Test ID:	1.3.6.1.4.1.25623.1.1.1.2.2016.678
Category:	Debian Local Security Checks
Title:	Debian: Security Advisory (DLA-678-1)
Summary:	The remote host is missing an update for the Debian 'qemu' package(s) announced via the DLA-678-1 advisory.
Description:	Summary: The remote host is missing an update for the Debian 'qemu' package(s) announced via the DLA-678-1 advisory. Vulnerability Insight: Multiple vulnerabilities have been found in QEMU: CVE-2016-8576 Quick Emulator (Qemu) built with the USB xHCI controller emulation support is vulnerable to an infinite loop issue. It could occur while processing USB command ring in xhci_ring_fetch. CVE-2016-8577 Quick Emulator (Qemu) built with the virtio-9p back-end support is vulnerable to a memory leakage issue. It could occur while doing a I/O read operation in v9fs_read() routine. CVE-2016-8578 Quick Emulator (Qemu) built with the virtio-9p back-end support is vulnerable to a null pointer dereference issue. It could occur while doing an I/O vector unmarshalling operation in v9fs_iov_vunmarshal() routine. CVE-2016-8669 Quick Emulator (Qemu) built with the 16550A UART emulation support is vulnerable to a divide by zero issue. It could occur while updating serial device parameters in serial_update_parameters. For Debian 7 Wheezy, these problems have been fixed in version 1.1.2+dfsg-6+deb7u17. We recommend that you upgrade your qemu packages. Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: [link moved to references] Affected Software/OS: 'qemu' package(s) on Debian 7. Solution: Please install the updated package(s). CVSS Score: 2.1 CVSS Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2016-8576 93469 http://www.securityfocus.com/bid/93469 GLSA-201611-11 https://security.gentoo.org/glsa/201611-11 RHSA-2017:2392 https://access.redhat.com/errata/RHSA-2017:2392 RHSA-2017:2408 https://access.redhat.com/errata/RHSA-2017:2408 [debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html [oss-security] 20161010 CVE request Qemu: usb: xHCI: infinite loop vulnerability in xhci_ring_fetch http://www.openwall.com/lists/oss-security/2016/10/10/6 [oss-security] 20161010 Re: CVE request Qemu: usb: xHCI: infinite loop vulnerability in xhci_ring_fetch http://www.openwall.com/lists/oss-security/2016/10/10/12 [qemu-devel] 20161007 Re: [PATCH] usb: xHCI: add check to limit command TRB processing https://lists.gnu.org/archive/html/qemu-devel/2016-10/msg01265.html http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=05f43d44e4bc26611ce25fd7d726e483f73363ce openSUSE-SU-2016:3237 http://lists.opensuse.org/opensuse-updates/2016-12/msg00140.html Common Vulnerability Exposure (CVE) ID: CVE-2016-8577 93473 http://www.securityfocus.com/bid/93473 [debian-lts-announce] 20181130 [SECURITY] [DLA 1599-1] qemu security update https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html [oss-security] 20161010 CVE request: Qemu: 9pfs: host memory leakage in v9fs_read http://www.openwall.com/lists/oss-security/2016/10/10/7 [oss-security] 20161010 Re: CVE request: Qemu: 9pfs: host memory leakage in v9fs_read http://www.openwall.com/lists/oss-security/2016/10/10/13 http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=e95c9a493a5a8d6f969e86c9f19f80ffe6587e19 Common Vulnerability Exposure (CVE) ID: CVE-2016-8578 93474 http://www.securityfocus.com/bid/93474 [oss-security] 20161010 CVE request Qemu: 9pfs: potential NULL dereferencein 9pfs routines http://www.openwall.com/lists/oss-security/2016/10/10/8 [oss-security] 20161010 Re: CVE request Qemu: 9pfs: potential NULL dereferencein 9pfs routines http://www.openwall.com/lists/oss-security/2016/10/10/14 [qemu-devel] 20160927 Re: [PATCH] 9pfs: make unmarshal V9fsString more robust https://lists.gnu.org/archive/html/qemu-devel/2016-09/msg07143.html Common Vulnerability Exposure (CVE) ID: CVE-2016-8669 93563 http://www.securityfocus.com/bid/93563 [oss-security] 20161014 CVE request Qemu: char: divide by zero error in serial_update_parameters http://www.openwall.com/lists/oss-security/2016/10/14/9 [oss-security] 20161015 Re: CVE request Qemu: char: divide by zero error in serial_update_parameters http://www.openwall.com/lists/oss-security/2016/10/15/5 http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=3592fe0c919cf27a81d8e9f9b4f269553418bb01
Copyright	Copyright (C) 2023 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.