Package "qemu"
| Name: |
qemu
|
Description: |
fast processor emulator
|
| Latest version: |
1:2.5+dfsg-5ubuntu10.46 |
| Release: |
xenial (16.04) |
| Level: |
updates |
| Repository: |
universe |
| Homepage: |
http://www.qemu.org/ |
Links
Download "qemu"
Other versions of "qemu" in Xenial
Packages in group
Deleted packages are displayed in grey.
Changelog
|
qemu (1:2.5+dfsg-5ubuntu10.46) xenial-security; urgency=medium
* SECURITY UPDATE: out-of-bounds read/write in USB emulator
- debian/patches/CVE-2020-14364-pre.patch: check RNDIS message length
in hw/usb/core.c.
- debian/patches/CVE-2020-14364.patch: fix setup_len init in
hw/usb/core.c.
- CVE-2020-14364
-- Marc Deslauriers <email address hidden> Tue, 15 Sep 2020 10:09:45 -0400
|
| Source diff to previous version |
| CVE-2020-14364 |
An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU in versions before 5.2.0. This issue occurs while processing USB pa |
|
|
qemu (1:2.5+dfsg-5ubuntu10.45) xenial-security; urgency=medium
* SECURITY UPDATE: out-of-bounds read and write in sm501
- debian/patches/CVE-2020-12829-pre0.patch: fix hardware cursor.
- debian/patches/CVE-2020-12829-pre1.patch: use values from the pitch
register for 2D operations.
- debian/patches/CVE-2020-12829-pre2.patch: implement negated
destination raster operation mode.
- debian/patches/CVE-2020-12829-pre3.patch: log unimplemented raster
operation modes.
- debian/patches/CVE-2020-12829-pre4.patch: fix support for non-zero
frame buffer start address.
- debian/patches/CVE-2020-12829-pre5.patch: set updated region dirty
after 2D operation.
- debian/patches/CVE-2020-12829-pre6.patch: adjust endianness of pixel
value in rectangle fill.
- debian/patches/CVE-2020-12829-pre7.patch: convert printf +
abort to qemu_log_mask.
- debian/patches/CVE-2020-12829-pre8.patch: shorten long
variable names in sm501_2d_operation.
- debian/patches/CVE-2020-12829-pre9.patch: use BIT(x) macro to
shorten constant.
- debian/patches/CVE-2020-12829-pre10.patch: clean up local
variables in sm501_2d_operation.
- debian/patches/CVE-2020-12829.patch: replace hand written
implementation with pixman where possible.
- debian/patches/CVE-2020-12829-2.patch: optimize small overlapping
blits.
- debian/patches/CVE-2020-12829-3.patch: fix bounds checks.
- debian/patches/CVE-2020-12829-4.patch: drop unneded variable.
- debian/patches/CVE-2020-12829-5.patch: do not allow guest to set
invalid format.
- debian/patches/CVE-2020-12829-6.patch: introduce variable for
commonly used value for better readability.
- debian/patches/CVE-2020-12829-7.patch: fix and optimize overlap
check.
- CVE-2020-12829
* SECURITY UPDATE: out-of-bounds read during sdhci_write() operations
- debian/patches/CVE-2020-13253.patch: do not switch to ReceivingData
if address is invalid in hw/sd/sd.c.
- CVE-2020-13253
* SECURITY UPDATE: out-of-bounds access during es1370_write() operation
- debian/patches/CVE-2020-13361.patch: check total frame count against
current frame in hw/audio/es1370.c.
- CVE-2020-13361
* SECURITY UPDATE: out-of-bounds read via crafted reply_queue_head
- debian/patches/CVE-2020-13362-1.patch: use unsigned type for
reply_queue_head and check index in hw/scsi/megasas.c.
- debian/patches/CVE-2020-13362-2.patch: avoid NULL pointer dereference
in hw/scsi/megasas.c.
- debian/patches/CVE-2020-13362-3.patch: use unsigned type for positive
numeric fields in hw/scsi/megasas.c.
- CVE-2020-13362
* SECURITY UPDATE: NULL pointer dereference related to BounceBuffer
- debian/patches/CVE-2020-13659.patch: set map length to zero when
returning NULL in exec.c, include/exec/memory.h.
- CVE-2020-13659
* SECURITY UPDATE: out-of-bounds access via msi-x mmio operation
- debian/patches/CVE-2020-13754-1.patch: revert accepting mismatching
sizes in memory_region_access_valid in memory.c.
- debian/patches/CVE-2020-13754-2.patch: accept byte and word access to
core ACPI registers in hw/acpi/core.c.
- CVE-2020-13754
* SECURITY UPDATE: invalid memory copy operation via rom_copy
- debian/patches/CVE-2020-13765.patch: add extra check to
hw/core/loader.c.
- CVE-2020-13765
* SECURITY UPDATE: buffer overflow in XGMAC Ethernet controller
- debian/patches/CVE-2020-15863.patch: check bounds in hw/net/xgmac.c.
- CVE-2020-15863
-- Marc Deslauriers <email address hidden> Tue, 11 Aug 2020 14:48:43 -0400
|
| Source diff to previous version |
| CVE-2020-13253 |
sd_wp_addr in hw/sd/sd.c in QEMU 4.2.0 uses an unvalidated address, which leads to an out-of-bounds read during sdhci_write() operations. A guest OS |
| CVE-2020-13361 |
In QEMU 5.0.0 and earlier, es1370_transfer_audio in hw/audio/es1370.c does not properly validate the frame count, which allows guest OS users to trig |
| CVE-2020-13362 |
In QEMU 5.0.0 and earlier, megasas_lookup_frame in hw/scsi/megasas.c has an out-of-bounds read via a crafted reply_queue_head field from a guest OS u |
| CVE-2020-13659 |
address_space_map in exec.c in QEMU 4.2.0 can trigger a NULL pointer dereference related to BounceBuffer. |
| CVE-2020-13754 |
hw/pci/msix.c in QEMU 4.2.0 allows guest OS users to trigger an out-of-bounds access via a crafted address in an msi-x mmio operation. |
| CVE-2020-13765 |
rom_copy() in hw/core/loader.c in QEMU 4.1.0 does not validate the relationship between two addresses, which allows attackers to trigger an invalid m |
| CVE-2020-15863 |
hw/net/xgmac.c in the XGMAC Ethernet controller in QEMU before 07-20-2020 has a buffer overflow. This occurs during packet transmission and affects t |
|
|
qemu (1:2.5+dfsg-5ubuntu10.44) xenial-security; urgency=medium
* SECURITY UPDATE: memory leak in zrle_compress_data
- debian/patches/ubuntu/CVE-2019-20382.patch: fix memory leak when vnc
disconnect in ui/vnc-enc-tight.c, ui/vnc-enc-zrle.inc.c, ui/vnc.c,
ui/vnc.h.
- CVE-2019-20382
* SECURITY UPDATE: use-after-free in ip_reass()
- debian/patches/ubuntu/CVE-2020-1983.patch: fix buffer handling in
slirp/ip_input.c.
- CVE-2020-1983
-- Marc Deslauriers <email address hidden> Thu, 14 May 2020 08:58:54 -0400
|
| Source diff to previous version |
| CVE-2019-20382 |
QEMU 4.1.0 has a memory leak in zrle_compress_data in ui/vnc-enc-zrle.c during a VNC disconnect operation because libz is misused, resulting in a sit |
| CVE-2020-1983 |
A use after free vulnerability in ip_reass() in ip_input.c of libslirp 4.2.0 and prior releases allows crafted packets to cause a denial of service. |
|
|
qemu (1:2.5+dfsg-5ubuntu10.43) xenial-security; urgency=medium
* SECURITY UPDATE: OOB heap access via unexpected iSCSI Server response
- debian/patches/CVE-2020-1711.patch: cap block count from GET LBA
STATUS in block/iscsi.c.
- CVE-2020-1711
* SECURITY UPDATE: heap-based overflow in slirp networking
- debian/patches/CVE-2020-7039-1.patch: fix oob issue in
slirp/tcp_subr.c.
- debian/patches/CVE-2020-7039-2.patch: use correct size while
emulating IRC commands in slirp/tcp_subr.c.
- debian/patches/CVE-2020-7039-3.patch: use correct size while
emulating commands in slirp/tcp_subr.c.
- CVE-2020-7039
* SECURITY UPDATE: buffer overflow via incorrect snprintf return codes
- debian/patches/CVE-2020-8608-1.patch: add slirp_fmt() helpers to
slirp/slirp.c, slirp/slirp.h.
- debian/patches/CVE-2020-8608-2.patch: fix unsafe snprintf() usages in
slirp/tcp_subr.c.
- CVE-2020-8608
-- Marc Deslauriers <email address hidden> Thu, 13 Feb 2020 07:06:36 -0500
|
| Source diff to previous version |
| CVE-2020-1711 |
An out-of-bounds heap buffer access flaw was found in the way the iSCSI Block driver in QEMU versions 2.12.0 before 4.2.1 handled a response coming f |
| CVE-2020-7039 |
tcp_emu in tcp_subr.c in libslirp 4.1.0, as used in QEMU 4.2.0, mismanages memory, as demonstrated by IRC DCC commands in EMU_IRC. This can cause a h |
| CVE-2020-8608 |
In libslirp 4.1.0, as used in QEMU 4.2.0, tcp_subr.c misuses snprintf return values, leading to a buffer overflow in later code. |
|
|
qemu (1:2.5+dfsg-5ubuntu10.42) xenial-security; urgency=medium
* SECURITY UPDATE: infinite loop when executing LSI scsi adapter
emulator scripts
- d/p/CVE-2019-12068.patch: Move the existing loop exit
- CVE-2019-12068
* SECURITY UPDATE: null pointer dereference in qxl display driver
- d/p/CVE-2019-12155.patch: qxl: check release info object
- CVE-2019-12155
* SECURITY UPDATE: qemu-bridge-helper interface name buffer overflow
- d/p/CVE-2019-13164.patch: qemu-bridge-helper: restrict
interface name to IFNAMSIZ
- CVE-2019-13164
* SECURITY UPDATE: heap overflow in slirp
- d/p/CVE-2019-14378.patch: slirp: Fix heap overflow in ip_reass
on big packet input
- CVE-2019-14378
* SECURITY UPDATE: use after free vulnerability in slirp
- d/p/CVE-2019-15890.patch: slirp: ip_reass: Fix use after free
- CVE-2019-15890
-- Steve Beattie <email address hidden> Mon, 04 Nov 2019 13:30:56 -0800
|
| CVE-2019-12068 |
In QEMU 1:4.1-1, 1:2.1+dfsg-12+deb8u6, 1:2.8+dfsg-6+deb9u8, 1:3.1+dfsg-8~deb10u1, 1:3.1+dfsg-8+deb10u2, and 1:2.1+dfsg-12+deb8u12 (fixed), when execu |
| CVE-2019-12155 |
interface_release_resource in hw/display/qxl.c in QEMU 4.0.0 has a NULL pointer dereference. |
| CVE-2019-13164 |
qemu-bridge-helper.c in QEMU 4.0.0 does not ensure that a network interface name (obtained from bridge.conf or a --br=bridge option) is limited to th |
| CVE-2019-14378 |
ip_reass in ip_input.c in libslirp 4.0.0 has a heap-based buffer overflow via a large packet because it mishandles a case involving the first fragmen |
| CVE-2019-15890 |
libslirp 4.0.0, as used in QEMU 4.1.0, has a use-after-free in ip_reass in ip_input.c. |
|
About
-
Send Feedback to @ubuntu_updates
