Test ID:	1.3.6.1.4.1.25623.1.0.890939
Category:	Debian Local Security Checks
Title:	Debian: Security Advisory (DLA-939-1)
Summary:	The remote host is missing an update for the Debian 'qemu-kvm' package(s) announced via the DLA-939-1 advisory.
Description:	Summary: The remote host is missing an update for the Debian 'qemu-kvm' package(s) announced via the DLA-939-1 advisory. Vulnerability Insight: Multiple vulnerabilities have been discovered in qemu-kvm, a full virtualization solution on x86 hardware based on Quick Emulator(Qemu). The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2016-9603 qemu-kvm built with the Cirrus CLGD 54xx VGA Emulator and the VNC display driver support is vulnerable to a heap buffer overflow issue. It could occur when Vnc client attempts to update its display after a vga operation is performed by a guest. A privileged user/process inside guest could use this flaw to crash the Qemu process resulting in DoS OR potentially leverage it to execute arbitrary code on the host with privileges of the Qemu process. CVE-2017-7718 qemu-kvm built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. It could occur while copying VGA data via bitblt functions cirrus_bitblt_rop_fwd_transp_ and/or cirrus_bitblt_rop_fwd_. A privileged user inside guest could use this flaw to crash the Qemu process resulting in DoS. CVE-2017-7980 qemu-kvm built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds r/w access issues. It could occur while copying VGA data via various bitblt functions. A privileged user inside guest could use this flaw to crash the Qemu process resulting in DoS OR potentially execute arbitrary code on a host with privileges of Qemu process on the host. For Debian 7 Wheezy, these problems have been fixed in version 1.1.2+dfsg-6+deb7u21. We recommend that you upgrade your qemu-kvm packages. Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: [link moved to references] Affected Software/OS: 'qemu-kvm' package(s) on Debian 7. Solution: Please install the updated package(s). CVSS Score: 9.0 CVSS Vector: AV:N/AC:L/Au:S/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2016-9603 BugTraq ID: 96893 http://www.securityfocus.com/bid/96893 https://security.gentoo.org/glsa/201706-03 https://lists.debian.org/debian-lts-announce/2018/02/msg00005.html https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html RedHat Security Advisories: RHSA-2017:0980 https://access.redhat.com/errata/RHSA-2017:0980 RedHat Security Advisories: RHSA-2017:0981 https://access.redhat.com/errata/RHSA-2017:0981 RedHat Security Advisories: RHSA-2017:0982 https://access.redhat.com/errata/RHSA-2017:0982 RedHat Security Advisories: RHSA-2017:0983 https://access.redhat.com/errata/RHSA-2017:0983 RedHat Security Advisories: RHSA-2017:0984 https://access.redhat.com/errata/RHSA-2017:0984 RedHat Security Advisories: RHSA-2017:0985 https://access.redhat.com/errata/RHSA-2017:0985 RedHat Security Advisories: RHSA-2017:0987 https://access.redhat.com/errata/RHSA-2017:0987 RedHat Security Advisories: RHSA-2017:0988 https://access.redhat.com/errata/RHSA-2017:0988 RedHat Security Advisories: RHSA-2017:1205 https://access.redhat.com/errata/RHSA-2017:1205 RedHat Security Advisories: RHSA-2017:1206 https://access.redhat.com/errata/RHSA-2017:1206 RedHat Security Advisories: RHSA-2017:1441 https://access.redhat.com/errata/RHSA-2017:1441 http://www.securitytracker.com/id/1038023 Common Vulnerability Exposure (CVE) ID: CVE-2017-7718 BugTraq ID: 97957 http://www.securityfocus.com/bid/97957 http://www.openwall.com/lists/oss-security/2017/04/19/4 RedHat Security Advisories: RHSA-2017:1430 https://access.redhat.com/errata/RHSA-2017:1430 RedHat Security Advisories: RHSA-2017:1431 https://access.redhat.com/errata/RHSA-2017:1431 Common Vulnerability Exposure (CVE) ID: CVE-2017-7980 BugTraq ID: 102129 http://www.securityfocus.com/bid/102129 BugTraq ID: 97955 http://www.securityfocus.com/bid/97955 http://www.openwall.com/lists/oss-security/2017/04/21/1 http://ubuntu.com/usn/usn-3289-1
Copyright	Copyright (C) 2018 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.