Skip to content
OpenAdvisories
High ALAS2-2025-3044 1 CVE

Important: qemu security update (Amazon Linux 2)

Published Oct 27, 2025 · Updated Oct 27, 2025

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-11234: A flaw was found in QEMU. If the QIOChannelWebsock object is freed while it is waiting to complete a handshake, a GSource is leaked. This can lead to the callback firing later on and triggering a use-after-free in the use of the channel. This can be abused by a malicious client with network access to the VNC WebSocket port to cause a denial of service during the WebSocket handshake prior to the VNC client authentication.

Fixed packages 28

ReleasePackageFixed in
Amazon Linux · 2 ivshmem-tools 10:3.1.0-8.amzn2.0.21
Amazon Linux · 2 qemu 10:3.1.0-8.amzn2.0.21
Amazon Linux · 2 qemu-audio-alsa 10:3.1.0-8.amzn2.0.21
Amazon Linux · 2 qemu-audio-oss 10:3.1.0-8.amzn2.0.21
Amazon Linux · 2 qemu-audio-pa 10:3.1.0-8.amzn2.0.21
Amazon Linux · 2 qemu-audio-sdl 10:3.1.0-8.amzn2.0.21
Amazon Linux · 2 qemu-block-curl 10:3.1.0-8.amzn2.0.21
Amazon Linux · 2 qemu-block-dmg 10:3.1.0-8.amzn2.0.21
Amazon Linux · 2 qemu-block-iscsi 10:3.1.0-8.amzn2.0.21
Amazon Linux · 2 qemu-block-nfs 10:3.1.0-8.amzn2.0.21
Amazon Linux · 2 qemu-block-rbd 10:3.1.0-8.amzn2.0.21
Amazon Linux · 2 qemu-block-ssh 10:3.1.0-8.amzn2.0.21
Amazon Linux · 2 qemu-common 10:3.1.0-8.amzn2.0.21
Amazon Linux · 2 qemu-debuginfo 10:3.1.0-8.amzn2.0.21
Amazon Linux · 2 qemu-guest-agent 10:3.1.0-8.amzn2.0.21
Amazon Linux · 2 qemu-img 10:3.1.0-8.amzn2.0.21
Amazon Linux · 2 qemu-kvm 10:3.1.0-8.amzn2.0.21
Amazon Linux · 2 qemu-kvm-core 10:3.1.0-8.amzn2.0.21
Amazon Linux · 2 qemu-system-aarch64 10:3.1.0-8.amzn2.0.21
Amazon Linux · 2 qemu-system-aarch64-core 10:3.1.0-8.amzn2.0.21
Amazon Linux · 2 qemu-system-x86 10:3.1.0-8.amzn2.0.21
Amazon Linux · 2 qemu-system-x86-core 10:3.1.0-8.amzn2.0.21
Amazon Linux · 2 qemu-ui-curses 10:3.1.0-8.amzn2.0.21
Amazon Linux · 2 qemu-ui-gtk 10:3.1.0-8.amzn2.0.21
Amazon Linux · 2 qemu-ui-sdl 10:3.1.0-8.amzn2.0.21
Amazon Linux · 2 qemu-user 10:3.1.0-8.amzn2.0.21
Amazon Linux · 2 qemu-user-binfmt 10:3.1.0-8.amzn2.0.21
Amazon Linux · 2 qemu-user-static 10:3.1.0-8.amzn2.0.21

Vulnerabilities 1

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-11234.html