Skip to content
OpenAdvisories
High ELSA-2016-0083 1 CVE

Important: qemu-kvm security and bug fix update (Oracle Linux 7)

Published Jan 28, 2016 · Updated Jan 28, 2016

Ecosystem: Oracle Linux

Summary

[1.5.3-105.el7_2.3]
- kvm-fw_cfg-add-check-to-validate-current-entry-value-CVE.patch [bz#1298047]
- Resolves: bz#1298047
(CVE-2016-1714 qemu-kvm: Qemu: nvram: OOB r/w access in processing firmware configurations [rhel-7.2.z])

[1.5.3-105.el7_2.2]
- kvm-raw-posix-Fix-.bdrv_co_get_block_status-for-unaligne.patch [bz#1298828]
- Resolves: bz#1298828
([abrt] qemu-img: get_block_status(): qemu-img killed by SIGABRT)

Fixed packages 7

ReleasePackageFixed in
Oracle Linux · 7 libcacard 10:1.5.3-105.el7_2.3
Oracle Linux · 7 libcacard-devel 10:1.5.3-105.el7_2.3
Oracle Linux · 7 libcacard-tools 10:1.5.3-105.el7_2.3
Oracle Linux · 7 qemu-img 10:1.5.3-105.el7_2.3
Oracle Linux · 7 qemu-kvm 10:1.5.3-105.el7_2.3
Oracle Linux · 7 qemu-kvm-common 10:1.5.3-105.el7_2.3
Oracle Linux · 7 qemu-kvm-tools 10:1.5.3-105.el7_2.3

Vulnerabilities 1

  • Unscored —
    CVE-2016-1714

    The (1) fw_cfg_write and (2) fw_cfg_read functions in hw/nvram/fw_cfg.c in QEMU before 2.4, when built with the Firmwar…

    qemu qemu Debian Ubuntu