Test ID:	1.3.6.1.4.1.25623.1.0.123329
Category:	Oracle Linux Local Security Checks
Title:	Oracle: Security Advisory (ELSA-2014-1075)
Summary:	The remote host is missing an update for the 'qemu-kvm' package(s) announced via the ELSA-2014-1075 advisory.
Description:	Summary: The remote host is missing an update for the 'qemu-kvm' package(s) announced via the ELSA-2014-1075 advisory. Vulnerability Insight: [0.12.1.2-2.415.el6_5.14] - The commit for zrelease .13 was incomplete, the changes to qemu-kvm.spec did not include the '%patchNNNN -p1' lines for patches 4647 through 4655, so although the patch files themselves were committed, the srpm build did not pick them up. In addition, the commit log did not describe the patches. This commit corrects these problems and bumps the zrelease to .14. [0.12.1.2-2.415.el6_5.13] - kvm-block-Create-proper-size-file-for-disk-mirror.patch [bz#1109715] - kvm-block-Fix-bdrv_is_allocated-return-value.patch [bz#1109715] - kvm-scsi-bus-prepare-scsi_req_new-for-introduction-of-pars.patch [bz#1125131] - kvm-scsi-bus-introduce-parse_cdb-in-SCSIDeviceClass-and-SC.patch [bz#1125131] - kvm-scsi-block-extract-scsi_block_is_passthrough.patch [bz#1125131] - kvm-scsi-block-scsi-generic-implement-parse_cdb.patch [bz#1125131] - kvm-virtio-scsi-implement-parse_cdb.patch [bz#1125131] - kvm-virtio-scsi-Fix-reset-callback-for-virtio-scsi.patch [bz#1123271] - kvm-virtio-scsi-add-ioeventfd-support.patch [bz#1123271] - Resolves: bz#1109715 (live incremental migration of vm with common shared base, size(disk) > size(base) transfers unallocated sectors, explodes disk on dest) - Resolves: bz#1123271 (Enable ioenventfd for virtio-scsi-pci) - Resolves: bz#1125131 ([FJ6.5 Bug] SCSI command issued from KVM guest doesn't reach target device) [0.12.1.2-2.415.el6_5.12] - kvm-qcow-Return-real-error-code-in-qcow_open.txt [bz#1097225] - kvm-qcow1-Make-padding-in-the-header-explicit.txt [bz#1097225] - kvm-qcow1-Check-maximum-cluster-size.txt [bz#1097225] - kvm-qcow1-Validate-L2-table-size-CVE-2014-0222.txt [bz#1097225] - kvm-qcow1-Validate-image-size-CVE-2014-0223.txt [bz#1097234] - kvm-qcow1-Stricter-backing-file-length-check.txt [bz#1097234] - Resolves: bz#1097225 (CVE-2014-0222 qemu-kvm: Qemu: qcow1: validate L2 table size to avoid integer overflows [rhel-6.5.z]) - Resolves: bz#1097234 (CVE-2014-0223 qemu-kvm: Qemu: qcow1: validate image size to avoid out-of-bounds memory access [rhel-6.5.z]) [0.12.1.2-2.415.el6_5.11] - kvm-block-Fix-bdrv_is_allocated-for-short-backing-files.patch [bz#1109715] - Resolves: bz#1109715 (live incremental migration of vm with common shared base, size(disk) > size(base) transfers unallocated sectors, explodes disk on dest) Affected Software/OS: 'qemu-kvm' package(s) on Oracle Linux 6. Solution: Please install the updated package(s). CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2014-0222 67357 http://www.securityfocus.com/bid/67357 DSA-3044 http://www.debian.org/security/2014/dsa-3044 FEDORA-2014-6288 http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133345.html FEDORA-2014-6970 http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134053.html SUSE-SU-2015:0929 http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00021.html [Qemu-devel] 20140512 [PATCH 3/5] qcow1: Validate L2 table size (CVE-2014-0222) https://lists.gnu.org/archive/html/qemu-devel/2014-05/msg02155.html [Qemu-stable] 20140723 [ANNOUNCE] QEMU 1.7.2 Stable released http://lists.nongnu.org/archive/html/qemu-stable/2014-07/msg00187.html openSUSE-SU-2015:1965 http://lists.opensuse.org/opensuse-updates/2015-11/msg00063.html Common Vulnerability Exposure (CVE) ID: CVE-2014-0223 67391 http://www.securityfocus.com/bid/67391 [Qemu-devel] 20140512 [PATCH 4/5] qcow1: Validate image size (CVE-2014-0223) https://lists.gnu.org/archive/html/qemu-devel/2014-05/msg02156.html
Copyright	Copyright (C) 2015 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.