Test ID:	1.3.6.1.4.1.25623.1.0.871789
Category:	Red Hat Local Security Checks
Title:	RedHat Update for qemu-kvm RHSA-2017:0621-01
Summary:	The remote host is missing an update for the 'qemu-kvm'; package(s) announced via the referenced advisory.
Description:	Summary: The remote host is missing an update for the 'qemu-kvm' package(s) announced via the referenced advisory. Vulnerability Insight: Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM. Security Fix(es): * An integer overflow flaw and an out-of-bounds read flaw were found in the way QEMU's VGA emulator set certain VGA registers while in VBE mode. A privileged guest user could use this flaw to crash the QEMU process instance. (CVE-2016-3712) Red Hat would like to thank Zuozhi Fzz (Alibaba Inc.) for reporting this issue. Additional Changes: For detailed information on changes in this release, see the Red Hat Enterprise Linux 6.9 Release Notes and Red Hat Enterprise Linux 6.9 Technical Notes linked from the References section. Affected Software/OS: qemu-kvm on Red Hat Enterprise Linux Desktop (v. 6), Red Hat Enterprise Linux Server (v. 6), Red Hat Enterprise Linux Workstation (v. 6) Solution: Please Install the Updated Packages. CVSS Score: 2.1 CVSS Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2016-3712 1035794 http://www.securitytracker.com/id/1035794 90314 http://www.securityfocus.com/bid/90314 DSA-3573 http://www.debian.org/security/2016/dsa-3573 RHSA-2016:2585 http://rhn.redhat.com/errata/RHSA-2016-2585.html RHSA-2017:0621 http://rhn.redhat.com/errata/RHSA-2017-0621.html USN-2974-1 http://www.ubuntu.com/usn/USN-2974-1 [Qemu-devel] 20160509 [PULL 5/5] vga: make sure vga register setup for vbe stays intact (CVE-2016-3712). https://lists.gnu.org/archive/html/qemu-devel/2016-05/msg01196.html [oss-security] 20160509 CVE-2016-3712 Qemu: vga: out-of-bounds read and integer overflow issues http://www.openwall.com/lists/oss-security/2016/05/09/4 http://support.citrix.com/article/CTX212736 http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html http://xenbits.xen.org/xsa/advisory-179.html
Copyright	Copyright (C) 2017 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.