitting\n requests without waiting for completion (boo#990923)\n\n - CVE-2016-6351: The esp_do_dma function in hw/scsi/esp.c,\n when built with ESP/NCR53C9x controller emulation\n support, allowed local guest OS administrators to cause\n a denial of service (out-of-bounds write and QEMU\n process crash) or execute arbitrary code on the host via\n vectors involving DMA read into ESP command buffer\n (bsc#990843)\n\n - CVE-2016-6258: The PV pagetable code in arch/x86/mm.c in\n Xen allowed local 32-bit PV guest OS administrators to\n gain host OS privileges by leveraging fast-paths for\n updating pagetable entries (bsc#988675)\n\n - CVE-2016-6259: Xen did not implement Supervisor Mode\n Access Prevention (SMAP) whitelisting in 32-bit\n exception and event delivery, which allowed local 32-bit\n PV guest OS kernels to cause a denial of service\n (hypervisor and VM crash) by triggering a safety check\n (bsc#988676)\n\n - CVE-2016-5337: The megasas_ctrl_get_info function in\n hw/scsi/megasas.c in QEMU allowed local guest OS\n administrators to obtain sensitive host memory\n information via vectors related to reading device\n control information (bsc#983973)\n\n - CVE-2016-5338: The (1) esp_reg_read and (2)\n esp_reg_write functions in hw/scsi/esp.c in QEMU allowed\n local guest OS administrators to cause a denial of\n service (QEMU process crash) or execute arbitrary code\n on the QEMU host via vectors related to the information\n transfer buffer (bsc#983984)\n\n - CVE-2016-5238: The get_cmd function in hw/scsi/esp.c in\n QEMU allowed local guest OS administrators to cause a\n denial of service (out-of-bounds write and QEMU process\n crash) via vectors related to reading from the\n information transfer buffer in non-DMA mode (bsc#982960)\n\n - CVE-2016-4453: The vmsvga_fifo_run function in\n hw/display/vmware_vga.c in QEMU allowed local guest OS\n administrators to cause a denial of service (infinite\n loop and QEMU process crash) via a VGA command\n (bsc#982225)\n\n - CVE-2016-4454: The vmsvga_fifo_read_raw function in\n hw/display/vmware_vga.c in QEMU allowed local guest OS\n administrators to obtain sensitive host memory\n information or cause a denial of service (QEMU process\n crash) by changing FIFO registers and issuing a VGA\n command, which triggers an out-of-bounds read\n (bsc#982224)\n\n - CVE-2016-5126: Heap-based buffer overflow in the\n iscsi_aio_ioctl function in block/iscsi.c in QEMU\n allowed local guest OS users to cause a denial of\n service (QEMU process crash) or possibly execute\n arbitrary code via a crafted iSCSI asynchronous I/O\n ioctl call (bsc#982286)\n\n - CVE-2016-5105: The megasas_dcmd_cfg_read function in\n hw/scsi/megasas.c in QEMU, when built with MegaRAID SAS\n 8708EM2 Host Bus Adapter emulation support, used an\n uninitialized variable, which allowed local guest\n administrators to read host memory via vectors involving\n a MegaRAID Firmware Interface (MFI) command (bsc#982024)\n\n - CVE-2016-5106: The megasas_dcmd_set_properties function\n in hw/scsi/megasas.c in QEMU, when built with MegaRAID\n SAS 8708EM2 Host Bus Adapter emulation support, allowed\n local guest administrators to cause a denial of service\n (out-of-bounds write access) via vectors involving a\n MegaRAID Firmware Interface (MFI) command (bsc#982025)\n\n - CVE-2016-5107: The megasas_lookup_frame function in\n QEMU, when built with MegaRAID SAS 8708EM2 Host Bus\n Adapter emulation support, allowed local guest OS\n administrators to cause a denial of service\n (out-of-bounds read and crash) via unspecified vectors\n (bsc#982026)\n\n - CVE-2016-4963: The libxl device-handling allowed local\n guest OS users with access to the driver domain to cause\n a denial of service (management tool confusion) by\n manipulating information in the backend directories in\n xenstore (bsc#979670)\n\n - CVE-2016-4962: The libxl device-handling allowed local\n OS guest administrators to cause a denial of service\n (resource consumption or management facility confusion)\n or gain host OS privileges by manipulating information\n in guest controlled areas of xenstore (bsc#979620)\n\n - CVE-2016-4952: Out-of-bounds access issue in\n pvsci_ring_init_msg/data routines (bsc#981276)\n\n - CVE-2016-3710: The VGA module improperly performed\n bounds checking on banked access to video memory, which\n allowed local guest OS administrators to execute\n arbitrary code on the host by changing access modes\n after setting the bank register, aka the 'Dark Portal'\n issue (bsc#978164)\n\n - CVE-2014-3672: The qemu implementation in libvirt Xen\n allowed local guest OS users to cause a denial of\n service (host disk consumption) by writing to stdout or\n stderr (bsc#981264)\n\n - CVE-2016-4441: The get_cmd function in the 53C9X Fast\n SCSI Controller (FSC) support did not properly check DMA\n length, which allowed local guest OS administrators to\n cause a denial of service (out-of-bounds write and QEMU\n process crash) via unspecified vectors, involving an\n SCSI command (bsc#980724)\n\n - CVE-2016-4439: The esp_reg_write function in the 53C9X\n Fast SCSI Controller (FSC) support did not properly\n check command buffer length, which allowed local guest\n OS administrators to cause a denial of service\n (out-of-bounds write and QEMU process crash) or\n potentially execute arbitrary code on the host via\n unspecified vectors (bsc#980716)\n\n - CVE-2016-3960: Integer overflow in the x86 shadow\n pagetable code allowed local guest OS users to cause a\n denial of service (host crash) or possibly gain\n privileges by shadowing a superpage mapping (bsc#974038)\n\n - CVE-2016-3158: The xrstor function did not properly\n handle writes to the hardware FSW.ES bit when running on\n AMD64 processors, which allowed local guest OS users to\n obtain sensitive register content information from\n another guest by leveraging pending exception and mask\n bits (bsc#973188)\n\n - CVE-2016-3159: The fpu_fxrstor function in\n arch/x86/i387.c did not properly handle writes to the\n hardware FSW.ES bit when running on AMD64 processors,\n which allowed local guest OS users to obtain sensitive\n register content information from another guest by\n leveraging pending exception and mask bits (bsc#973188)\n\n - CVE-2016-4037: The ehci_advance_state function in\n hw/usb/hcd-ehci.c allowed local guest OS administrators\n to cause a denial of service (infinite loop and CPU\n consumption) via a circular split isochronous transfer\n descriptor (siTD) list (bsc#976111)\n\n - CVE-2016-4020: The patch_instruction function did not\n initialize the imm32 variable, which allowed local guest\n OS administrators to obtain sensitive information from\n host stack memory by accessing the Task Priority\n Register (TPR) (bsc#975907)\n\n - CVE-2016-4001: Buffer overflow in the\n stellaris_enet_receive function, when the Stellaris\n ethernet controller is configured to accept large\n packets, allowed remote attackers to cause a denial of\n service (QEMU crash) via a large packet (bsc#975130)\n\n - CVE-2016-4002: Buffer overflow in the mipsnet_receive\n function, when the guest NIC is configured to accept\n large packets, allowed remote attackers to cause a\n denial of service (memory corruption and QEMU crash) or\n possibly execute arbitrary code via a packet larger than\n 1514 bytes (bsc#975138)\n\n - CVE-2016-4480: The guest_walk_tables function in\n arch/x86/mm/guest_walk.c in Xen did not properly handle\n the Page Size (PS) page table entry bit at the L4 and L3\n page table levels, which might have allowed local guest\n OS users to gain privileges via a crafted mapping of\n memory (bsc#978295)\n\nThese non-security issues were fixed :\n\n - boo#991934: xen hypervisor crash in csched_acct\n\n - boo#992224: During boot of Xen Hypervisor, Failed to get\n contiguous memory for DMA from Xen\n\n - boo#955104: Virsh reports error 'one or more references\n were leaked after disconnect from hypervisor' when\n 'virsh save' failed due to 'no response from client\n after 6 keepalive messages'\n\n - boo#959552: Migration of HVM guest leads into libvirt\n segmentation fault\n\n - boo#993665: Migration of xen guests finishes in: One or\n more references were leaked after disconnect from the\n hypervisor\n\n - boo#959330: Guest migrations using virsh results in\n error 'Internal error: received hangup / error event on\n socket'\n\n - boo#990500: VM virsh migration fails with keepalive\n error: ':virKeepAliveTimerInternal:143 : No response\n from client'\n\n - boo#953518: Unplug also SCSI disks in\n qemu-xen-traditional for upstream unplug protocol\n\n - boo#953518: xen_platform: unplug also SCSI disks in\n qemu-xen\n\n - boo#971949: Support (by ignoring) xl migrate --live. xl\n migrations are always live \n\n - boo#970135: New virtualization project clock test\n randomly fails on Xen\n\n - boo#990970: Add PMU support for Intel E7-8867 v4 (fam=6,\n model=79)\n\n - boo#985503: vif-route broken\n\n - boo#961100: Migrate a fv guest from sles12 to sles12sp1\n fails remove patch because it can not fix the bug\n\n - boo#978413: PV guest upgrade from sles11sp4 to sles12sp2\n alpha3 failed on sles11sp4 xen host.\n\n - boo#986586: Out of memory (oom) during boot on 'modprobe\n xenblk' (non xen kernel) init.50-hvm-xen_conf\n\n - boo#900418: Dump cannot be performed on SLES12 XEN\n\n - boo#953339, boo#953362, boo#953518, boo#984981:\n Implement SUSE specific unplug protocol for emulated PCI\n devices in PVonHVM guests to qemu-xen-upstream \n\n - boo#954872: script block-dmmd not working as expected -\n libxl: error: libxl_dm.c (Additional fixes) block-dmmd\n\n - boo#982695: xen-4.5.2 qemu fails to boot HVM guest from\n xvda \n\n - boo#958848: HVM guest crash at /usr/src/packages/BUILD/\n xen-4.4.2-testing/obj/default/balloon/balloon.c:407\n\n - boo#949889: Fail to install 32-bit paravirt VM under\n SLES12SP1Beta3 XEN\n\n - boo#954872: script block-dmmd not working as expected -\n libxl: error: libxl_dm.c (another modification)\n block-dmmd\n\n - boo#961600: Poor performance when Xen HVM domU\n configured with max memory greater than current memory\n\n - boo#963161: Windows VM getting stuck during load while a\n VF is assigned to it after upgrading to latest\n maintenance updates\n\n - boo#976058: Xen error running simple HVM guest (Post\n Alpha 2 xen+qemu)\n\n - boo#961100: Migrate a fv guest from sles12 to sles12sp1\n on xen fails for 'Domain is not running on destination\n host'. qemu-ignore-kvm-tpr-opt-on-migration.patch \n\n - boo#973631: AWS EC2 kdump issue\n\n - boo#964427: Discarding device blocks: failed -\n Input/output error\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=900418\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=949889\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=953339\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=953362\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=953518\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=954872\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=955104\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=958848\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=959330\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=959552\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=961100\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=961600\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=963161\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=964427\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=970135\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=971949\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=973188\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=973631\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=974038\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=975130\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=975138\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=975907\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=976058\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=976111\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=978164\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=978295\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=978413\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=979620\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=979670\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=980716\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=980724\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=981264\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=981276\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=982024\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=982025\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=982026\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=982224\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=982225\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=982286\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=982695\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=982960\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=983973\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=983984\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=984981\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=985503\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=986586\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=988675\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=988676\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=990500\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=990843\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=990923\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=990970\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=991934\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=992224\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=993665\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=994421\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=994625\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=994761\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=994772\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=994775\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=995785\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=995789\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=995792\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected xen packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:xen\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:xen-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:xen-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:xen-doc-html\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:xen-kmp-default\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:xen-kmp-default-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:xen-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:xen-libs-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:xen-libs-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:xen-libs-debuginfo-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:xen-tools\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:xen-tools-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:xen-tools-domU\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:xen-tools-domU-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:42.1\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/10/11\");\n script_set_attribute(attribute:\"in_the_news\", value:\"true\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/10/12\");\n script_set_attribute(attribute:\"stig_severity\", value:\"I\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2021 Tenable Network Security, Inc.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE42\\.1)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"42.1\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(i586|i686|x86_64)$\") audit(AUDIT_ARCH_NOT, \"i586 / i686 / x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE42.1\", reference:\"xen-debugsource-4.5.3_10-15.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"xen-devel-4.5.3_10-15.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"xen-libs-4.5.3_10-15.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"xen-libs-debuginfo-4.5.3_10-15.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"xen-tools-domU-4.5.3_10-15.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"xen-tools-domU-debuginfo-4.5.3_10-15.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"xen-4.5.3_10-15.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"xen-doc-html-4.5.3_10-15.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"xen-kmp-default-4.5.3_10_k4.1.31_30-15.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"xen-kmp-default-debuginfo-4.5.3_10_k4.1.31_30-15.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"xen-libs-32bit-4.5.3_10-15.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"xen-libs-debuginfo-32bit-4.5.3_10-15.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"xen-tools-4.5.3_10-15.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"xen-tools-debuginfo-4.5.3_10-15.2\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"xen-debugsource / xen-devel / xen-libs-32bit / xen-libs / etc\");\n}\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-12T15:31:50", "description": "According to the versions of the qemu-kvm packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :\n\n - Race condition in QEMU in Xen allows local x86 HVM guest OS administrators to gain privileges by changing certain data on shared rings, aka a 'double fetch' vulnerability.(CVE-2016-9381)\n\n - The ohci_bus_start function in the USB OHCI emulation support (hw/usb/hcd-ohci.c) in QEMU allows local guest OS administrators to cause a denial of service (NULL pointer dereference and QEMU process crash) via vectors related to multiple eof_timers.(CVE-2016-2391)\n\n - qemu_deliver_packet_iov in net/net.c in Qemu accepts packet sizes greater than INT_MAX, which allows attackers to cause a denial of service or possibly have unspecified other impact.(CVE-2018-17963)\n\n - Memory leak in the serial_exit_core function in hw/char/serial.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (host memory consumption and QEMU process crash) via a large number of device unplug operations.(CVE-2017-5579)\n\n - Memory leak in QEMU (aka Quick Emulator), when built with IDE AHCI Emulation support, allows local guest OS privileged users to cause a denial of service (memory consumption) by repeatedly hot-unplugging the AHCI device.(CVE-2017-9373)\n\n - Microarchitectural Store Buffer Data Sampling (MSBDS):\n Store buffers on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here:\n https://www.intel.com/content/dam/www/public/us/en/docu ments/corporate-information/SA00233-microcode-update-gu idance_05132019.pdf(CVE-2018-12126)\n\n - Microarchitectural Data Sampling Uncacheable Memory (MDSUM): Uncacheable memory on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here:\n https://www.intel.com/content/dam/www/public/us/en/docu ments/corporate-information/SA00233-microcode-update-gu idance_05132019.pdf(CVE-2019-11091)\n\n - Microarchitectural Fill Buffer Data Sampling (MFBDS):\n Fill buffers on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here:\n https://www.intel.com/content/dam/www/public/us/en/docu ments/corporate-information/SA00233-microcode-update-gu idance_05132019.pdf(CVE-2018-12130)\n\n - Microarchitectural Load Port Data Sampling (MLPDS):\n Load ports on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here:\n https://www.intel.com/content/dam/www/public/us/en/docu ments/corporate-information/SA00233-microcode-update-gu idance_05132019.pdf(CVE-2018-12127)\n\n - Directory traversal vulnerability in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to access host files outside the export path via a .. (dot dot) in an unspecified string.(CVE-2016-7116)\n\n - QEMU, when built with the Pseudo Random Number Generator (PRNG) back-end support, allows local guest OS users to cause a denial of service (process crash) via an entropy request, which triggers arbitrary stack based allocation and memory corruption.(CVE-2016-2858)\n\n - hw/ide/core.c in QEMU does not properly restrict the commands accepted by an ATAPI device, which allows guest users to cause a denial of service or possibly have unspecified other impact via certain IDE commands, as demonstrated by a WIN_READ_NATIVE_MAX command to an empty drive, which triggers a divide-by-zero error and instance crash.(CVE-2015-6855)\n\n - The slirp_smb function in net/slirp.c in QEMU 2.3.0 and earlier creates temporary files with predictable names, which allows local users to cause a denial of service (instantiation failure) by creating /tmp/qemu-smb.*-* files before the program.(CVE-2015-4037)\n\n - The MSI-X MMIO support in hw/pci/msix.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (NULL pointer dereference and QEMU process crash) by leveraging failure to define the .write method.(CVE-2015-7549)\n\n - The ne2000_receive function in the NE2000 NIC emulation support (hw/net/ne2000.c) in QEMU before 2.5.1 allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via crafted values for the PSTART and PSTOP registers, involving ring buffer control.(CVE-2016-2841)\n\n - The mcf_fec_do_tx function in hw/net/mcf_fec.c in QEMU (aka Quick Emulator) does not properly limit the buffer descriptor count when transmitting packets, which allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via vectors involving a buffer descriptor with a length of 0 and crafted values in bd.flags.(CVE-2016-7908)\n\n - Integer overflow in the macro ROUND_UP (n, d) in Quick Emulator (Qemu) allows a user to cause a denial of service (Qemu process crash).(CVE-2017-18043)\n\n - The xhci_kick_epctx function in hw/usb/hcd-xhci.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (infinite loop and QEMU process crash) via vectors related to control transfer descriptor sequence.(CVE-2017-5973)\n\n - Memory leak in QEMU (aka Quick Emulator), when built with USB EHCI Emulation support, allows local guest OS privileged users to cause a denial of service (memory consumption) by repeatedly hot-unplugging the device.(CVE-2017-9374)\n\n - Use-after-free vulnerability in hw/ide/ahci.c in QEMU, when built with IDE AHCI Emulation support, allows guest OS users to cause a denial of service (instance crash) or possibly execute arbitrary code via an invalid AHCI Native Command Queuing (NCQ) AIO command.(CVE-2016-1568)\n\n - Buffer overflow in the stellaris_enet_receive function in hw/net/stellaris_enet.c in QEMU, when the Stellaris ethernet controller is configured to accept large packets, allows remote attackers to cause a denial of service (QEMU crash) via a large packet.(CVE-2016-4001)\n\n - Buffer overflow in the mipsnet_receive function in hw/net/mipsnet.c in QEMU, when the guest NIC is configured to accept large packets, allows remote attackers to cause a denial of service (memory corruption and QEMU crash) or possibly execute arbitrary code via a packet larger than 1514 bytes.(CVE-2016-4002)\n\n - The pvscsi_ring_pop_req_descr function in hw/scsi/vmw_pvscsi.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) by leveraging failure to limit process IO loop to the ring size.(CVE-2016-7421)\n\n - Quick Emulator (Qemu) built with the USB redirector usb-guest support is vulnerable to a memory leakage flaw. It could occur while destroying the USB redirector in 'usbredir_handle_destroy'. A guest user/process could use this issue to leak host memory, resulting in DoS for a host.(CVE-2016-9907)\n\n - qemu-seccomp.c in QEMU might allow local OS guest users to cause a denial of service (guest crash) by leveraging mishandling of the seccomp policy for threads other than the main thread.(CVE-2018-15746)\n\n - Stack-based buffer overflow in hw/usb/redirect.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (QEMU process crash) via vectors related to logging debug messages.(CVE-2017-10806)\n\n - The dhcp_decode function in slirp/bootp.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (out-of-bounds read and QEMU process crash) via a crafted DHCP options string.(CVE-2017-11434)\n\n - Memory leak in the audio/audio.c in QEMU (aka Quick Emulator) allows remote attackers to cause a denial of service (memory consumption) by repeatedly starting and stopping audio capture.(CVE-2017-8309)\n\n - Qemu emulator <= 3.0.0 built with the NE2000 NIC emulation support is vulnerable to an integer overflow, which could lead to buffer overflow issue. It could occur when receiving packets over the network. A user inside guest could use this flaw to crash the Qemu process resulting in DoS.(CVE-2018-10839)\n\n - Qemu has a Buffer Overflow in rtl8139_do_receive in hw/net/rtl8139.c because an incorrect integer data type is used.(CVE-2018-17958)\n\n - In QEMU 3.0.0, tcp_emu in slirp/tcp_subr.c has a heap-based buffer overflow.(CVE-2019-6778)\n\n - The vmxnet_tx_pkt_parse_headers function in hw/net/vmxnet_tx_pkt.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (buffer over-read) by leveraging failure to check IP header length.(CVE-2016-6835)\n\n - Memory leak in the v9fs_xattrcreate function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory consumption and QEMU process crash) via a large number of Txattrcreate messages with the same fid number.(CVE-2016-9102)\n\n - The v9fs_xattrcreate function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to obtain sensitive host heap memory information by reading xattribute values before writing to them.(CVE-2016-9103)\n\n - Multiple integer overflows in the (1) v9fs_xattr_read and (2) v9fs_xattr_write functions in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allow local guest OS administrators to cause a denial of service (QEMU process crash) via a crafted offset, which triggers an out-of-bounds access.(CVE-2016-9104)\n\n - Memory leak in the v9fs_link function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory consumption) via vectors involving a reference to the source fid object.(CVE-2016-9105)\n\n - Memory leak in the v9fs_write function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory consumption) by leveraging failure to free an IO vector.(CVE-2016-9106)\n\n - Quick Emulator (Qemu) built with the USB EHCI Emulation support is vulnerable to a memory leakage issue. It could occur while processing packet data in 'ehci_init_transfer'. A guest user/process could use this issue to leak host memory, resulting in DoS for a host.(CVE-2016-9911)\n\n - The net_tx_pkt_do_sw_fragmentation function in hw/net/net_tx_pkt.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via a zero length for the current fragment length.(CVE-2016-6834)\n\n - The vmxnet3_complete_packet function in hw/net/vmxnet3.c in QEMU (aka Quick Emulator) allows local guest OS administrators to obtain sensitive host memory information by leveraging failure to initialize the txcq_descr object.(CVE-2016-6836)\n\n - Integer overflow in the net_tx_pkt_init function in hw/net/net_tx_pkt.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (QEMU process crash) via the maximum fragmentation count, which triggers an unchecked multiplication and NULL pointer dereference.(CVE-2016-6888)\n\n - The pcnet_rdra_addr function in hw/net/pcnet.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) by setting the (1) receive or (2) transmit descriptor ring length to 0.(CVE-2016-7909)\n\n - The xhci_ring_fetch function in hw/usb/hcd-xhci.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) by leveraging failure to limit the number of link Transfer Request Blocks (TRB) to process.(CVE-2016-8576)\n\n - The serial_update_parameters function in hw/char/serial.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (divide-by-zero error and QEMU process crash) via vectors involving a value of divider greater than baud base.(CVE-2016-8669)\n\n - The intel_hda_xfer function in hw/audio/intel-hda.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and CPU consumption) via an entry with the same value for buffer length and pointer position.(CVE-2016-8909)\n\n - The rtl8139_cplus_transmit function in hw/net/rtl8139.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and CPU consumption) by leveraging failure to limit the ring descriptor count.(CVE-2016-8910)\n\n - Stack-based buffer overflow in the megasas_ctrl_get_info function in QEMU, when built with SCSI MegaRAID SAS HBA emulation support, allows local guest users to cause a denial of service (QEMU instance crash) via a crafted SCSI controller CTRL_GET_INFO command.(CVE-2015-8613)\n\n - QEMU (aka Quick Emulator) built with the USB EHCI emulation support is vulnerable to a null pointer dereference flaw. It could occur when an application attempts to write to EHCI capabilities registers. A privileged user inside quest could use this flaw to crash the QEMU process instance resulting in DoS.(CVE-2016-2198)\n\n - The is_rndis function in the USB Net device emulator (hw/usb/dev-network.c) in QEMU before 2.5.1 does not properly validate USB configuration descriptor objects, which allows local guest OS administrators to cause a denial of service (NULL pointer dereference and QEMU process crash) via vectors involving a remote NDIS control message packet.(CVE-2016-2392)\n\n - The ehci_advance_state function in hw/usb/hcd-ehci.c in QEMU allows local guest OS administrators to cause a denial of service (infinite loop and CPU consumption) via a circular split isochronous transfer descriptor (siTD) list, a related issue to CVE-2015-8558.(CVE-2016-4037)\n\n - The vmsvga_fifo_run function in hw/display/vmware_vga.c in QEMU allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via a VGA command.(CVE-2016-4453)\n\n - The vmsvga_fifo_read_raw function in hw/display/vmware_vga.c in QEMU allows local guest OS administrators to obtain sensitive host memory information or cause a denial of service (QEMU process crash) by changing FIFO registers and issuing a VGA command, which triggers an out-of-bounds read.(CVE-2016-4454)\n\n - hw/virtio/virtio.c in the Virtual Network Device (virtio-net) support in QEMU, when big or mergeable receive buffers are not supported, allows remote attackers to cause a denial of service (guest network consumption) via a flood of jumbo frames on the (1) tuntap or (2) macvtap interface.(CVE-2015-7295)\n\n - The eepro100 emulator in QEMU qemu-kvm blank allows local guest users to cause a denial of service (application crash and infinite loop) via vectors involving the command block list.(CVE-2015-8345)\n\n - Qemu, when built with VNC display driver support, allows remote attackers to cause a denial of service (arithmetic exception and application crash) via crafted SetPixelFormat messages from a client.(CVE-2015-8504)\n\n - The ehci_process_itd function in hw/usb/hcd-ehci.c in QEMU allows local guest OS administrators to cause a denial of service (infinite loop and CPU consumption) via a circular isochronous transfer descriptor (iTD) list.(CVE-2015-8558)\n\n - Memory leak in net/vmxnet3.c in QEMU allows remote attackers to cause a denial of service (memory consumption).(CVE-2015-8567)\n\n - Memory leak in QEMU, when built with a VMWARE VMXNET3 paravirtual NIC emulator support, allows local guest users to cause a denial of service (host memory consumption) by trying to activate the vmxnet3 device repeatedly.(CVE-2015-8568)\n\n - Buffer overflow in the pxa2xx_ssp_load function in hw/arm/pxa2xx.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted s->rx_level value in a savevm image.(CVE-2013-4533)\n\n - hw/net/vmxnet3.c in QEMU 2.0.0-rc0, 1.7.1, and earlier allows local guest users to cause a denial of service or possibly execute arbitrary code via vectors related to (1) RX or (2) TX queue numbers or (3) interrupt indices. NOTE: some of these details are obtained from third party information.(CVE-2013-4544)\n\n - Multiple integer overflows in the USB Net device emulator (hw/usb/dev-network.c) in QEMU before 2.5.1 allow local guest OS administrators to cause a denial of service (QEMU process crash) or obtain sensitive host memory information via a remote NDIS control message packet that is mishandled in the (1) rndis_query_response, (2) rndis_set_response, or (3) usb_net_handle_dataout function.(CVE-2016-2538)\n\nNote that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2019-12-04T00:00:00", "type": "nessus", "title": "EulerOS 2.0 SP2 : qemu-kvm (EulerOS-SA-2019-2431)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "COMPLETE", "integrityImpact": "NONE", "baseScore": 7.8, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-4533", "CVE-2013-4544", "CVE-2015-4037", "CVE-2015-6855", "CVE-2015-7295", "CVE-2015-7549", "CVE-2015-8345", "CVE-2015-8504", "CVE-2015-8558", "CVE-2015-8567", "CVE-2015-8568", "CVE-2015-8613", "CVE-2016-1568", "CVE-2016-2198", "CVE-2016-2391", "CVE-2016-2392", "CVE-2016-2538", "CVE-2016-2841", "CVE-2016-2858", "CVE-2016-4001", "CVE-2016-4002", "CVE-2016-4037", "CVE-2016-4453", "CVE-2016-4454", "CVE-2016-6834", "CVE-2016-6835", "CVE-2016-6836", "CVE-2016-6888", "CVE-2016-7116", "CVE-2016-7421", "CVE-2016-7908", "CVE-2016-7909", "CVE-2016-8576", "CVE-2016-8669", "CVE-2016-8909", "CVE-2016-8910", "CVE-2016-9102", "CVE-2016-9103", "CVE-2016-9104", "CVE-2016-9105", "CVE-2016-9106", "CVE-2016-9381", "CVE-2016-9907", "CVE-2016-9911", "CVE-2017-10806", "CVE-2017-11434", "CVE-2017-18043", "CVE-2017-5579", "CVE-2017-5973", "CVE-2017-8309", "CVE-2017-9373", "CVE-2017-9374", "CVE-2018-10839", "CVE-2018-12126", "CVE-2018-12127", "CVE-2018-12130", "CVE-2018-15746", "CVE-2018-17958", "CVE-2018-17963", "CVE-2019-11091", "CVE-2019-6778"], "modified": "2022-12-05T00:00:00", "cpe": ["p-cpe:/a:huawei:euleros:qemu-img", "p-cpe:/a:huawei:euleros:qemu-kvm", "p-cpe:/a:huawei:euleros:qemu-kvm-common", "cpe:/o:huawei:euleros:2.0"], "id": "EULEROS_SA-2019-2431.NASL", "href": "https://www.tenable.com/plugins/nessus/131585", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(131585);\n script_version(\"1.9\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/12/05\");\n\n script_cve_id(\n \"CVE-2013-4533\",\n \"CVE-2013-4544\",\n \"CVE-2015-4037\",\n \"CVE-2015-6855\",\n \"CVE-2015-7295\",\n \"CVE-2015-7549\",\n \"CVE-2015-8345\",\n \"CVE-2015-8504\",\n \"CVE-2015-8558\",\n \"CVE-2015-8567\",\n \"CVE-2015-8568\",\n \"CVE-2015-8613\",\n \"CVE-2016-1568\",\n \"CVE-2016-2198\",\n \"CVE-2016-2391\",\n \"CVE-2016-2392\",\n \"CVE-2016-2538\",\n \"CVE-2016-2841\",\n \"CVE-2016-2858\",\n \"CVE-2016-4001\",\n \"CVE-2016-4002\",\n \"CVE-2016-4037\",\n \"CVE-2016-4453\",\n \"CVE-2016-4454\",\n \"CVE-2016-6834\",\n \"CVE-2016-6835\",\n \"CVE-2016-6836\",\n \"CVE-2016-6888\",\n \"CVE-2016-7116\",\n \"CVE-2016-7421\",\n \"CVE-2016-7908\",\n \"CVE-2016-7909\",\n \"CVE-2016-8576\",\n \"CVE-2016-8669\",\n \"CVE-2016-8909\",\n \"CVE-2016-8910\",\n \"CVE-2016-9102\",\n \"CVE-2016-9103\",\n \"CVE-2016-9104\",\n \"CVE-2016-9105\",\n \"CVE-2016-9106\",\n \"CVE-2016-9381\",\n \"CVE-2016-9907\",\n \"CVE-2016-9911\",\n \"CVE-2017-10806\",\n \"CVE-2017-11434\",\n \"CVE-2017-18043\",\n \"CVE-2017-5579\",\n \"CVE-2017-5973\",\n \"CVE-2017-8309\",\n \"CVE-2017-9373\",\n \"CVE-2017-9374\",\n \"CVE-2018-10839\",\n \"CVE-2018-12126\",\n \"CVE-2018-12127\",\n \"CVE-2018-12130\",\n \"CVE-2018-15746\",\n \"CVE-2018-17958\",\n \"CVE-2018-17963\",\n \"CVE-2019-11091\",\n \"CVE-2019-6778\"\n );\n script_bugtraq_id(66955, 67483, 74809);\n script_xref(name:\"CEA-ID\", value:\"CEA-2019-0547\");\n script_xref(name:\"CEA-ID\", value:\"CEA-2019-0324\");\n\n script_name(english:\"EulerOS 2.0 SP2 : qemu-kvm (EulerOS-SA-2019-2431)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote EulerOS host is missing multiple security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to the versions of the qemu-kvm packages installed, the\nEulerOS installation on the remote host is affected by the following\nvulnerabilities :\n\n - Race condition in QEMU in Xen allows local x86 HVM\n guest OS administrators to gain privileges by changing\n certain data on shared rings, aka a 'double fetch'\n vulnerability.(CVE-2016-9381)\n\n - The ohci_bus_start function in the USB OHCI emulation\n support (hw/usb/hcd-ohci.c) in QEMU allows local guest\n OS administrators to cause a denial of service (NULL\n pointer dereference and QEMU process crash) via vectors\n related to multiple eof_timers.(CVE-2016-2391)\n\n - qemu_deliver_packet_iov in net/net.c in Qemu accepts\n packet sizes greater than INT_MAX, which allows\n attackers to cause a denial of service or possibly have\n unspecified other impact.(CVE-2018-17963)\n\n - Memory leak in the serial_exit_core function in\n hw/char/serial.c in QEMU (aka Quick Emulator) allows\n local guest OS privileged users to cause a denial of\n service (host memory consumption and QEMU process\n crash) via a large number of device unplug\n operations.(CVE-2017-5579)\n\n - Memory leak in QEMU (aka Quick Emulator), when built\n with IDE AHCI Emulation support, allows local guest OS\n privileged users to cause a denial of service (memory\n consumption) by repeatedly hot-unplugging the AHCI\n device.(CVE-2017-9373)\n\n - Microarchitectural Store Buffer Data Sampling (MSBDS):\n Store buffers on some microprocessors utilizing\n speculative execution may allow an authenticated user\n to potentially enable information disclosure via a side\n channel with local access. A list of impacted products\n can be found here:\n https://www.intel.com/content/dam/www/public/us/en/docu\n ments/corporate-information/SA00233-microcode-update-gu\n idance_05132019.pdf(CVE-2018-12126)\n\n - Microarchitectural Data Sampling Uncacheable Memory\n (MDSUM): Uncacheable memory on some microprocessors\n utilizing speculative execution may allow an\n authenticated user to potentially enable information\n disclosure via a side channel with local access. A list\n of impacted products can be found here:\n https://www.intel.com/content/dam/www/public/us/en/docu\n ments/corporate-information/SA00233-microcode-update-gu\n idance_05132019.pdf(CVE-2019-11091)\n\n - Microarchitectural Fill Buffer Data Sampling (MFBDS):\n Fill buffers on some microprocessors utilizing\n speculative execution may allow an authenticated user\n to potentially enable information disclosure via a side\n channel with local access. A list of impacted products\n can be found here:\n https://www.intel.com/content/dam/www/public/us/en/docu\n ments/corporate-information/SA00233-microcode-update-gu\n idance_05132019.pdf(CVE-2018-12130)\n\n - Microarchitectural Load Port Data Sampling (MLPDS):\n Load ports on some microprocessors utilizing\n speculative execution may allow an authenticated user\n to potentially enable information disclosure via a side\n channel with local access. A list of impacted products\n can be found here:\n https://www.intel.com/content/dam/www/public/us/en/docu\n ments/corporate-information/SA00233-microcode-update-gu\n idance_05132019.pdf(CVE-2018-12127)\n\n - Directory traversal vulnerability in hw/9pfs/9p.c in\n QEMU (aka Quick Emulator) allows local guest OS\n administrators to access host files outside the export\n path via a .. (dot dot) in an unspecified\n string.(CVE-2016-7116)\n\n - QEMU, when built with the Pseudo Random Number\n Generator (PRNG) back-end support, allows local guest\n OS users to cause a denial of service (process crash)\n via an entropy request, which triggers arbitrary stack\n based allocation and memory corruption.(CVE-2016-2858)\n\n - hw/ide/core.c in QEMU does not properly restrict the\n commands accepted by an ATAPI device, which allows\n guest users to cause a denial of service or possibly\n have unspecified other impact via certain IDE commands,\n as demonstrated by a WIN_READ_NATIVE_MAX command to an\n empty drive, which triggers a divide-by-zero error and\n instance crash.(CVE-2015-6855)\n\n - The slirp_smb function in net/slirp.c in QEMU 2.3.0 and\n earlier creates temporary files with predictable names,\n which allows local users to cause a denial of service\n (instantiation failure) by creating /tmp/qemu-smb.*-*\n files before the program.(CVE-2015-4037)\n\n - The MSI-X MMIO support in hw/pci/msix.c in QEMU (aka\n Quick Emulator) allows local guest OS privileged users\n to cause a denial of service (NULL pointer dereference\n and QEMU process crash) by leveraging failure to define\n the .write method.(CVE-2015-7549)\n\n - The ne2000_receive function in the NE2000 NIC emulation\n support (hw/net/ne2000.c) in QEMU before 2.5.1 allows\n local guest OS administrators to cause a denial of\n service (infinite loop and QEMU process crash) via\n crafted values for the PSTART and PSTOP registers,\n involving ring buffer control.(CVE-2016-2841)\n\n - The mcf_fec_do_tx function in hw/net/mcf_fec.c in QEMU\n (aka Quick Emulator) does not properly limit the buffer\n descriptor count when transmitting packets, which\n allows local guest OS administrators to cause a denial\n of service (infinite loop and QEMU process crash) via\n vectors involving a buffer descriptor with a length of\n 0 and crafted values in bd.flags.(CVE-2016-7908)\n\n - Integer overflow in the macro ROUND_UP (n, d) in Quick\n Emulator (Qemu) allows a user to cause a denial of\n service (Qemu process crash).(CVE-2017-18043)\n\n - The xhci_kick_epctx function in hw/usb/hcd-xhci.c in\n QEMU (aka Quick Emulator) allows local guest OS\n privileged users to cause a denial of service (infinite\n loop and QEMU process crash) via vectors related to\n control transfer descriptor sequence.(CVE-2017-5973)\n\n - Memory leak in QEMU (aka Quick Emulator), when built\n with USB EHCI Emulation support, allows local guest OS\n privileged users to cause a denial of service (memory\n consumption) by repeatedly hot-unplugging the\n device.(CVE-2017-9374)\n\n - Use-after-free vulnerability in hw/ide/ahci.c in QEMU,\n when built with IDE AHCI Emulation support, allows\n guest OS users to cause a denial of service (instance\n crash) or possibly execute arbitrary code via an\n invalid AHCI Native Command Queuing (NCQ) AIO\n command.(CVE-2016-1568)\n\n - Buffer overflow in the stellaris_enet_receive function\n in hw/net/stellaris_enet.c in QEMU, when the Stellaris\n ethernet controller is configured to accept large\n packets, allows remote attackers to cause a denial of\n service (QEMU crash) via a large packet.(CVE-2016-4001)\n\n - Buffer overflow in the mipsnet_receive function in\n hw/net/mipsnet.c in QEMU, when the guest NIC is\n configured to accept large packets, allows remote\n attackers to cause a denial of service (memory\n corruption and QEMU crash) or possibly execute\n arbitrary code via a packet larger than 1514\n bytes.(CVE-2016-4002)\n\n - The pvscsi_ring_pop_req_descr function in\n hw/scsi/vmw_pvscsi.c in QEMU (aka Quick Emulator)\n allows local guest OS administrators to cause a denial\n of service (infinite loop and QEMU process crash) by\n leveraging failure to limit process IO loop to the ring\n size.(CVE-2016-7421)\n\n - Quick Emulator (Qemu) built with the USB redirector\n usb-guest support is vulnerable to a memory leakage\n flaw. It could occur while destroying the USB\n redirector in 'usbredir_handle_destroy'. A guest\n user/process could use this issue to leak host memory,\n resulting in DoS for a host.(CVE-2016-9907)\n\n - qemu-seccomp.c in QEMU might allow local OS guest users\n to cause a denial of service (guest crash) by\n leveraging mishandling of the seccomp policy for\n threads other than the main thread.(CVE-2018-15746)\n\n - Stack-based buffer overflow in hw/usb/redirect.c in\n QEMU (aka Quick Emulator) allows local guest OS users\n to cause a denial of service (QEMU process crash) via\n vectors related to logging debug\n messages.(CVE-2017-10806)\n\n - The dhcp_decode function in slirp/bootp.c in QEMU (aka\n Quick Emulator) allows local guest OS users to cause a\n denial of service (out-of-bounds read and QEMU process\n crash) via a crafted DHCP options\n string.(CVE-2017-11434)\n\n - Memory leak in the audio/audio.c in QEMU (aka Quick\n Emulator) allows remote attackers to cause a denial of\n service (memory consumption) by repeatedly starting and\n stopping audio capture.(CVE-2017-8309)\n\n - Qemu emulator <= 3.0.0 built with the NE2000 NIC\n emulation support is vulnerable to an integer overflow,\n which could lead to buffer overflow issue. It could\n occur when receiving packets over the network. A user\n inside guest could use this flaw to crash the Qemu\n process resulting in DoS.(CVE-2018-10839)\n\n - Qemu has a Buffer Overflow in rtl8139_do_receive in\n hw/net/rtl8139.c because an incorrect integer data type\n is used.(CVE-2018-17958)\n\n - In QEMU 3.0.0, tcp_emu in slirp/tcp_subr.c has a\n heap-based buffer overflow.(CVE-2019-6778)\n\n - The vmxnet_tx_pkt_parse_headers function in\n hw/net/vmxnet_tx_pkt.c in QEMU (aka Quick Emulator)\n allows local guest OS administrators to cause a denial\n of service (buffer over-read) by leveraging failure to\n check IP header length.(CVE-2016-6835)\n\n - Memory leak in the v9fs_xattrcreate function in\n hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local\n guest OS administrators to cause a denial of service\n (memory consumption and QEMU process crash) via a large\n number of Txattrcreate messages with the same fid\n number.(CVE-2016-9102)\n\n - The v9fs_xattrcreate function in hw/9pfs/9p.c in QEMU\n (aka Quick Emulator) allows local guest OS\n administrators to obtain sensitive host heap memory\n information by reading xattribute values before writing\n to them.(CVE-2016-9103)\n\n - Multiple integer overflows in the (1) v9fs_xattr_read\n and (2) v9fs_xattr_write functions in hw/9pfs/9p.c in\n QEMU (aka Quick Emulator) allow local guest OS\n administrators to cause a denial of service (QEMU\n process crash) via a crafted offset, which triggers an\n out-of-bounds access.(CVE-2016-9104)\n\n - Memory leak in the v9fs_link function in hw/9pfs/9p.c\n in QEMU (aka Quick Emulator) allows local guest OS\n administrators to cause a denial of service (memory\n consumption) via vectors involving a reference to the\n source fid object.(CVE-2016-9105)\n\n - Memory leak in the v9fs_write function in hw/9pfs/9p.c\n in QEMU (aka Quick Emulator) allows local guest OS\n administrators to cause a denial of service (memory\n consumption) by leveraging failure to free an IO\n vector.(CVE-2016-9106)\n\n - Quick Emulator (Qemu) built with the USB EHCI Emulation\n support is vulnerable to a memory leakage issue. It\n could occur while processing packet data in\n 'ehci_init_transfer'. A guest user/process could use\n this issue to leak host memory, resulting in DoS for a\n host.(CVE-2016-9911)\n\n - The net_tx_pkt_do_sw_fragmentation function in\n hw/net/net_tx_pkt.c in QEMU (aka Quick Emulator) allows\n local guest OS administrators to cause a denial of\n service (infinite loop and QEMU process crash) via a\n zero length for the current fragment\n length.(CVE-2016-6834)\n\n - The vmxnet3_complete_packet function in\n hw/net/vmxnet3.c in QEMU (aka Quick Emulator) allows\n local guest OS administrators to obtain sensitive host\n memory information by leveraging failure to initialize\n the txcq_descr object.(CVE-2016-6836)\n\n - Integer overflow in the net_tx_pkt_init function in\n hw/net/net_tx_pkt.c in QEMU (aka Quick Emulator) allows\n local guest OS administrators to cause a denial of\n service (QEMU process crash) via the maximum\n fragmentation count, which triggers an unchecked\n multiplication and NULL pointer\n dereference.(CVE-2016-6888)\n\n - The pcnet_rdra_addr function in hw/net/pcnet.c in QEMU\n (aka Quick Emulator) allows local guest OS\n administrators to cause a denial of service (infinite\n loop and QEMU process crash) by setting the (1) receive\n or (2) transmit descriptor ring length to\n 0.(CVE-2016-7909)\n\n - The xhci_ring_fetch function in hw/usb/hcd-xhci.c in\n QEMU (aka Quick Emulator) allows local guest OS\n administrators to cause a denial of service (infinite\n loop and QEMU process crash) by leveraging failure to\n limit the number of link Transfer Request Blocks (TRB)\n to process.(CVE-2016-8576)\n\n - The serial_update_parameters function in\n hw/char/serial.c in QEMU (aka Quick Emulator) allows\n local guest OS administrators to cause a denial of\n service (divide-by-zero error and QEMU process crash)\n via vectors involving a value of divider greater than\n baud base.(CVE-2016-8669)\n\n - The intel_hda_xfer function in hw/audio/intel-hda.c in\n QEMU (aka Quick Emulator) allows local guest OS\n administrators to cause a denial of service (infinite\n loop and CPU consumption) via an entry with the same\n value for buffer length and pointer\n position.(CVE-2016-8909)\n\n - The rtl8139_cplus_transmit function in hw/net/rtl8139.c\n in QEMU (aka Quick Emulator) allows local guest OS\n administrators to cause a denial of service (infinite\n loop and CPU consumption) by leveraging failure to\n limit the ring descriptor count.(CVE-2016-8910)\n\n - Stack-based buffer overflow in the\n megasas_ctrl_get_info function in QEMU, when built with\n SCSI MegaRAID SAS HBA emulation support, allows local\n guest users to cause a denial of service (QEMU instance\n crash) via a crafted SCSI controller CTRL_GET_INFO\n command.(CVE-2015-8613)\n\n - QEMU (aka Quick Emulator) built with the USB EHCI\n emulation support is vulnerable to a null pointer\n dereference flaw. It could occur when an application\n attempts to write to EHCI capabilities registers. A\n privileged user inside quest could use this flaw to\n crash the QEMU process instance resulting in\n DoS.(CVE-2016-2198)\n\n - The is_rndis function in the USB Net device emulator\n (hw/usb/dev-network.c) in QEMU before 2.5.1 does not\n properly validate USB configuration descriptor objects,\n which allows local guest OS administrators to cause a\n denial of service (NULL pointer dereference and QEMU\n process crash) via vectors involving a remote NDIS\n control message packet.(CVE-2016-2392)\n\n - The ehci_advance_state function in hw/usb/hcd-ehci.c in\n QEMU allows local guest OS administrators to cause a\n denial of service (infinite loop and CPU consumption)\n via a circular split isochronous transfer descriptor\n (siTD) list, a related issue to\n CVE-2015-8558.(CVE-2016-4037)\n\n - The vmsvga_fifo_run function in hw/display/vmware_vga.c\n in QEMU allows local guest OS administrators to cause a\n denial of service (infinite loop and QEMU process\n crash) via a VGA command.(CVE-2016-4453)\n\n - The vmsvga_fifo_read_raw function in\n hw/display/vmware_vga.c in QEMU allows local guest OS\n administrators to obtain sensitive host memory\n information or cause a denial of service (QEMU process\n crash) by changing FIFO registers and issuing a VGA\n command, which triggers an out-of-bounds\n read.(CVE-2016-4454)\n\n - hw/virtio/virtio.c in the Virtual Network Device\n (virtio-net) support in QEMU, when big or mergeable\n receive buffers are not supported, allows remote\n attackers to cause a denial of service (guest network\n consumption) via a flood of jumbo frames on the (1)\n tuntap or (2) macvtap interface.(CVE-2015-7295)\n\n - The eepro100 emulator in QEMU qemu-kvm blank allows\n local guest users to cause a denial of service\n (application crash and infinite loop) via vectors\n involving the command block list.(CVE-2015-8345)\n\n - Qemu, when built with VNC display driver support,\n allows remote attackers to cause a denial of service\n (arithmetic exception and application crash) via\n crafted SetPixelFormat messages from a\n client.(CVE-2015-8504)\n\n - The ehci_process_itd function in hw/usb/hcd-ehci.c in\n QEMU allows local guest OS administrators to cause a\n denial of service (infinite loop and CPU consumption)\n via a circular isochronous transfer descriptor (iTD)\n list.(CVE-2015-8558)\n\n - Memory leak in net/vmxnet3.c in QEMU allows remote\n attackers to cause a denial of service (memory\n consumption).(CVE-2015-8567)\n\n - Memory leak in QEMU, when built with a VMWARE VMXNET3\n paravirtual NIC emulator support, allows local guest\n users to cause a denial of service (host memory\n consumption) by trying to activate the vmxnet3 device\n repeatedly.(CVE-2015-8568)\n\n - Buffer overflow in the pxa2xx_ssp_load function in\n hw/arm/pxa2xx.c in QEMU before 1.7.2 allows remote\n attackers to cause a denial of service or possibly\n execute arbitrary code via a crafted s->rx_level value\n in a savevm image.(CVE-2013-4533)\n\n - hw/net/vmxnet3.c in QEMU 2.0.0-rc0, 1.7.1, and earlier\n allows local guest users to cause a denial of service\n or possibly execute arbitrary code via vectors related\n to (1) RX or (2) TX queue numbers or (3) interrupt\n indices. NOTE: some of these details are obtained from\n third party information.(CVE-2013-4544)\n\n - Multiple integer overflows in the USB Net device\n emulator (hw/usb/dev-network.c) in QEMU before 2.5.1\n allow local guest OS administrators to cause a denial\n of service (QEMU process crash) or obtain sensitive\n host memory information via a remote NDIS control\n message packet that is mishandled in the (1)\n rndis_query_response, (2) rndis_set_response, or (3)\n usb_net_handle_dataout function.(CVE-2016-2538)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\");\n # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2019-2431\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?3ee4218f\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected qemu-kvm packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2018-17963\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/12/04\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/12/04\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:qemu-img\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:qemu-kvm\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:qemu-kvm-common\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:huawei:euleros:2.0\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Huawei Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2019-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/EulerOS/release\", \"Host/EulerOS/rpm-list\", \"Host/EulerOS/sp\");\n script_exclude_keys(\"Host/EulerOS/uvp_version\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/EulerOS/release\");\nif (isnull(release) || release !~ \"^EulerOS\") audit(AUDIT_OS_NOT, \"EulerOS\");\nif (release !~ \"^EulerOS release 2\\.0(\\D|$)\") audit(AUDIT_OS_NOT, \"EulerOS 2.0\");\n\nsp = get_kb_item(\"Host/EulerOS/sp\");\nif (isnull(sp) || sp !~ \"^(2)$\") audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP2\");\n\nuvp = get_kb_item(\"Host/EulerOS/uvp_version\");\nif (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP2\", \"EulerOS UVP \" + uvp);\n\nif (!get_kb_item(\"Host/EulerOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"aarch64\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"EulerOS\", cpu);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_ARCH_NOT, \"i686 / x86_64\", cpu);\n\nflag = 0;\n\npkgs = [\"qemu-img-1.5.3-156.5.h22\",\n \"qemu-kvm-1.5.3-156.5.h22\",\n \"qemu-kvm-common-1.5.3-156.5.h22\"];\n\nforeach (pkg in pkgs)\n if (rpm_check(release:\"EulerOS-2.0\", sp:\"2\", reference:pkg)) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"qemu-kvm\");\n}\n", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2023-01-11T15:10:34", "description": "According to the versions of the qemu-kvm packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :\n\n - In libslirp 4.1.0, as used in QEMU 4.2.0, tcp_subr.c misuses snprintf return values, leading to a buffer overflow in later code.(CVE-2020-8608)\n\n - This vulnerability has been modified since it was last analyzed by the NVD. It is awaiting reanalysis which may result in further changes to the information provided.(CVE-2019-11135)\n\n - tcp_emu in tcp_subr.c in libslirp 4.1.0, as used in QEMU 4.2.0, mismanages memory, as demonstrated by IRC DCC commands in EMU_IRC. This can cause a heap-based buffer overflow or other out-of-bounds access which can lead to a DoS or potential execute arbitrary code.(CVE-2020-7039)\n\n - ip_reass in ip_input.c in libslirp 4.0.0 has a heap-based buffer overflow via a large packet because it mishandles a case involving the first fragment.(CVE-2019-14378)\n\n - Integer overflow in the VNC display driver in QEMU before 2.1.0 allows attachers to cause a denial of service (process crash) via a CLIENT_CUT_TEXT message, which triggers an infinite loop.(CVE-2015-5239)\n\n - Buffer overflow in the send_control_msg function in hw/char/virtio-serial-bus.c in QEMU before 2.4.0 allows guest users to cause a denial of service (QEMU process crash) via a crafted virtio control message.(CVE-2015-5745)\n\n - The ne2000_receive function in hw/net/ne2000.c in QEMU before 2.4.0.1 allows attackers to cause a denial of service (infinite loop and instance crash) or possibly execute arbitrary code via vectors related to receiving packets.(CVE-2015-5278)\n\n - The process_tx_desc function in hw/net/e1000.c in QEMU before 2.4.0.1 does not properly process transmit descriptor data when sending a network packet, which allows attackers to cause a denial of service (infinite loop and guest crash) via unspecified vectors.(CVE-2015-6815)\n\n - Heap-based buffer overflow in the ne2000_receive function in hw/net/ne2000.c in QEMU before 2.4.0.1 allows guest OS users to cause a denial of service (instance crash) or possibly execute arbitrary code via vectors related to receiving packets.(CVE-2015-5279)\n\n - Heap-based buffer overflow in the .receive callback of xlnx.xps-ethernetlite in QEMU (aka Quick Emulator) allows attackers to execute arbitrary code on the QEMU host via a large ethlite packet.(CVE-2016-7161)\n\n - hw/net/vmxnet3.c in QEMU 2.0.0-rc0, 1.7.1, and earlier allows local guest users to cause a denial of service or possibly execute arbitrary code via vectors related to (1) RX or (2) TX queue numbers or (3) interrupt indices. NOTE: some of these details are obtained from third party information.(CVE-2013-4544)\n\n - The slirp_smb function in net/slirp.c in QEMU 2.3.0 and earlier creates temporary files with predictable names, which allows local users to cause a denial of service (instantiation failure) by creating /tmp/qemu-smb.*-* files before the program.(CVE-2015-4037)\n\n - hw/ide/core.c in QEMU does not properly restrict the commands accepted by an ATAPI device, which allows guest users to cause a denial of service or possibly have unspecified other impact via certain IDE commands, as demonstrated by a WIN_READ_NATIVE_MAX command to an empty drive, which triggers a divide-by-zero error and instance crash.(CVE-2015-6855)\n\n - hw/virtio/virtio.c in the Virtual Network Device (virtio-net) support in QEMU, when big or mergeable receive buffers are not supported, allows remote attackers to cause a denial of service (guest network consumption) via a flood of jumbo frames on the (1) tuntap or (2) macvtap interface.(CVE-2015-7295)\n\n - The MSI-X MMIO support in hw/pci/msix.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (NULL pointer dereference and QEMU process crash) by leveraging failure to define the .write method.(CVE-2015-7549)\n\n - The eepro100 emulator in QEMU qemu-kvm blank allows local guest users to cause a denial of service (application crash and infinite loop) via vectors involving the command block list.(CVE-2015-8345)\n\n - Qemu, when built with VNC display driver support, allows remote attackers to cause a denial of service (arithmetic exception and application crash) via crafted SetPixelFormat messages from a client.(CVE-2015-8504)\n\n - The ehci_process_itd function in hw/usb/hcd-ehci.c in QEMU allows local guest OS administrators to cause a denial of service (infinite loop and CPU consumption) via a circular isochronous transfer descriptor (iTD) list.(CVE-2015-8558)\n\n - Memory leak in net/vmxnet3.c in QEMU allows remote attackers to cause a denial of service (memory consumption).(CVE-2015-8567)\n\n - Memory leak in QEMU, when built with a VMWARE VMXNET3 paravirtual NIC emulator support, allows local guest users to cause a denial of service (host memory consumption) by trying to activate the vmxnet3 device repeatedly.(CVE-2015-8568)\n\n - Stack-based buffer overflow in the megasas_ctrl_get_info function in QEMU, when built with SCSI MegaRAID SAS HBA emulation support, allows local guest users to cause a denial of service (QEMU instance crash) via a crafted SCSI controller CTRL_GET_INFO command.(CVE-2015-8613)\n\n - Use-after-free vulnerability in hw/ide/ahci.c in QEMU, when built with IDE AHCI Emulation support, allows guest OS users to cause a denial of service (instance crash) or possibly execute arbitrary code via an invalid AHCI Native Command Queuing (NCQ) AIO command.(CVE-2016-1568)\n\n - QEMU (aka Quick Emulator) built with the USB EHCI emulation support is vulnerable to a null pointer dereference flaw. It could occur when an application attempts to write to EHCI capabilities registers. A privileged user inside quest could use this flaw to crash the QEMU process instance resulting in DoS.(CVE-2016-2198)\n\n - The ohci_bus_start function in the USB OHCI emulation support (hw/usb/hcd-ohci.c) in QEMU allows local guest OS administrators to cause a denial of service (NULL pointer dereference and QEMU process crash) via vectors related to multiple eof_timers.(CVE-2016-2391)\n\n - The is_rndis function in the USB Net device emulator (hw/usb/dev-network.c) in QEMU before 2.5.1 does not properly validate USB configuration descriptor objects, which allows local guest OS administrators to cause a denial of service (NULL pointer dereference and QEMU process crash) via vectors involving a remote NDIS control message packet.(CVE-2016-2392)\n\n - Multiple integer overflows in the USB Net device emulator (hw/usb/dev-network.c) in QEMU before 2.5.1 allow local guest OS administrators to cause a denial of service (QEMU process crash) or obtain sensitive host memory information via a remote NDIS control message packet that is mishandled in the (1) rndis_query_response, (2) rndis_set_response, or (3) usb_net_handle_dataout function.(CVE-2016-2538)\n\n - The ne2000_receive function in the NE2000 NIC emulation support (hw/net/ne2000.c) in QEMU before 2.5.1 allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via crafted values for the PSTART and PSTOP registers, involving ring buffer control.(CVE-2016-2841)\n\n - QEMU, when built with the Pseudo Random Number Generator (PRNG) back-end support, allows local guest OS users to cause a denial of service (process crash) via an entropy request, which triggers arbitrary stack based allocation and memory corruption.(CVE-2016-2858)\n\n - Buffer overflow in the stellaris_enet_receive function in hw/net/stellaris_enet.c in QEMU, when the Stellaris ethernet controller is configured to accept large packets, allows remote attackers to cause a denial of service (QEMU crash) via a large packet.(CVE-2016-4001)\n\n - Buffer overflow in the mipsnet_receive function in hw/net/mipsnet.c in QEMU, when the guest NIC is configured to accept large packets, allows remote attackers to cause a denial of service (memory corruption and QEMU crash) or possibly execute arbitrary code via a packet larger than 1514 bytes.(CVE-2016-4002)\n\n - The ehci_advance_state function in hw/usb/hcd-ehci.c in QEMU allows local guest OS administrators to cause a denial of service (infinite loop and CPU consumption) via a circular split isochronous transfer descriptor (siTD) list, a related issue to CVE-2015-8558.(CVE-2016-4037)\n\n - The vmsvga_fifo_run function in hw/display/vmware_vga.c in QEMU allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via a VGA command.(CVE-2016-4453)\n\n - The vmsvga_fifo_read_raw function in hw/display/vmware_vga.c in QEMU allows local guest OS administrators to obtain sensitive host memory information or cause a denial of service (QEMU process crash) by changing FIFO registers and issuing a VGA command, which triggers an out-of-bounds read.(CVE-2016-4454)\n\n - The net_tx_pkt_do_sw_fragmentation function in hw/net/net_tx_pkt.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via a zero length for the current fragment length.(CVE-2016-6834)\n\n - The vmxnet_tx_pkt_parse_headers function in hw/net/vmxnet_tx_pkt.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (buffer over-read) by leveraging failure to check IP header length.(CVE-2016-6835)\n\n - The vmxnet3_complete_packet function in hw/net/vmxnet3.c in QEMU (aka Quick Emulator) allows local guest OS administrators to obtain sensitive host memory information by leveraging failure to initialize the txcq_descr object.(CVE-2016-6836)\n\n - Integer overflow in the net_tx_pkt_init function in hw/net/net_tx_pkt.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (QEMU process crash) via the maximum fragmentation count, which triggers an unchecked multiplication and NULL pointer dereference.(CVE-2016-6888)\n\n - Directory traversal vulnerability in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to access host files outside the export path via a .. (dot dot) in an unspecified string.(CVE-2016-7116)\n\n - The pvscsi_ring_pop_req_descr function in hw/scsi/vmw_pvscsi.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) by leveraging failure to limit process IO loop to the ring size.(CVE-2016-7421)\n\n - The mcf_fec_do_tx function in hw/net/mcf_fec.c in QEMU (aka Quick Emulator) does not properly limit the buffer descriptor count when transmitting packets, which allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via vectors involving a buffer descriptor with a length of 0 and crafted values in bd.flags.(CVE-2016-7908)\n\n - The pcnet_rdra_addr function in hw/net/pcnet.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) by setting the (1) receive or (2) transmit descriptor ring length to 0.(CVE-2016-7909)\n\n - The xhci_ring_fetch function in hw/usb/hcd-xhci.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) by leveraging failure to limit the number of link Transfer Request Blocks (TRB) to process.(CVE-2016-8576)\n\n - The serial_update_parameters function in hw/char/serial.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (divide-by-zero error and QEMU process crash) via vectors involving a value of divider greater than baud base.(CVE-2016-8669)\n\n - The intel_hda_xfer function in hw/audio/intel-hda.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and CPU consumption) via an entry with the same value for buffer length and pointer position.(CVE-2016-8909)\n\n - The rtl8139_cplus_transmit function in hw/net/rtl8139.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and CPU consumption) by leveraging failure to limit the ring descriptor count.(CVE-2016-8910)\n\n - Memory leak in the v9fs_xattrcreate function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory consumption and QEMU process crash) via a large number of Txattrcreate messages with the same fid number.(CVE-2016-9102)\n\n - The v9fs_xattrcreate function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to obtain sensitive host heap memory information by reading xattribute values before writing to them.(CVE-2016-9103)\n\n - Multiple integer overflows in the (1) v9fs_xattr_read and (2) v9fs_xattr_write functions in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allow local guest OS administrators to cause a denial of service (QEMU process crash) via a crafted offset, which triggers an out-of-bounds access.(CVE-2016-9104)\n\n - Memory leak in the v9fs_link function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory consumption) via vectors involving a reference to the source fid object.(CVE-2016-9105)\n\n - Memory leak in the v9fs_write function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory consumption) by leveraging failure to free an IO vector.(CVE-2016-9106)\n\n - Race condition in QEMU in Xen allows local x86 HVM guest OS administrators to gain privileges by changing certain data on shared rings, aka a 'double fetch' vulnerability.(CVE-2016-9381)\n\n - Quick Emulator (Qemu) built with the USB redirector usb-guest support is vulnerable to a memory leakage flaw. It could occur while destroying the USB redirector in 'usbredir_handle_destroy'. A guest user/process could use this issue to leak host memory, resulting in DoS for a host.(CVE-2016-9907)\n\n - Quick Emulator (Qemu) built with the USB EHCI Emulation support is vulnerable to a memory leakage issue. It could occur while processing packet data in 'ehci_init_transfer'. A guest user/process could use this issue to leak host memory, resulting in DoS for a host.(CVE-2016-9911)\n\n - Stack-based buffer overflow in hw/usb/redirect.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (QEMU process crash) via vectors related to logging debug messages.(CVE-2017-10806)\n\n - The dhcp_decode function in slirp/bootp.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (out-of-bounds read and QEMU process crash) via a crafted DHCP options string.(CVE-2017-11434)\n\n - Integer overflow in the macro ROUND_UP (n, d) in Quick Emulator (Qemu) allows a user to cause a denial of service (Qemu process crash).(CVE-2017-18043)\n\n - Memory leak in the serial_exit_core function in hw/char/serial.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (host memory consumption and QEMU process crash) via a large number of device unplug operations.(CVE-2017-5579)\n\n - The xhci_kick_epctx function in hw/usb/hcd-xhci.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (infinite loop and QEMU process crash) via vectors related to control transfer descriptor sequence.(CVE-2017-5973)\n\n - Memory leak in the audio/audio.c in QEMU (aka Quick Emulator) allows remote attackers to cause a denial of service (memory consumption) by repeatedly starting and stopping audio capture.(CVE-2017-8309)\n\n - Memory leak in QEMU (aka Quick Emulator), when built with IDE AHCI Emulation support, allows local guest OS privileged users to cause a denial of service (memory consumption) by repeatedly hot-unplugging the AHCI device.(CVE-2017-9373)\n\n - Memory leak in QEMU (aka Quick Emulator), when built with USB EHCI Emulation support, allows local guest OS privileged users to cause a denial of service (memory consumption) by repeatedly hot-unplugging the device.(CVE-2017-9374)\n\n - Qemu emulator <= 3.0.0 built with the NE2000 NIC emulation support is vulnerable to an integer overflow, which could lead to buffer overflow issue. It could occur when receiving packets over the network. A user inside guest could use this flaw to crash the Qemu process resulting in DoS.(CVE-2018-10839)\n\n - qemu-seccomp.c in QEMU might allow local OS guest users to cause a denial of service (guest crash) by leveraging mishandling of the seccomp policy for threads other than the main thread.(CVE-2018-15746)\n\n - Qemu has a Buffer Overflow in rtl8139_do_receive in hw/net/rtl8139.c because an incorrect integer data type is used.(CVE-2018-17958)\n\n - qemu_deliver_packet_iov in net/net.c in Qemu accepts packet sizes greater than INT_MAX, which allows attackers to cause a denial of service or possibly have unspecified other impact.(CVE-2018-17963)\n\n - In QEMU 3.0.0, tcp_emu in slirp/tcp_subr.c has a heap-based buffer overflow.(CVE-2019-6778)\n\nNote that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2020-04-15T00:00:00", "type": "nessus", "title": "EulerOS 2.0 SP3 : qemu-kvm (EulerOS-SA-2020-1430)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-4544", "CVE-2015-4037", "CVE-2015-5239", "CVE-2015-5278", "CVE-2015-5279", "CVE-2015-5745", "CVE-2015-6815", "CVE-2015-6855", "CVE-2015-7295", "CVE-2015-7549", "CVE-2015-8345", "CVE-2015-8504", "CVE-2015-8558", "CVE-2015-8567", "CVE-2015-8568", "CVE-2015-8613", "CVE-2016-1568", "CVE-2016-2198", "CVE-2016-2391", "CVE-2016-2392", "CVE-2016-2538", "CVE-2016-2841", "CVE-2016-2858", "CVE-2016-4001", "CVE-2016-4002", "CVE-2016-4037", "CVE-2016-4453", "CVE-2016-4454", "CVE-2016-6834", "CVE-2016-6835", "CVE-2016-6836", "CVE-2016-6888", "CVE-2016-7116", "CVE-2016-7161", "CVE-2016-7421", "CVE-2016-7908", "CVE-2016-7909", "CVE-2016-8576", "CVE-2016-8669", "CVE-2016-8909", "CVE-2016-8910", "CVE-2016-9102", "CVE-2016-9103", "CVE-2016-9104", "CVE-2016-9105", "CVE-2016-9106", "CVE-2016-9381", "CVE-2016-9907", "CVE-2016-9911", "CVE-2017-10806", "CVE-2017-11434", "CVE-2017-18043", "CVE-2017-5579", "CVE-2017-5973", "CVE-2017-8309", "CVE-2017-9373", "CVE-2017-9374", "CVE-2018-10839", "CVE-2018-15746", "CVE-2018-17958", "CVE-2018-17963", "CVE-2019-11135", "CVE-2019-14378", "CVE-2019-6778", "CVE-2020-7039", "CVE-2020-8608"], "modified": "2021-01-06T00:00:00", "cpe": ["p-cpe:/a:huawei:euleros:qemu-img", "p-cpe:/a:huawei:euleros:qemu-kvm", "p-cpe:/a:huawei:euleros:qemu-kvm-common", "cpe:/o:huawei:euleros:2.0"], "id": "EULEROS_SA-2020-1430.NASL", "href": "https://www.tenable.com/plugins/nessus/135559", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(135559);\n script_version(\"1.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\n \"CVE-2013-4544\",\n \"CVE-2015-4037\",\n \"CVE-2015-5239\",\n \"CVE-2015-5278\",\n \"CVE-2015-5279\",\n \"CVE-2015-5745\",\n \"CVE-2015-6815\",\n \"CVE-2015-6855\",\n \"CVE-2015-7295\",\n \"CVE-2015-7549\",\n \"CVE-2015-8345\",\n \"CVE-2015-8504\",\n \"CVE-2015-8558\",\n \"CVE-2015-8567\",\n \"CVE-2015-8568\",\n \"CVE-2015-8613\",\n \"CVE-2016-1568\",\n \"CVE-2016-2198\",\n \"CVE-2016-2391\",\n \"CVE-2016-2392\",\n \"CVE-2016-2538\",\n \"CVE-2016-2841\",\n \"CVE-2016-2858\",\n \"CVE-2016-4001\",\n \"CVE-2016-4002\",\n \"CVE-2016-4037\",\n \"CVE-2016-4453\",\n \"CVE-2016-4454\",\n \"CVE-2016-6834\",\n \"CVE-2016-6835\",\n \"CVE-2016-6836\",\n \"CVE-2016-6888\",\n \"CVE-2016-7116\",\n \"CVE-2016-7161\",\n \"CVE-2016-7421\",\n \"CVE-2016-7908\",\n \"CVE-2016-7909\",\n \"CVE-2016-8576\",\n \"CVE-2016-8669\",\n \"CVE-2016-8909\",\n \"CVE-2016-8910\",\n \"CVE-2016-9102\",\n \"CVE-2016-9103\",\n \"CVE-2016-9104\",\n \"CVE-2016-9105\",\n \"CVE-2016-9106\",\n \"CVE-2016-9381\",\n \"CVE-2016-9907\",\n \"CVE-2016-9911\",\n \"CVE-2017-10806\",\n \"CVE-2017-11434\",\n \"CVE-2017-18043\",\n \"CVE-2017-5579\",\n \"CVE-2017-5973\",\n \"CVE-2017-8309\",\n \"CVE-2017-9373\",\n \"CVE-2017-9374\",\n \"CVE-2018-10839\",\n \"CVE-2018-15746\",\n \"CVE-2018-17958\",\n \"CVE-2018-17963\",\n \"CVE-2019-11135\",\n \"CVE-2019-14378\",\n \"CVE-2019-6778\",\n \"CVE-2020-7039\",\n \"CVE-2020-8608\"\n );\n script_bugtraq_id(\n 66955,\n 74809\n );\n\n script_name(english:\"EulerOS 2.0 SP3 : qemu-kvm (EulerOS-SA-2020-1430)\");\n script_summary(english:\"Checks the rpm output for the updated packages.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote EulerOS host is missing multiple security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to the versions of the qemu-kvm packages installed, the\nEulerOS installation on the remote host is affected by the following\nvulnerabilities :\n\n - In libslirp 4.1.0, as used in QEMU 4.2.0, tcp_subr.c\n misuses snprintf return values, leading to a buffer\n overflow in later code.(CVE-2020-8608)\n\n - This vulnerability has been modified since it was last\n analyzed by the NVD. It is awaiting reanalysis which\n may result in further changes to the information\n provided.(CVE-2019-11135)\n\n - tcp_emu in tcp_subr.c in libslirp 4.1.0, as used in\n QEMU 4.2.0, mismanages memory, as demonstrated by IRC\n DCC commands in EMU_IRC. This can cause a heap-based\n buffer overflow or other out-of-bounds access which can\n lead to a DoS or potential execute arbitrary\n code.(CVE-2020-7039)\n\n - ip_reass in ip_input.c in libslirp 4.0.0 has a\n heap-based buffer overflow via a large packet because\n it mishandles a case involving the first\n fragment.(CVE-2019-14378)\n\n - Integer overflow in the VNC display driver in QEMU\n before 2.1.0 allows attachers to cause a denial of\n service (process crash) via a CLIENT_CUT_TEXT message,\n which triggers an infinite loop.(CVE-2015-5239)\n\n - Buffer overflow in the send_control_msg function in\n hw/char/virtio-serial-bus.c in QEMU before 2.4.0 allows\n guest users to cause a denial of service (QEMU process\n crash) via a crafted virtio control\n message.(CVE-2015-5745)\n\n - The ne2000_receive function in hw/net/ne2000.c in QEMU\n before 2.4.0.1 allows attackers to cause a denial of\n service (infinite loop and instance crash) or possibly\n execute arbitrary code via vectors related to receiving\n packets.(CVE-2015-5278)\n\n - The process_tx_desc function in hw/net/e1000.c in QEMU\n before 2.4.0.1 does not properly process transmit\n descriptor data when sending a network packet, which\n allows attackers to cause a denial of service (infinite\n loop and guest crash) via unspecified\n vectors.(CVE-2015-6815)\n\n - Heap-based buffer overflow in the ne2000_receive\n function in hw/net/ne2000.c in QEMU before 2.4.0.1\n allows guest OS users to cause a denial of service\n (instance crash) or possibly execute arbitrary code via\n vectors related to receiving packets.(CVE-2015-5279)\n\n - Heap-based buffer overflow in the .receive callback of\n xlnx.xps-ethernetlite in QEMU (aka Quick Emulator)\n allows attackers to execute arbitrary code on the QEMU\n host via a large ethlite packet.(CVE-2016-7161)\n\n - hw/net/vmxnet3.c in QEMU 2.0.0-rc0, 1.7.1, and earlier\n allows local guest users to cause a denial of service\n or possibly execute arbitrary code via vectors related\n to (1) RX or (2) TX queue numbers or (3) interrupt\n indices. NOTE: some of these details are obtained from\n third party information.(CVE-2013-4544)\n\n - The slirp_smb function in net/slirp.c in QEMU 2.3.0 and\n earlier creates temporary files with predictable names,\n which allows local users to cause a denial of service\n (instantiation failure) by creating /tmp/qemu-smb.*-*\n files before the program.(CVE-2015-4037)\n\n - hw/ide/core.c in QEMU does not properly restrict the\n commands accepted by an ATAPI device, which allows\n guest users to cause a denial of service or possibly\n have unspecified other impact via certain IDE commands,\n as demonstrated by a WIN_READ_NATIVE_MAX command to an\n empty drive, which triggers a divide-by-zero error and\n instance crash.(CVE-2015-6855)\n\n - hw/virtio/virtio.c in the Virtual Network Device\n (virtio-net) support in QEMU, when big or mergeable\n receive buffers are not supported, allows remote\n attackers to cause a denial of service (guest network\n consumption) via a flood of jumbo frames on the (1)\n tuntap or (2) macvtap interface.(CVE-2015-7295)\n\n - The MSI-X MMIO support in hw/pci/msix.c in QEMU (aka\n Quick Emulator) allows local guest OS privileged users\n to cause a denial of service (NULL pointer dereference\n and QEMU process crash) by leveraging failure to define\n the .write method.(CVE-2015-7549)\n\n - The eepro100 emulator in QEMU qemu-kvm blank allows\n local guest users to cause a denial of service\n (application crash and infinite loop) via vectors\n involving the command block list.(CVE-2015-8345)\n\n - Qemu, when built with VNC display driver support,\n allows remote attackers to cause a denial of service\n (arithmetic exception and application crash) via\n crafted SetPixelFormat messages from a\n client.(CVE-2015-8504)\n\n - The ehci_process_itd function in hw/usb/hcd-ehci.c in\n QEMU allows local guest OS administrators to cause a\n denial of service (infinite loop and CPU consumption)\n via a circular isochronous transfer descriptor (iTD)\n list.(CVE-2015-8558)\n\n - Memory leak in net/vmxnet3.c in QEMU allows remote\n attackers to cause a denial of service (memory\n consumption).(CVE-2015-8567)\n\n - Memory leak in QEMU, when built with a VMWARE VMXNET3\n paravirtual NIC emulator support, allows local guest\n users to cause a denial of service (host memory\n consumption) by trying to activate the vmxnet3 device\n repeatedly.(CVE-2015-8568)\n\n - Stack-based buffer overflow in the\n megasas_ctrl_get_info function in QEMU, when built with\n SCSI MegaRAID SAS HBA emulation support, allows local\n guest users to cause a denial of service (QEMU instance\n crash) via a crafted SCSI controller CTRL_GET_INFO\n command.(CVE-2015-8613)\n\n - Use-after-free vulnerability in hw/ide/ahci.c in QEMU,\n when built with IDE AHCI Emulation support, allows\n guest OS users to cause a denial of service (instance\n crash) or possibly execute arbitrary code via an\n invalid AHCI Native Command Queuing (NCQ) AIO\n command.(CVE-2016-1568)\n\n - QEMU (aka Quick Emulator) built with the USB EHCI\n emulation support is vulnerable to a null pointer\n dereference flaw. It could occur when an application\n attempts to write to EHCI capabilities registers. A\n privileged user inside quest could use this flaw to\n crash the QEMU process instance resulting in\n DoS.(CVE-2016-2198)\n\n - The ohci_bus_start function in the USB OHCI emulation\n support (hw/usb/hcd-ohci.c) in QEMU allows local guest\n OS administrators to cause a denial of service (NULL\n pointer dereference and QEMU process crash) via vectors\n related to multiple eof_timers.(CVE-2016-2391)\n\n - The is_rndis function in the USB Net device emulator\n (hw/usb/dev-network.c) in QEMU before 2.5.1 does not\n properly validate USB configuration descriptor objects,\n which allows local guest OS administrators to cause a\n denial of service (NULL pointer dereference and QEMU\n process crash) via vectors involving a remote NDIS\n control message packet.(CVE-2016-2392)\n\n - Multiple integer overflows in the USB Net device\n emulator (hw/usb/dev-network.c) in QEMU before 2.5.1\n allow local guest OS administrators to cause a denial\n of service (QEMU process crash) or obtain sensitive\n host memory information via a remote NDIS control\n message packet that is mishandled in the (1)\n rndis_query_response, (2) rndis_set_response, or (3)\n usb_net_handle_dataout function.(CVE-2016-2538)\n\n - The ne2000_receive function in the NE2000 NIC emulation\n support (hw/net/ne2000.c) in QEMU before 2.5.1 allows\n local guest OS administrators to cause a denial of\n service (infinite loop and QEMU process crash) via\n crafted values for the PSTART and PSTOP registers,\n involving ring buffer control.(CVE-2016-2841)\n\n - QEMU, when built with the Pseudo Random Number\n Generator (PRNG) back-end support, allows local guest\n OS users to cause a denial of service (process crash)\n via an entropy request, which triggers arbitrary stack\n based allocation and memory corruption.(CVE-2016-2858)\n\n - Buffer overflow in the stellaris_enet_receive function\n in hw/net/stellaris_enet.c in QEMU, when the Stellaris\n ethernet controller is configured to accept large\n packets, allows remote attackers to cause a denial of\n service (QEMU crash) via a large packet.(CVE-2016-4001)\n\n - Buffer overflow in the mipsnet_receive function in\n hw/net/mipsnet.c in QEMU, when the guest NIC is\n configured to accept large packets, allows remote\n attackers to cause a denial of service (memory\n corruption and QEMU crash) or possibly execute\n arbitrary code via a packet larger than 1514\n bytes.(CVE-2016-4002)\n\n - The ehci_advance_state function in hw/usb/hcd-ehci.c in\n QEMU allows local guest OS administrators to cause a\n denial of service (infinite loop and CPU consumption)\n via a circular split isochronous transfer descriptor\n (siTD) list, a related issue to\n CVE-2015-8558.(CVE-2016-4037)\n\n - The vmsvga_fifo_run function in hw/display/vmware_vga.c\n in QEMU allows local guest OS administrators to cause a\n denial of service (infinite loop and QEMU process\n crash) via a VGA command.(CVE-2016-4453)\n\n - The vmsvga_fifo_read_raw function in\n hw/display/vmware_vga.c in QEMU allows local guest OS\n administrators to obtain sensitive host memory\n information or cause a denial of service (QEMU process\n crash) by changing FIFO registers and issuing a VGA\n command, which triggers an out-of-bounds\n read.(CVE-2016-4454)\n\n - The net_tx_pkt_do_sw_fragmentation function in\n hw/net/net_tx_pkt.c in QEMU (aka Quick Emulator) allows\n local guest OS administrators to cause a denial of\n service (infinite loop and QEMU process crash) via a\n zero length for the current fragment\n length.(CVE-2016-6834)\n\n - The vmxnet_tx_pkt_parse_headers function in\n hw/net/vmxnet_tx_pkt.c in QEMU (aka Quick Emulator)\n allows local guest OS administrators to cause a denial\n of service (buffer over-read) by leveraging failure to\n check IP header length.(CVE-2016-6835)\n\n - The vmxnet3_complete_packet function in\n hw/net/vmxnet3.c in QEMU (aka Quick Emulator) allows\n local guest OS administrators to obtain sensitive host\n memory information by leveraging failure to initialize\n the txcq_descr object.(CVE-2016-6836)\n\n - Integer overflow in the net_tx_pkt_init function in\n hw/net/net_tx_pkt.c in QEMU (aka Quick Emulator) allows\n local guest OS administrators to cause a denial of\n service (QEMU process crash) via the maximum\n fragmentation count, which triggers an unchecked\n multiplication and NULL pointer\n dereference.(CVE-2016-6888)\n\n - Directory traversal vulnerability in hw/9pfs/9p.c in\n QEMU (aka Quick Emulator) allows local guest OS\n administrators to access host files outside the export\n path via a .. (dot dot) in an unspecified\n string.(CVE-2016-7116)\n\n - The pvscsi_ring_pop_req_descr function in\n hw/scsi/vmw_pvscsi.c in QEMU (aka Quick Emulator)\n allows local guest OS administrators to cause a denial\n of service (infinite loop and QEMU process crash) by\n leveraging failure to limit process IO loop to the ring\n size.(CVE-2016-7421)\n\n - The mcf_fec_do_tx function in hw/net/mcf_fec.c in QEMU\n (aka Quick Emulator) does not properly limit the buffer\n descriptor count when transmitting packets, which\n allows local guest OS administrators to cause a denial\n of service (infinite loop and QEMU process crash) via\n vectors involving a buffer descriptor with a length of\n 0 and crafted values in bd.flags.(CVE-2016-7908)\n\n - The pcnet_rdra_addr function in hw/net/pcnet.c in QEMU\n (aka Quick Emulator) allows local guest OS\n administrators to cause a denial of service (infinite\n loop and QEMU process crash) by setting the (1) receive\n or (2) transmit descriptor ring length to\n 0.(CVE-2016-7909)\n\n - The xhci_ring_fetch function in hw/usb/hcd-xhci.c in\n QEMU (aka Quick Emulator) allows local guest OS\n administrators to cause a denial of service (infinite\n loop and QEMU process crash) by leveraging failure to\n limit the number of link Transfer Request Blocks (TRB)\n to process.(CVE-2016-8576)\n\n - The serial_update_parameters function in\n hw/char/serial.c in QEMU (aka Quick Emulator) allows\n local guest OS administrators to cause a denial of\n service (divide-by-zero error and QEMU process crash)\n via vectors involving a value of divider greater than\n baud base.(CVE-2016-8669)\n\n - The intel_hda_xfer function in hw/audio/intel-hda.c in\n QEMU (aka Quick Emulator) allows local guest OS\n administrators to cause a denial of service (infinite\n loop and CPU consumption) via an entry with the same\n value for buffer length and pointer\n position.(CVE-2016-8909)\n\n - The rtl8139_cplus_transmit function in hw/net/rtl8139.c\n in QEMU (aka Quick Emulator) allows local guest OS\n administrators to cause a denial of service (infinite\n loop and CPU consumption) by leveraging failure to\n limit the ring descriptor count.(CVE-2016-8910)\n\n - Memory leak in the v9fs_xattrcreate function in\n hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local\n guest OS administrators to cause a denial of service\n (memory consumption and QEMU process crash) via a large\n number of Txattrcreate messages with the same fid\n number.(CVE-2016-9102)\n\n - The v9fs_xattrcreate function in hw/9pfs/9p.c in QEMU\n (aka Quick Emulator) allows local guest OS\n administrators to obtain sensitive host heap memory\n information by reading xattribute values before writing\n to them.(CVE-2016-9103)\n\n - Multiple integer overflows in the (1) v9fs_xattr_read\n and (2) v9fs_xattr_write functions in hw/9pfs/9p.c in\n QEMU (aka Quick Emulator) allow local guest OS\n administrators to cause a denial of service (QEMU\n process crash) via a crafted offset, which triggers an\n out-of-bounds access.(CVE-2016-9104)\n\n - Memory leak in the v9fs_link function in hw/9pfs/9p.c\n in QEMU (aka Quick Emulator) allows local guest OS\n administrators to cause a denial of service (memory\n consumption) via vectors involving a reference to the\n source fid object.(CVE-2016-9105)\n\n - Memory leak in the v9fs_write function in hw/9pfs/9p.c\n in QEMU (aka Quick Emulator) allows local guest OS\n administrators to cause a denial of service (memory\n consumption) by leveraging failure to free an IO\n vector.(CVE-2016-9106)\n\n - Race condition in QEMU in Xen allows local x86 HVM\n guest OS administrators to gain privileges by changing\n certain data on shared rings, aka a 'double fetch'\n vulnerability.(CVE-2016-9381)\n\n - Quick Emulator (Qemu) built with the USB redirector\n usb-guest support is vulnerable to a memory leakage\n flaw. It could occur while destroying the USB\n redirector in 'usbredir_handle_destroy'. A guest\n user/process could use this issue to leak host memory,\n resulting in DoS for a host.(CVE-2016-9907)\n\n - Quick Emulator (Qemu) built with the USB EHCI Emulation\n support is vulnerable to a memory leakage issue. It\n could occur while processing packet data in\n 'ehci_init_transfer'. A guest user/process could use\n this issue to leak host memory, resulting in DoS for a\n host.(CVE-2016-9911)\n\n - Stack-based buffer overflow in hw/usb/redirect.c in\n QEMU (aka Quick Emulator) allows local guest OS users\n to cause a denial of service (QEMU process crash) via\n vectors related to logging debug\n messages.(CVE-2017-10806)\n\n - The dhcp_decode function in slirp/bootp.c in QEMU (aka\n Quick Emulator) allows local guest OS users to cause a\n denial of service (out-of-bounds read and QEMU process\n crash) via a crafted DHCP options\n string.(CVE-2017-11434)\n\n - Integer overflow in the macro ROUND_UP (n, d) in Quick\n Emulator (Qemu) allows a user to cause a denial of\n service (Qemu process crash).(CVE-2017-18043)\n\n - Memory leak in the serial_exit_core function in\n hw/char/serial.c in QEMU (aka Quick Emulator) allows\n local guest OS privileged users to cause a denial of\n service (host memory consumption and QEMU process\n crash) via a large number of device unplug\n operations.(CVE-2017-5579)\n\n - The xhci_kick_epctx function in hw/usb/hcd-xhci.c in\n QEMU (aka Quick Emulator) allows local guest OS\n privileged users to cause a denial of service (infinite\n loop and QEMU process crash) via vectors related to\n control transfer descriptor sequence.(CVE-2017-5973)\n\n - Memory leak in the audio/audio.c in QEMU (aka Quick\n Emulator) allows remote attackers to cause a denial of\n service (memory consumption) by repeatedly starting and\n stopping audio capture.(CVE-2017-8309)\n\n - Memory leak in QEMU (aka Quick Emulator), when built\n with IDE AHCI Emulation support, allows local guest OS\n privileged users to cause a denial of service (memory\n consumption) by repeatedly hot-unplugging the AHCI\n device.(CVE-2017-9373)\n\n - Memory leak in QEMU (aka Quick Emulator), when built\n with USB EHCI Emulation support, allows local guest OS\n privileged users to cause a denial of service (memory\n consumption) by repeatedly hot-unplugging the\n device.(CVE-2017-9374)\n\n - Qemu emulator <= 3.0.0 built with the NE2000 NIC\n emulation support is vulnerable to an integer overflow,\n which could lead to buffer overflow issue. It could\n occur when receiving packets over the network. A user\n inside guest could use this flaw to crash the Qemu\n process resulting in DoS.(CVE-2018-10839)\n\n - qemu-seccomp.c in QEMU might allow local OS guest users\n to cause a denial of service (guest crash) by\n leveraging mishandling of the seccomp policy for\n threads other than the main thread.(CVE-2018-15746)\n\n - Qemu has a Buffer Overflow in rtl8139_do_receive in\n hw/net/rtl8139.c because an incorrect integer data type\n is used.(CVE-2018-17958)\n\n - qemu_deliver_packet_iov in net/net.c in Qemu accepts\n packet sizes greater than INT_MAX, which allows\n attackers to cause a denial of service or possibly have\n unspecified other impact.(CVE-2018-17963)\n\n - In QEMU 3.0.0, tcp_emu in slirp/tcp_subr.c has a\n heap-based buffer overflow.(CVE-2019-6778)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\");\n # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2020-1430\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?3afa4311\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected qemu-kvm packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-8608\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/04/16\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/04/15\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:qemu-img\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:qemu-kvm\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:qemu-kvm-common\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:huawei:euleros:2.0\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Huawei Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2020-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/EulerOS/release\", \"Host/EulerOS/rpm-list\", \"Host/EulerOS/sp\");\n script_exclude_keys(\"Host/EulerOS/uvp_version\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/EulerOS/release\");\nif (isnull(release) || release !~ \"^EulerOS\") audit(AUDIT_OS_NOT, \"EulerOS\");\nif (release !~ \"^EulerOS release 2\\.0(\\D|$)\") audit(AUDIT_OS_NOT, \"EulerOS 2.0\");\n\nsp = get_kb_item(\"Host/EulerOS/sp\");\nif (isnull(sp) || sp !~ \"^(3)$\") audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP3\");\n\nuvp = get_kb_item(\"Host/EulerOS/uvp_version\");\nif (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP3\", \"EulerOS UVP \" + uvp);\n\nif (!get_kb_item(\"Host/EulerOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"aarch64\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"EulerOS\", cpu);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_ARCH_NOT, \"i686 / x86_64\", cpu);\n\nflag = 0;\n\npkgs = [\"qemu-img-1.5.3-156.5.h12\",\n \"qemu-kvm-1.5.3-156.5.h12\",\n \"qemu-kvm-common-1.5.3-156.5.h12\"];\n\nforeach (pkg in pkgs)\n if (rpm_check(release:\"EulerOS-2.0\", sp:\"3\", reference:pkg)) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"qemu-kvm\");\n}\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "centos": [{"lastseen": "2023-01-01T04:43:08", "description": "**CentOS Errata and Security Advisory** CESA-2016:0082\n\n\nKVM (Kernel-based Virtual Machine) is a full virtualization solution for\nLinux on AMD64 and Intel 64 systems. The qemu-kvm package provides the\nuser-space component for running virtual machines using KVM.\n\nAn out-of-bounds read/write flaw was discovered in the way QEMU's Firmware\nConfiguration device emulation processed certain firmware configurations.\nA privileged (CAP_SYS_RAWIO) guest user could use this flaw to crash the\nQEMU process instance or, potentially, execute arbitrary code on the host\nwith privileges of the QEMU process. (CVE-2016-1714)\n\nRed Hat would like to thank Donghai Zhu of Alibaba for reporting this\nissue.\n\nAll qemu-kvm users are advised to upgrade to these updated packages, which\ncontain a backported patch to correct this issue. After installing this\nupdate, shut down all running virtual machines. Once all virtual machines\nhave shut down, start them again for this update to take effect.\n\n\n**Merged security bulletin from advisories:**\nhttps://lists.centos.org/pipermail/centos-announce/2016-February/071111.html\n\n**Affected packages:**\nqemu-guest-agent\nqemu-img\nqemu-kvm\nqemu-kvm-tools\n\n**Upstream details at:**\nhttps://access.redhat.com/errata/RHSA-2016:0082", "cvss3": {"exploitabilityScore": 1.4, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "CHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.1, "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.0", "userInteraction": "NONE"}, "impactScore": 6.0}, "published": "2016-02-01T10:06:38", "type": "centos", "title": "qemu security update", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 3.4, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 6.9, "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2016-1714"], "modified": "2016-02-01T10:06:38", "id": "CESA-2016:0082", "href": "https://lists.centos.org/pipermail/centos-announce/2016-February/071111.html", "cvss": {"score": 6.9, "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-01T04:43:08", "description": "**CentOS Errata and Security Advisory** CESA-2016:0083\n\n\nKVM (Kernel-based Virtual Machine) is a full virtualization solution for\nLinux on AMD64 and Intel 64 systems. The qemu-kvm package provides the\nuser-space component for running virtual machines using KVM.\n\nAn out-of-bounds read/write flaw was discovered in the way QEMU's Firmware\nConfiguration device emulation processed certain firmware configurations.\nA privileged (CAP_SYS_RAWIO) guest user could use this flaw to crash the\nQEMU process instance or, potentially, execute arbitrary code on the host\nwith privileges of the QEMU process. (CVE-2016-1714)\n\nRed Hat would like to thank Donghai Zhu of Alibaba for reporting this\nissue.\n\nThis update also fixes the following bugs:\n\n* Incorrect handling of the last sector of an image file could trigger an\nassertion failure in qemu-img. This update changes the handling of the last\nsector, and no assertion failure occurs. (BZ#1298828)\n\nAll qemu-kvm users are advised to upgrade to these updated packages, which\ncontain backported patches to correct these issues. After installing this\nupdate, shut down all running virtual machines. Once all virtual machines\nhave shut down, start them again for this update to take effect.\n\n**Merged security bulletin from advisories:**\nhttps://lists.centos.org/pipermail/centos-announce/2016-February/071112.html\n\n**Affected packages:**\nlibcacard\nlibcacard-devel\nlibcacard-tools\nqemu-img\nqemu-kvm\nqemu-kvm-common\nqemu-kvm-tools\n\n**Upstream details at:**\nhttps://access.redhat.com/errata/RHSA-2016:0083", "cvss3": {"exploitabilityScore": 1.4, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "CHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.1, "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.0", "userInteraction": "NONE"}, "impactScore": 6.0}, "published": "2016-02-01T10:07:16", "type": "centos", "title": "libcacard, qemu security update", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 3.4, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 6.9, "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2016-1714"], "modified": "2016-02-01T10:07:16", "id": "CESA-2016:0083", "href": "https://lists.centos.org/pipermail/centos-announce/2016-February/071112.html", "cvss": {"score": 6.9, "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"}}], "debiancve": [{"lastseen": "2022-12-31T18:08:18", "description": "The (1) fw_cfg_write and (2) fw_cfg_read functions in hw/nvram/fw_cfg.c in QEMU before 2.4, when built with the Firmware Configuration device emulation support, allow guest OS users with the CAP_SYS_RAWIO privilege to cause a denial of service (out-of-bounds read or write access and process crash) or possibly execute arbitrary code via an invalid current entry value in a firmware configuration.", "cvss3": {"exploitabilityScore": 1.4, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "CHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.1, "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.0", "userInteraction": "NONE"}, "impactScore": 6.0}, "published": "2016-04-07T19:59:00", "type": "debiancve", "title": "CVE-2016-1714", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 3.4, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 6.9, "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2016-1714"], "modified": "2016-04-07T19:59:00", "id": "DEBIANCVE:CVE-2016-1714", "href": "https://security-tracker.debian.org/tracker/CVE-2016-1714", "cvss": {"score": 6.9, "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2022-12-31T18:08:18", "description": "Use-after-free vulnerability in hw/ide/ahci.c in QEMU, when built with IDE AHCI Emulation support, allows guest OS users to cause a denial of service (instance crash) or possibly execute arbitrary code via an invalid AHCI Native Command Queuing (NCQ) AIO command.", "cvss3": {"exploitabilityScore": 2.0, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 6.0}, "published": "2016-04-12T02:00:00", "type": "debiancve", "title": "CVE-2016-1568", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 3.4, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 6.9, "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2016-1568"], "modified": "2016-04-12T02:00:00", "id": "DEBIANCVE:CVE-2016-1568", "href": "https://security-tracker.debian.org/tracker/CVE-2016-1568", "cvss": {"score": 6.9, "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"}}], "ubuntucve": [{"lastseen": "2022-08-04T14:13:25", "description": "The (1) fw_cfg_write and (2) fw_cfg_read functions in hw/nvram/fw_cfg.c in\nQEMU before 2.4, when built with the Firmware Configuration device\nemulation support, allow guest OS users with the CAP_SYS_RAWIO privilege to\ncause a denial of service (out-of-bounds read or write access and process\ncrash) or possibly execute arbitrary code via an invalid current entry\nvalue in a firmware configuration.\n\n#### Notes\n\nAuthor| Note \n---|--- \n[sbeattie](<https://launchpad.net/~sbeattie>) | affects qemu 2.3 and earlier\n", "cvss3": {"exploitabilityScore": 1.4, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "CHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.1, "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.0", "userInteraction": "NONE"}, "impactScore": 6.0}, "published": "2016-01-12T00:00:00", "type": "ubuntucve", "title": "CVE-2016-1714", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 3.4, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 6.9, "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2016-1714"], "modified": "2016-01-12T00:00:00", "id": "UB:CVE-2016-1714", "href": "https://ubuntu.com/security/CVE-2016-1714", "cvss": {"score": 6.9, "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2022-08-04T14:13:26", "description": "Use-after-free vulnerability in hw/ide/ahci.c in QEMU, when built with IDE\nAHCI Emulation support, allows guest OS users to cause a denial of service\n(instance crash) or possibly execute arbitrary code via an invalid AHCI\nNative Command Queuing (NCQ) AIO command.\n\n#### Bugs\n\n * <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=810527>\n * <https://bugzilla.redhat.com/show_bug.cgi?id=1288532>\n", "cvss3": {"exploitabilityScore": 2.0, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 6.0}, "published": "2016-01-11T00:00:00", "type": "ubuntucve", "title": "CVE-2016-1568", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 3.4, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 6.9, "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2016-1568"], "modified": "2016-01-11T00:00:00", "id": "UB:CVE-2016-1568", "href": "https://ubuntu.com/security/CVE-2016-1568", "cvss": {"score": 6.9, "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"}}], "oraclelinux": [{"lastseen": "2021-06-04T20:21:01", "description": "[1.5.3-105.el7_2.3]\n- kvm-fw_cfg-add-check-to-validate-current-entry-value-CVE.patch [bz#1298047]\n- Resolves: bz#1298047\n (CVE-2016-1714 qemu-kvm: Qemu: nvram: OOB r/w access in processing firmware configurations [rhel-7.2.z])\n[1.5.3-105.el7_2.2]\n- kvm-raw-posix-Fix-.bdrv_co_get_block_status-for-unaligne.patch [bz#1298828]\n- Resolves: bz#1298828\n ([abrt] qemu-img: get_block_status(): qemu-img killed by SIGABRT)", "cvss3": {}, "published": "2016-01-28T00:00:00", "type": "oraclelinux", "title": "qemu-kvm security and bug fix update", "bulletinFamily": "unix", "cvss2": {}, "cvelist": ["CVE-2016-1714"], "modified": "2016-01-28T00:00:00", "id": "ELSA-2016-0083", "href": "http://linux.oracle.com/errata/ELSA-2016-0083.html", "cvss": {"score": 6.9, "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-06-04T20:21:04", "description": "[0.12.1.2-2.479.el6_7.4]\n- kvm-fw_cfg-add-check-to-validate-current-entry-value-CVE.patch [bz#1298045]\n- Resolves: bz#1298045\n (CVE-2016-1714 qemu-kvm: Qemu: nvram: OOB r/w access in processing firmware configurations [rhel-6.7.z])", "cvss3": {}, "published": "2016-01-28T00:00:00", "type": "oraclelinux", "title": "qemu-kvm security update", "bulletinFamily": "unix", "cvss2": {}, "cvelist": ["CVE-2016-1714"], "modified": "2016-01-28T00:00:00", "id": "ELSA-2016-0082", "href": "http://linux.oracle.com/errata/ELSA-2016-0082.html", "cvss": {"score": 6.9, "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-06-04T20:20:53", "description": "[0.12.1.2-2.491.el6_8.1]\n- kvm-Add-vga.h-unmodified-from-Linux.patch [bz#1331407]\n- kvm-vga.h-remove-unused-stuff-and-reformat.patch [bz#1331407]\n- kvm-vga-use-constants-from-vga.h.patch [bz#1331407]\n- kvm-vga-Remove-some-should-be-done-in-BIOS-comments.patch [bz#1331407]\n- kvm-vga-fix-banked-access-bounds-checking-CVE-2016-3710.patch [bz#1331407]\n- kvm-vga-add-vbe_enabled-helper.patch [bz#1331407]\n- kvm-vga-factor-out-vga-register-setup.patch [bz#1331407]\n- kvm-vga-update-vga-register-setup-on-vbe-changes.patch [bz#1331407]\n- kvm-vga-make-sure-vga-register-setup-for-vbe-stays-intac.patch [bz#1331407]\n- Resolves: bz#1331407\n (EMBARGOED CVE-2016-3710 qemu-kvm: qemu: incorrect banked access bounds checking in vga module [rhel-6.8.z])\n[0.12.1.2-2.491.el6]\n- Revert 'warning when CPU threads>1 for non-Intel CPUs' fix\n[0.12.1.2-2.490.el6]\n- kvm-qemu-ga-implement-win32-guest-set-user-password.patch [bz#1174181]\n- kvm-util-add-base64-decoding-function.patch [bz#1174181]\n- kvm-qga-convert-to-use-error-checked-base64-decode.patch [bz#1174181]\n- kvm-qga-use-more-idiomatic-qemu-style-eol-operators.patch [bz#1174181]\n- kvm-qga-use-size_t-for-wcslen-return-value.patch [bz#1174181]\n- kvm-qga-use-wide-chars-constants-for-wchar_t-comparisons.patch [bz#1174181]\n- kvm-qga-fix-off-by-one-length-check.patch [bz#1174181]\n- kvm-qga-check-utf8-to-utf16-conversion.patch [bz#1174181]\n- Resolves: bz#1174181\n (RFE: provide QEMU guest agent command for setting root account password (Linux guest))\n[0.12.1.2-2.489.el6]\n- kvm-hw-qxl-qxl_send_events-nop-if-stopped.patch [bz#1290743]\n- kvm-block-mirror-fix-full-sync-mode-when-target-does-not.patch [bz#971312]\n- Resolves: bz#1290743\n (qemu-kvm core dumped when repeat system_reset 20 times during guest boot)\n- Resolves: bz#971312\n (block: Mirroring to raw block device doesnt zero out unused blocks)\n* Mon Feb 08 2016 Miroslav Rezanina \n- Fixed qemu-ga path configuration [bz#1213233]\n- Resolves: bz#1213233\n ([virtagent] The default path '/etc/qemu/fsfreeze-hook' for 'fsfreeze-hook' script doesnt exist)\n[0.12.1.2-2.487.el6]\n- kvm-virtio-scsi-use-virtqueue_map_sg-when-loading-reques.patch [bz#1249740]\n- kvm-scsi-disk-fix-cmd.mode-field-typo.patch [bz#1249740]\n- Resolves: bz#1249740\n (Segfault occurred at Dst VM while completed migration upon ENOSPC)\n[0.12.1.2-2.486.el6]\n- kvm-blockdev-Error-out-on-negative-throttling-option-val.patch [bz#1294619]\n- kvm-fw_cfg-add-check-to-validate-current-entry-value-CVE.patch [bz#1298046]\n- Resolves: bz#1294619\n (Guest should failed to boot if set iops,bps to negative number)\n- Resolves: bz#1298046\n (CVE-2016-1714 qemu-kvm: Qemu: nvram: OOB r/w access in processing firmware configurations [rhel-6.8])\n[0.12.1.2-2.485.el6]\n- kvm-Change-fsfreeze-hook-default-location.patch [bz#1213233]\n- kvm-qxl-replace-pipe-signaling-with-bottom-half.patch [bz#1290743]\n- Resolves: bz#1213233\n ([virtagent] The default path '/etc/qemu/fsfreeze-hook' for 'fsfreeze-hook' script doesnt exist)\n- Resolves: bz#1290743\n (qemu-kvm core dumped when repeat system_reset 20 times during guest boot)\n[0.12.1.2-2.484.el6]\n- kvm-qga-flush-explicitly-when-needed.patch [bz#1210246]\n- kvm-qga-add-guest-set-user-password-command.patch [bz#1174181]\n- kvm-qcow2-Zero-initialise-first-cluster-for-new-images.patch [bz#1223216]\n- kvm-Documentation-Warn-against-qemu-img-on-active-image.patch [bz#1297424]\n- kvm-target-i386-warns-users-when-CPU-threads-1-for-non-I.patch [bz#1292678]\n- kvm-qemu-options-Fix-texinfo-markup.patch [bz#1250442]\n- kvm-qga-Fix-memory-allocation-pasto.patch []\n- kvm-block-raw-posix-Open-file-descriptor-O_RDWR-to-work-.patch [bz#1268347]\n- Resolves: bz#1174181\n (RFE: provide QEMU guest agent command for setting root/administrator account password)\n- Resolves: bz#1210246\n ([virtagent]The 'write' content is lost if 'read' it before flush through guest agent)\n- Resolves: bz#1223216\n (qemu-img can not create qcow2 image when backend is block device)\n- Resolves: bz#1250442\n (qemu-doc.html bad markup in section 3.3 Invocation)\n- Resolves: bz#1268347\n (posix_fallocate emulation on NFS fails with Bad file descriptor if fd is opened O_WRONLY)\n- Resolves: bz#1292678\n (Qemu should report error when cmdline set threads=2 in amd host)\n- Resolves: bz#1297424\n (Add warning about running qemu-img on active VMs to its manpage)\n[0.12.1.2-2.483.el6]\n- kvm-rtl8139-Fix-receive-buffer-overflow-check.patch [bz#1262866]\n- kvm-rtl8139-Do-not-consume-the-packet-during-overflow-in.patch [bz#1262866]\n- Resolves: bz#1262866\n ([RHEL6] Package is 100% lost when ping from host to Win2012r2 guest with 64000 size)\n[0.12.1.2-2.482.el6]\n- kvm-qemu-kvm-get-put-MSR_TSC_AUX-across-reset-and-migrat.patch [bz#1265428]\n- kvm-qcow2-Discard-VM-state-in-active-L1-after-creating-s.patch [bz#1219908]\n- kvm-net-pcnet-add-check-to-validate-receive-data-size-CV.patch [bz#1286597]\n- kvm-pcnet-fix-rx-buffer-overflow-CVE-2015-7512.patch [bz#1286567]\n- Resolves: bz#1219908\n (Writing snapshots with 'virsh snapshot-create-as' command slows as more snapshots are created)\n- Resolves: bz#1265428\n (contents of MSR_TSC_AUX are not migrated)\n- Resolves: bz#1286567\n (CVE-2015-7512 qemu-kvm: Qemu: net: pcnet: buffer overflow in non-loopback mode [rhel-6.8])\n[0.12.1.2-2.481.el6]\n- kvm-net-add-checks-to-validate-ring-buffer-pointers-CVE-.patch [bz#1263275]\n- Resolves: bz#1263275\n (CVE-2015-5279 qemu-kvm: qemu: Heap overflow vulnerability in ne2000_receive() function [rhel-6.8])\n[0.12.1.2-2.480.el6]\n- kvm-virtio-rng-fix-segfault-when-adding-a-virtio-pci-rng.patch [bz#1230068]\n- kvm-qga-commands-posix-Fix-bug-in-guest-fstrim.patch [bz#1213236]\n- kvm-rtl8139-avoid-nested-ifs-in-IP-header-parsing-CVE-20.patch [bz#1248763]\n- kvm-rtl8139-drop-tautologous-if-ip-.-statement-CVE-2015-.patch [bz#1248763]\n- kvm-rtl8139-skip-offload-on-short-Ethernet-IP-header-CVE.patch [bz#1248763]\n- kvm-rtl8139-check-IP-Header-Length-field-CVE-2015-5165.patch [bz#1248763]\n- kvm-rtl8139-check-IP-Total-Length-field-CVE-2015-5165.patch [bz#1248763]\n- kvm-rtl8139-skip-offload-on-short-TCP-header-CVE-2015-51.patch [bz#1248763]\n- kvm-rtl8139-check-TCP-Data-Offset-field-CVE-2015-5165.patch [bz#1248763]\n- Resolves: bz#1213236\n ([virtagent] 'guest-fstrim' failed for guest with os on spapr-vscsi disk)\n- Resolves: bz#1230068\n (Segmentation fault when re-adding virtio-rng-pci device)\n- Resolves: bz#1248763\n (CVE-2015-5165 qemu-kvm: Qemu: rtl8139 uninitialized heap memory information leakage to guest [rhel-6.8])", "cvss3": {}, "published": "2016-05-16T00:00:00", "type": "oraclelinux", "title": "qemu-kvm security update", "bulletinFamily": "unix", "cvss2": {}, "cvelist": ["CVE-2015-5165", "CVE-2015-5279", "CVE-2015-7512", "CVE-2016-1714", "CVE-2016-3710"], "modified": "2016-05-16T00:00:00", "id": "ELSA-2016-0997", "href": "http://linux.oracle.com/errata/ELSA-2016-0997.html", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-07-28T14:24:48", "description": "[1.5.3-126.el7]\n- kvm-virtio-recalculate-vq-inuse-after-migration.patch [bz#1376542]\n- Resolves: bz#1376542\n (RHSA-2016-1756 breaks migration of instances)\n[1.5.3-125.el7]\n- kvm-nbd-server-Set-O_NONBLOCK-on-client-fd.patch [bz#1285453]\n- Resolves: bz#1285453\n (An NBD client can cause QEMU main loop to block when connecting to built-in NBD server)\n[1.5.3-124.el7]\n- kvm-target-i386-Add-support-for-FEAT_7_0_ECX.patch [bz#1372459]\n- kvm-target-i386-Add-more-Intel-AVX-512-instructions-supp.patch [bz#1372459]\n- Resolves: bz#1372459\n ([Intel 7.3 Bug] SKL-SP Guest cpu doesnt support avx512 instruction sets(avx512bw, avx512dq and avx512vl) (qemu-kvm))\n[1.5.3-123.el7]\n- kvm-Fix-backport-of-target-i386-add-feature-flags-for-CP.patch [bz#1371619]\n- kvm-Add-skip_dump-flag-to-ignore-memory-region-during-du.patch [bz#1373088]\n- Resolves: bz#1371619\n (Flags xsaveopt xsavec xgetbv1 are missing on qemu-kvm)\n- Resolves: bz#1373088\n ([FJ7.3 Bug]: virsh dump with both --memory-only and --format option fails)\n[1.5.3-122.el7]\n- kvm-virtio-validate-the-existence-of-handle_output-befor.patch [bz#1367040]\n- Resolves: bz#1367040\n (QEMU crash when guest notifies non-existent virtqueue)\n[1.5.3-121.el7]\n- kvm-json-parser-drop-superfluous-assignment-for-token-va.patch [bz#1276036]\n- kvm-qjson-Apply-nesting-limit-more-sanely.patch [bz#1276036]\n- kvm-qjson-Don-t-crash-when-input-exceeds-nesting-limit.patch [bz#1276036]\n- kvm-check-qjson-Add-test-for-JSON-nesting-depth-limit.patch [bz#1276036]\n- kvm-qjson-Spell-out-some-silent-assumptions.patch [bz#1276036]\n- kvm-qjson-Give-each-of-the-six-structural-chars-its-own-.patch [bz#1276036]\n- kvm-qjson-Inline-token_is_keyword-and-simplify.patch [bz#1276036]\n- kvm-qjson-Inline-token_is_escape-and-simplify.patch [bz#1276036]\n- kvm-qjson-replace-QString-in-JSONLexer-with-GString.patch [bz#1276036]\n- kvm-qjson-Convert-to-parser-to-recursive-descent.patch [bz#1276036]\n- kvm-qjson-store-tokens-in-a-GQueue.patch [bz#1276036]\n- kvm-qjson-surprise-allocating-6-QObjects-per-token-is-ex.patch [bz#1276036]\n- kvm-qjson-Limit-number-of-tokens-in-addition-to-total-si.patch [bz#1276036]\n- kvm-json-streamer-Don-t-leak-tokens-on-incomplete-parse.patch [bz#1276036]\n- kvm-json-streamer-fix-double-free-on-exiting-during-a-pa.patch [bz#1276036]\n- kvm-trace-remove-malloc-tracing.patch [bz#1360137]\n- Resolves: bz#1276036\n (Crash on QMP input exceeding limits)\n- Resolves: bz#1360137\n (GLib-WARNING **: gmem.c:482: custom memory allocation vtable not supported)\n[1.5.3-120.el7]\n- kvm-Add-install-dependency-to-newer-libusbx-version.patch [bz#1351106]\n- kvm-virtio-error-out-if-guest-exceeds-virtqueue-size.patch [bz#1359729]\n- Resolves: bz#1351106\n (symbol lookup error: /usr/libexec/qemu-kvm: undefined symbol: libusb_get_port_numbers)\n- Resolves: bz#1359729\n (CVE-2016-5403 qemu-kvm: Qemu: virtio: unbounded memory allocation on host via guest leading to DoS [rhel-7.3])\n[1.5.3-119.el7]\n- kvm-qxl-factor-out-qxl_get_check_slot_offset.patch [bz#1355730]\n- kvm-qxl-store-memory-region-and-offset-instead-of-pointe.patch [bz#1355730]\n- kvm-qxl-fix-surface-migration.patch [bz#1355730]\n- kvm-qxl-fix-qxl_set_dirty-call-in-qxl_dirty_one_surface.patch [bz#1355730]\n- Resolves: bz#1355730\n (spice-gtk shows outdated screen state after migration [qemu-kvm])\n[1.5.3-118.el7]\n- kvm-util-introduce-MIN_NON_ZERO.patch [bz#1318199]\n- kvm-BlockLimits-introduce-max_transfer_length.patch [bz#1318199]\n- kvm-block-backend-expose-bs-bl.max_transfer_length.patch [bz#1318199]\n- kvm-scsi-generic-Merge-block-max-xfer-len-in-INQUIRY-res.patch [bz#1318199]\n- kvm-raw-posix-Fetch-max-sectors-for-host-block-device.patch [bz#1318199]\n- kvm-scsi-Advertise-limits-by-blocksize-not-512.patch [bz#1318199]\n- kvm-util-Fix-MIN_NON_ZERO.patch [bz#1318199]\n- Resolves: bz#1318199\n (expose host BLKSECTGET limit in scsi-block (qemu-kvm))\n[1.5.3-117.el7]\n- kvm-target-i386-add-feature-flags-for-CPUID-EAX-0xd-ECX-.patch [bz#1327599]\n- kvm-target-i386-add-Skylake-Client-cpu-model.patch [bz#1327599]\n- Resolves: bz#1327599\n (Add Skylake CPU model)\n[1.5.3-116.el7]\n- kvm-block-iscsi-avoid-potential-overflow-of-acb-task-cdb.patch [bz#1340929]\n- Resolves: bz#1340929\n (CVE-2016-5126 qemu-kvm: Qemu: block: iscsi: buffer overflow in iscsi_aio_ioctl [rhel-7.3])\n[1.5.3-115.el7]\n- kvm-spice-do-not-require-TCP-ports.patch [bz#1336491]\n- kvm-vga-add-sr_vbe-register-set.patch [bz#1346982]\n- Resolves: bz#1336491\n (Ship FD connection patches qemu-kvm part)\n- Resolves: bz#1346982\n (Regression from CVE-2016-3712: windows installer fails to start)\n[1.5.3-114.el7]\n- kvm-hw-input-hid.c-Fix-capslock-hid-code.patch [bz#1256741]\n- kvm-target-i386-fix-pcmpxstrx-equal-ordered-strstr-mode.patch [bz#1340971]\n- kvm-spec-Update-rules-before-triggering-for-kvm-device.patch [bz#1333159]\n- Resolves: bz#1256741\n ('CapsLock' will work as '\\' when boot a guest with usb-kbd)\n- Resolves: bz#1333159\n (qemu-kvm doesnt reload udev rules before triggering for kvm device)\n- Resolves: bz#1340971\n (qemu: accel=tcg does not implement SSE 4 properly)\n[1.5.3-113.el7]\n- kvm-qxl-allow-to-specify-head-limit-to-qxl-driver.patch [bz#1283198]\n- kvm-qxl-Fix-new-function-name-for-spice-server-library.patch [bz#1283198]\n- kvm-block-raw-posix-Open-file-descriptor-O_RDWR-to-work-.patch [bz#1268345]\n- Resolves: bz#1268345\n (posix_fallocate emulation on NFS fails with Bad file descriptor if fd is opened O_WRONLY)\n- Resolves: bz#1283198\n (RFE: backport max monitor limitation from Qemu upstream)\n[1.5.3-112.el7]\n- kvm-virtio-scsi-Prevent-assertion-on-missed-events.patch [bz#1312289]\n- kvm-seccomp-adding-sysinfo-system-call-to-whitelist.patch [bz#1177318]\n- kvm-acpi-strip-compiler-info-in-built-in-DSDT.patch [bz#1330969]\n- kvm-acpi-fix-endian-ness-for-table-ids.patch [bz#1330969]\n- kvm-acpi-support-specified-oem-table-id-for-build_header.patch [bz#1330969]\n- kvm-acpi-take-oem_id-in-build_header-optionally.patch [bz#1330969]\n- kvm-acpi-expose-oem_id-and-oem_table_id-in-build_rsdt.patch [bz#1330969]\n- kvm-acpi-add-function-to-extract-oem_id-and-oem_table_id.patch [bz#1330969]\n- kvm-pc-set-the-OEM-fields-in-the-RSDT-and-the-FADT-from-.patch [bz#1330969]\n- kvm-block-jobs-qemu-kvm-rhel-differentiation.patch [bz#1156635]\n- Resolves: bz#1156635\n (Libvirt is confused that qemu-kvm exposes 'block-job-cancel' but not 'block-stream')\n- Resolves: bz#1177318\n (Guest using rbd based image as disk failed to start when sandbox was enabled)\n- Resolves: bz#1312289\n ('qemu-kvm: /builddir/build/BUILD/qemu-1.5.3/hw/scsi/virtio-scsi.c:533: virtio_scsi_push_event: Assertion 'event == 0' failed' after hotplug 20 virtio-scsi disks then hotunplug them)\n- Resolves: bz#1330969\n (match the OEM ID and OEM Table ID fields of the FADT and the RSDT to those of the SLIC)\n[1.5.3-111.el7]\n- kvm-vmdk-Leave-bdi-intact-if-ENOTSUP-in-vmdk_get_info.patch [bz#1299250]\n- kvm-vmdk-Use-g_random_int-to-generate-CID.patch [bz#1299250]\n- kvm-vmdk-Fix-comment-to-match-code-of-extent-lines.patch [bz#1299250]\n- kvm-vmdk-Clean-up-descriptor-file-reading.patch [bz#1299250]\n- kvm-vmdk-Check-descriptor-file-length-when-reading-it.patch [bz#1299250]\n- kvm-vmdk-Remove-unnecessary-initialization.patch [bz#1299250]\n- kvm-vmdk-Set-errp-on-failures-in-vmdk_open_vmdk4.patch [bz#1299250]\n- kvm-block-vmdk-make-ret-variable-usage-clear.patch [bz#1299250]\n- kvm-block-vmdk-move-string-allocations-from-stack-to-the.patch [bz#1299250]\n- kvm-block-vmdk-fixed-sizeof-error.patch [bz#1299250]\n- kvm-vmdk-Widen-before-shifting-32-bit-header-field.patch [bz#1299250]\n- kvm-vmdk-Fix-next_cluster_sector-for-compressed-write.patch [bz#1299250]\n- kvm-vmdk-Fix-index_in_cluster-calculation-in-vmdk_co_get.patch [bz#1299250]\n- kvm-vmdk-Use-vmdk_find_index_in_cluster-everywhere.patch [bz#1299250]\n- kvm-vmdk-Fix-next_cluster_sector-for-compressed-write2.patch [bz#1299250]\n- kvm-vmdk-Create-streamOptimized-as-version-3.patch [bz#1299116]\n- kvm-vmdk-Fix-converting-to-streamOptimized.patch [bz#1299116]\n- kvm-vmdk-Fix-calculation-of-block-status-s-offset.patch [bz#1299116]\n- Resolves: bz#1299116\n (qemu-img created VMDK images lead to 'Not a supported disk format (sparse VMDK version too old)')\n- Resolves: bz#1299250\n (qemu-img created VMDK images are unbootable)\n[1.5.3-110.el7]\n- kvm-qemu-io-Remove-unused-args_command.patch [bz#1272523]\n- kvm-cutils-Support-P-and-E-suffixes-in-strtosz.patch [bz#1272523]\n- kvm-qemu-io-Make-cvtnum-a-wrapper-around-strtosz_suffix.patch [bz#1272523]\n- kvm-qemu-io-Handle-cvtnum-errors-in-alloc.patch [bz#1272523]\n- kvm-qemu-io-Don-t-use-global-bs-in-command-implementatio.patch [bz#1272523]\n- kvm-qemu-io-Split-off-commands-to-qemu-io-cmds.c.patch [bz#1272523]\n- kvm-qemu-io-Factor-out-qemuio_command.patch [bz#1272523]\n- kvm-qemu-io-Move-help-function.patch [bz#1272523]\n- kvm-qemu-io-Move-quit-function.patch [bz#1272523]\n- kvm-qemu-io-Move-qemu_strsep-to-cutils.c.patch [bz#1272523]\n- kvm-qemu-io-Move-functions-for-registering-and-running-c.patch [bz#1272523]\n- kvm-qemu-io-Move-command_loop-and-friends.patch [bz#1272523]\n- kvm-qemu-io-Move-remaining-helpers-from-cmd.c.patch [bz#1272523]\n- kvm-qemu-io-Interface-cleanup.patch [bz#1272523]\n- kvm-qemu-io-Use-the-qemu-version-for-V.patch [bz#1272523]\n- kvm-Make-qemu-io-commands-available-in-HMP.patch [bz#1272523]\n- kvm-blkdebug-Add-BLKDBG_FLUSH_TO_OS-DISK-events.patch [bz#1272523]\n- kvm-qemu-io-fix-cvtnum-lval-types.patch [bz#1272523]\n- kvm-qemu-io-Check-for-trailing-chars.patch [bz#1272523]\n- kvm-qemu-io-Correct-error-messages.patch [bz#1272523]\n- kvm-ide-test-fix-failure-for-test_flush.patch [bz#1272523]\n- kvm-vga-Remove-some-should-be-done-in-BIOS-comments.patch [bz#1331413]\n- kvm-vga-fix-banked-access-bounds-checking-CVE-2016-xxxx.patch [bz#1331413]\n- kvm-vga-add-vbe_enabled-helper.patch [bz#1331413]\n- kvm-vga-factor-out-vga-register-setup.patch [bz#1331413]\n- kvm-vga-update-vga-register-setup-on-vbe-changes.patch [bz#1331413]\n- kvm-vga-make-sure-vga-register-setup-for-vbe-stays-intac.patch [bz#1331413]\n- Resolves: bz#1272523\n (qemu-kvm build failure race condition in tests/ide-test)\n- Resolves: bz#1331413\n (EMBARGOED CVE-2016-3710 qemu-kvm: qemu: incorrect banked access bounds checking in vga module [rhel-7.3])\n[1.5.3-109.el7]\n- kvm-e1000-eliminate-infinite-loops-on-out-of-bounds-tran.patch [bz#1296044]\n- kvm-nbd-Always-call-close_fn-in-nbd_client_new.patch [bz#1285453]\n- kvm-nbd-server-Coroutine-based-negotiation.patch [bz#1285453]\n- kvm-nbd-client_close-on-error-in-nbd_co_client_start.patch [bz#1285453]\n- kvm-Remove-libcacard-build.patch [bz#1314153]\n- Resolves: bz#1285453\n (An NBD client can cause QEMU main loop to block when connecting to built-in NBD server)\n- Resolves: bz#1296044\n (qemu-kvm: insufficient loop termination conditions in start_xmit() and e1000_receive() [rhel-7.3])\n- Resolves: bz#1314153\n (Disable building of libcacard)\n[1.5.3-108.el7]\n- kvm-net-Make-qmp_query_rx_filter-with-name-argument-more.patch [bz#1269738]\n- kvm-fw_cfg-add-check-to-validate-current-entry-value-CVE.patch [bz#1298048]\n- Resolves: bz#1269738\n (Vlan table display repeat four times in qmp when queues=4)\n- Resolves: bz#1298048\n (CVE-2016-1714 qemu-kvm: Qemu: nvram: OOB r/w access in processing firmware configurations [rhel-7.3])\n[1.5.3-107.el7]\n- kvm-raw-posix-Fix-.bdrv_co_get_block_status-for-unaligne.patch [bz#1283116]\n- Resolves: bz#1283116\n ([abrt] qemu-img: get_block_status(): qemu-img killed by SIGABRT)\n[1.5.3-106.el7]\n- kvm-ehci-clear-suspend-bit-on-detach.patch [bz#1268879]\n- kvm-rbd-make-qemu-s-cache-setting-override-any-ceph-sett.patch [bz#1277248]\n- kvm-rbd-fix-ceph-settings-precedence.patch [bz#1277248]\n- kvm-target-i386-get-put-MSR_TSC_AUX-across-reset-and-mig.patch [bz#1265427]\n- kvm-rtl8139-Fix-receive-buffer-overflow-check.patch [bz#1252757]\n- kvm-rtl8139-Do-not-consume-the-packet-during-overflow-in.patch [bz#1252757]\n- Resolves: bz#1252757\n ([RHEL-7.2-qmu-kvm] Package is 100% lost when ping from host to Win2012r2 guest with 64000 size)\n- Resolves: bz#1265427\n (contents of MSR_TSC_AUX are not migrated)\n- Resolves: bz#1268879\n (Camera stops work after remote-viewer re-connection [qemu-kvm])\n- Resolves: bz#1277248\n (ceph.conf properties override qemus command-line properties)", "cvss3": {"exploitabilityScore": 2.0, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.8, "privilegesRequired": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "userInteraction": "NONE", "version": "3.1"}, "impactScore": 6.0}, "published": "2016-11-09T00:00:00", "type": "oraclelinux", "title": "qemu-kvm security, bug fix, and enhancement update", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.2, "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2016-1714", "CVE-2016-1981", "CVE-2016-3710", "CVE-2016-3712", "CVE-2016-5126", "CVE-2016-5403"], "modified": "2016-11-09T00:00:00", "id": "ELSA-2016-2585", "href": "http://linux.oracle.com/errata/ELSA-2016-2585.html", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}], "f5": [{"lastseen": "2021-06-08T18:49:07", "description": "Vulnerability Recommended Actions\n\nIf you are running a version listed in the **Versions known to be vulnerable** column, you can eliminate this vulnerability by upgrading to a version listed in the **Versions known to be not vulnerable** column. If the table lists only an older version than what you are currently running, or does not list a non-vulnerable version, then no upgrade candidate currently exists.\n\nSupplemental Information\n\n * SOL9970: Subscribing to email notifications regarding F5 products\n * SOL9957: Creating a custom RSS feed to view new and updated documents\n * SOL4602: Overview of the F5 security vulnerability response policy\n * SOL4918: Overview of the F5 critical issue hotfix policy\n", "cvss3": {"exploitabilityScore": 1.4, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "CHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.1, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "userInteraction": "NONE", "version": "3.0"}, "impactScore": 6.0}, "published": "2016-05-10T00:00:00", "type": "f5", "title": "SOL75248350 - QEMU vulnerability CVE-2016-1714", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 3.4, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 6.9, "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2016-1714"], "modified": "2016-09-01T00:00:00", "id": "SOL75248350", "href": "http://support.f5.com/kb/en-us/solutions/public/k/75/sol75248350.html", "cvss": {"score": 6.9, "vector": "AV:LOCAL/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2019-05-20T00:31:32", "description": "\nF5 Product Development has assigned ID 573778 (BIG-IP) to this vulnerability and has evaluated the currently supported releases for potential vulnerability. Additionally, [BIG-IP iHealth](<http://www.f5.com/support/support-tools/big-ip-ihealth/>) may list Heuristic H75248350 on the **Diagnostics** &gt; **Identified** &gt; **High** screen.\n\nTo determine if your release is known to be vulnerable, the components or features that are affected by the vulnerability, and for information about releases or hotfixes that address the vulnerability, refer to the following table:\n\nProduct | Versions known to be vulnerable | Versions known to be not vulnerable | Severity | Vulnerable component or feature \n---|---|---|---|--- \nBIG-IP LTM | 12.0.0 \n11.4.0 - 11.6.1 \n11.2.1 | 12.1.0 \n11.6.1 HF1 \n11.5.5 \n10.1.0 - 10.2.41 | High | vCMP \nBIG-IP AAM | 12.0.0 \n11.4.0 - 11.6.1 | 12.1.0 \n11.6.1 HF1 \n11.5.5 | High | vCMP \nBIG-IP AFM | 12.0.0 \n11.3.0 - 11.6.1 | 12.1.0 \n11.6.1 HF1 \n11.5.5 | High | vCMP \nBIG-IP Analytics | 12.0.0 \n11.4.0 - 11.6.1 \n11.2.1 | 12.1.0 \n11.6.1 HF1 \n11.5.5 | High | vCMP \nBIG-IP APM | 12.0.0 \n11.4.0 - 11.6.1 \n11.2.1 | 12.1.0 \n11.6.1 HF1 \n11.5.5 \n10.1.0 - 10.2.41 | High | vCMP \nBIG-IP ASM | 12.0.0 \n11.4.0 - 11.6.1 \n11.2.1 | 12.1.0 \n11.6.1 HF1 \n11.5.5 \n10.1.0 - 10.2.41 | High | vCMP \nBIG-IP DNS | 12.0.0 | 12.1.0 | High | vCMP \nBIG-IP Edge Gateway | 11.2.1 | 10.1.0 - 10.2.41 | High | vCMP \nBIG-IP GTM | 11.4.0 - 11.6.1 \n11.2.1 | 11.6.1 HF1 \n11.5.5 \n10.1.0 - 10.2.41 | High | vCMP \nBIG-IP Link Controller | 12.0.0 \n11.4.0 - 11.6.1 \n11.2.1 | 12.1.0 \n11.6.1 HF1 \n11.5.5 \n10.1.0 - 10.2.41 | High | vCMP \nBIG-IP PEM | 12.0.0 \n11.4.0 - 11.6.1 | 12.1.0 \n11.6.1 HF1 \n11.5.5 | High | vCMP \nBIG-IP PSM | 11.4.0 - 11.4.1 \n11.2.1 | 10.1.0 - 10.2.41 | High | vCMP \nBIG-IP WebAccelerator | 11.2.1 | 10.1.0 - 10.2.41 | High | vCMP \nBIG-IP WOM | 11.2.1 | 10.1.0 - 10.2.41 | High | vCMP \nARX | None | 6.0.0 - 6.4.0 | Not vulnerable | None \nEnterprise Manager | None | 3.0.0 - 3.1.1 | Not vulnerable | None \nFirePass | None | 7.0.0 \n6.0.0 - 6.1.0 | Not vulnerable | None \nBIG-IQ Cloud | None | 4.0.0 - 4.5.0 | Not vulnerable | None \nBIG-IQ Device | None | 4.2.0 - 4.5.0 | Not vulnerable | None \nBIG-IQ Security | None | 4.0.0 - 4.5.0 | Not vulnerable | None \nBIG-IQ ADC | None | 4.5.0 | Not vulnerable | None \nBIG-IQ Centralized Management | None | 4.6.0 | Not vulnerable | None \nBIG-IQ Cloud and Orchestration | None | 1.0.0 | Not vulnerable | None \nLineRate | None | 2.5.0 - 2.6.1 | Not vulnerable | None \nF5 WebSafe | None | 1.0.0 | Not vulnerable | None \nTraffix SDC | None | 4.0.0 - 4.4.0 \n3.3.2 - 3.5.1 | Not vulnerable | None \n \n1 vCMP is not available on BIG-IP versions prior to 11.0.0.\n\nIf you are running a version listed in the **Versions known to be vulnerable** column, you can eliminate this vulnerability by upgrading to a version listed in the **Versions known to be not vulnerable **column. If the table lists only an older version than what you are currently running, or does not list a non-vulnerable version, then no upgrade candidate currently exists.\n\nMitigation\n\nNone\n\n * [K9970: Subscribing to email notifications regarding F5 products](<https://support.f5.com/csp/article/K9970>)\n * [K9957: Creating a custom RSS feed to view new and updated documents](<https://support.f5.com/csp/article/K9957>)\n * [K4602: Overview of the F5 security vulnerability response policy](<https://support.f5.com/csp/article/K4602>)\n * [K4918: Overview of the F5 critical issue hotfix policy](<https://support.f5.com/csp/article/K4918>)\n", "cvss3": {"exploitabilityScore": 1.4, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "CHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.1, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "userInteraction": "NONE", "version": "3.0"}, "impactScore": 6.0}, "published": "2016-05-10T22:25:00", "type": "f5", "title": "QEMU vulnerability CVE-2016-1714", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 3.4, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 6.9, "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2016-1714"], "modified": "2017-11-09T19:52:00", "id": "F5:K75248350", "href": "https://support.f5.com/csp/article/K75248350", "cvss": {"score": 6.9, "vector": "AV:LOCAL/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "openvas": [{"lastseen": "2019-05-29T18:35:03", "description": "Oracle Linux Local Security Checks ELSA-2016-0082", "cvss3": {}, "published": "2016-01-29T00:00:00", "type": "openvas", "title": "Oracle Linux Local Check: ELSA-2016-0082", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2016-1714"], "modified": "2019-03-14T00:00:00", "id": "OPENVAS:1361412562310122865", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310122865", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: ELSA-2016-0082.nasl 14180 2019-03-14 12:29:16Z cfischer $\n#\n# Oracle Linux Local Check\n#\n# Authors:\n# Eero Volotinen <eero.volotinen@solinor.com>\n#\n# Copyright:\n# Copyright (c) 2016 Eero Volotinen, http://solinor.com\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.122865\");\n script_version(\"$Revision: 14180 $\");\n script_tag(name:\"creation_date\", value:\"2016-01-29 07:28:02 +0200 (Fri, 29 Jan 2016)\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-14 13:29:16 +0100 (Thu, 14 Mar 2019) $\");\n script_name(\"Oracle Linux Local Check: ELSA-2016-0082\");\n script_tag(name:\"insight\", value:\"ELSA-2016-0082 - qemu-kvm security update. Please see the references for more insight.\");\n script_tag(name:\"solution\", value:\"Update the affected packages to the latest available version.\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"summary\", value:\"Oracle Linux Local Security Checks ELSA-2016-0082\");\n script_xref(name:\"URL\", value:\"http://linux.oracle.com/errata/ELSA-2016-0082.html\");\n script_cve_id(\"CVE-2016-1714\");\n script_tag(name:\"cvss_base\", value:\"6.9\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:L/AC:M/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/oracle_linux\", \"ssh/login/release\", re:\"ssh/login/release=OracleLinux6\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Eero Volotinen\");\n script_family(\"Oracle Linux Local Security Checks\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release) exit(0);\n\nres = \"\";\n\nif(release == \"OracleLinux6\")\n{\n if ((res = isrpmvuln(pkg:\"qemu-guest-agent\", rpm:\"qemu-guest-agent~0.12.1.2~2.479.el6_7.4\", rls:\"OracleLinux6\")) != NULL) {\n security_message(data:res);\n exit(0);\n }\n if ((res = isrpmvuln(pkg:\"qemu-img\", rpm:\"qemu-img~0.12.1.2~2.479.el6_7.4\", rls:\"OracleLinux6\")) != NULL) {\n security_message(data:res);\n exit(0);\n }\n if ((res = isrpmvuln(pkg:\"qemu-kvm\", rpm:\"qemu-kvm~0.12.1.2~2.479.el6_7.4\", rls:\"OracleLinux6\")) != NULL) {\n security_message(data:res);\n exit(0);\n }\n if ((res = isrpmvuln(pkg:\"qemu-kvm-tools\", rpm:\"qemu-kvm-tools~0.12.1.2~2.479.el6_7.4\", rls:\"OracleLinux6\")) != NULL) {\n security_message(data:res);\n exit(0);\n }\n\n}\nif (__pkg_match) exit(99);\n exit(0);\n\n", "cvss": {"score": 6.9, "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-05-29T18:35:48", "description": "Check the version of libcacard", "cvss3": {}, "published": "2016-02-02T00:00:00", "type": "openvas", "title": "CentOS Update for libcacard CESA-2016:0083 centos7", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2016-1714"], "modified": "2019-03-08T00:00:00", "id": "OPENVAS:1361412562310882388", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310882388", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# CentOS Update for libcacard CESA-2016:0083 centos7\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2016 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.882388\");\n script_version(\"$Revision: 14058 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-08 14:25:52 +0100 (Fri, 08 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2016-02-02 06:14:07 +0100 (Tue, 02 Feb 2016)\");\n script_cve_id(\"CVE-2016-1714\");\n script_tag(name:\"cvss_base\", value:\"6.9\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:L/AC:M/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"CentOS Update for libcacard CESA-2016:0083 centos7\");\n script_tag(name:\"summary\", value:\"Check the version of libcacard\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"insight\", value:\"KVM (Kernel-based Virtual Machine) is a\nfull virtualization solution for Linux on AMD64 and Intel 64 systems.\nThe qemu-kvm package provides the user-space component for running virtual\nmachines using KVM.\n\nAn out-of-bounds read/write flaw was discovered in the way QEMU's Firmware\nConfiguration device emulation processed certain firmware configurations.\nA privileged (CAP_SYS_RAWIO) guest user could use this flaw to crash the\nQEMU process instance or, potentially, execute arbitrary code on the host\nwith privileges of the QEMU process. (CVE-2016-1714)\n\nRed Hat would like to thank Donghai Zhu of Alibaba for reporting this\nissue.\n\nThis update also fixes the following bugs:\n\n * Incorrect handling of the last sector of an image file could trigger an\nassertion failure in qemu-img. This update changes the handling of the last\nsector, and no assertion failure occurs. (BZ#1298828)\n\nAll qemu-kvm users are advised to upgrade to these updated packages, which\ncontain backported patches to correct these issues. After installing this\nupdate, shut down all running virtual machines. Once all virtual machines\nhave shut down, start them again for this update to take effect.\");\n script_tag(name:\"affected\", value:\"libcacard on CentOS 7\");\n script_tag(name:\"solution\", value:\"Please Install the Updated Packages.\");\n\n script_xref(name:\"CESA\", value:\"2016:0083\");\n script_xref(name:\"URL\", value:\"http://lists.centos.org/pipermail/centos-announce/2016-February/021637.html\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2016 Greenbone Networks GmbH\");\n script_family(\"CentOS Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/centos\", \"ssh/login/rpms\", re:\"ssh/login/release=CentOS7\");\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"CentOS7\")\n{\n\n if ((res = isrpmvuln(pkg:\"libcacard\", rpm:\"libcacard~1.5.3~105.el7_2.3\", rls:\"CentOS7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"libcacard-devel\", rpm:\"libcacard-devel~1.5.3~105.el7_2.3\", rls:\"CentOS7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"libcacard-tools\", rpm:\"libcacard-tools~1.5.3~105.el7_2.3\", rls:\"CentOS7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"qemu-img\", rpm:\"qemu-img~1.5.3~105.el7_2.3\", rls:\"CentOS7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"qemu-kvm\", rpm:\"qemu-kvm~1.5.3~105.el7_2.3\", rls:\"CentOS7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"qemu-kvm-common\", rpm:\"qemu-kvm-common~1.5.3~105.el7_2.3\", rls:\"CentOS7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"qemu-kvm-tools\", rpm:\"qemu-kvm-tools~1.5.3~105.el7_2.3\", rls:\"CentOS7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 6.9, "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-05-29T18:35:13", "description": "Check the version of qemu-guest-agent", "cvss3": {}, "published": "2016-02-02T00:00:00", "type": "openvas", "title": "CentOS Update for qemu-guest-agent CESA-2016:0082 centos6", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2016-1714"], "modified": "2019-03-08T00:00:00", "id": "OPENVAS:1361412562310882389", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310882389", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# CentOS Update for qemu-guest-agent CESA-2016:0082 centos6\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2016 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.882389\");\n script_version(\"$Revision: 14058 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-08 14:25:52 +0100 (Fri, 08 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2016-02-02 06:14:10 +0100 (Tue, 02 Feb 2016)\");\n script_cve_id(\"CVE-2016-1714\");\n script_tag(name:\"cvss_base\", value:\"6.9\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:L/AC:M/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"CentOS Update for qemu-guest-agent CESA-2016:0082 centos6\");\n script_tag(name:\"summary\", value:\"Check the version of qemu-guest-agent\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"insight\", value:\"KVM (Kernel-based Virtual Machine) is a\nfull virtualization solution for Linux on AMD64 and Intel 64 systems.\nThe qemu-kvm package provides the user-space component for running virtual\nmachines using KVM.\n\nAn out-of-bounds read/write flaw was discovered in the way QEMU's Firmware\nConfiguration device emulation processed certain firmware configurations.\nA privileged (CAP_SYS_RAWIO) guest user could use this flaw to crash the\nQEMU process instance or, potentially, execute arbitrary code on the host\nwith privileges of the QEMU process. (CVE-2016-1714)\n\nRed Hat would like to thank Donghai Zhu of Alibaba for reporting this\nissue.\n\nAll qemu-kvm users are advised to upgrade to these updated packages, which\ncontain a backported patch to correct this issue. After installing this\nupdate, shut down all running virtual machines. Once all virtual machines\nhave shut down, start them again for this update to take effect.\");\n script_tag(name:\"affected\", value:\"qemu-guest-agent on CentOS 6\");\n script_tag(name:\"solution\", value:\"Please Install the Updated Packages.\");\n\n script_xref(name:\"CESA\", value:\"2016:0082\");\n script_xref(name:\"URL\", value:\"http://lists.centos.org/pipermail/centos-announce/2016-February/021636.html\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2016 Greenbone Networks GmbH\");\n script_family(\"CentOS Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/centos\", \"ssh/login/rpms\", re:\"ssh/login/release=Ce