Test ID:	1.3.6.1.4.1.25623.1.0.882388
Category:	CentOS Local Security Checks
Title:	CentOS Update for libcacard CESA-2016:0083 centos7
Summary:	Check the version of libcacard
Description:	Summary: Check the version of libcacard Vulnerability Insight: KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on AMD64 and Intel 64 systems. The qemu-kvm package provides the user-space component for running virtual machines using KVM. An out-of-bounds read/write flaw was discovered in the way QEMU's Firmware Configuration device emulation processed certain firmware configurations. A privileged (CAP_SYS_RAWIO) guest user could use this flaw to crash the QEMU process instance or, potentially, execute arbitrary code on the host with privileges of the QEMU process. (CVE-2016-1714) Red Hat would like to thank Donghai Zhu of Alibaba for reporting this issue. This update also fixes the following bugs: * Incorrect handling of the last sector of an image file could trigger an assertion failure in qemu-img. This update changes the handling of the last sector, and no assertion failure occurs. (BZ#1298828) All qemu-kvm users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect. Affected Software/OS: libcacard on CentOS 7 Solution: Please Install the Updated Packages. CVSS Score: 6.9 CVSS Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2016-1714 1034858 http://www.securitytracker.com/id/1034858 80250 http://www.securityfocus.com/bid/80250 DSA-3469 http://www.debian.org/security/2016/dsa-3469 DSA-3470 http://www.debian.org/security/2016/dsa-3470 DSA-3471 http://www.debian.org/security/2016/dsa-3471 GLSA-201604-01 https://security.gentoo.org/glsa/201604-01 RHSA-2016:0081 http://rhn.redhat.com/errata/RHSA-2016-0081.html RHSA-2016:0082 http://rhn.redhat.com/errata/RHSA-2016-0082.html RHSA-2016:0083 http://rhn.redhat.com/errata/RHSA-2016-0083.html RHSA-2016:0084 http://rhn.redhat.com/errata/RHSA-2016-0084.html RHSA-2016:0085 http://rhn.redhat.com/errata/RHSA-2016-0085.html RHSA-2016:0086 http://rhn.redhat.com/errata/RHSA-2016-0086.html RHSA-2016:0087 http://rhn.redhat.com/errata/RHSA-2016-0087.html RHSA-2016:0088 http://rhn.redhat.com/errata/RHSA-2016-0088.html [Qemu-devel] 20160106 [PATCH v2 for v2.3.0] fw_cfg: add check to validate current entry value https://lists.gnu.org/archive/html/qemu-devel/2016-01/msg00428.html [oss-security] 20160111 CVE request Qemu: nvram: OOB r/w access in processing firmware configurations http://www.openwall.com/lists/oss-security/2016/01/11/7 [oss-security] 20160112 Re: CVE request Qemu: nvram: OOB r/w access in processing firmware configurations http://www.openwall.com/lists/oss-security/2016/01/12/10 [oss-security] 20160112 Re: Re: CVE request Qemu: nvram: OOB r/w access in processing firmware configurations http://www.openwall.com/lists/oss-security/2016/01/12/11 http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
Copyright	Copyright (C) 2016 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.