Package "qemu-system-x86-microvm"

Name: qemu-system-x86-microvm


QEMU minimized system emulation binaries (x86)

Latest version: 1:4.2-3ubuntu6.6
Release: focal (20.04)
Level: security
Repository: universe
Head package: qemu
Homepage: http://www.qemu.org/


Download "qemu-system-x86-microvm"

Other versions of "qemu-system-x86-microvm" in Focal

Repository Area Version
base universe 1:4.2-3ubuntu6
updates universe 1:4.2-3ubuntu6.6


Version: 1:4.2-3ubuntu6.6 2020-09-17 12:06:18 UTC

  qemu (1:4.2-3ubuntu6.6) focal-security; urgency=medium

  * SECURITY UPDATE: out-of-bounds read/write in USB emulator
    - debian/patches/ubuntu/CVE-2020-14364.patch: fix setup_len init in
    - CVE-2020-14364

 -- Marc Deslauriers <email address hidden> Tue, 15 Sep 2020 10:02:08 -0400

Source diff to previous version
CVE-2020-14364 An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU in versions before 5.2.0. This issue occurs while processing USB pa

Version: 1:4.2-3ubuntu6.4 2020-08-19 17:06:24 UTC

  qemu (1:4.2-3ubuntu6.4) focal-security; urgency=medium

  * SECURITY UPDATE: assert failure in nbd
    - debian/patches/ubuntu/CVE-2020-10761.patch: avoid long error message
      assertions in nbd/server.c, tests/qemu-iotests/143,
    - CVE-2020-10761
  * SECURITY UPDATE: out-of-bounds read and write in sm501
    - debian/patches/ubuntu/CVE-2020-12829-pre1.patch: convert printf +
      abort to qemu_log_mask.
    - debian/patches/ubuntu/CVE-2020-12829-pre2.patch: shorten long
      variable names in sm501_2d_operation.
    - debian/patches/ubuntu/CVE-2020-12829-pre3.patch: use BIT(x) macro to
      shorten constant.
    - debian/patches/ubuntu/CVE-2020-12829-pre4.patch: clean up local
      variables in sm501_2d_operation.
    - debian/patches/ubuntu/CVE-2020-12829.patch: replace hand written
      implementation with pixman where possible.
    - debian/patches/ubuntu/CVE-2020-12829-2.patch: optimize small
      overlapping blits.
    - debian/patches/ubuntu/CVE-2020-12829-3.patch: fix bounds checks.
    - debian/patches/ubuntu/CVE-2020-12829-4.patch: drop unneded variable.
    - debian/patches/ubuntu/CVE-2020-12829-5.patch: do not allow guest to
      set invalid format.
    - debian/patches/ubuntu/CVE-2020-12829-6.patch: introduce variable for
      commonly used value for better readability.
    - debian/patches/ubuntu/CVE-2020-12829-7.patch: fix and optimize
      overlap check.
    - CVE-2020-12829
  * SECURITY UPDATE: out-of-bounds read during sdhci_write() operations
    - debian/patches/ubuntu/CVE-2020-13253.patch: do not switch to
      ReceivingData if address is invalid in hw/sd/sd.c.
    - CVE-2020-13253
  * SECURITY UPDATE: out-of-bounds access during es1370_write() operation
    - debian/patches/ubuntu/CVE-2020-13361.patch: check total frame count
      against current frame in hw/audio/es1370.c.
    - CVE-2020-13361
  * SECURITY UPDATE: out-of-bounds read via crafted reply_queue_head
    - debian/patches/ubuntu/CVE-2020-13362-1.patch: use unsigned type for
      reply_queue_head and check index in hw/scsi/megasas.c.
    - debian/patches/ubuntu/CVE-2020-13362-2.patch: avoid NULL pointer
      dereference in hw/scsi/megasas.c.
    - debian/patches/ubuntu/CVE-2020-13362-3.patch: use unsigned type for
      positive numeric fields in hw/scsi/megasas.c.
    - CVE-2020-13362
  * SECURITY UPDATE: NULL pointer dereference related to BounceBuffer
    - debian/patches/ubuntu/CVE-2020-13659.patch: set map length to zero
      when returning NULL in exec.c, include/exec/memory.h.
    - CVE-2020-13659
  * SECURITY UPDATE: out-of-bounds access via msi-x mmio operation
    - debian/patches/ubuntu/CVE-2020-13754-1.patch: revert accepting
      mismatching sizes in memory_region_access_valid in memory.c.
    - debian/patches/ubuntu/CVE-2020-13754-2.patch: accept byte and word
      access to core ACPI registers in hw/acpi/core.c.
    - CVE-2020-13754
  * SECURITY UPDATE: infinite recursion in ati-vga
    - debian/patches/ubuntu/CVE-2020-13800.patch: check mm_index before
      recursive call in hw/display/ati.c.
    - CVE-2020-13800
  * SECURITY UPDATE: division by zero in oss_write()
    - debian/patches/ubuntu/CVE-2020-14415.patch: fix buffer pos
      calculation in audio/ossaudio.c.
    - CVE-2020-14415
  * SECURITY UPDATE: buffer overflow in XGMAC Ethernet controller
    - debian/patches/ubuntu/CVE-2020-15863.patch: check bounds in
    - CVE-2020-15863
  * SECURITY UPDATE: reachable assertion failure
    - debian/patches/ubuntu/CVE-2020-16092.patch: fix assertion failure in
    - CVE-2020-16092

 -- Marc Deslauriers <email address hidden> Tue, 11 Aug 2020 12:30:06 -0400

Source diff to previous version
CVE-2020-10761 An assertion failure issue was found in the Network Block Device(NBD) Server in all QEMU versions before QEMU 5.0.1. This flaw occurs when an nbd-cli
CVE-2020-13253 sd_wp_addr in hw/sd/sd.c in QEMU 4.2.0 uses an unvalidated address, which leads to an out-of-bounds read during sdhci_write() operations. A guest OS
CVE-2020-13361 In QEMU 5.0.0 and earlier, es1370_transfer_audio in hw/audio/es1370.c does not properly validate the frame count, which allows guest OS users to trig
CVE-2020-13362 In QEMU 5.0.0 and earlier, megasas_lookup_frame in hw/scsi/megasas.c has an out-of-bounds read via a crafted reply_queue_head field from a guest OS u
CVE-2020-13659 address_space_map in exec.c in QEMU 4.2.0 can trigger a NULL pointer dereference related to BounceBuffer.
CVE-2020-13754 hw/pci/msix.c in QEMU 4.2.0 allows guest OS users to trigger an out-of-bounds access via a crafted address in an msi-x mmio operation.
CVE-2020-13800 ati-vga in hw/display/ati.c in QEMU 4.2.0 allows guest OS users to trigger infinite recursion via a crafted mm_index value during an ati_mm_read or a
CVE-2020-14415 division by zero in oss_write() in audio/ossaudio.c
CVE-2020-15863 hw/net/xgmac.c in the XGMAC Ethernet controller in QEMU before 07-20-2020 has a buffer overflow. This occurs during packet transmission and affects t
CVE-2020-16092 In QEMU through 5.0.0, an assertion failure can occur in the network packet processing. This issue affects the e1000e and vmxnet3 network devices. A

Version: 1:4.2-3ubuntu6.1 2020-05-21 18:06:47 UTC

  qemu (1:4.2-3ubuntu6.1) focal-security; urgency=medium

  * SECURITY UPDATE: DoS via integer overflow in ati_2d_blt()
    - debian/patches/ubuntu/CVE-2020-11869.patch: fix checks in
      ati_2d_blt() to avoid crash in hw/display/ati_2d.c.
    - CVE-2020-11869

 -- Marc Deslauriers <email address hidden> Thu, 14 May 2020 08:25:24 -0400

CVE-2020-11869 An integer overflow was found in QEMU 4.0.1 through 4.2.0 in the way it implemented ATI VGA emulation. This flaw occurs in the ati_2d_blt() routine i

About   -   Send Feedback to @ubuntu_updates