Debian Security Advisory DSA 3348-1 (qemu - security update)

Several vulnerabilities were discovered in qemu, a fast processor emulator. CVE-2015-3214 Matt Tait of Google OpenVAS Vulnerability Test $Id: deb3348.nasl 6609 2017-07-07 12:05:59Z cfischer $ Auto-generated from advisory DSA 3348-1 using nvtgen 1.0 Script version: 1.0 Author: Greenbone Networks...

Fedora 21 : qemu-2.1.3-9.fc21 (2015-13404)

Fix crash in qemuspicecreatedisplay bz 1163047 CVE-2015-3209: pcnet: multi-tmd buffer overflow in the tx path bz 1230536 CVE-2015-3214: i8254: out-of-bounds memory access bz 1243728 CVE-2015-5154: ide: atapi: heap overflow during I/O buffer memory access bz 1247141 CVE-2015-5745: buffer overflow...

SUSE SLED11 / SLES11 Security Update : kvm (SUSE-SU-2015:1455-1)

kvm was updated to fix one security issue. This security issue was fixed : - CVE-2015-5154: Host code execution via IDE subsystem CD-ROM bsc938344. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to...

Ubuntu 14.04 LTS : QEMU vulnerabilities (USN-2724-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2724-1 advisory. It was discovered that QEMU incorrectly handled a PRDT with zero complete sectors in the IDE functionality. A malicious guest could possibly use this iss...

USN-2724-1 qemu, qemu-kvm vulnerabilities

It was discovered that QEMU incorrectly handled a PRDT with zero complete sectors in the IDE functionality. A malicious guest could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. CVE-2014-9718 Donghai Zhu discovered that QEMU...

SUSE SLES11 Security Update : kvm (SUSE-SU-2015:1426-1)

kvm was updated to fix two security issues. The following vulnerabilities were fixed : - CVE-2015-5154: Host code execution via IDE subsystem CD-ROM bsc938344. - CVE-2015-3209: Fix buffer overflow in pcnet emulation bsc932770. Note that Tenable Network Security has extracted the preceding...

SUSE SLES11 Security Update : xen (SUSE-SU-2015:1421-1)

Xen was updated to fix the following security issues : - CVE-2015-5154: Host code execution via IDE subsystem CD-ROM bsc938344 - CVE-2015-5165: QEMU leak of uninitialized heap memory in rtl8139 device model XSA-140, bsc939712 Note that Tenable Network Security has extracted the preceding...

SUSE-SU-2015:1472-1 Security update for kvm

kvm was updated to fix one security issue. This security issue was fixed: - CVE-2015-5154: Host code execution via IDE subsystem CD-ROM bsc938344...

SUSE SLES11 Security Update : xen (SUSE-SU-2015:1408-1)

This security update of Xen fixes the following issues : - bsc939712 XSA-140: QEMU leak of uninitialized heap memory in rtl8139 device model CVE-2015-5165 - bsc938344: qemu,kvm,xen: host code execution via IDE subsystem CD-ROM CVE-2015-5154 Note that Tenable Network Security has extracted the...

DEBIAN-CVE-2015-5154

Heap-based buffer overflow in the IDE subsystem in QEMU, as used in Xen 4.5.x and earlier, when the container has a CDROM drive enabled, allows local guest users to execute arbitrary code on the host via unspecified ATAPI commands...

CVE-2015-5154

Heap-based buffer overflow in the IDE subsystem in QEMU, as used in Xen 4.5.x and earlier, when the container has a CDROM drive enabled, allows local guest users to execute arbitrary code on the host via unspecified ATAPI commands...

CVE-2015-5154

Heap-based buffer overflow in the IDE subsystem in QEMU, as used in Xen 4.5.x and earlier, when the container has a CDROM drive enabled, allows local guest users to execute arbitrary code on the host via unspecified ATAPI commands...

CVE-2015-5154

CVE-2015-5154 is a heap-based buffer overflow in QEMU’s IDE subsystem (ATAPI handling). A privileged guest with a CDROM drive enabled could potentially execute arbitrary host code via crafted ATAPI I/O. Public docs specify this as a host-attack surface when CD-ROM access is present; Debian securi...

SUSE-SU-2015:1409-1 Security update for kvm

kvm was updated to fix one security issue. This security issue was fixed: - CVE-2015-5154: Host code execution via IDE subsystem CD-ROM bsc938344...

SUSE-SU-2015:1426-1 Security update for kvm

kvm was updated to fix two security issues. The following vulnerabilities were fixed: - CVE-2015-5154: Host code execution via IDE subsystem CD-ROM bsc938344. - CVE-2015-3209: Fix buffer overflow in pcnet emulation bsc932770...

FreeBSD : qemu, xen-tools -- QEMU heap overflow flaw with certain ATAPI commands (da451130-365d-11e5-a4a5-002590263bf5)

The Xen Project reports : A heap overflow flaw was found in the way QEMU's IDE subsystem handled I/O buffer access while processing certain ATAPI commands. A privileged guest user in a guest with CDROM drive enabled could potentially use this flaw to execute arbitrary code on the host with the...

Qemu Memory Misreference Vulnerability

QEMU is an open source emulator software. A memory misreference vulnerability exists when Qemu, which supports IDE Emulation PCI PIIX3/4, writes data to a client I/O port, which can be exploited by a client user to cause a Qemu instance to crash, resulting in a denial of service...

Use after free in QEMU/Xen block unplug protocol

ISSUE DESCRIPTION When unplugging an emulated block device the device was not fully unplugged, meaning a second unplug attempt would attempt to unplug the device a second time using a previously freed pointer. IMPACT An HVM guest which has access to an emulated IDE disk device may be able to...

qemu, xen-tools -- use-after-free in QEMU/Xen block unplug protocol

The Xen Project reports: When unplugging an emulated block device the device was not fully unplugged, meaning a second unplug attempt would attempt to unplug the device a second time using a previously freed pointer. An HVM guest which has access to an emulated IDE disk device may be able to...

Xen Patches VM Escape Flaw

The Xen Project has patched a serious vulnerability that could allow an attacker in a guest virtual machine to escape and gain the ability to run arbitrary code on the host machine. The vulnerability is in the QEMU open source machine emulator that ships as part of the Xen hypervisor. The problem...