| Description: | Summary:
The remote host is missing an update for the Debian 'qemu' package(s) announced via the DLA-1497-1 advisory.
Vulnerability Insight:
Several vulnerabilities were found in qemu, a fast processor emulator:
CVE-2015-8666
Heap-based buffer overflow in QEMU when built with the Q35-chipset-based PC system emulator
CVE-2016-2198
Null pointer dereference in ehci_caps_write in the USB EHCI support that may result in denial of service
CVE-2016-6833
Use after free while writing in the vmxnet3 device that could be used to cause a denial of service
CVE-2016-6835
Buffer overflow in vmxnet_tx_pkt_parse_headers() in vmxnet3 device that could result in denial of service
CVE-2016-8576
Infinite loop vulnerability in xhci_ring_fetch in the USB xHCI support
CVE-2016-8667 / CVE-2016-8669 Divide by zero errors in set_next_tick in the JAZZ RC4030 chipset emulator, and in serial_update_parameters of some serial devices, that could result in denial of service
CVE-2016-9602
Improper link following with VirtFS
CVE-2016-9603
Heap buffer overflow via vnc connection in the Cirrus CLGD 54xx VGA emulator support
CVE-2016-9776
Infinite loop while receiving data in the ColdFire Fast Ethernet Controller emulator
CVE-2016-9907
Memory leakage in the USB redirector usb-guest support
CVE-2016-9911
Memory leakage in ehci_init_transfer in the USB EHCI support
CVE-2016-9914 / CVE-2016-9915 / CVE-2016-9916 Plan 9 File System (9pfs): add missing cleanup operation in FileOperations, in the handle backend and in the proxy backend driver
CVE-2016-9921 / CVE-2016-9922 Divide by zero in cirrus_do_copy in the Cirrus CLGD 54xx VGA Emulator support
CVE-2016-10155
Memory leak in hw/watchdog/wdt_i6300esb.c allowing local guest OS privileged users to cause a denial of service via a large number of device unplug operations.
CVE-2017-2615 / CVE-2017-2620 / CVE-2017-18030 / CVE-2018-5683 / CVE-2017-7718 Out-of-bounds access issues in the Cirrus CLGD 54xx VGA emulator support, that could result in denial of service
CVE-2017-5525 / CVE-2017-5526 Memory leakage issues in the ac97 and es1370 device emulation
CVE-2017-5579
Most memory leakage in the 16550A UART emulation
CVE-2017-5667
Out-of-bounds access during multi block SDMA transfer in the SDHCI emulation support.
CVE-2017-5715
Mitigations against the Spectre v2 vulnerability. For more information please refer to [link moved to references]
CVE-2017-5856
Memory leak in the MegaRAID SAS 8708EM2 Host Bus Adapter emulation support
CVE-2017-5973 / CVE-2017-5987 / CVE-2017-6505 Infinite loop issues in the USB xHCI, in the transfer mode register of the SDHCI protocol, and the USB ohci_service_ed_list
CVE-2017-7377
9pfs: host memory leakage via v9fs_create
CVE-2017-7493
Improper access control issues in the host directory sharing via 9pfs support.
CVE-2017-7980
Heap-based buffer overflow in the Cirrus VGA device that could allow local guest OS users to execute arbitrary code or cause a denial of service
CVE-2017-8086
9pfs: host memory leakage via ... [Please see the references for more information on the vulnerabilities]
Affected Software/OS:
'qemu' package(s) on Debian 8.
Solution:
Please install the updated package(s).
CVSS Score:
9.0
CVSS Vector:
AV:N/AC:L/Au:S/C:C/I:C/A:C
|
