Important: qemu security update (Amazon Linux 2)

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-9824: tcp_emu in slirp/tcp_subr.c (aka slirp/src/tcp_subr.c) in QEMU 3.0.0 uses uninitialized data in an snprintf call, leading to Information disclosure. 1678515: CVE-2019-9824 QEMU: Slirp: information leakage in tcp_emu() due to uninitialized stack variables CVE-2019-5008: hw/sparc64/sun4u.c in QEMU 3.1.50 is vulnerable to a NULL pointer dereference, which allows the attacker to cause a denial of service via a device driver. 1705915: CVE-2019-5008 QEMU: NULL pointer dereference in hw/sparc64/sun4u.c leading to DoS CVE-2019-12155: interface_release_resource in hw/display/qxl.c in QEMU 4.0.0 has a NULL pointer dereference. 1712670: CVE-2019-12155 QEMU: qxl: null pointer dereference while releasing spice resources CVE-2018-20815: A heap buffer overflow issue was found in the load_device_tree() function of QEMU, which is invoked to load a device tree blob at boot time. It occurs due to device tree size manipulation before buffer allocation, which could overflow a signed int type. A user/process could use this flaw to potentially execute arbitrary code on a host system with privileges of the QEMU process. 1693101: CVE-2018-20815 QEMU: device_tree: heap buffer overflow while loading device tree blob