Summary
[12:2.9.0-17.el7]
- i386: Remove generic SMT thread check (Babu Moger) [Orabug: 28676425]
- pc: Fix typo on PC_COMPAT_2_12 (Eduardo Habkost) [Orabug: 28676425]
- i386: Enable TOPOEXT feature on AMD EPYC CPU (Babu Moger) [Orabug: 28676425]
- net: ignore packet size greater than INT_MAX (Jason Wang) [Orabug: 28762625] {CVE-2018-17963}
- pcnet: fix possible buffer overflow (Jason Wang) [Orabug: 28762617] {CVE-2018-17962}
- rtl8139: fix possible out of bound access (Jason Wang) [Orabug: 28762613] {CVE-2018-17958}
- ne2000: fix possible out of bound access in ne2000_receive (Jason Wang) [Orabug: 28733338] {CVE-2018-10839}
- seccomp: set the seccomp filter to all threads (Marc-Andre Lureau) [Orabug: 28576303] {CVE-2018-15746}
- virtio_net: Introduce VIRTIO_NET_F_STANDBY feature bit to virtio_net (Venu Busireddy) [Orabug: 28497003]
- virtio-net: use 64-bit values for feature flags (Jason Baron) [Orabug: 28497003]
- qga: check bytes count read by guest-file-read (Prasad J Pandit) [Orabug: 28312939] {CVE-2018-12617}
- CVE-2017-2630: Qemu: nbd: oob stack write in client routine drop_sync (Mark Kanda) [Orabug: 28424694] {CVE-2017-2630}
- CVE-2017-2633: Qemu: VNC: memory corruption due to unchecked resolution limit (Mark Kanda) [Orabug: 28424697] {CVE-2017-2633}
- CVE-2017-7471: Qemu: 9p: virtfs allows guest to change filesystem attributes (Mark Kanda) [Orabug: 28407849] {CVE-2017-7471}
- slirp: correct size computation while concatenating mbuf (Prasad J Pandit) [Orabug: 28263244] {CVE-2018-11806}
Fixed packages 10
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 7 | qemu | 12:2.9.0-17.el7 |
| Oracle Linux · 7 | qemu-block-gluster | 12:2.9.0-17.el7 |
| Oracle Linux · 7 | qemu-block-iscsi | 12:2.9.0-17.el7 |
| Oracle Linux · 7 | qemu-block-rbd | 12:2.9.0-17.el7 |
| Oracle Linux · 7 | qemu-common | 12:2.9.0-17.el7 |
| Oracle Linux · 7 | qemu-img | 12:2.9.0-17.el7 |
| Oracle Linux · 7 | qemu-kvm | 12:2.9.0-17.el7 |
| Oracle Linux · 7 | qemu-kvm-core | 12:2.9.0-17.el7 |
| Oracle Linux · 7 | qemu-system-x86 | 12:2.9.0-17.el7 |
| Oracle Linux · 7 | qemu-system-x86-core | 12:2.9.0-17.el7 |
Vulnerabilities 10
-
High 7.5
Qemu has a Buffer Overflow in rtl8139_do_receive in hw/net/rtl8139.c because an incorrect integer data type is used.
-
Medium 6.5
Qemu emulator <= 3.0.0 built with the NE2000 NIC emulation support is vulnerable to an integer overflow, which could le…
-
Medium 5.5
A stack buffer overflow flaw was found in the Quick Emulator (QEMU) before 2.9 built with the Network Block Device (NBD…
-
Medium 5.4
An out-of-bounds memory access issue was found in Quick Emulator (QEMU) before 1.7.2 in the VNC display driver. This fl…
-
Unscored —
Quick Emulator (Qemu) built with the VirtFS, host directory sharing via Plan 9 File System (9pfs) support, is vulnerabl…
-
Unscored —
m_cat in slirp/mbuf.c in Qemu has a heap-based buffer overflow via incoming fragmented datagrams.
-
Unscored —
qmp_guest_file_read in qga/commands-posix.c and qga/commands-win32.c in qemu-ga (aka QEMU Guest Agent) in QEMU 2.12.50 …
-
Unscored —
qemu-seccomp.c in QEMU might allow local OS guest users to cause a denial of service (guest crash) by leveraging mishan…
-
Unscored —
Qemu has a Buffer Overflow in pcnet_receive in hw/net/pcnet.c because an incorrect integer data type is used.
-
Unscored —
qemu_deliver_packet_iov in net/net.c in Qemu accepts packet sizes greater than INT_MAX, which allows attackers to cause…