Red Hat Security AdvisoryRHSA-2018:0816
qemu-kvm security, bug fix, and enhancement update
Released 2018-04-10 · Red Hat rating Low · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) qemu-img-10:1.5.3-156.el7, qemu-kvm-10:1.5.3-156.el7, qemu-kvm-common-10:1.5.3-156.el7 +1
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) qemu-img-10:1.5.3-156.el7, qemu-kvm-10:1.5.3-156.el7, qemu-kvm-common-10:1.5.3-156.el7 +1
- Red Hat Enterprise Linux Server (v. 7) qemu-img-10:1.5.3-156.el7, qemu-kvm-10:1.5.3-156.el7, qemu-kvm-common-10:1.5.3-156.el7 +1
- Red Hat Enterprise Linux Workstation (v. 7) qemu-img-10:1.5.3-156.el7, qemu-kvm-10:1.5.3-156.el7, qemu-kvm-common-10:1.5.3-156.el7 +1
Fixes 5 records
Priority MEDIUM 40
Qemu through 2.10.0 allows remote attackers to cause a memory leak by triggering slow data-channel read operations, related to io/channel-websock.c.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.04272 · Published 2017-10-12 · Partial fix CWE-772
Priority LOW 39
Use-after-free vulnerability in the sofree function in slirp/socket.c in QEMU (aka Quick Emulator) allows attackers to cause a denial of service (QEMU instance crash) by leveraging failure to properly clear ifq_so from p…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.03841 · Published 2017-09-01 · Partial fix CWE-416
Priority LOW 38
VNC server implementation in Quick Emulator (QEMU) 2.11.0 and older was found to be vulnerable to an unbounded memory allocation issue, as it did not throttle the framebuffer updates sent to its client.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.02843 · Published 2018-01-09 · Partial fix CWE-770
Priority LOW 28
The vga_draw_text function in Qemu allows local OS guest privileged users to cause a denial of service (out-of-bounds read and QEMU process crash) by leveraging improper memory address validation.
CVSS 3.1MEDIUM 6.0· Local · High privileges · No interaction · EPSS 0.00683 · Published 2018-01-23 · Partial fix CWE-125
Priority LOW 27
QEMU (aka Quick Emulator), when built with the VGA display emulator support, allows local guest OS privileged users to cause a denial of service (out-of-bounds read and QEMU process crash) via vectors involving display u…
CVSS 3.1MEDIUM 5.5· Local · Low privileges · No interaction · EPSS 0.00953 · Published 2017-09-01 · Partial fix CWE-125
THREATIST.IORead the docs