OracleVM 3.4 : qemu-kvm (OVMSA-2017-0055)

The remote OracleVM system is missing necessary patches to address critical security updates : - kvm-cirrus-fix-patterncopy-checks.patch bz1420487 bz1420489 - kvm-Revert-cirrus-allow-zero-source-pitch-in-pattern-fil .patch - kvm-cirrus-add-blitisunsafe-call-to-cirrusbitbltcput .patch - Resolves:...

Fedora 24 : 2:qemu (2017-62ac1230f7)

CVE-2017-5525: audio: memory leakage in ac97 bz 1414110 - CVE-2017-5526: audio: memory leakage in es1370 bz 1414210 - CVE-2016-10155 watchdog: memory leakage in i6300esb bz 1415200 - CVE-2017-5552: virtio-gpu-3d: memory leakage bz 1415283 - CVE-2017-5667: sd: sdhci OOB access during multi block...

Fedora 25 : 2:qemu (2017-31b976672b)

CVE-2016-7907: net: imx: infinite loop bz 1381182 - CVE-2017-5525: audio: memory leakage in ac97 bz 1414110 - CVE-2017-5526: audio: memory leakage in es1370 bz 1414210 - CVE-2016-10155 watchdog: memory leakage in i6300esb bz 1415200 - CVE-2017-5552: virtio-gpu-3d: memory leakage bz 1415283 -...

qemu-kvm security and bug fix update

1.5.3-126.el73.5 - kvm-cirrus-fix-patterncopy-checks.patch bz1420490 - kvm-Revert-cirrus-allow-zero-source-pitch-in-pattern-fil.patch bz1420490 - kvm-cirrus-add-blitisunsafe-call-to-cirrusbitbltcput.patch bz1420490 - Resolves: bz1420490 EMBARGOED CVE-2017-2620 qemu-kvm: Qemu: display: cirrus:...

Fedora 24 : xen (2017-d4ee7018c1)

memory leak when destroying guest without PT devices XSA-207 1422492 update patches for XSA-208 after upstream revision no functional change ---- Qemu: net: mcffec: infinite loop while receiving data in mcffecreceive CVE-2016-9776 Qemu: audio: memory leakage in ac97 CVE-2017-5525 1414111 Qemu:...

oob access in cirrus bitblt copy

ISSUE DESCRIPTION When doing bitblt copy backwards, qemu should negate the blit width. This avoids an oob access before the start of video memory. IMPACT A malicious guest administrator can cause an out of bounds memory access, leading to information disclosure or privilege escalation. VULNERABLE...

xen-tools -- oob access in cirrus bitblt copy

The Xen Project reports: When doing bitblt copy backwards, qemu should negate the blit width. This avoids an oob access before the start of video memory. A malicious guest administrator can cause an out of bounds memory access, possibly leading to information disclosure or privilege escalation...

CVE-2015-8817

QEMU aka Quick Emulator built to use 'addressspacetranslate' to map an address to a MemoryRegionSection is vulnerable to an OOB r/w access issue. It could occur while doing pcidmaread/write calls. Affects QEMU versions = 1.6.0 and = 2.3.1. A privileged user inside guest could use this flaw to cra...

Security update for qemu (important)

This update for qemu fixes the following issues: - Patch queue updated from https://gitlab.suse.de/virtualization/qemu.git SLE12-SP1 - Change package post script udevadm trigger calls to be device specific bsc1002116 - Address various security/stability issues Fix OOB access in...

SUSE SLED12 / SLES12 Security Update : qemu (SUSE-SU-2016:2988-1)

This update for qemu fixes the following issues : - Patch queue updated from https://gitlab.suse.de/virtualization/qemu.git SLE12-SP1 - Change package post script udevadm trigger calls to be device specific bsc1002116 - Address various security/stability issues - Fix OOB access in...

SUSE SLES12 Security Update : qemu (SUSE-SU-2016:2936-1)

This update for qemu fixes the following issues : - Patch queue updated from https://gitlab.suse.de/virtualization/qemu.git SLE12 - Change package post script udevadm trigger calls to be device specific bsc1002116 - Address various security/stability issues - Fix OOB access in xlnx.xpx-ethernetli...

SUSE SLES11 Security Update : kvm (SUSE-SU-2016:2902-1)

This update for kvm fixes the following issues : - Address various security/stability issues - Fix OOB access in xlnx.xpx-ethernetlite emulation CVE-2016-7161 bsc1001151 - Fix OOB access in VMware SVGA emulation CVE-2016-7170 bsc998516 - Fix DOS in ColdFire Fast Ethernet Controller emulation...

Fedora 23 : xen (2016-103752d2a9)

Qemu: scsi: esp: OOB r/w access while processing ESPFIFO CVE-2016-5338 1343323 Qemu: scsi: megasas: information leakage in megasasctrlgetinfo CVE-2016-5337 1343909 ---- fix for CVE-2016-2858 doesn't build with qemu-xen enabled Unsanitised guest input in libxl device handling code XSA-175,...

SUSE-SU-2016:1785-1 Security update for kvm

kvm was updated to fix 33 security issues. These security issues were fixed: - CVE-2016-4439: Avoid OOB access in 53C9X emulation bsc980711 - CVE-2016-4441: Avoid OOB access in 53C9X emulation bsc980723 - CVE-2016-3710: Fixed VGA emulation based OOB access with potential for guest escape bsc97815...

Fedora 23 : xen-4.5.2-9.fc23 (2016-f4504e9445)

Qemu: nvram: OOB r/w access in processing firmware configurations CVE-2016-1714 1296080 Qemu: i386: NULL pointer dereference in vapicwrite CVE-2016-1922 1292767 qemu: Stack-based buffer overflow in megasasctrlgetinfo CVE-2015-8613 1293305 qemu-kvm: Infinite loop and out-of-bounds transfer start i...

Mandriva Linux Security Advisory : unzip (MDVSA-2015:123)

Updated unzip package fix security vulnerabilities : The unzip command line tool is affected by heap-based buffer overflows within the CRC32 verification CVE-2014-8139, the testcompreb CVE-2014-8140 and the getZip64Data CVE-2014-8141 functions. The input errors may result in in arbitrary code...

Mandriva Linux Security Advisory : unzip (MDVSA-2015:016)

Updated unzip package fix security vulnerabilities : The unzip command line tool is affected by heap-based buffer overflows within the CRC32 verification CVE-2014-8139, the testcompreb CVE-2014-8140 and the getZip64Data CVE-2014-8141 functions. The input errors may result in in arbitrary code...

FreeBSD : chromium -- multiple vulnerabilities (963413a5-bf50-11e3-a2d6-00262d5ed8ee)

Google Chrome Releases reports : 31 vulnerabilities fixed in this release, including : - 354123 High CVE-2014-1716: UXSS in V8. Credit to Anonymous. - 353004 High CVE-2014-1717: OOB access in V8. Credit to Anonymous. - 348332 High CVE-2014-1718: Integer overflow in compositor. Credit to Aaron...

chromium -- multiple vulnerabilities

Google Chrome Releases reports: 31 vulnerabilities fixed in this release, including: 354123 High CVE-2014-1716: UXSS in V8. Credit to Anonymous. 353004 High CVE-2014-1717: OOB access in V8. Credit to Anonymous. 348332 High CVE-2014-1718: Integer overflow in compositor. Credit to Aaron Staple...

SuSE 11.2 Security Update : freetype2 (SAT Patch Number 7232)

This update fixes : - OOB access in bdffreefont and bdfparseglyphs CVE-2012-5668 / CVE-2012-5669 As well as the following non-security bugs : - bdf Savannah bug 37905. - src/bdf/bdflib.c bdfparsestart: Reset propssize' to zero in case of allocation error; this value gets used in a loop in - bdf F...