Package "qemu"
Name: |
qemu
|
Description: |
fast processor emulator
|
Latest version: |
1:2.5+dfsg-5ubuntu10.42 |
Release: |
xenial (16.04) |
Level: |
security |
Repository: |
universe |
Homepage: |
http://www.qemu.org/ |
Links
Save this URL for the latest version of "qemu":
https://www.ubuntuupdates.org/qemu
Download "qemu"
Other versions of "qemu" in Xenial
Packages in group
Deleted packages are displayed in grey.
Changelog
qemu (1:2.5+dfsg-5ubuntu10.42) xenial-security; urgency=medium
* SECURITY UPDATE: infinite loop when executing LSI scsi adapter
emulator scripts
- d/p/CVE-2019-12068.patch: Move the existing loop exit
- CVE-2019-12068
* SECURITY UPDATE: null pointer dereference in qxl display driver
- d/p/CVE-2019-12155.patch: qxl: check release info object
- CVE-2019-12155
* SECURITY UPDATE: qemu-bridge-helper interface name buffer overflow
- d/p/CVE-2019-13164.patch: qemu-bridge-helper: restrict
interface name to IFNAMSIZ
- CVE-2019-13164
* SECURITY UPDATE: heap overflow in slirp
- d/p/CVE-2019-14378.patch: slirp: Fix heap overflow in ip_reass
on big packet input
- CVE-2019-14378
* SECURITY UPDATE: use after free vulnerability in slirp
- d/p/CVE-2019-15890.patch: slirp: ip_reass: Fix use after free
- CVE-2019-15890
-- Steve Beattie <email address hidden> Mon, 04 Nov 2019 13:30:56 -0800
|
Source diff to previous version |
CVE-2019-12068 |
In QEMU 1:4.1-1, 1:2.1+dfsg-12+deb8u6, 1:2.8+dfsg-6+deb9u8, 1:3.1+dfsg-8~deb10u1, 1:3.1+dfsg-8+deb10u2, and 1:2.1+dfsg-12+deb8u12 (fixed), when execu |
CVE-2019-12155 |
interface_release_resource in hw/display/qxl.c in QEMU 4.0.0 has a NULL pointer dereference. |
CVE-2019-13164 |
qemu-bridge-helper.c in QEMU 4.0.0 does not ensure that a network interface name (obtained from bridge.conf or a --br=bridge option) is limited to th |
CVE-2019-14378 |
ip_reass in ip_input.c in libslirp 4.0.0 has a heap-based buffer overflow via a large packet because it mishandles a case involving the first fragmen |
CVE-2019-15890 |
libslirp 4.0.0, as used in QEMU 4.1.0, has a use-after-free in ip_reass in ip_input.c. |
|
qemu (1:2.5+dfsg-5ubuntu10.39) xenial-security; urgency=medium
* Disable patches from 1:2.5+dfsg-5ubuntu10.37 to prevent regression
(LP: #1829245)
- d/p/lp1823458/add-VirtIONet-vhost_stopped-flag-to-prevent-multiple.patch
- d/p/lp1823458/do-not-call-vhost_net_cleanup-on-running-net-from-ch.patch
-- Marc Deslauriers <email address hidden> Thu, 16 May 2019 07:11:54 -0400
|
Source diff to previous version |
1829245 |
Networking issues after upgrade to 1:2.5+dfsg-5ubuntu10.37 |
|
qemu (1:2.5+dfsg-5ubuntu10.38) xenial-security; urgency=medium
* SECURITY UPDATE: Add support for exposing md-clear functionality
to guests
- d/p/ubuntu/enable-md-clear.patch
- CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091
* SECURITY UPDATE: heap overflow when loading device tree blob
- d/p/ubuntu/CVE-2018-20815.patch: specify how large the buffer to
copy the device tree blob into is.
- CVE-2018-20815
* SECURITY UPDATE: information leak in SLiRP
- d/p/ubuntu/CVE-2019-9824.patch: check sscanf result when
emulating ident.
- CVE-2019-9824
|
Source diff to previous version |
|
qemu (1:2.5+dfsg-5ubuntu10.36) xenial-security; urgency=medium
* Spectre/Meltdown fixes for ppc64 (LP: #1765364)
- debian/patches/lp1765364/*.patches: add backported capabilities and
spectre/meltdown commits.
* SECURITY UPDATE: race during file renaming in v9fs_wstat
- debian/patches/CVE-2018-19489.patch: add locks to hw/9pfs/9p.c.
- CVE-2018-19489
* SECURITY UPDATE: heap based buffer overflow in slirp
- debian/patches/CVE-2019-6778.patch: check data length while emulating
ident function in slirp/tcp_subr.c.
- CVE-2019-6778
-- Marc Deslauriers <email address hidden> Fri, 22 Mar 2019 14:19:08 -0400
|
Source diff to previous version |
1765364 |
Backport spectre/meltdown fixes on qemu for ppc64 into 16.04 and possibly 14.04 LTS releases |
CVE-2018-19489 |
v9fs_wstat in hw/9pfs/9p.c in QEMU allows guest OS users to cause a denial of service (crash) because of a race condition during file renaming. |
CVE-2019-6778 |
In QEMU 3.0.0, tcp_emu in slirp/tcp_subr.c has a heap-based buffer overflow. |
|
qemu (1:2.5+dfsg-5ubuntu10.33) xenial-security; urgency=medium
* SECURITY UPDATE: integer overflow in NE2000 NIC emulation
- debian/patches/CVE-2018-10839.patch: use proper type in
hw/net/ne2000.c.
- CVE-2018-10839
* SECURITY UPDATE: buffer overflow via incoming fragmented datagrams
- debian/patches/CVE-2018-11806.patch: correct size computation in
slirp/mbuf.c, slirp/mbuf.h.
- CVE-2018-11806
* SECURITY UPDATE: integer overflow via crafted QMP command
- debian/patches/CVE-2018-12617.patch: check bytes count read by
guest-file-read in qga/commands-posix.c.
- CVE-2018-12617
* SECURITY UPDATE: buffer overflow in rtl8139
- debian/patches/CVE-2018-17958.patch: use proper type in
hw/net/rtl8139.c.
- CVE-2018-17958
* SECURITY UPDATE: buffer overflow in pcnet
- debian/patches/CVE-2018-17962.patch: use proper type in
hw/net/pcnet.c.
- CVE-2018-17962
* SECURITY UPDATE: DoS via large packet sizes
- debian/patches/CVE-2018-17963.patch: check size in net/net.c.
- CVE-2018-17963
* SECURITY UPDATE: DoS in lsi53c895a
- debian/patches/CVE-2018-18849.patch: check message length value is
valid in hw/scsi/lsi53c895a.c.
- CVE-2018-18849
* SECURITY UPDATE: race condition in 9p
- debian/patches/CVE-2018-19364-1.patch: use write lock in
hw/9pfs/cofile.c.
- debian/patches/CVE-2018-19364-2.patch: use write lock in
hw/9pfs/virtio-9p.c.
- CVE-2018-19364
-- Marc Deslauriers <email address hidden> Wed, 21 Nov 2018 14:53:19 -0500
|
CVE-2018-10839 |
Qemu emulator <= 3.0.0 built with the NE2000 NIC emulation support is vulnerable to an integer overflow, which could lead to buffer overflow issue. I |
CVE-2018-11806 |
m_cat in slirp/mbuf.c in Qemu has a heap-based buffer overflow via incoming fragmented datagrams. |
CVE-2018-12617 |
qmp_guest_file_read in qga/commands-posix.c and qga/commands-win32.c in qemu-ga (aka QEMU Guest Agent) in QEMU 2.12.50 has an integer overflow causin |
CVE-2018-17958 |
Qemu has a Buffer Overflow in rtl8139_do_receive in hw/net/rtl8139.c because an incorrect integer data type is used. |
CVE-2018-17962 |
Qemu has a Buffer Overflow in pcnet_receive in hw/net/pcnet.c because an incorrect integer data type is used. |
CVE-2018-17963 |
qemu_deliver_packet_iov in net/net.c in Qemu accepts packet sizes greater than INT_MAX, which allows attackers to cause a denial of service or possib |
CVE-2018-18849 |
lsi53c895a: OOB msg buffer access leads to DoS |
CVE-2018-19364 |
Use-after-free due to race condition while updating fid path |
|
About
-
Send Feedback to @ubuntu_updates