Summary
[15:3.0.0-4.el7]
- usb-mtp: use O_NOFOLLOW and O_CLOEXEC. (Gerd Hoffmann) [Orabug: 29056673] {CVE-2018-16872}
- pvrdma: add uar_read routine (Prasad J Pandit) {CVE-2018-20191}
- pvrdma: release ring object in case of an error (Prasad J Pandit) [Orabug: 29171822] {CVE-2018-20126}
- pvrdma: check number of pages when creating rings (Prasad J Pandit) [Orabug: 29171821] {CVE-2018-20125}
- pvrdma: check return value from pvrdma_idx_ring_has_ routines (Prasad J Pandit) [Orabug: 29171820] {CVE-2018-20216}
- rdma: remove unused VENDOR_ERR_NO_SGE macro (Prasad J Pandit) [Orabug: 29121181] {CVE-2018-20124}
- rdma: check num_sge does not exceed MAX_SGE (Prasad J Pandit) [Orabug: 29121181] {CVE-2018-20124}
- i386: Add 'stibp' flag name (Eduardo Habkost) [Orabug: 29114828]
- i386: Add some MSR based features on Cascadelake-Server CPU model (Tao Xu) [Orabug: 29029615]
- i386: Update stepping of Cascadelake-Server (Tao Xu) [Orabug: 29029615]
- kvm: Use KVM_GET_MSR_INDEX_LIST for MSR_IA32_ARCH_CAPABILITIES support (Bandan Das) [Orabug: 29029615]
- x86: define a new MSR based feature word -- FEATURE_WORDS_ARCH_CAPABILITIES (Robert Hoo) [Orabug: 29029615]
- x86: Data structure changes to support MSR based features (Robert Hoo) [Orabug: 29029615]
- kvm: Add support to KVM_GET_MSR_FEATURE_INDEX_LIST and KVM_GET_MSRS system ioctl (Robert Hoo) [Orabug: 29029615]
- i386: Add CPUID bit and feature words for IA32_ARCH_CAPABILITIES MSR (Robert Hoo) [Orabug: 29029615]
- i386: Add new MSR indices for IA32_PRED_CMD and IA32_ARCH_CAPABILITIES (Robert Hoo) [Orabug: 29029615]
- Fix compilation issue: 'qapi_event_send_failover_primary_changed' not declared (Mark Kanda) [Orabug: 29121163]
- lsi_scsi: add support for PPR Extended Message (George Kennedy) [Orabug: 28879117]
Fixed packages 13
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 7 | ivshmem-tools | 15:3.0.0-4.el7 |
| Oracle Linux · 7 | qemu | 15:3.0.0-4.el7 |
| Oracle Linux · 7 | qemu-block-gluster | 15:3.0.0-4.el7 |
| Oracle Linux · 7 | qemu-block-iscsi | 15:3.0.0-4.el7 |
| Oracle Linux · 7 | qemu-block-rbd | 15:3.0.0-4.el7 |
| Oracle Linux · 7 | qemu-common | 15:3.0.0-4.el7 |
| Oracle Linux · 7 | qemu-img | 15:3.0.0-4.el7 |
| Oracle Linux · 7 | qemu-kvm | 15:3.0.0-4.el7 |
| Oracle Linux · 7 | qemu-kvm-core | 15:3.0.0-4.el7 |
| Oracle Linux · 7 | qemu-system-aarch64 | 15:3.0.0-4.el7 |
| Oracle Linux · 7 | qemu-system-aarch64-core | 15:3.0.0-4.el7 |
| Oracle Linux · 7 | qemu-system-x86 | 15:3.0.0-4.el7 |
| Oracle Linux · 7 | qemu-system-x86-core | 15:3.0.0-4.el7 |
Vulnerabilities 6
-
Medium 5.0
A flaw was found in qemu Media Transfer Protocol (MTP). The code opening files in usb_mtp_get_object and usb_mtp_get_pa…
-
Unscored —
hw/rdma/rdma_backend.c in QEMU allows guest OS users to trigger out-of-bounds access via a PvrdmaSqWqe ring element wit…
-
Unscored —
hw/rdma/vmw/pvrdma_cmd.c in QEMU allows attackers to cause a denial of service (NULL pointer dereference or excessive m…
-
Unscored —
hw/rdma/vmw/pvrdma_cmd.c in QEMU allows create_cq and create_qp memory leaks because errors are mishandled.
-
Unscored —
hw/rdma/vmw/pvrdma_main.c in QEMU does not implement a read operation (such as uar_read by analogy to uar_write), which…
-
Unscored —
QEMU can have an infinite loop in hw/rdma/vmw/pvrdma_dev_ring.c because return values are not checked (and -1 is mishan…