SUSE-SU-2016:2936-1

See a problem?
Import Source
https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2016:2936-1.json
JSON Data
https://api.osv.dev/v1/vulns/SUSE-SU-2016:2936-1
Related
Published
2016-11-29T09:18:32Z
Modified
2016-11-29T09:18:32Z
Summary
Security update for qemu
Details

This update for qemu fixes the following issues:

  • Patch queue updated from https://gitlab.suse.de/virtualization/qemu.git SLE12
  • Change package post script udevadm trigger calls to be device specific (bsc#1002116)
  • Address various security/stability issues
    • Fix OOB access in xlnx.xpx-ethernetlite emulation (CVE-2016-7161 bsc#1001151)
    • Fix OOB access in VMware SVGA emulation (CVE-2016-7170 bsc#998516)
    • Fix DOS in Vmware pv scsi interface (CVE-2016-7421 bsc#999661)
    • Fix DOS in ColdFire Fast Ethernet Controller emulation (CVE-2016-7908 bsc#1002550)
    • Fix DOS in USB xHCI emulation (CVE-2016-8576 bsc#1003878)
    • Fix DOS in virtio-9pfs (CVE-2016-8578 bsc#1003894)
    • Fix DOS in virtio-9pfs (CVE-2016-9105 bsc#1007494)
    • Fix DOS in virtio-9pfs (CVE-2016-8577 bsc#1003893)
    • Plug data leak in virtio-9pfs interface (CVE-2016-9103 bsc#1007454)
    • Fix DOS in virtio-9pfs interface (CVE-2016-9102 bsc#1007450)
    • Fix DOS in virtio-9pfs (CVE-2016-9106 bsc#1007495)
    • Fix DOS in 16550A UART emulation (CVE-2016-8669 bsc#1004707)
    • Fix DOS in PC-Net II emulation (CVE-2016-7909 bsc#1002557)
    • Fix DOS in PRO100 emulation (CVE-2016-9101 bsc#1007391)
    • Fix DOS in RTL8139 emulation (CVE-2016-8910 bsc#1006538)
    • Fix DOS in Intel HDA controller emulation (CVE-2016-8909 bsc#1006536)
    • Fix DOS in virtio-9pfs (CVE-2016-9104 bsc#1007493)
    • Fix DOS in JAZZ RC4030 emulation (CVE-2016-8667 bsc#1004702)
References

Affected packages

SUSE:Linux Enterprise Server for SAP Applications 12 / qemu

Package

Name
qemu
Purl
purl:rpm/suse/qemu&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.0.2-48.25.1

Ecosystem specific 

{
    "binaries": [
        {
            "qemu-tools": "2.0.2-48.25.1",
            "qemu": "2.0.2-48.25.1",
            "qemu-guest-agent": "2.0.2-48.25.1",
            "qemu-block-curl": "2.0.2-48.25.1",
            "qemu-lang": "2.0.2-48.25.1",
            "qemu-ipxe": "1.0.0-48.25.1",
            "qemu-kvm": "2.0.2-48.25.1",
            "qemu-seabios": "1.7.4-48.25.1",
            "qemu-sgabios": "8-48.25.1",
            "qemu-vgabios": "1.7.4-48.25.1",
            "qemu-x86": "2.0.2-48.25.1",
            "qemu-block-rbd": "2.0.2-48.25.1"
        }
    ]
}

SUSE:Linux Enterprise Server 12-LTSS / qemu

Package

Name
qemu
Purl
purl:rpm/suse/qemu&distro=SUSE%20Linux%20Enterprise%20Server%2012-LTSS

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.0.2-48.25.1

Ecosystem specific 

{
    "binaries": [
        {
            "qemu-tools": "2.0.2-48.25.1",
            "qemu-block-curl": "2.0.2-48.25.1",
            "qemu-guest-agent": "2.0.2-48.25.1",
            "qemu-lang": "2.0.2-48.25.1",
            "qemu-seabios": "1.7.4-48.25.1",
            "qemu-kvm": "2.0.2-48.25.1",
            "qemu-vgabios": "1.7.4-48.25.1",
            "qemu-x86": "2.0.2-48.25.1",
            "qemu-s390": "2.0.2-48.25.1",
            "qemu": "2.0.2-48.25.1",
            "qemu-sgabios": "8-48.25.1",
            "qemu-ipxe": "1.0.0-48.25.1",
            "qemu-ppc": "2.0.2-48.25.1",
            "qemu-block-rbd": "2.0.2-48.25.1"
        }
    ]
}