ID de Prueba:	1.3.6.1.4.1.25623.1.0.871553
Categoría:	Red Hat Local Security Checks
Título:	RedHat Update for qemu-kvm RHSA-2016:0083-01
Resumen:	The remote host is missing an update for the 'qemu-kvm'; package(s) announced via the referenced advisory.
Descripción:	Summary: The remote host is missing an update for the 'qemu-kvm' package(s) announced via the referenced advisory. Vulnerability Insight: KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on AMD64 and Intel 64 systems. The qemu-kvm package provides the user-space component for running virtual machines using KVM. An out-of-bounds read/write flaw was discovered in the way QEMU's Firmware Configuration device emulation processed certain firmware configurations. A privileged (CAP_SYS_RAWIO) guest user could use this flaw to crash the QEMU process instance or, potentially, execute arbitrary code on the host with privileges of the QEMU process. (CVE-2016-1714) Red Hat would like to thank Donghai Zhu of Alibaba for reporting this issue. This update also fixes the following bugs: * Incorrect handling of the last sector of an image file could trigger an assertion failure in qemu-img. This update changes the handling of the last sector, and no assertion failure occurs. (BZ#1298828) All qemu-kvm users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect. Affected Software/OS: qemu-kvm on Red Hat Enterprise Linux Server (v. 7) Solution: Please Install the Updated Packages. CVSS Score: 6.9 CVSS Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2016-1714 1034858 http://www.securitytracker.com/id/1034858 80250 http://www.securityfocus.com/bid/80250 DSA-3469 http://www.debian.org/security/2016/dsa-3469 DSA-3470 http://www.debian.org/security/2016/dsa-3470 DSA-3471 http://www.debian.org/security/2016/dsa-3471 GLSA-201604-01 https://security.gentoo.org/glsa/201604-01 RHSA-2016:0081 http://rhn.redhat.com/errata/RHSA-2016-0081.html RHSA-2016:0082 http://rhn.redhat.com/errata/RHSA-2016-0082.html RHSA-2016:0083 http://rhn.redhat.com/errata/RHSA-2016-0083.html RHSA-2016:0084 http://rhn.redhat.com/errata/RHSA-2016-0084.html RHSA-2016:0085 http://rhn.redhat.com/errata/RHSA-2016-0085.html RHSA-2016:0086 http://rhn.redhat.com/errata/RHSA-2016-0086.html RHSA-2016:0087 http://rhn.redhat.com/errata/RHSA-2016-0087.html RHSA-2016:0088 http://rhn.redhat.com/errata/RHSA-2016-0088.html [Qemu-devel] 20160106 [PATCH v2 for v2.3.0] fw_cfg: add check to validate current entry value https://lists.gnu.org/archive/html/qemu-devel/2016-01/msg00428.html [oss-security] 20160111 CVE request Qemu: nvram: OOB r/w access in processing firmware configurations http://www.openwall.com/lists/oss-security/2016/01/11/7 [oss-security] 20160112 Re: CVE request Qemu: nvram: OOB r/w access in processing firmware configurations http://www.openwall.com/lists/oss-security/2016/01/12/10 [oss-security] 20160112 Re: Re: CVE request Qemu: nvram: OOB r/w access in processing firmware configurations http://www.openwall.com/lists/oss-security/2016/01/12/11 http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
Copyright	Copyright (C) 2016 Greenbone AG

Esta es sólo una de 145615 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.