Vulnerability   
Search   
    Search 219043 CVE descriptions
and 99761 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:1.3.6.1.4.1.25623.1.0.871866
Category:Red Hat Local Security Checks
Title:RedHat Update for qemu-kvm RHSA-2017:1856-01
Summary:The remote host is missing an update for the 'qemu-kvm'; package(s) announced via the referenced advisory.
Description:Summary:
The remote host is missing an update for the 'qemu-kvm'
package(s) announced via the referenced advisory.

Vulnerability Insight:
Kernel-based Virtual Machine (KVM) is a full
virtualization solution for Linux on a variety of architectures. The qemu-kvm
package provides the user-space component for running virtual machines that use
KVM. Security Fix(es): * An out-of-bounds memory access issue was found in Quick
Emulator (QEMU) in the VNC display driver. This flaw could occur while
refreshing the VNC display surface area in the 'vnc_refresh_server_surface'. A
user inside a guest could use this flaw to crash the QEMU process.
(CVE-2017-2633) * An integer overflow flaw was found in Quick Emulator (QEMU) in
the CCID Card device support. The flaw could occur while passing messages via
command/response packets to and from the host. A privileged user inside a guest
could use this flaw to crash the QEMU process. (CVE-2017-5898) * An information
exposure flaw was found in Quick Emulator (QEMU) in Task Priority Register (TPR)
optimizations for 32-bit Windows guests. The flaw could occur while accessing
TPR. A privileged user inside a guest could use this issue to read portions of
the host memory. (CVE-2016-4020) Red Hat would like to thank Li Qiang (360.cn
Inc.) for reporting CVE-2017-5898 and Donghai Zdh (Alibaba Inc.) for reporting
CVE-2016-4020. Additional Changes: For detailed information on changes in this
release, see the Red Hat Enterprise Linux 7.4 Release Notes linked from the
References section.

Affected Software/OS:
qemu-kvm on Red Hat Enterprise Linux Server (v. 7)

Solution:
Please Install the Updated Packages.

CVSS Score:
4.0

CVSS Vector:
AV:N/AC:L/Au:S/C:N/I:N/A:P

Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2016-4020
BugTraq ID: 86067
http://www.securityfocus.com/bid/86067
https://security.gentoo.org/glsa/201609-01
https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
https://lists.gnu.org/archive/html/qemu-devel/2016-04/msg01118.html
https://lists.gnu.org/archive/html/qemu-devel/2016-04/msg01106.html
RedHat Security Advisories: RHSA-2017:1856
https://access.redhat.com/errata/RHSA-2017:1856
RedHat Security Advisories: RHSA-2017:2392
https://access.redhat.com/errata/RHSA-2017:2392
RedHat Security Advisories: RHSA-2017:2408
https://access.redhat.com/errata/RHSA-2017:2408
http://www.ubuntu.com/usn/USN-2974-1
Common Vulnerability Exposure (CVE) ID: CVE-2017-2633
BugTraq ID: 96417
http://www.securityfocus.com/bid/96417
http://www.openwall.com/lists/oss-security/2017/02/23/1
RedHat Security Advisories: RHSA-2017:1205
https://access.redhat.com/errata/RHSA-2017:1205
RedHat Security Advisories: RHSA-2017:1206
https://access.redhat.com/errata/RHSA-2017:1206
RedHat Security Advisories: RHSA-2017:1441
https://access.redhat.com/errata/RHSA-2017:1441
Common Vulnerability Exposure (CVE) ID: CVE-2017-5898
BugTraq ID: 96112
http://www.securityfocus.com/bid/96112
https://security.gentoo.org/glsa/201702-28
http://www.openwall.com/lists/oss-security/2017/02/07/3
SuSE Security Announcement: SUSE-SU-2017:0570 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00045.html
SuSE Security Announcement: SUSE-SU-2017:0582 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00048.html
CopyrightCopyright (C) 2017 Greenbone Networks GmbH

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.




© 1998-2021 E-Soft Inc. All rights reserved.