Skip to content
OpenAdvisories
High ELSA-2020-5576 3 CVEs

Important: qemu security update (Oracle Linux 7)

Published Mar 17, 2020 · Updated Mar 17, 2020

Summary

[15:3.1.0-7.el7]
- qemu-img: Add --target-is-zero to convert (David Edmondson)

[15:3.1.0-6.el7]
- qemu.spec: Remove 'BuildRequires: kernel' (Karl Heubaum) [Orabug: 30858754]
- target/i386: add support for MSR_IA32_TSX_CTRL (Paolo Bonzini) [Orabug: 30652327]
- iscsi: Cap block count from GET LBA STATUS (CVE-2020-1711) (Felipe Franciosi) [Orabug: 30807256] {CVE-2020-1711}
- scsi: lsi: exit infinite loop while executing script (CVE-2019-12068) (Paolo Bonzini) [Orabug: 30351703] {CVE-2019-12068}
- lsi: use enum type for s->waiting (Sven Schnelle) {CVE-2019-12068}
- json: Fix % handling when not interpolating (Christophe Fergeau) [Orabug: 30640103]
- qemu.spec: enable have_curl in spec (Dongli Zhang) [Orabug: 30640103]
- Fix heap overflow in ip_reass on big packet input (Samuel Thibault) [Orabug: 30229916] {CVE-2019-14378}
- Make poll_control_msr default 1 (Mark Kanda)
- Remove redundant check for host support of halt polling (Mark Kanda) [Orabug: 30240121]
- Enable '-Werror' compiler flag (Mark Kanda) [Orabug: 30213025]
- qemu-submodule-init: Add Git submodule init script (Karl Heubaum) [Orabug: 30729551]

Fixed packages 10

ReleasePackageFixed in
Oracle Linux · 7 qemu 15:3.1.0-7.el7
Oracle Linux · 7 qemu-block-gluster 15:3.1.0-7.el7
Oracle Linux · 7 qemu-block-iscsi 15:3.1.0-7.el7
Oracle Linux · 7 qemu-block-rbd 15:3.1.0-7.el7
Oracle Linux · 7 qemu-common 15:3.1.0-7.el7
Oracle Linux · 7 qemu-img 15:3.1.0-7.el7
Oracle Linux · 7 qemu-kvm 15:3.1.0-7.el7
Oracle Linux · 7 qemu-kvm-core 15:3.1.0-7.el7
Oracle Linux · 7 qemu-system-x86 15:3.1.0-7.el7
Oracle Linux · 7 qemu-system-x86-core 15:3.1.0-7.el7

Vulnerabilities 3