(RHSA-2019:2425) Important: qemu-kvm-rhev security and bug fix update

KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-rhev packages provide the user-space component for running virtual machines that use KVM in environments managed by Red Hat products.

Security Fix(es):

• QEMU: slirp: heap buffer overflow in tcp_emu() (CVE-2019-6778)

• QEMU: rtl8139: integer overflow leads to buffer overflow (CVE-2018-17958)

• QEMU: net: ignore packets with large size (CVE-2018-17963)

• QEMU: seccomp: blacklist is not applied to all threads (CVE-2018-15746)

• QEMU: scsi-generic: possible OOB access while handling inquiry request (CVE-2019-6501)

• QEMU: slirp: information leakage in tcp_emu() due to uninitialized stack variables (CVE-2019-9824)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• Update qemu-kvm-rhev for RHEL 7.7 compatibility [OSP-14] (BZ#1728358)

• Update qemu-kvm-rhev for RHEL 7.7 compatibility [OSP-13] (BZ#1728359)

• Update qemu-kvm-rhev for RHEL 7.7 compatibility [OSP-10] (BZ#1728360)