UbuntuUpdates.org

Package "qemu"

Name: qemu

Description:

This package is just an umbrella for a group of other packages, it has no description.
Description samples from packages in group:

  • extra block backend modules for qemu-system and qemu-utils
  • QEMU Full virtualization on x86 hardware
  • QEMU full system emulation binaries (arm)
  • QEMU full system emulation binaries (common files)

Latest version: 1:2.11+dfsg-1ubuntu7.8
Release: bionic (18.04)
Level: security
Repository: main

Links

Save this URL for the latest version of "qemu": https://www.ubuntuupdates.org/qemu



Other versions of "qemu" in Bionic

Repository Area Version
base universe 1:2.11+dfsg-1ubuntu7
base main 1:2.11+dfsg-1ubuntu7
security universe 1:2.11+dfsg-1ubuntu7.8
updates main 1:2.11+dfsg-1ubuntu7.9
updates universe 1:2.11+dfsg-1ubuntu7.9

Packages in group

Deleted packages are displayed in grey.


Changelog

Version: 1:2.11+dfsg-1ubuntu7.8 2018-11-26 15:07:04 UTC

  qemu (1:2.11+dfsg-1ubuntu7.8) bionic-security; urgency=medium

  * SECURITY UPDATE: integer overflow in NE2000 NIC emulation
    - debian/patches/CVE-2018-10839.patch: use proper type in
      hw/net/ne2000.c.
    - CVE-2018-10839
  * SECURITY UPDATE: buffer overflow via incoming fragmented datagrams
    - debian/patches/CVE-2018-11806.patch: correct size computation in
      slirp/mbuf.c, slirp/mbuf.h.
    - CVE-2018-11806
  * SECURITY UPDATE: integer overflow via crafted QMP command
    - debian/patches/CVE-2018-12617.patch: check bytes count read by
      guest-file-read in qga/commands-posix.c.
    - CVE-2018-12617
  * SECURITY UPDATE: OOB heap buffer r/w access in NVM Express Controller
    - debian/patches/CVE-2018-16847.patch: check size in hw/block/nvme.c.
    - CVE-2018-16847
  * SECURITY UPDATE: buffer overflow in rtl8139
    - debian/patches/CVE-2018-17958.patch: use proper type in
      hw/net/rtl8139.c.
    - CVE-2018-17958
  * SECURITY UPDATE: buffer overflow in pcnet
    - debian/patches/CVE-2018-17962.patch: use proper type in
      hw/net/pcnet.c.
    - CVE-2018-17962
  * SECURITY UPDATE: DoS via large packet sizes
    - debian/patches/CVE-2018-17963.patch: check size in net/net.c.
    - CVE-2018-17963
  * SECURITY UPDATE: DoS in lsi53c895a
    - debian/patches/CVE-2018-18849.patch: check message length value is
      valid in hw/scsi/lsi53c895a.c.
    - CVE-2018-18849
  * SECURITY UPDATE: Out-of-bounds r/w stack access in ppc64
    - debian/patches/CVE-2018-18954.patch: check size before data buffer
      access in hw/ppc/pnv_lpc.c.
    - CVE-2018-18954
  * SECURITY UPDATE: race condition in 9p
    - debian/patches/CVE-2018-19364-1.patch: use write lock in
      hw/9pfs/cofile.c.
    - debian/patches/CVE-2018-19364-2.patch: use write lock in
      hw/9pfs/9p.c.
    - CVE-2018-19364

 -- Marc Deslauriers <email address hidden> Wed, 21 Nov 2018 14:17:51 -0500

Source diff to previous version
CVE-2018-10839 Qemu emulator <= 3.0.0 built with the NE2000 NIC emulation support is vulnerable to an integer overflow, which could lead to buffer overflow issue. I
CVE-2018-11806 m_cat in slirp/mbuf.c in Qemu has a heap-based buffer overflow via incoming fragmented datagrams.
CVE-2018-12617 qmp_guest_file_read in qga/commands-posix.c and qga/commands-win32.c in qemu-ga (aka QEMU Guest Agent) in QEMU 2.12.50 has an integer overflow causin
CVE-2018-16847 An OOB heap buffer r/w access issue was found in the NVM Express Controller emulation in QEMU. It could occur in nvme_cmb_ops routines in nvme device
CVE-2018-17958 Qemu has a Buffer Overflow in rtl8139_do_receive in hw/net/rtl8139.c because an incorrect integer data type is used.
CVE-2018-17962 Qemu has a Buffer Overflow in pcnet_receive in hw/net/pcnet.c because an incorrect integer data type is used.
CVE-2018-17963 qemu_deliver_packet_iov in net/net.c in Qemu accepts packet sizes greater than INT_MAX, which allows attackers to cause a denial of service or possib
CVE-2018-18849 lsi53c895a: OOB msg buffer access leads to DoS
CVE-2018-18954 The pnv_lpc_do_eccb function in hw/ppc/pnv_lpc.c in Qemu before 3.1 allows out-of-bounds write or read access to PowerNV memory.
CVE-2018-19364 Use-after-free due to race condition while updating fid path

Version: 1:2.11+dfsg-1ubuntu7.3 2018-06-12 13:06:42 UTC

  qemu (1:2.11+dfsg-1ubuntu7.3) bionic-security; urgency=medium

  * SECURITY UPDATE: Speculative Store Bypass
    - debian/patches/ubuntu/CVE-2018-3639-2.patch: define the AMD
      'virt-ssbd' CPUID feature bit in target/i386/cpu.c.
    - debian/patches/ubuntu/CVE-2018-3639-3.patch: define the Virt SSBD MSR
      and handling of it in target/i386/cpu.h, target/i386/kvm.c,
      target/i386/machine.c.
    - CVE-2018-3639

 -- Marc Deslauriers <email address hidden> Wed, 23 May 2018 07:57:07 -0400

Source diff to previous version
CVE-2018-3639 Speculative Store Bypass

Version: 1:2.11+dfsg-1ubuntu7.2 2018-05-22 00:06:58 UTC

  qemu (1:2.11+dfsg-1ubuntu7.2) bionic-security; urgency=medium

  * SECURITY UPDATE: Speculative Store Bypass
    - debian/patches/ubuntu/CVE-2018-3639.patch: add bit(2) of SPEC_CTRL
      MSR support - Reduced Data Speculation to target/i386/cpu.*.
    - CVE-2018-3639

 -- Marc Deslauriers <email address hidden> Thu, 17 May 2018 09:57:26 -0400

Source diff to previous version
CVE-2018-3639 Speculative Store Bypass

Version: 1:2.11+dfsg-1ubuntu7.1 2018-05-16 16:07:13 UTC

  qemu (1:2.11+dfsg-1ubuntu7.1) bionic-security; urgency=medium

  * SECURITY UPDATE: out-of-bounds access during migration via ps2
    - debian/patches/ubuntu/CVE-2017-16845.patch: check PS2Queue pointers
      in post_load routine in hw/input/ps2.c.
    - CVE-2017-16845
  * SECURITY UPDATE: arbitrary code execution via load_multiboot
    - debian/patches/ubuntu/CVE-2018-7550.patch: handle bss_end_addr being
      zero in hw/i386/multiboot.c.
    - CVE-2018-7550
  * SECURITY UPDATE: denial of service in Cirrus CLGD 54xx VGA
    - debian/patches/ubuntu/CVE-2018-7858.patch: fix region calculation in
      hw/display/vga.c.
    - CVE-2018-7858

 -- Marc Deslauriers <email address hidden> Fri, 11 May 2018 13:26:42 -0400

CVE-2017-16845 hw/input/ps2.c in Qemu does not validate 'rptr' and 'count' values during guest migration, leading to out-of-bounds access.
CVE-2018-7550 The load_multiboot function in hw/i386/multiboot.c in Quick Emulator (aka QEMU) allows local guest OS users to execute arbitrary code on the QEMU hos
CVE-2018-7858 Quick Emulator (aka QEMU), when built with the Cirrus CLGD 54xx VGA Emulator support, allows local guest OS privileged users to cause a denial of ser



About   -   Send Feedback to @ubuntu_updates