UbuntuUpdates.org

Package "qemu"

Name: qemu

Description:

fast processor emulator
Latest version: 1:2.5+dfsg-5ubuntu10.42
Release: xenial (16.04)
Level: security
Repository: universe
Homepage: http://www.qemu.org/

Links

Save this URL for the latest version of "qemu": https://www.ubuntuupdates.org/qemu

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "qemu"

32-bit deb package
64-bit deb package
APT INSTALL

Other versions of "qemu" in Xenial

Repository Area Version
base universe 1:2.5+dfsg-5ubuntu10
base main 1:2.5+dfsg-5ubuntu10
security main 1:2.5+dfsg-5ubuntu10.42
updates main 1:2.5+dfsg-5ubuntu10.42
updates universe 1:2.5+dfsg-5ubuntu10.42

Packages in group

Deleted packages are displayed in grey.


Changelog

Version: 1:2.5+dfsg-5ubuntu10.42 2019-11-14 00:06:59 UTC

  qemu (1:2.5+dfsg-5ubuntu10.42) xenial-security; urgency=medium

  * SECURITY UPDATE: infinite loop when executing LSI scsi adapter
    emulator scripts
    - d/p/CVE-2019-12068.patch: Move the existing loop exit
    - CVE-2019-12068
  * SECURITY UPDATE: null pointer dereference in qxl display driver
    - d/p/CVE-2019-12155.patch: qxl: check release info object
    - CVE-2019-12155
  * SECURITY UPDATE: qemu-bridge-helper interface name buffer overflow
    - d/p/CVE-2019-13164.patch: qemu-bridge-helper: restrict
      interface name to IFNAMSIZ
    - CVE-2019-13164
  * SECURITY UPDATE: heap overflow in slirp
    - d/p/CVE-2019-14378.patch: slirp: Fix heap overflow in ip_reass
      on big packet input
    - CVE-2019-14378
  * SECURITY UPDATE: use after free vulnerability in slirp
    - d/p/CVE-2019-15890.patch: slirp: ip_reass: Fix use after free
    - CVE-2019-15890

 -- Steve Beattie <email address hidden> Mon, 04 Nov 2019 13:30:56 -0800
Source diff to previous version
CVE-2019-12068 In QEMU 1:4.1-1, 1:2.1+dfsg-12+deb8u6, 1:2.8+dfsg-6+deb9u8, 1:3.1+dfsg-8~deb10u1, 1:3.1+dfsg-8+deb10u2, and 1:2.1+dfsg-12+deb8u12 (fixed), when execu
CVE-2019-12155 interface_release_resource in hw/display/qxl.c in QEMU 4.0.0 has a NULL pointer dereference.
CVE-2019-13164 qemu-bridge-helper.c in QEMU 4.0.0 does not ensure that a network interface name (obtained from bridge.conf or a --br=bridge option) is limited to th
CVE-2019-14378 ip_reass in ip_input.c in libslirp 4.0.0 has a heap-based buffer overflow via a large packet because it mishandles a case involving the first fragmen
CVE-2019-15890 libslirp 4.0.0, as used in QEMU 4.1.0, has a use-after-free in ip_reass in ip_input.c.

Version: 1:2.5+dfsg-5ubuntu10.39 2019-05-16 17:07:20 UTC

  qemu (1:2.5+dfsg-5ubuntu10.39) xenial-security; urgency=medium

  * Disable patches from 1:2.5+dfsg-5ubuntu10.37 to prevent regression
    (LP: #1829245)
    - d/p/lp1823458/add-VirtIONet-vhost_stopped-flag-to-prevent-multiple.patch
    - d/p/lp1823458/do-not-call-vhost_net_cleanup-on-running-net-from-ch.patch

 -- Marc Deslauriers <email address hidden> Thu, 16 May 2019 07:11:54 -0400
Source diff to previous version
1829245 Networking issues after upgrade to 1:2.5+dfsg-5ubuntu10.37

Version: 1:2.5+dfsg-5ubuntu10.38 2019-05-14 18:06:33 UTC

  qemu (1:2.5+dfsg-5ubuntu10.38) xenial-security; urgency=medium

  * SECURITY UPDATE: Add support for exposing md-clear functionality
    to guests
    - d/p/ubuntu/enable-md-clear.patch
    - CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091
  * SECURITY UPDATE: heap overflow when loading device tree blob
    - d/p/ubuntu/CVE-2018-20815.patch: specify how large the buffer to
      copy the device tree blob into is.
    - CVE-2018-20815
  * SECURITY UPDATE: information leak in SLiRP
    - d/p/ubuntu/CVE-2019-9824.patch: check sscanf result when
      emulating ident.
    - CVE-2019-9824
Source diff to previous version
CVE-2018-12126 MSBDS Microarchitectural Store Buffer Data Sampling
CVE-2018-12127 MLPDS Microarchitectural Load Port Data Sampling
CVE-2018-12130 MFBDS Microarchitectural Fill Buffer Data Sampling
CVE-2019-11091 MDSUM Microarchitectural Data Sampling Uncacheable Memory
CVE-2018-20815 device_tree: heap buffer overflow while loading device tree blob

Version: 1:2.5+dfsg-5ubuntu10.36 2019-03-28 17:06:36 UTC

  qemu (1:2.5+dfsg-5ubuntu10.36) xenial-security; urgency=medium

  * Spectre/Meltdown fixes for ppc64 (LP: #1765364)
    - debian/patches/lp1765364/*.patches: add backported capabilities and
      spectre/meltdown commits.
  * SECURITY UPDATE: race during file renaming in v9fs_wstat
    - debian/patches/CVE-2018-19489.patch: add locks to hw/9pfs/9p.c.
    - CVE-2018-19489
  * SECURITY UPDATE: heap based buffer overflow in slirp
    - debian/patches/CVE-2019-6778.patch: check data length while emulating
      ident function in slirp/tcp_subr.c.
    - CVE-2019-6778

 -- Marc Deslauriers <email address hidden> Fri, 22 Mar 2019 14:19:08 -0400
Source diff to previous version
1765364 Backport spectre/meltdown fixes on qemu for ppc64 into 16.04 and possibly 14.04 LTS releases
CVE-2018-19489 v9fs_wstat in hw/9pfs/9p.c in QEMU allows guest OS users to cause a denial of service (crash) because of a race condition during file renaming.
CVE-2019-6778 In QEMU 3.0.0, tcp_emu in slirp/tcp_subr.c has a heap-based buffer overflow.

Version: 1:2.5+dfsg-5ubuntu10.33 2018-11-26 15:07:01 UTC

  qemu (1:2.5+dfsg-5ubuntu10.33) xenial-security; urgency=medium

  * SECURITY UPDATE: integer overflow in NE2000 NIC emulation
    - debian/patches/CVE-2018-10839.patch: use proper type in
      hw/net/ne2000.c.
    - CVE-2018-10839
  * SECURITY UPDATE: buffer overflow via incoming fragmented datagrams
    - debian/patches/CVE-2018-11806.patch: correct size computation in
      slirp/mbuf.c, slirp/mbuf.h.
    - CVE-2018-11806
  * SECURITY UPDATE: integer overflow via crafted QMP command
    - debian/patches/CVE-2018-12617.patch: check bytes count read by
      guest-file-read in qga/commands-posix.c.
    - CVE-2018-12617
  * SECURITY UPDATE: buffer overflow in rtl8139
    - debian/patches/CVE-2018-17958.patch: use proper type in
      hw/net/rtl8139.c.
    - CVE-2018-17958
  * SECURITY UPDATE: buffer overflow in pcnet
    - debian/patches/CVE-2018-17962.patch: use proper type in
      hw/net/pcnet.c.
    - CVE-2018-17962
  * SECURITY UPDATE: DoS via large packet sizes
    - debian/patches/CVE-2018-17963.patch: check size in net/net.c.
    - CVE-2018-17963
  * SECURITY UPDATE: DoS in lsi53c895a
    - debian/patches/CVE-2018-18849.patch: check message length value is
      valid in hw/scsi/lsi53c895a.c.
    - CVE-2018-18849
  * SECURITY UPDATE: race condition in 9p
    - debian/patches/CVE-2018-19364-1.patch: use write lock in
      hw/9pfs/cofile.c.
    - debian/patches/CVE-2018-19364-2.patch: use write lock in
      hw/9pfs/virtio-9p.c.
    - CVE-2018-19364

 -- Marc Deslauriers <email address hidden> Wed, 21 Nov 2018 14:53:19 -0500
CVE-2018-10839 Qemu emulator <= 3.0.0 built with the NE2000 NIC emulation support is vulnerable to an integer overflow, which could lead to buffer overflow issue. I
CVE-2018-11806 m_cat in slirp/mbuf.c in Qemu has a heap-based buffer overflow via incoming fragmented datagrams.
CVE-2018-12617 qmp_guest_file_read in qga/commands-posix.c and qga/commands-win32.c in qemu-ga (aka QEMU Guest Agent) in QEMU 2.12.50 has an integer overflow causin
CVE-2018-17958 Qemu has a Buffer Overflow in rtl8139_do_receive in hw/net/rtl8139.c because an incorrect integer data type is used.
CVE-2018-17962 Qemu has a Buffer Overflow in pcnet_receive in hw/net/pcnet.c because an incorrect integer data type is used.
CVE-2018-17963 qemu_deliver_packet_iov in net/net.c in Qemu accepts packet sizes greater than INT_MAX, which allows attackers to cause a denial of service or possib
CVE-2018-18849 lsi53c895a: OOB msg buffer access leads to DoS
CVE-2018-19364 Use-after-free due to race condition while updating fid path


About   -   Send Feedback to @ubuntu_updates