Package "qemu-kvm"
| Name: |
qemu-kvm
|
Description: |
QEMU Full virtualization
|
| Latest version: |
2.0.0+dfsg-2ubuntu1.46 |
| Release: |
trusty (14.04) |
| Level: |
security |
| Repository: |
main |
| Head package: |
qemu |
| Homepage: |
http://www.qemu.org/ |
Links
Download "qemu-kvm"
Other versions of "qemu-kvm" in Trusty
Changelog
|
qemu (2.0.0+dfsg-2ubuntu1.46) trusty-security; urgency=medium
* SECURITY UPDATE: Add support for exposing md-clear functionality
to guests
- d/p/ubuntu/enable-md-clear.patch
- CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091
* SECURITY UPDATE: heap overflow when loading device tree blob
- d/p/ubuntu/CVE-2018-20815.patch: specify how large the buffer to
copy the device tree blob into is.
- d/p/ubuntu/CVE-2018-20815-prereq-1.patch: Add load_image_size()
to replace load_image()
- d/p/ubuntu/CVE-2018-20815-prereq-2.patch: Read as long as possible
in load_image_size()
- CVE-2018-20815
* SECURITY UPDATE: information leak in SLiRP
- d/p/ubuntu/CVE-2019-9824.patch: check sscanf result when
emulating ident.
- CVE-2019-9824
-- Steve Beattie <email address hidden> Wed, 08 May 2019 23:59:48 -0700
|
| Source diff to previous version |
|
|
|
qemu (2.0.0+dfsg-2ubuntu1.45) trusty-security; urgency=medium
* SECURITY UPDATE: race during file renaming in v9fs_wstat
- debian/patches/CVE-2018-19489.patch: add locks to hw/9pfs/9p.c.
- CVE-2018-19489
* SECURITY UPDATE: heap based buffer overflow in slirp
- debian/patches/CVE-2019-6778.patch: check data length while emulating
ident function in slirp/tcp_subr.c.
- CVE-2019-6778
-- Marc Deslauriers <email address hidden> Fri, 22 Mar 2019 17:08:37 -0400
|
| Source diff to previous version |
| CVE-2018-19489 |
v9fs_wstat in hw/9pfs/9p.c in QEMU allows guest OS users to cause a denial of service (crash) because of a race condition during file renaming. |
| CVE-2019-6778 |
In QEMU 3.0.0, tcp_emu in slirp/tcp_subr.c has a heap-based buffer overflow. |
|
|
qemu (2.0.0+dfsg-2ubuntu1.44) trusty-security; urgency=medium
* SECURITY UPDATE: integer overflow in NE2000 NIC emulation
- debian/patches/CVE-2018-10839.patch: use proper type in
hw/net/ne2000.c.
- CVE-2018-10839
* SECURITY UPDATE: buffer overflow via incoming fragmented datagrams
- debian/patches/CVE-2018-11806.patch: correct size computation in
slirp/mbuf.c, slirp/mbuf.h.
- CVE-2018-11806
* SECURITY UPDATE: integer overflow via crafted QMP command
- debian/patches/CVE-2018-12617.patch: check bytes count read by
guest-file-read in qga/commands-posix.c.
- CVE-2018-12617
* SECURITY UPDATE: buffer overflow in rtl8139
- debian/patches/CVE-2018-17958.patch: use proper type in
hw/net/rtl8139.c.
- CVE-2018-17958
* SECURITY UPDATE: buffer overflow in pcnet
- debian/patches/CVE-2018-17962.patch: use proper type in
hw/net/pcnet.c.
- CVE-2018-17962
* SECURITY UPDATE: DoS via large packet sizes
- debian/patches/CVE-2018-17963.patch: check size in net/net.c.
- CVE-2018-17963
* SECURITY UPDATE: DoS in lsi53c895a
- debian/patches/CVE-2018-18849.patch: check message length value is
valid in hw/scsi/lsi53c895a.c.
- CVE-2018-18849
* SECURITY UPDATE: race condition in 9p
- debian/patches/CVE-2018-19364-1.patch: use write lock in
hw/9pfs/cofile.c.
- debian/patches/CVE-2018-19364-2.patch: use write lock in
hw/9pfs/virtio-9p.c.
- CVE-2018-19364
-- Marc Deslauriers <email address hidden> Wed, 21 Nov 2018 15:10:13 -0500
|
| Source diff to previous version |
| CVE-2018-10839 |
Qemu emulator <= 3.0.0 built with the NE2000 NIC emulation support is vulnerable to an integer overflow, which could lead to buffer overflow issue. I |
| CVE-2018-11806 |
m_cat in slirp/mbuf.c in Qemu has a heap-based buffer overflow via incoming fragmented datagrams. |
| CVE-2018-12617 |
qmp_guest_file_read in qga/commands-posix.c and qga/commands-win32.c in qemu-ga (aka QEMU Guest Agent) in QEMU 2.12.50 has an integer overflow causin |
| CVE-2018-17958 |
Qemu has a Buffer Overflow in rtl8139_do_receive in hw/net/rtl8139.c because an incorrect integer data type is used. |
| CVE-2018-17962 |
Qemu has a Buffer Overflow in pcnet_receive in hw/net/pcnet.c because an incorrect integer data type is used. |
| CVE-2018-17963 |
qemu_deliver_packet_iov in net/net.c in Qemu accepts packet sizes greater than INT_MAX, which allows attackers to cause a denial of service or possib |
| CVE-2018-18849 |
lsi53c895a: OOB msg buffer access leads to DoS |
| CVE-2018-19364 |
Use-after-free due to race condition while updating fid path |
|
|
qemu (2.0.0+dfsg-2ubuntu1.43) trusty-security; urgency=medium
* SECURITY UPDATE: Speculative Store Bypass
- debian/patches/CVE-2018-3639-2.patch: define the AMD 'virt-ssbd'
CPUID feature bit in target/i386/cpu.c.
- debian/patches/CVE-2018-3639-3.patch: define the Virt SSBD MSR and
handling of it in target/i386/cpu.h, target/i386/kvm.c,
target/i386/machine.c.
- CVE-2018-3639
-- Marc Deslauriers <email address hidden> Wed, 23 May 2018 08:03:09 -0400
|
| Source diff to previous version |
|
|
|
qemu (2.0.0+dfsg-2ubuntu1.42) trusty-security; urgency=medium
* SECURITY UPDATE: Speculative Store Bypass
- debian/patches/ubuntu/CVE-2018-3639.patch: add bit(2) of SPEC_CTRL
MSR support - Reduced Data Speculation to target-i386/cpu.*.
- CVE-2018-3639
-- Marc Deslauriers <email address hidden> Thu, 17 May 2018 10:09:16 -0400
|
|
|
About
-
Send Feedback to @ubuntu_updates
