| Description: | Summary:
The remote host is missing an update for the 'qemu' package(s) announced via the MGASA-2015-0397 advisory.
Vulnerability Insight:
Qinghao Tang of QIHU 360 Inc. discovered an infinite loop issue in the
NE2000 NIC emulation. A privileged guest user could use this flaw to
mount a denial of service (QEMU process crash). (CVE-2015-5278)
Qinghao Tang of QIHU 360 Inc. discovered a heap buffer overflow flaw in
the NE2000 NIC emulation. A privileged guest user could use this flaw to
mount a denial of service (QEMU process crash), or potentially to execute
arbitrary code on the host with the privileges of the hosting QEMU
process. (CVE-2015-5279)
A flaw has been discovered in the QEMU emulator built with Virtual Network
Device(virtio-net) support. If the guest's virtio-net driver did not
support big or mergeable receive buffers, an issue could occur while
receiving large packets over the tuntap/ macvtap interfaces. An attacker
on the local network could use this flaw to disable the guest's
networking, the user could send a large number of jumbo frames to the
guest, which could exhaust all receive buffers, and lead to a denial of
service. (CVE-2015-7295)
Affected Software/OS:
'qemu' package(s) on Mageia 5.
Solution:
Please install the updated package(s).
CVSS Score:
7.2
CVSS Vector:
AV:L/AC:L/Au:N/C:C/I:C/A:C
|
