FEDORA-2015-13358 — security update for qemu

stable

qemu-2.4.0-1.fc23

FEDORA-2015-13358 created by crobinso 9 years ago for Fedora 23

Rebased to version 2.4.0
Support for virtio-gpu, 2D only
Support for virtio-based keyboard/mouse/tablet emulation
x86 support for memory hot-unplug
ACPI v5.1 table support for 'virt' board
CVE-2015-3209: pcnet: multi-tmd buffer overflow in the tx path (bz #1230536)
CVE-2015-3214: i8254: out-of-bounds memory access (bz #1243728)
CVE-2015-5158: scsi stack buffer overflow (bz #1246025)
CVE-2015-5154: ide: atapi: heap overflow during I/O buffer memory access (bz #1247141)
CVE-2015-5165: rtl8139 uninitialized heap memory information leakage to guest (bz #1249755)
CVE-2015-5166: BlockBackend object use after free issue (bz #1249758)
CVE-2015-5745: buffer overflow in virtio-serial (bz #1251160)

How to install

Updates may require up to 24 hours to propagate to mirrors. If the following command doesn't work, please retry later:

sudo dnf upgrade --refresh --advisory=FEDORA-2015-13358

This update has been submitted for testing by crobinso.

9 years ago

taskotron commented 9 years ago

Taskotron: depcheck test PASSED on i386. Result log: https://taskotron.fedoraproject.org/taskmaster//builders/x86_64/builds/115994/steps/runtask/logs/stdio (results are informative only)

taskotron commented 9 years ago

Taskotron: depcheck test PASSED on x86_64. Result log: https://taskotron.fedoraproject.org/taskmaster//builders/x86_64/builds/115994/steps/runtask/logs/stdio (results are informative only)

This update is currently being pushed to the Fedora 23 testing updates repository.

9 years ago

This update has been pushed to testing

9 years ago

This update has reached 3 days in testing and can be pushed to stable now if the maintainer wishes

9 years ago

This update has been submitted for stable by chr77.

9 years ago

chr77 commented & provided feedback 9 years ago

karma

Works for me

This update has been pushed to stable

9 years ago

Please login to add feedback.

Metadata

Type

security

Karma

Signed

Content Type

RPM

Test Gating

None

Autopush Settings

Unstable by Karma

-3

Stable by Karma

disabled

Stable by Time

disabled

Dates

submitted

9 years ago

in testing

9 years ago

in stable

9 years ago

Builds

qemu-2.4.0-1.fc23

BZ#1225882 CVE-2015-3209 qemu: pcnet: multi-tmd buffer overflow in the tx path

BZ#1229640 CVE-2015-3214 qemu/kvm: i8254: out-of-bounds memory access in pit_ioport_read function

BZ#1230536 CVE-2015-3209 qemu: pcnet: multi-tmd buffer overflow in the tx path [fedora-all]

BZ#1243563 CVE-2015-5154 qemu: ide: atapi: heap overflow during I/O buffer memory access

BZ#1243728 CVE-2015-3214 qemu: qemu/kvm: i8254: out-of-bounds memory access in pit_ioport_read function [fedora-all]

BZ#1244332 CVE-2015-5158 Qemu: scsi stack buffer overflow

BZ#1246025 CVE-2015-5158 Qemu: scsi stack buffer overflow [fedora-all]

BZ#1247141 CVE-2015-5154 qemu: ide: atapi: heap overflow during I/O buffer memory access [fedora-all]

BZ#1248760 CVE-2015-5165 Qemu: rtl8139 uninitialized heap memory information leakage to guest (XSA-140)

BZ#1248997 CVE-2015-5166 Qemu: BlockBackend object use after free issue (XSA-139)

BZ#1249755 CVE-2015-5165 Qemu: rtl8139 uninitialized heap memory information leakage to guest [fedora-all]

BZ#1249758 CVE-2015-5166 Qemu: BlockBackend object use after free issue [fedora-all]

BZ#1251157 CVE-2015-5745 kernel: qemu buffer overflow in virtio-serial

BZ#1251160 CVE-2015-5745 qemu: kernel: qemu buffer overflow in virtio-serial [fedora-all]

qemu-2.4.0-1.fc23

Automated Test Results

None