Red Hat Security Advisory

RHSA-2019:1881

qemu-kvm-ma security and bug fix update

Released 2019-07-29 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux Server (v. 7) qemu-img-ma-10:2.12.0-18.el7_6.4, qemu-kvm-common-ma-10:2.12.0-18.el7_6.4, qemu-kvm-ma-10:2.12.0-18.el7_6.4 +1
Red Hat Enterprise Linux Server Optional (v. 7) qemu-kvm-common-ma-10:2.12.0-18.el7_6.4, qemu-kvm-ma-10:2.12.0-18.el7_6.4, qemu-kvm-tools-ma-10:2.12.0-18.el7_6.4
Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) qemu-img-ma-10:2.12.0-18.el7_6.4, qemu-kvm-common-ma-10:2.12.0-18.el7_6.4, qemu-kvm-ma-10:2.12.0-18.el7_6.4 +1
Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) qemu-img-ma-10:2.12.0-18.el7_6.4, qemu-kvm-common-ma-10:2.12.0-18.el7_6.4, qemu-kvm-ma-10:2.12.0-18.el7_6.4 +1

TI-2018-14786 CVE-2018-20815 · GHSA-4g35-fx39-gwjh

MEDIUM 49

In QEMU 3.1.0, load_device_tree in device_tree.c calls the deprecated load_image function, which has a buffer overflow risk.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.04428 Published 2019-05-31 Partial fix CWE-119