SUSE SLED12 / SLES12 Security Update : qemu (SUSE-SU-2017:2416-1)

This update for qemu fixes the following issues: Security issues fixed : - CVE-2017-10664: Fix DOS vulnerability in qemu-nbd bsc1046636 - CVE-2017-10806: Fix DOS from stack overflow in debug messages of usb redirection support bsc1047674 - CVE-2017-11334: Fix OOB access during DMA operation...

Fedora 26 : xen (2017-b7f1197c23)

Qemu: usb: ohci: infinite loop due to incorrect return value CVE-2017-9330 1457698 Qemu: nbd: segmentation fault due to client non-negotiation CVE-2017-9524 1460173 Qemu: qemu-nbd: server breaks with SIGPIPE upon client abort CVE-2017-10664 1466466 Qemu: exec: oob access during dma operation...

WebKit Unspecified Memory Corruption Vulnerability(CVE-2017-2521)

WebKit: JSC: JSObject::ensureLength doesn't check if ensureLengthSlow failed. Here's a snippet of JSObject::ensureLength. bool WARNUNUSEDRETURN ensureLengthVM& vm, unsigned length ASSERTlength vectorLength publicLength setPublicLengthlength; return result; |setPublicLength| is called whether...

WebKit JSC JSObject::ensureLength Failure Check Vulnerability

WebKit JSC JSObject::ensureLength does not check if ensureLengthSlow fails. WebKit: JSC: JSObject::ensureLength doesn't check if ensureLengthSlow failed. CVE-2017-2521 Here's a snippet of JSObject::ensureLength. bool WARNUNUSEDRETURN ensureLengthVM& vm, unsigned length ASSERTlength vectorLength...

WebKit JSC - 'JSObject::ensureLength' ensureLengthSlow Check Failure

/ Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1165 Here's a snippet of JSObject::ensureLength. bool WARNUNUSEDRETURN ensureLengthVM& vm, unsigned length ASSERTlength vectorLength publicLength setPublicLengthlength; return result; |setPublicLength| is called whether...

WebKit JSC JSObject::ensureLength Failure Check

WebKit: JSC: JSObject::ensureLength doesn't check if ensureLengthSlow failed. CVE-2017-2521 Here's a snippet of JSObject::ensureLength. bool WARNUNUSEDRETURN ensureLengthVM& vm, unsigned length ASSERTlength vectorLength publicLength setPublicLengthlength; return result; |setPublicLength| is calle...

qemu-kvm security update

0.12.1.2-2.503.el69.3 - kvm-cirrus-avoid-write-only-variables.patch bz1444377 bz1444379 - kvm-cirrus-stop-passing-around-dst-pointers-in-the-blitt.patch bz1444377 bz1444379 - kvm-cirrus-stop-passing-around-src-pointers-in-the-blitt.patch bz1444377 bz1444379 -...

openSUSE Security Update : virglrenderer (openSUSE-2017-415)

This update for virglrenderer fixes the following issues : Security issues fixed : - CVE-2017-6386: memory leakage while in vrendcreatevertexelementsstate bsc1027376 - CVE-2017-6355: integer overflow while creating shader object bsc1027108 - CVE-2017-6317: fix memory leak in add shader program...

OracleVM 3.4 : qemu-kvm (OVMSA-2017-0055)

The remote OracleVM system is missing necessary patches to address critical security updates : - kvm-cirrus-fix-patterncopy-checks.patch bz1420487 bz1420489 - kvm-Revert-cirrus-allow-zero-source-pitch-in-pattern-fil .patch - kvm-cirrus-add-blitisunsafe-call-to-cirrusbitbltcput .patch - Resolves:...

Fedora 24 : 2:qemu (2017-62ac1230f7)

CVE-2017-5525: audio: memory leakage in ac97 bz 1414110 - CVE-2017-5526: audio: memory leakage in es1370 bz 1414210 - CVE-2016-10155 watchdog: memory leakage in i6300esb bz 1415200 - CVE-2017-5552: virtio-gpu-3d: memory leakage bz 1415283 - CVE-2017-5667: sd: sdhci OOB access during multi block...

Fedora 25 : 2:qemu (2017-31b976672b)

CVE-2016-7907: net: imx: infinite loop bz 1381182 - CVE-2017-5525: audio: memory leakage in ac97 bz 1414110 - CVE-2017-5526: audio: memory leakage in es1370 bz 1414210 - CVE-2016-10155 watchdog: memory leakage in i6300esb bz 1415200 - CVE-2017-5552: virtio-gpu-3d: memory leakage bz 1415283 -...

qemu-kvm security and bug fix update

1.5.3-126.el73.5 - kvm-cirrus-fix-patterncopy-checks.patch bz1420490 - kvm-Revert-cirrus-allow-zero-source-pitch-in-pattern-fil.patch bz1420490 - kvm-cirrus-add-blitisunsafe-call-to-cirrusbitbltcput.patch bz1420490 - Resolves: bz1420490 EMBARGOED CVE-2017-2620 qemu-kvm: Qemu: display: cirrus:...

Fedora 24 : xen (2017-d4ee7018c1)

memory leak when destroying guest without PT devices XSA-207 1422492 update patches for XSA-208 after upstream revision no functional change ---- Qemu: net: mcffec: infinite loop while receiving data in mcffecreceive CVE-2016-9776 Qemu: audio: memory leakage in ac97 CVE-2017-5525 1414111 Qemu:...

oob access in cirrus bitblt copy

ISSUE DESCRIPTION When doing bitblt copy backwards, qemu should negate the blit width. This avoids an oob access before the start of video memory. IMPACT A malicious guest administrator can cause an out of bounds memory access, leading to information disclosure or privilege escalation. VULNERABLE...

xen-tools -- oob access in cirrus bitblt copy

The Xen Project reports: When doing bitblt copy backwards, qemu should negate the blit width. This avoids an oob access before the start of video memory. A malicious guest administrator can cause an out of bounds memory access, possibly leading to information disclosure or privilege escalation...

CVE-2015-8817

QEMU aka Quick Emulator built to use 'addressspacetranslate' to map an address to a MemoryRegionSection is vulnerable to an OOB r/w access issue. It could occur while doing pcidmaread/write calls. Affects QEMU versions = 1.6.0 and = 2.3.1. A privileged user inside guest could use this flaw to cra...

Security update for qemu (important)

This update for qemu fixes the following issues: - Patch queue updated from https://gitlab.suse.de/virtualization/qemu.git SLE12-SP1 - Change package post script udevadm trigger calls to be device specific bsc1002116 - Address various security/stability issues Fix OOB access in...

SUSE SLED12 / SLES12 Security Update : qemu (SUSE-SU-2016:2988-1)

This update for qemu fixes the following issues : - Patch queue updated from https://gitlab.suse.de/virtualization/qemu.git SLE12-SP1 - Change package post script udevadm trigger calls to be device specific bsc1002116 - Address various security/stability issues - Fix OOB access in...

SUSE SLES12 Security Update : qemu (SUSE-SU-2016:2936-1)

This update for qemu fixes the following issues : - Patch queue updated from https://gitlab.suse.de/virtualization/qemu.git SLE12 - Change package post script udevadm trigger calls to be device specific bsc1002116 - Address various security/stability issues - Fix OOB access in xlnx.xpx-ethernetli...

SUSE SLES11 Security Update : kvm (SUSE-SU-2016:2902-1)

This update for kvm fixes the following issues : - Address various security/stability issues - Fix OOB access in xlnx.xpx-ethernetlite emulation CVE-2016-7161 bsc1001151 - Fix OOB access in VMware SVGA emulation CVE-2016-7170 bsc998516 - Fix DOS in ColdFire Fast Ethernet Controller emulation...