UbuntuUpdates.org

Package "qemu"

Name: qemu

Description:

fast processor emulator

Latest version: 1:2.5+dfsg-5ubuntu10.29
Release: xenial (16.04)
Level: security
Repository: universe
Homepage: http://www.qemu.org/

Links

Save this URL for the latest version of "qemu": https://www.ubuntuupdates.org/qemu


Download "qemu"


Other versions of "qemu" in Xenial

Repository Area Version
base universe 1:2.5+dfsg-5ubuntu10
base main 1:2.5+dfsg-5ubuntu10
security main 1:2.5+dfsg-5ubuntu10.29
updates main 1:2.5+dfsg-5ubuntu10.29
updates universe 1:2.5+dfsg-5ubuntu10.29

Packages in group

Deleted packages are displayed in grey.

qemu-guest-agent qemu-user qemu-user-binfmt qemu-user-static

Changelog

Version: 1:2.5+dfsg-5ubuntu10.29 2018-05-22 00:06:55 UTC

  qemu (1:2.5+dfsg-5ubuntu10.29) xenial-security; urgency=medium

  * SECURITY UPDATE: Speculative Store Bypass
    - debian/patches/ubuntu/CVE-2018-3639.patch: add bit(2) of SPEC_CTRL
      MSR support - Reduced Data Speculation to target-i386/cpu.*.
    - CVE-2018-3639

 -- Marc Deslauriers <email address hidden> Thu, 17 May 2018 10:08:05 -0400

Source diff to previous version
CVE-2018-3639 Speculative Store Bypass

Version: 1:2.5+dfsg-5ubuntu10.28 2018-05-16 16:07:08 UTC

  qemu (1:2.5+dfsg-5ubuntu10.28) xenial-security; urgency=medium

  * SECURITY UPDATE: arbitrary code execution via load_multiboot
    - debian/patches/CVE-2018-7550.patch: handle bss_end_addr being zero in
      hw/i386/multiboot.c.
    - CVE-2018-7550

 -- Marc Deslauriers <email address hidden> Fri, 11 May 2018 13:34:24 -0400

Source diff to previous version
CVE-2018-7550 The load_multiboot function in hw/i386/multiboot.c in Quick Emulator (aka QEMU) allows local guest OS users to execute arbitrary code on the QEMU hos

Version: 1:2.5+dfsg-5ubuntu10.24 2018-03-05 11:09:08 UTC

  qemu (1:2.5+dfsg-5ubuntu10.24) xenial-security; urgency=medium

  * SECURITY REGRESSION: Xen regression (LP: #1752761)
    - debian/patches/CVE-2017-11334-1.patch: removed.
    - debian/patches/CVE-2017-11334-2.patch: removed.
  * This package does _not_ contain the changes from
    (1:2.5+dfsg-5ubuntu10.23) in xenial-proposed.

 -- Marc Deslauriers <email address hidden> Fri, 02 Mar 2018 08:14:50 -0500

Source diff to previous version
1752761 Regression in vga handling ubuntu10.21 to ubuntu10.22
CVE-2017-11334 The address_space_write_continue function in exec.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service

Version: 1:2.5+dfsg-5ubuntu10.22 2018-02-20 21:08:09 UTC

  qemu (1:2.5+dfsg-5ubuntu10.22) xenial-security; urgency=medium

  * SECURITY UPDATE: DoS via guest ram block area
    - debian/patches/CVE-2017-11334-1.patch: use qemu_ram_ptr_length to
      access guest ram in exec.c.
    - debian/patches/CVE-2017-11334-2.patch: add lock parameter to
      qemu_ram_ptr_length in exec.c.
    - CVE-2017-11334
  * SECURITY UPDATE: code execution via multiboot out-of-bounds write
    - debian/patches/CVE-2017-14167.patch: validate multiboot header
      address values in hw/i386/multiboot.c.
    - CVE-2017-14167
  * SECURITY UPDATE: information disclosure via race in 9pfs
    - debian/patches/CVE-2017-15038.patch: use g_malloc0 to allocate space
      for xattr in hw/9pfs/virtio-9p.c.
    - CVE-2017-15038
  * SECURITY UPDATE: DoS via large option request in NBD server
    - debian/patches/CVE-2017-15119.patch: reject options larger than 32M
      in nbd.c.
    - CVE-2017-15119
  * SECURITY UPDATE: DoS in cirrus driver
    - debian/patches/CVE-2017-15289.patch: fix oob access in mode4and5
      write functions in hw/display/cirrus_vga.c.
    - CVE-2017-15289
  * SECURITY UPDATE: out-of-bounds access in ps2 driver
    - debian/patches/CVE-2017-16845.patch: check PS2Queue pointers in
      post_load routine in hw/input/ps2.c.
    - CVE-2017-16845
  * SECURITY UPDATE: DoS in Virtio Vring implementation
    - debian/patches/CVE-2017-17381.patch: check VirtQueue Vring object is
      set in hw/virtio/virtio.c.
    - CVE-2017-17381
  * SECURITY UPDATE: DoS via integer overflow in ROUND_UP
    - debian/patches/CVE-2017-18043.patch: fix ROUND_UP in
      include/qemu/osdep.h.
    - CVE-2017-18043
  * SECURITY UPDATE: DoS in VGA driver
    - debian/patches/CVE-2018-5683.patch: check the validation of memory
      addr when draw text in hw/display/vga.c.
    - CVE-2018-5683

 -- Marc Deslauriers <email address hidden> Thu, 15 Feb 2018 09:48:27 -0500

Source diff to previous version
CVE-2017-11334 The address_space_write_continue function in exec.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service
CVE-2017-14167 Integer overflow in the load_multiboot function in hw/i386/multiboot.c in QEMU (aka Quick Emulator) allows local guest OS users to execute arbitrary
CVE-2017-15038 Race condition in the v9fs_xattrwalk function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS users to obtain sensitive informatio
CVE-2017-15119 DoS via large option request
CVE-2017-15289 The mode4and5 write functions in hw/display/cirrus_vga.c in Qemu allow local OS guest privileged users to cause a denial of service (out-of-bounds wr
CVE-2017-16845 hw/input/ps2.c in Qemu does not validate 'rptr' and 'count' values during guest migration, leading to out-of-bounds access.
CVE-2017-17381 The Virtio Vring implementation in QEMU allows local OS guest users to cause a denial of service (divide-by-zero error and QEMU process crash) by uns
CVE-2017-18043 Integer overflow in the macro ROUND_UP (n, d) in Quick Emulator (Qemu) allows a user to cause a denial of service (Qemu process crash).
CVE-2018-5683 The vga_draw_text function in Qemu allows local OS guest privileged users to cause a denial of service (out-of-bounds read and QEMU process crash) by

Version: 1:2.5+dfsg-5ubuntu10.20 2018-02-07 19:06:39 UTC

  qemu (1:2.5+dfsg-5ubuntu10.20) xenial-security; urgency=medium

  * SECURITY UPDATE: Add support for Spectre mitigations (LP: #1744882)
    - debian/patches/CVE-2017-5715-1.patch: Lengthen X86CPUDefinition::
      model_id in target-i386/cpu.c.
    - debian/patches/CVE-2017-5715-2.patch: Add support for SPEC_CTRL MSR
      in target-i386/cpu.h, target-i386/kvm.c, target-i386/machine.c.
    - debian/patches/CVE-2017-5715-3pre1.patch: add FEAT_7_0_ECX and
      FEAT_7_0_EDX in target-i386/cpu.c, target-i386/cpu.h.
    - debian/patches/CVE-2017-5715-3.patch: Add spec-ctrl CPUID bit in
      target-i386/cpu.c, target-i386/cpu.h.
    - debian/patches/CVE-2017-5715-4.patch: Add FEAT_8000_0008_EBX CPUID
      feature word in target-i386/cpu.c, target-i386/cpu.h.
    - debian/patches/CVE-2017-5715-5.patch: Add new -IBRS versions of Intel
      CPU models in target-i386/cpu.c.
    - debian/patches/CVE-2017-5715-s390x-1.patch: add linux-header content
      for bpbc in linux-headers/asm-s390/kvm.h, linux-headers/linux/kvm.h.
    - debian/patches/CVE-2017-5715-s390x-2.patch: handle bpb feature in
      target-s390x/cpu.c, target-s390x/cpu.h, target-s390x/kvm.c.
    - CVE-2017-5715

 -- Marc Deslauriers <email address hidden> Thu, 01 Feb 2018 13:27:34 -0500

1744882 Add SPEC_CTRL and IBRS changes
CVE-2017-5715 Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an at



About   -   Send Feedback to @ubuntu_updates