Red Hat Security AdvisoryRHSA-2015:0349
qemu-kvm security, bug fix, and enhancement update
Released 2015-03-05 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) libcacard-10:1.5.3-86.el7, qemu-img-10:1.5.3-86.el7, qemu-kvm-10:1.5.3-86.el7 +2
- Red Hat Enterprise Linux Client Optional (v. 7) libcacard-devel-10:1.5.3-86.el7, libcacard-tools-10:1.5.3-86.el7
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) libcacard-10:1.5.3-86.el7, libcacard-devel-10:1.5.3-86.el7, libcacard-tools-10:1.5.3-86.el7 +4
- Red Hat Enterprise Linux Server (v. 7) libcacard-10:1.5.3-86.el7, qemu-img-10:1.5.3-86.el7, qemu-kvm-10:1.5.3-86.el7 +2
- Red Hat Enterprise Linux Server Optional (v. 7) libcacard-10:1.5.3-86.el7, libcacard-10:1.5.3-86.el7.ppc, libcacard-devel-10:1.5.3-86.el7 +2
- Red Hat Enterprise Linux Workstation (v. 7) libcacard-10:1.5.3-86.el7, qemu-img-10:1.5.3-86.el7, qemu-kvm-10:1.5.3-86.el7 +2
- Red Hat Enterprise Linux Workstation Optional (v. 7) libcacard-devel-10:1.5.3-86.el7, libcacard-tools-10:1.5.3-86.el7
Fixes 4 records
Priority MEDIUM 40
The host_from_stream_offset function in arch_init.c in QEMU, when loading RAM during migration, allows remote attackers to execute arbitrary code via a crafted (1) offset or (2) length value in savevm data.
CVSS 2.0HIGH 7.5· Network · No auth · Interaction — · EPSS 0.04115 · Published 2014-12-12 · Partial fix CWE-20
Priority LOW 29
The set_pixel_format function in ui/vnc.c in QEMU allows remote attackers to cause a denial of service (crash) via a small bytes_per_pixel value.
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.03742 · Published 2014-11-14 · Partial fix CWE-20
Priority LOW 22
Heap-based buffer overflow in the Cirrus VGA emulator (hw/display/cirrus_vga.c) in QEMU before 2.2.0 allows local guest users to execute arbitrary code via vectors related to blit regions.
CVSS 2.0MEDIUM 4.6· Local · No auth · Interaction — · EPSS 0.00603 · Published 2014-12-08 · Partial fix CWE-119
Priority LOW 11
The sosendto function in slirp/udp.c in QEMU before 2.1.2 allows local users to cause a denial of service (NULL pointer dereference) by sending a udp packet with a value of 0 in the source port and address, which trigger…
CVSS 2.0LOW 2.1· Local · No auth · Interaction — · EPSS 0.00405 · Published 2014-11-07 · Partial fix CWE-476
THREATIST.IORead the docs