Test ID:	1.3.6.1.4.1.25623.1.0.893099
Category:	Debian Local Security Checks
Title:	Debian: Security Advisory (DLA-3099-1)
Summary:	The remote host is missing an update for the Debian 'qemu' package(s) announced via the DLA-3099-1 advisory.
Description:	Summary: The remote host is missing an update for the Debian 'qemu' package(s) announced via the DLA-3099-1 advisory. Vulnerability Insight: Brief introduction CVE-2020-13253 Description CVE-2020-15469 Description CVE-2020-15859 Description CVE-2020-25084 Description CVE-2020-25085 Description CVE-2020-25624 Description CVE-2020-25625 Description CVE-2020-25723 Description CVE-2020-27617 Description CVE-2020-27821 Description CVE-2020-28916 Description CVE-2020-29129 Description CVE-2020-29443 Description CVE-2020-35504 Description CVE-2020-35505 Description CVE-2021-3392 Description CVE-2021-3416 Description CVE-2021-3507 Description CVE-2021-3527 Description CVE-2021-3582 Description CVE-2021-3607 Description CVE-2021-3608 Description CVE-2021-3682 Description CVE-2021-3713 Description CVE-2021-3748 Description CVE-2021-3930 Description CVE-2021-4206 Description CVE-2021-4207 Description CVE-2021-20181 Description CVE-2021-20196 Description CVE-2021-20203 Description CVE-2021-20221 Description CVE-2021-20257 Description CVE-2022-26354 Description CVE-2022-35414 Description For Debian 10 buster, these problems have been fixed in version 1:3.1+dfsg-8+deb10u9. We recommend that you upgrade your qemu packages. For the detailed security status of qemu please refer to its security tracker page at: [link moved to references] Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: [link moved to references] Affected Software/OS: 'qemu' package(s) on Debian 10. Solution: Please install the updated package(s). CVSS Score: 6.9 CVSS Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2020-13253 https://security.gentoo.org/glsa/202011-09 https://lists.gnu.org/archive/html/qemu-devel/2020-05/msg05835.html https://lists.debian.org/debian-lts-announce/2020/09/msg00013.html https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html https://usn.ubuntu.com/4467-1/ Common Vulnerability Exposure (CVE) ID: CVE-2020-15469 https://lists.gnu.org/archive/html/qemu-devel/2020-06/msg09961.html https://lists.debian.org/debian-lts-announce/2021/02/msg00024.html Common Vulnerability Exposure (CVE) ID: CVE-2020-15859 https://security.gentoo.org/glsa/202208-27 https://bugs.launchpad.net/qemu/+bug/1886362 https://lists.gnu.org/archive/html/qemu-devel/2020-07/msg05304.html https://www.openwall.com/lists/oss-security/2020/07/21/3 Common Vulnerability Exposure (CVE) ID: CVE-2020-25084 https://lists.nongnu.org/archive/html/qemu-devel/2020-08/msg08050.html Common Vulnerability Exposure (CVE) ID: CVE-2020-25085 https://bugs.launchpad.net/qemu/+bug/1892960 https://lists.nongnu.org/archive/html/qemu-devel/2020-09/msg00733.html https://lists.debian.org/debian-lts-announce/2020/11/msg00047.html http://www.openwall.com/lists/oss-security/2021/03/09/1 Common Vulnerability Exposure (CVE) ID: CVE-2020-25624 https://lists.nongnu.org/archive/html/qemu-devel/2020-09/msg05492.html Common Vulnerability Exposure (CVE) ID: CVE-2020-25625 https://lists.nongnu.org/archive/html/qemu-devel/2020-09/msg05905.html Common Vulnerability Exposure (CVE) ID: CVE-2020-25723 https://bugzilla.redhat.com/show_bug.cgi?id=1898579 http://www.openwall.com/lists/oss-security/2020/12/22/1 Common Vulnerability Exposure (CVE) ID: CVE-2020-27617 https://lists.nongnu.org/archive/html/qemu-devel/2020-10/msg05731.html Common Vulnerability Exposure (CVE) ID: CVE-2020-27821 https://bugzilla.redhat.com/show_bug.cgi?id=1902651 http://www.openwall.com/lists/oss-security/2020/12/16/6 Common Vulnerability Exposure (CVE) ID: CVE-2020-28916 https://lists.nongnu.org/archive/html/qemu-devel/2020-11/msg03185.html Common Vulnerability Exposure (CVE) ID: CVE-2020-29129 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/45S5IHSWYITJKMRT23HCHJQDI674AMTQ/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OPCOHDEONMHH6QPJZKRLLCNRGRYODG7X/ https://lists.freedesktop.org/archives/slirp/2020-November/000115.html http://www.openwall.com/lists/oss-security/2020/11/27/1 Common Vulnerability Exposure (CVE) ID: CVE-2020-29443 http://www.openwall.com/lists/oss-security/2021/01/18/2 https://lists.nongnu.org/archive/html/qemu-devel/2020-11/msg04685.html Common Vulnerability Exposure (CVE) ID: CVE-2020-35504 https://bugzilla.redhat.com/show_bug.cgi?id=1909766 https://www.openwall.com/lists/oss-security/2021/04/16/3 http://www.openwall.com/lists/oss-security/2021/04/16/3 Common Vulnerability Exposure (CVE) ID: CVE-2020-35505 https://bugzilla.redhat.com/show_bug.cgi?id=1909769 Common Vulnerability Exposure (CVE) ID: CVE-2021-20181 [debian-lts-announce] 20210218 [SECURITY] [DLA 2560-1] qemu security update [debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update https://bugzilla.redhat.com/show_bug.cgi?id=1927007 https://security.netapp.com/advisory/ntap-20210720-0009/ https://www.zerodayinitiative.com/advisories/ZDI-21-159/ Common Vulnerability Exposure (CVE) ID: CVE-2021-20196 [debian-lts-announce] 20220404 [SECURITY] [DLA 2970-1] qemu security update https://lists.debian.org/debian-lts-announce/2022/04/msg00002.html https://bugs.launchpad.net/qemu/+bug/1912780 https://security.netapp.com/advisory/ntap-20210708-0004/ https://www.openwall.com/lists/oss-security/2021/01/28/1 Common Vulnerability Exposure (CVE) ID: CVE-2021-20203 GLSA-202208-27 [debian-lts-announce] 20210410 [SECURITY] [DLA 2623-1] qemu security update https://lists.debian.org/debian-lts-announce/2021/04/msg00009.html https://bugs.launchpad.net/qemu/+bug/1913873 https://bugzilla.redhat.com/show_bug.cgi?id=1922441 Common Vulnerability Exposure (CVE) ID: CVE-2021-20221 [oss-security] 20210205 CVE-2021-20221 QEMU: aarch64: GIC: out-of-bound heap buffer access via an interrupt ID field http://www.openwall.com/lists/oss-security/2021/02/05/1 https://bugzilla.redhat.com/show_bug.cgi?id=1924601 https://security.netapp.com/advisory/ntap-20210708-0005/ Common Vulnerability Exposure (CVE) ID: CVE-2021-20257 https://bugzilla.redhat.com/show_bug.cgi?id=1930087 https://github.com/qemu/qemu/commit/3de46e6fc489c52c9431a8a832ad8170a7569bd8 https://lists.gnu.org/archive/html/qemu-devel/2021-02/msg07428.html https://security.netapp.com/advisory/ntap-20220425-0003/ https://www.openwall.com/lists/oss-security/2021/02/25/2 Common Vulnerability Exposure (CVE) ID: CVE-2021-3392 https://bugs.launchpad.net/qemu/+bug/1914236 https://bugzilla.redhat.com/show_bug.cgi?id=1924042 Common Vulnerability Exposure (CVE) ID: CVE-2021-3416 https://bugzilla.redhat.com/show_bug.cgi?id=1932827 https://security.netapp.com/advisory/ntap-20210507-0002/ https://www.openwall.com/lists/oss-security/2021/02/26/1 Common Vulnerability Exposure (CVE) ID: CVE-2021-3507 https://bugzilla.redhat.com/show_bug.cgi?id=1951118 https://security.netapp.com/advisory/ntap-20210528-0005/ Common Vulnerability Exposure (CVE) ID: CVE-2021-3527 [debian-lts-announce] 20210902 [SECURITY] [DLA 2753-1] qemu security update https://lists.debian.org/debian-lts-announce/2021/09/msg00000.html https://bugzilla.redhat.com/show_bug.cgi?id=1955695 https://gitlab.com/qemu-project/qemu/-/commit/05a40b172e4d691371534828078be47e7fff524c https://gitlab.com/qemu-project/qemu/-/commit/7ec54f9eb62b5d177e30eb8b1cad795a5f8d8986 https://security.netapp.com/advisory/ntap-20210708-0008/ https://www.openwall.com/lists/oss-security/2021/05/05/5 Common Vulnerability Exposure (CVE) ID: CVE-2021-3582 https://bugzilla.redhat.com/show_bug.cgi?id=1966266 Common Vulnerability Exposure (CVE) ID: CVE-2021-3607 https://bugzilla.redhat.com/show_bug.cgi?id=1973349 https://lists.gnu.org/archive/html/qemu-devel/2021-06/msg07925.html Common Vulnerability Exposure (CVE) ID: CVE-2021-3608 https://bugzilla.redhat.com/show_bug.cgi?id=1973383 https://lists.gnu.org/archive/html/qemu-devel/2021-06/msg07926.html Common Vulnerability Exposure (CVE) ID: CVE-2021-3682 Debian Security Information: DSA-4980 (Google Search) https://www.debian.org/security/2021/dsa-4980 https://bugzilla.redhat.com/show_bug.cgi?id=1989651 Common Vulnerability Exposure (CVE) ID: CVE-2021-3713 https://bugzilla.redhat.com/show_bug.cgi?id=1994640 Common Vulnerability Exposure (CVE) ID: CVE-2021-3748 https://bugzilla.redhat.com/show_bug.cgi?id=1998514 https://github.com/qemu/qemu/commit/bedd7e93d01961fcb16a97ae45d93acf357e11f6 https://lists.nongnu.org/archive/html/qemu-devel/2021-09/msg00388.html https://ubuntu.com/security/CVE-2021-3748 Common Vulnerability Exposure (CVE) ID: CVE-2021-3930 https://bugzilla.redhat.com/show_bug.cgi?id=2020588 Common Vulnerability Exposure (CVE) ID: CVE-2021-4206 Debian Security Information: DSA-5133 (Google Search) https://www.debian.org/security/2022/dsa-5133 https://bugzilla.redhat.com/show_bug.cgi?id=2036998 https://starlabs.sg/advisories/21-4206/ Common Vulnerability Exposure (CVE) ID: CVE-2021-4207 https://bugzilla.redhat.com/show_bug.cgi?id=2036966 https://starlabs.sg/advisories/21-4207/ Common Vulnerability Exposure (CVE) ID: CVE-2022-26354 DSA-5133 https://gitlab.com/qemu-project/qemu/-/commit/8d1b247f3748ac4078524130c6d7ae42b6140aaf Common Vulnerability Exposure (CVE) ID: CVE-2022-35414 https://github.com/qemu/qemu/blob/f200ff158d5abcb974a6b597a962b6b2fbea2b06/softmmu/physmem.c https://github.com/qemu/qemu/blob/v7.0.0/include/exec/cpu-all.h#L145-L148 https://github.com/qemu/qemu/commit/3517fb726741c109cae7995f9ea46f0cab6187d6#diff-83c563ed6330dc5d49876f1116e7518b5c16654bbc6e9b4ea8e28f5833d576fcR482 https://github.com/qemu/qemu/commit/3517fb726741c109cae7995f9ea46f0cab6187d6#diff-83c563ed6330dc5d49876f1116e7518b5c16654bbc6e9b4ea8e28f5833d576fcR482.aa https://github.com/qemu/qemu/commit/418ade7849ce7641c0f7333718caf5091a02fd4c https://gitlab.com/qemu-project/qemu/-/issues/1065 https://sick.codes/sick-2022-113 https://www.mail-archive.com/qemu-devel@nongnu.org/msg895266.html https://www.qemu.org/docs/master/system/security.html#non-virtualization-use-case
Copyright	Copyright (C) 2022 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.