Summary
[15:3.1.0-3.el7]
- x86: Document CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091 as
fixed (Mark Kanda) [Orabug: 29744956] {CVE-2018-12126} {CVE-2018-12127}
{CVE-2018-12130} {CVE-2019-11091}
[15:3.1.0-2.el7]
- x86: Add mds feature (Karl Heubaum)
- e1000: Never increment the RX undersize count register (Chris Kenna)
- qemu.spec: audioflags set but never passed to configure script (Liam Merwick) [Orabug: 29715562]
- parfait: deal with parfait returning non-zero return value (Liam Merwick) [Orabug: 29715548]
- parfait: use nproc to choose default number of threads (Liam Merwick) [Orabug: 29715548]
- parfait: provide option to upload results (Liam Merwick) [Orabug: 29715548]
- parfait: disable misaligned-access check (Liam Merwick) [Orabug: 29715548]
- Document CVE-2019-8934 and CVE-2019-5008 as fixed (Mark Kanda) [Orabug: 29715605] {CVE-2019-5008} {CVE-2019-8934}
- device_tree.c: Don't use load_image() (Peter Maydell) [Orabug: 29715527] {CVE-2018-20815}
- slirp: check sscanf result when emulating ident (William Bowling) [Orabug: 29715525] {CVE-2019-9824}
- i2c-ddc: fix oob read (Gerd Hoffmann) [Orabug: 29715520] {CVE-2019-3812}
- scsi-generic: avoid possible out-of-bounds access to r->buf (Paolo Bonzini) [Orabug: 29259700] {CVE-2019-6501}
- slirp: check data length while emulating ident function (Prasad J Pandit) [Orabug: 29715755] {CVE-2019-6778}
Fixed packages 11
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 7 | ivshmem-tools | 15:3.1.0-3.el7 |
| Oracle Linux · 7 | qemu | 15:3.1.0-3.el7 |
| Oracle Linux · 7 | qemu-block-gluster | 15:3.1.0-3.el7 |
| Oracle Linux · 7 | qemu-block-iscsi | 15:3.1.0-3.el7 |
| Oracle Linux · 7 | qemu-block-rbd | 15:3.1.0-3.el7 |
| Oracle Linux · 7 | qemu-common | 15:3.1.0-3.el7 |
| Oracle Linux · 7 | qemu-img | 15:3.1.0-3.el7 |
| Oracle Linux · 7 | qemu-kvm | 15:3.1.0-3.el7 |
| Oracle Linux · 7 | qemu-kvm-core | 15:3.1.0-3.el7 |
| Oracle Linux · 7 | qemu-system-aarch64 | 15:3.1.0-3.el7 |
| Oracle Linux · 7 | qemu-system-aarch64-core | 15:3.1.0-3.el7 |
Vulnerabilities 13
-
Medium 5.9
Microarchitectural Fill Buffer Data Sampling (MFBDS): Fill buffers on some microprocessors utilizing speculative execut…
-
Medium 5.6
Microarchitectural Store Buffer Data Sampling (MSBDS): Store buffers on some microprocessors utilizing speculative exec…
-
Medium 5.6
Microarchitectural Load Port Data Sampling (MLPDS): Load ports on some microprocessors utilizing speculative execution …
-
Medium 5.6
Microarchitectural Data Sampling Uncacheable Memory (MDSUM): Uncacheable memory on some microprocessors utilizing specu…
-
Medium 4.4
QEMU, through version 2.10 and through version 3.1.0, is vulnerable to an out-of-bounds read of up to 128 bytes in the …
-
Unscored —
Qemu has integer overflows because IOReadHandler and its associated functions use a signed integer data type for a size…
-
Unscored —
The Bluetooth subsystem in QEMU mishandles negative values for length variables, leading to memory corruption.
-
Unscored —
pvrdma_realize in hw/rdma/vmw/pvrdma_main.c in QEMU has a Memory leak after an initialisation error.
-
Unscored —
In QEMU 3.1.0, load_device_tree in device_tree.c calls the deprecated load_image function, which has a buffer overflow …
-
Unscored —
In QEMU 3.1, scsi_handle_inquiry_reply in hw/scsi/scsi-generic.c allows out-of-bounds write and read operations.
-
Unscored —
In QEMU 3.0.0, tcp_emu in slirp/tcp_subr.c has a heap-based buffer overflow.
-
Unscored —
hw/ppc/spapr.c in QEMU through 3.1.0 allows Information Exposure because the hypervisor shares the /proc/device-tree/sy…
-
Unscored —
tcp_emu in slirp/tcp_subr.c (aka slirp/src/tcp_subr.c) in QEMU 3.0.0 uses uninitialized data in an snprintf call, leadi…