Debian Security Advisory
DLA-1927-1 qemu -- LTS security update
- Date Reported:
- 20 Sep 2019
- Affected Packages:
- qemu
- Vulnerable:
- Yes
- Security database references:
- In the Debian bugtracking system: Bug 826151, Bug 832619, Bug 864219, Bug 929353, Bug 931351, Bug 933741, Bug 933742, Bug 939868, Bug 939869.
In Mitre's CVE dictionary: CVE-2016-5126, CVE-2016-5403, CVE-2017-9375, CVE-2019-12068, CVE-2019-12155, CVE-2019-13164, CVE-2019-14378, CVE-2019-15890. - More information:
-
Several vulnerabilities were found in QEMU, a fast processor emulator (notably used in KVM and Xen HVM virtualization).
- CVE-2016-5126
Heap-based buffer overflow in the iscsi_aio_ioctl function in block/iscsi.c in QEMU allows local guest OS users to cause a denial of service (QEMU process crash) or possibly execute arbitrary code via a crafted iSCSI asynchronous I/O ioctl call.
- CVE-2016-5403
The virtqueue_pop function in hw/virtio/virtio.c in QEMU allows local guest OS administrators to cause a denial of service (memory consumption and QEMU process crash) by submitting requests without waiting for completion.
- CVE-2017-9375
QEMU, when built with USB xHCI controller emulator support, allows local guest OS privileged users to cause a denial of service (infinite recursive call) via vectors involving control transfer descriptors sequencing.
- CVE-2019-12068
QEMU scsi disk backend: lsi: exit infinite loop while executing script
- CVE-2019-12155
interface_release_resource in hw/display/qxl.c in QEMU has a NULL pointer dereference.
- CVE-2019-13164
qemu-bridge-helper.c in QEMU does not ensure that a network interface name (obtained from bridge.conf or a --br=bridge option) is limited to the IFNAMSIZ size, which can lead to an ACL bypass.
- CVE-2019-14378
ip_reass in ip_input.c in libslirp 4.0.0 has a heap-based buffer overflow via a large packet because it mishandles a case involving the first fragment.
- CVE-2019-15890
libslirp 4.0.0, as used in QEMU, has a use-after-free in ip_reass in ip_input.c.
For Debian 8
Jessie
, these problems have been fixed in version 1:2.1+dfsg-12+deb8u12.We recommend that you upgrade your qemu packages.
Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS
- CVE-2016-5126