Test ID:	1.3.6.1.4.1.25623.1.0.123533
Category:	Oracle Linux Local Security Checks
Title:	Oracle: Security Advisory (ELSA-2013-1553)
Summary:	The remote host is missing an update for the 'qemu-kvm' package(s) announced via the ELSA-2013-1553 advisory.
Description:	Summary: The remote host is missing an update for the 'qemu-kvm' package(s) announced via the ELSA-2013-1553 advisory. Vulnerability Insight: [qemu-kvm-0.12.1.2-2.415.el6] - kvm-target-i386-don-t-migrate-steal-time-MSR-on-older-ma.patch [bz#1022821] - Resolves: bz#1022821 (live-migration from RHEL6.5 to RHEL6.4.z fails with 'error while loading state for instance 0x0 of device 'cpu'') [0.12.1.2-2.414.el6] - kvm-vmstate-Add-max_version_id-field-to-VMStateDescripti.patch [bz#1016736] - kvm-savevm-Introduce-max_version_id-field-to-SaveStateEn.patch [bz#1016736] - kvm-i386-Set-cpu-section-version_id-to-11.patch [bz#1016736] - kvm-qemu-ga-execute-fsfreeze-freeze-in-reverse-order-of-.patch [bz#1015633] - Resolves: bz#1015633 (qemu-guest-agent: 'guest-fsfreeze-freeze' deadlocks if the guest have mounted disk images) - Resolves: bz#1016736 (CPU migration data has version_id 12 but version 11 format) [0.12.1.2-2.413.el6] - kvm-scsi-Allocate-SCSITargetReq-r-buf-dynamically-CVE-20.patch [bz#1007330] - kvm-scsi-Fix-data-length-SCSI_SENSE_BUF_SIZE.patch [bz#956929] - Resolves: bz#1007330 (CVE-2013-4344 qemu: buffer overflow in scsi_target_emulate_report_luns) - Resolves: bz#956929 (/usr/libexec/qemu-kvm was killed by signal 6 (SIGABRT) when SCSI inquiry is sent to unsupported page inside the KVM guest) [qemu-kvm-0.12.1.2-2.412.el6] - kvm-char-move-backends-io-watch-tag-to-CharDriverState.patch [bz#985205] - kvm-char-use-common-function-to-disable-callbacks-on-cha.patch [bz#985205] - kvm-char-remove-watch-callback-on-chardev-detach-from-fr.patch [bz#985205] - kvm-os-posix-block-SIGUSR2-in-os_setup_early_signal_hand.patch [bz#996814] - Resolves: bz#985205 (QEMU core dumped when do hot-unplug virtio serial port during transfer file between host to guest with virtio serial through TCP socket) - Resolves: bz#996814 (boot image with gluster native mode can't work with attach another device from local file system) [qemu-kvm-0.12.1.2-2.411.el6] - kvm-block-don-t-lose-data-from-last-incomplete-sector.patch [bz#1009370] - kvm-vmdk-fix-cluster-size-check-for-flat-extents.patch [bz#1009370] - Resolves: bz#1009370 (qemu-img refuses to open the vmdk format image its created) [qemu-kvm-0.12.1.2-2.410.el6] - kvm-chardev-fix-pty_chr_timer.patch [bz#995341] - Resolves: bz#995341 (hot-unplug chardev with pty backend caused qemu Segmentation fault) [qemu-kvm-0.12.1.2-2.409.el6] - kvm-exec-Simplify-allocation-of-guest-RAM.patch [bz#867921] - kvm-exec-Don-t-abort-when-we-can-t-allocate-guest-memory.patch [bz#867921] - kvm-block-better-error-message-for-read-only-format-name.patch [bz#999788] - kvm-vmdk-Add-migration-blocker.patch [bz#999358] - kvm-scsi-Fix-scsi_bus_legacy_add_drive-scsi-generic-with.patch [bz#1013478] - kvm-Add-support-for-JSON-pretty-printing.patch [bz#1010610] - kvm-qemu-img-add-dirty-flag-status.patch [bz#1010610] - kvm-qemu-img-make-info-backing-file-output-correct-and-e2.patch [bz#1010610] - kvm-qapi-Add-SnapshotInfo-and-ImageInfo.patch [bz#1010610] - ... [Please see the references for more information on the vulnerabilities] Affected Software/OS: 'qemu-kvm' package(s) on Oracle Linux 6. Solution: Please install the updated package(s). CVSS Score: 7.2 CVSS Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2013-4344 62773 http://www.securityfocus.com/bid/62773 98028 http://osvdb.org/98028 RHSA-2013:1553 http://rhn.redhat.com/errata/RHSA-2013-1553.html RHSA-2013:1754 http://rhn.redhat.com/errata/RHSA-2013-1754.html USN-2092-1 http://www.ubuntu.com/usn/USN-2092-1 [oss-security] 20131002 Xen Security Advisory 65 (CVE-2013-4344) - qemu SCSI REPORT LUNS buffer overflow http://www.openwall.com/lists/oss-security/2013/10/02/2 [qemu-devel] 20131009 [ANNOUNCE] QEMU 1.6.1 Stable released http://article.gmane.org/gmane.comp.emulators.qemu/237191 openSUSE-SU-2014:1279 http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00002.html openSUSE-SU-2014:1281 http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00003.html
Copyright	Copyright (C) 2015 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.