Red Hat Security Advisory

RHSA-2019:1968

qemu-kvm-rhev security and bug fix update

Released 2019-07-30 · Red Hat rating Important · View on Red Hat →

Fixed in

RHV-M 4.2 qemu-img-rhev-10:2.12.0-18.el7_6.7, qemu-kvm-common-rhev-10:2.12.0-18.el7_6.7, qemu-kvm-rhev-10:2.12.0-18.el7_6.7 +1
RHV-M 4.3 qemu-img-rhev-10:2.12.0-18.el7_6.7, qemu-kvm-common-rhev-10:2.12.0-18.el7_6.7, qemu-kvm-rhev-10:2.12.0-18.el7_6.7 +1
Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts qemu-img-rhev-10:2.12.0-18.el7_6.7, qemu-kvm-common-rhev-10:2.12.0-18.el7_6.7, qemu-kvm-rhev-10:2.12.0-18.el7_6.7 +1

TI-2018-14786 CVE-2018-20815 · GHSA-4g35-fx39-gwjh

MEDIUM 49

In QEMU 3.1.0, load_device_tree in device_tree.c calls the deprecated load_image function, which has a buffer overflow risk.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.04428 Published 2019-05-31 Partial fix CWE-119

TI-2019-04814 CVE-2019-6778 · GHSA-4wxm-q46g-3mcf

LOW 35

In QEMU 3.0.0, tcp_emu in slirp/tcp_subr.c has a heap-based buffer overflow.

CVSS 3.0HIGH 7.8 Local Low privileges No interaction EPSS 0.0061 Published 2019-03-17 Partial fix CWE-787