| Description: | Summary:
The remote host is missing an update for the Debian 'qemu' package(s) announced via the DSA-4213-1 advisory.
Vulnerability Insight:
Several vulnerabilities were discovered in qemu, a fast processor emulator.
CVE-2017-15038
Tuomas Tynkkynen discovered an information leak in 9pfs.
CVE-2017-15119
Eric Blake discovered that the NBD server insufficiently restricts large option requests, resulting in denial of service.
CVE-2017-15124
Daniel Berrange discovered that the integrated VNC server insufficiently restricted memory allocation, which could result in denial of service.
CVE-2017-15268
A memory leak in websockets support may result in denial of service.
CVE-2017-15289
Guoxiang Niu discovered an OOB write in the emulated Cirrus graphics adaptor which could result in denial of service.
CVE-2017-16845
Cyrille Chatras discovered an information leak in PS/2 mouse and keyboard emulation which could be exploited during instance migration.
CVE-2017-17381
Dengzhan Heyuandong Bijunhua and Liweichao discovered that an implementation error in the virtio vring implementation could result in denial of service.
CVE-2017-18043
Eric Blake discovered an integer overflow in an internally used macro which could result in denial of service.
CVE-2018-5683
Jiang Xin and Lin ZheCheng discovered an OOB memory access in the emulated VGA adaptor which could result in denial of service.
CVE-2018-7550
Cyrille Chatras discovered that an OOB memory write when using multiboot could result in the execution of arbitrary code.
This update also backports a number of mitigations against the Spectre v2 vulnerability affecting modern CPUs ( CVE-2017-5715). For additional information please refer to [link moved to references]
For the stable distribution (stretch), these problems have been fixed in version 1:2.8+dfsg-6+deb9u4.
We recommend that you upgrade your qemu packages.
For the detailed security status of qemu please refer to its security tracker page at: [link moved to references]
Affected Software/OS:
'qemu' package(s) on Debian 9.
Solution:
Please install the updated package(s).
CVSS Score:
7.8
CVSS Vector:
AV:N/AC:L/Au:N/C:N/I:N/A:C
|
