FEDORA-2015-13358 — security update for qemu

stable

qemu-2.4.0-1.fc23

FEDORA-2015-13358 created by crobinso 10 years ago for Fedora 23

Rebased to version 2.4.0
Support for virtio-gpu, 2D only
Support for virtio-based keyboard/mouse/tablet emulation
x86 support for memory hot-unplug
ACPI v5.1 table support for 'virt' board
CVE-2015-3209: pcnet: multi-tmd buffer overflow in the tx path (bz #1230536)
CVE-2015-3214: i8254: out-of-bounds memory access (bz #1243728)
CVE-2015-5158: scsi stack buffer overflow (bz #1246025)
CVE-2015-5154: ide: atapi: heap overflow during I/O buffer memory access (bz #1247141)
CVE-2015-5165: rtl8139 uninitialized heap memory information leakage to guest (bz #1249755)
CVE-2015-5166: BlockBackend object use after free issue (bz #1249758)
CVE-2015-5745: buffer overflow in virtio-serial (bz #1251160)

How to install

Updates may require up to 24 hours to propagate to mirrors. If the following command doesn't work, please retry later:

sudo dnf upgrade --refresh --advisory=FEDORA-2015-13358

This update has been submitted for testing by crobinso.

10 years ago

taskotron commented 10 years ago

Taskotron: depcheck test PASSED on i386. Result log: https://taskotron.fedoraproject.org/taskmaster//builders/x86_64/builds/115994/steps/runtask/logs/stdio (results are informative only)

taskotron commented 10 years ago

Taskotron: depcheck test PASSED on x86_64. Result log: https://taskotron.fedoraproject.org/taskmaster//builders/x86_64/builds/115994/steps/runtask/logs/stdio (results are informative only)

This update is currently being pushed to the Fedora 23 testing updates repository.

10 years ago

This update has been pushed to testing

10 years ago

This update has reached 3 days in testing and can be pushed to stable now if the maintainer wishes

10 years ago

This update has been submitted for stable by chr77.

10 years ago

chr77 commented & provided feedback 10 years ago

karma

Works for me

This update has been pushed to stable

10 years ago

Please log in to add feedback.

Metadata

Type

security

Karma

Signed

Content Type

RPM

Test Gating

None

Autopush Settings

Unstable by Karma

-3

Stable by Karma

disabled

Stable by Time

disabled

Dates

submitted

10 years ago

in testing

10 years ago

in stable

10 years ago

Builds

qemu-2.4.0-1.fc23

BZ#1225882 CVE-2015-3209 qemu: pcnet: multi-tmd buffer overflow in the tx path

BZ#1229640 CVE-2015-3214 qemu/kvm: i8254: out-of-bounds memory access in pit_ioport_read function

BZ#1230536 CVE-2015-3209 qemu: pcnet: multi-tmd buffer overflow in the tx path [fedora-all]

BZ#1243563 CVE-2015-5154 qemu: ide: atapi: heap overflow during I/O buffer memory access

BZ#1243728 CVE-2015-3214 qemu: qemu/kvm: i8254: out-of-bounds memory access in pit_ioport_read function [fedora-all]

BZ#1244332 CVE-2015-5158 Qemu: scsi stack buffer overflow

BZ#1246025 CVE-2015-5158 Qemu: scsi stack buffer overflow [fedora-all]

BZ#1247141 CVE-2015-5154 qemu: ide: atapi: heap overflow during I/O buffer memory access [fedora-all]

BZ#1248760 CVE-2015-5165 Qemu: rtl8139 uninitialized heap memory information leakage to guest (XSA-140)

BZ#1248997 CVE-2015-5166 Qemu: BlockBackend object use after free issue (XSA-139)

BZ#1249755 CVE-2015-5165 Qemu: rtl8139 uninitialized heap memory information leakage to guest [fedora-all]

BZ#1249758 CVE-2015-5166 Qemu: BlockBackend object use after free issue [fedora-all]

BZ#1251157 CVE-2015-5745 kernel: qemu buffer overflow in virtio-serial

BZ#1251160 CVE-2015-5745 qemu: kernel: qemu buffer overflow in virtio-serial [fedora-all]

qemu-2.4.0-1.fc23

Automated Test Results

None