Skip to content
OpenAdvisories
Low ELSA-2019-2607 1 CVE

Low: qemu-kvm security update (Oracle Linux 7)

Published Sep 4, 2019 · Updated Sep 4, 2019

Ecosystem: Oracle Linux

Summary

[1.5.3-167.el7_7.1]
- kvm-qxl-check-release-info-object.patch [bz#1732337]
- kvm-Fix-heap-overflow-in-ip_reass-on-big-packet-input.patch [bz#1734748]
- Resolves: bz#1732337
(CVE-2019-12155 qemu-kvm: QEMU: qxl: null pointer dereference while releasing spice resources [rhel-7] [rhel-7.7.z])
- Resolves: bz#1734748
(CVE-2019-14378 qemu-kvm: QEMU: slirp: heap buffer overflow during packet reassembly [rhel-7.7.z])

Fixed packages 4

ReleasePackageFixed in
Oracle Linux · 7 qemu-img 10:1.5.3-167.el7_7.1
Oracle Linux · 7 qemu-kvm 10:1.5.3-167.el7_7.1
Oracle Linux · 7 qemu-kvm-common 10:1.5.3-167.el7_7.1
Oracle Linux · 7 qemu-kvm-tools 10:1.5.3-167.el7_7.1

Vulnerabilities 1

  • Unscored —
    CVE-2019-12155

    interface_release_resource in hw/display/qxl.c in QEMU 3.1.x through 4.0.0 has a NULL pointer dereference.

    qemu qemu Debian Ubuntu