QEMU - Security Update
Summary
DSA-3469-1: qemu - security update. Affects qemu versions < 1.1.2+dfsg-6a+deb7u12. Fixed in 1.1.2+dfsg-6a+deb7u12. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
QEMU is a full virtualization solution designed for x86 hardware. It provides a platform for running virtual machines on various operating systems. QEMU supports a wide range of devices and emulates their functionality to enable virtualization. However, several vulnerabilities have been discovered in QEMU that could lead to denial-of-service attacks, application crashes, arbitrary code execution, information leaks, and memory corruption.
Vulnerability Detail
The following vulnerabilities have been identified in QEMU:
-
CVE-2015-7295: This vulnerability affects the Virtual Network Device support and can result in denial-of-service due to resource exhaustion when receiving large packets.
-
CVE-2015-7504: The PC-Net II ethernet controller is vulnerable to a heap-based buffer overflow, which can lead to denial-of-service or arbitrary code execution through application crashes.
-
CVE-2015-7512: Similar to CVE-2015-7504, the PC-Net II ethernet controller is vulnerable to a buffer overflow, resulting in denial-of-service or arbitrary code execution through application crashes.
-
CVE-2015-8345: The eepro100 emulator contains a flaw that can cause an infinite loop when processing Command Blocks, leading to denial-of-service through application crashes.
-
CVE-2015-8504: The VNC display driver support is vulnerable to an arithmetic exception flaw, resulting in denial-of-service through application crashes.
-
CVE-2015-8558: The USB EHCI emulation support contains a flaw that can cause an infinite loop during communication between the host controller and a device driver, leading to denial-of-service through resource exhaustion.
-
CVE-2015-8743: The NE2000 emulator is vulnerable to an out-of-bound read/write access issue, potentially resulting in information leaks or memory corruption.
-
CVE-2016-1568: The IDE AHCI emulation support is vulnerable to a use-after-free issue, leading to denial-of-service or arbitrary code execution through application crashes.
-
CVE-2016-1714: The Firmware Configuration emulation support is vulnerable to an out-of-bound read/write access issue, resulting in denial-of-service or arbitrary code execution through application crashes.
-
CVE-2016-1922: 32-bit Windows guests support is vulnerable to a null pointer dereference issue, leading to denial-of-service through application crashes.
How To Fix
Minimum fixed version
1.1.2+dfsg-6a+deb7u12
This is the first release that contains the fix.
sudo apt-get install --only-upgrade qemuTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
QEMU is a powerful virtualization solution, but it is not immune to vulnerabilities. It is crucial to keep your QEMU packages up to date to mitigate the risks associated with these vulnerabilities. If you need further assistance or support in addressing these vulnerabilities, please contact DevNack.com.
See every vulnerability recorded for qemu →
FAQ
QEMU is a full virtualization solution that allows running virtual machines on various operating systems.
The vulnerabilities in QEMU include denial-of-service, application crashes, arbitrary code execution, information leaks, and memory corruption.
These vulnerabilities can be exploited by sending specially crafted packets or input to the affected components in QEMU.
The impact of these vulnerabilities can range from denial-of-service attacks to arbitrary code execution, potentially compromising the security and stability of the virtualized environment.
To fix these vulnerabilities, it is recommended to upgrade your QEMU packages to the latest version that includes the necessary patches and fixes.
Related vulnerabilities
Recent vulnerabilities recorded for qemu.
