Package "qemu"
| Name: |
qemu
|
Description: |
fast processor emulator
|
| Latest version: |
1:2.5+dfsg-5ubuntu10.51 |
| Release: |
xenial (16.04) |
| Level: |
updates |
| Repository: |
universe |
| Homepage: |
http://www.qemu.org/ |
Links
Download "qemu"
Other versions of "qemu" in Xenial
Packages in group
Deleted packages are displayed in grey.
Changelog
|
qemu (1:2.5+dfsg-5ubuntu10.51) xenial-security; urgency=medium
* SECURITY REGRESSION: fix multiple regressions caused by CVE-2020-13754
security update (LP: #1914883)
- debian/patches/CVE-2020-13754-5.patch: allow 64-bit accesses in
hw/timer/slavio_timer.c.
- debian/patches/CVE-2020-13754-9.patch: fix valid.max_access_size to
access address registers in hw/usb/hcd-xhci.c.
-- Marc Deslauriers <email address hidden> Wed, 10 Feb 2021 08:40:41 -0500
|
| Source diff to previous version |
| 1914883 |
hart0: trap handler failed (error -2) (Needs cherry-pick ab3d207f) |
| CVE-2020-13754 |
hw/pci/msix.c in QEMU 4.2.0 allows guest OS users to trigger an out-of-bounds access via a crafted address in an msi-x mmio operation. |
|
|
qemu (1:2.5+dfsg-5ubuntu10.49) xenial-security; urgency=medium
* SECURITY UPDATE: heap overread in iscsi_aio_ioctl_cb
- debian/patches/CVE-2020-11947.patch: fix heap-buffer-overflow in
block/iscsi.c.
- CVE-2020-11947
* SECURITY UPDATE: use-after-free in e1000e
- debian/patches/CVE-2020-15859.patch: forbid the reentrant RX in
net/queue.c.
- CVE-2020-15859
* SECURITY UPDATE: out of bounds read in atapi
- debian/patches/CVE-2020-29443-1.patch: assert that the buffer pointer
is in range in hw/ide/atapi.c.
- debian/patches/CVE-2020-29443-2.patch: check logical block address
and read size in hw/ide/atapi.c.
- CVE-2020-29443
* SECURITY UPDATE: use after free in 9p
- debian/patches/CVE-2021-20181.patch: fully restart unreclaim loop in
hw/9pfs/virtio-9p.c.
- CVE-2021-20181
-- Marc Deslauriers <email address hidden> Wed, 03 Feb 2021 12:56:37 -0500
|
| Source diff to previous version |
| CVE-2020-11947 |
iscsi_aio_ioctl_cb in block/iscsi.c in QEMU 4.1.0 has a heap-based buffer over-read that may disclose unrelated information from process memory to an |
| CVE-2020-15859 |
QEMU 4.2.0 has a use-after-free in hw/net/e1000e_core.c because a guest OS user can trigger an e1000e packet with the data's address set to the e1000 |
| CVE-2020-29443 |
ide_atapi_cmd_reply_end in hw/ide/atapi.c in QEMU 5.1.0 allows out-of-bounds read access because a buffer index is not validated. |
| CVE-2021-20181 |
9pfs: Fully restart unreclaim loop |
|
|
qemu (1:2.5+dfsg-5ubuntu10.48) xenial-security; urgency=medium
* SECURITY UPDATE: heap buffer overflow in sdhci_sdma_transfer_multi_blocks()
- debian/patches/CVE-2020-17380.patch: fix DMA Transfer Block Size
field in hw/sd/sdhci.c.
- CVE-2020-17380
- CVE-2020-25085
* SECURITY UPDATE: use-after-free via unchecked return value
- debian/patches/CVE-2020-25084.patch: check return value of
'usb_packet_map' in hw/usb/hcd-xhci.c.
- CVE-2020-25084
* SECURITY UPDATE: out-of-bound access issue
- debian/patches/CVE-2020-25624.patch: check len and frame_number
variables in hw/usb/hcd-ohci.c.
- CVE-2020-25624
* SECURITY UPDATE: infinite loop when a TD list has a loop
- debian/patches/CVE-2020-25625.patch: check for processed TD before
retire in hw/usb/hcd-ohci.c.
- CVE-2020-25625
* SECURITY UPDATE: assertion failure through usb_packet_unmap()
- debian/patches/CVE-2020-25723.patch: check return value of
'usb_packet_map' in hw/usb/hcd-ehci.c.
- CVE-2020-25723
* SECURITY UPDATE: assertion failure
- debian/patches/CVE-2020-27617.patch: remove an assert call in
eth_get_gso_type in net/eth.c.
- CVE-2020-27617
-- Marc Deslauriers <email address hidden> Fri, 20 Nov 2020 08:19:16 -0500
|
| Source diff to previous version |
| CVE-2020-17380 |
heap buffer overflow in sdhci_sdma_transfer_multi_blocks() in hw/sd/sdhci.c |
| CVE-2020-25085 |
QEMU 5.0.0 has a heap-based Buffer Overflow in flatview_read_continue in exec.c because hw/sd/sdhci.c mishandles a write operation in the SDHC_BLKSIZ |
| CVE-2020-25084 |
QEMU 5.0.0 has a use-after-free in hw/usb/hcd-xhci.c because the usb_packet_map return value is not checked. |
| CVE-2020-25624 |
hw/usb/hcd-ohci.c in QEMU 5.0.0 has a stack-based buffer over-read via ... |
| CVE-2020-25625 |
hw/usb/hcd-ohci.c in QEMU 5.0.0 has an infinite loop when a TD list has a loop. |
| CVE-2020-25723 |
assertion failure through usb_packet_unmap() in hw/usb/hcd-ehci.c |
| CVE-2020-27617 |
eth_get_gso_type in net/eth.c in QEMU 4.2.1 allows guest OS users to trigger an assertion failure. A guest can crash the QEMU process via packet data |
|
|
qemu (1:2.5+dfsg-5ubuntu10.47) xenial; urgency=medium
* d/p/u/lp-1894942-*: fix virtio-ccw host/guest notification (LP: #1894942)
-- Christian Ehrhardt <email address hidden> Mon, 21 Sep 2020 15:50:56 +0200
|
| Source diff to previous version |
| 1894942 |
[UBUNTU 20.04] Lost virtio host --\u003e guest notifications cause devices to cease normal operation |
|
|
qemu (1:2.5+dfsg-5ubuntu10.46) xenial-security; urgency=medium
* SECURITY UPDATE: out-of-bounds read/write in USB emulator
- debian/patches/CVE-2020-14364-pre.patch: check RNDIS message length
in hw/usb/core.c.
- debian/patches/CVE-2020-14364.patch: fix setup_len init in
hw/usb/core.c.
- CVE-2020-14364
-- Marc Deslauriers <email address hidden> Tue, 15 Sep 2020 10:09:45 -0400
|
| CVE-2020-14364 |
An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU in versions before 5.2.0. This issue occurs while processing USB pa |
|
About
-
Send Feedback to @ubuntu_updates
