Red Hat Security AdvisoryRHSA-2018:1113
qemu-kvm-rhev security and bug fix update
Released 2018-04-11 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat OpenStack Platform 10.0 qemu-img-rhev-10:2.10.0-21.el7, qemu-kvm-common-rhev-10:2.10.0-21.el7, qemu-kvm-rhev-10:2.10.0-21.el7 +1
- Red Hat OpenStack Platform 11.0 qemu-img-rhev-10:2.10.0-21.el7, qemu-kvm-common-rhev-10:2.10.0-21.el7, qemu-kvm-rhev-10:2.10.0-21.el7 +1
- Red Hat OpenStack Platform 12.0 qemu-img-rhev-10:2.10.0-21.el7, qemu-kvm-common-rhev-10:2.10.0-21.el7, qemu-kvm-rhev-10:2.10.0-21.el7 +1
- Red Hat OpenStack Platform 8.0 (Liberty) qemu-img-rhev-10:2.10.0-21.el7, qemu-kvm-common-rhev-10:2.10.0-21.el7, qemu-kvm-rhev-10:2.10.0-21.el7 +1
- Red Hat OpenStack Platform 9.0 qemu-img-rhev-10:2.10.0-21.el7, qemu-kvm-common-rhev-10:2.10.0-21.el7, qemu-kvm-rhev-10:2.10.0-21.el7 +1
Fixes 8 records
Priority MEDIUM 56
A stack-based buffer overflow vulnerability was found in NBD server implementation in qemu before 2.11 allowing a client to request an export name of size up to 4096 bytes, which in fact should be limited to 256 bytes, c…
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.11931 · Published 2018-07-27 · Partial fix CWE-121
Priority MEDIUM 43
The Network Block Device (NBD) server in Quick Emulator (QEMU) before 2.11 is vulnerable to a denial of service issue.
CVSS 3.0HIGH 8.6· Network · No auth · No interaction · EPSS 0.03282 · Published 2018-07-27 · Partial fix CWE-400
Priority MEDIUM 40
Qemu through 2.10.0 allows remote attackers to cause a memory leak by triggering slow data-channel read operations, related to io/channel-websock.c.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.04272 · Published 2017-10-12 · Partial fix CWE-772
Priority LOW 39
Use-after-free vulnerability in the sofree function in slirp/socket.c in QEMU (aka Quick Emulator) allows attackers to cause a denial of service (QEMU instance crash) by leveraging failure to properly clear ifq_so from p…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.03841 · Published 2017-09-01 · Partial fix CWE-416
Priority LOW 38
VNC server implementation in Quick Emulator (QEMU) 2.11.0 and older was found to be vulnerable to an unbounded memory allocation issue, as it did not throttle the framebuffer updates sent to its client.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.02843 · Published 2018-01-09 · Partial fix CWE-770
Priority LOW 34
The vga display update in mis-calculated the region for the dirty bitmap snapshot in case split screen mode is used causing a denial of service (assertion failure) in the cpu_physical_memory_snapshot_get_dirty function.
CVSS 3.0MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.02959 · Published 2017-08-29 · Partial fix CWE-617
Priority LOW 28
The vga_draw_text function in Qemu allows local OS guest privileged users to cause a denial of service (out-of-bounds read and QEMU process crash) by leveraging improper memory address validation.
CVSS 3.1MEDIUM 6.0· Local · High privileges · No interaction · EPSS 0.00683 · Published 2018-01-23 · Partial fix CWE-125
Priority LOW 27
QEMU (aka Quick Emulator), when built with the VGA display emulator support, allows local guest OS privileged users to cause a denial of service (out-of-bounds read and QEMU process crash) via vectors involving display u…
CVSS 3.1MEDIUM 5.5· Local · Low privileges · No interaction · EPSS 0.00953 · Published 2017-09-01 · Partial fix CWE-125
THREATIST.IORead the docs