SB2015081209 - Fedora 22 update for qemu
Published: August 12, 2015 Updated: April 24, 2025
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 7 secuirty vulnerabilities.
1) Buffer overflow (CVE-ID: CVE-2015-3209)
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary code by sending a packet with TXSTATUS_STARTPACKET set and then a crafted packet with TXSTATUS_DEVICEOWNS set.
2) Memory corruption (CVE-ID: CVE-2015-3214)
The vulnerability allows a local user to execute arbitrary code.
The vulnerability exists due to memory corruption error within the pit_ioport_read() function in arch/x86/kvm/i8254.c. A local user can execute arbitrary code.
3) Stack-based buffer overflow (CVE-ID: CVE-2015-5158)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when processing an invalid opcode in a SCSI command descriptor block. A remote unauthenticated attacker can trigger stack-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
4) Heap-based buffer overflow (CVE-ID: CVE-2015-5154)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in Heap-based buffer overflow in the IDE subsystem in QEMU, as used in Xen 4.5.x and earlier, when the container has a CDROM drive enabled,. A remote attacker can use unspecified ATAPI commands. to trigger heap-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
5) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2015-5166)
The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
Use-after-free vulnerability in QEMU in Xen 4.5.x and earlier does not completely unplug emulated block devices, which allows local HVM guest users to gain privileges by unplugging a block device twice.
6) Buffer overflow (CVE-ID: CVE-2015-5745)
The vulnerability allows a remote user to execute arbitrary code on the hypervisor system.
The vulnerability exists due to a boundary error in the send_control_msg function in hw/char/virtio-serial-bus.c in QEMU. A remote user can pass a specially crafted virtio control message, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
7) Information disclosure (CVE-ID: CVE-2015-5165)
The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.
The C+ mode offload emulation in the RTL8139 network card device model in QEMU, as used in Xen 4.5.x and earlier, allows remote attackers to read process heap memory via unspecified vectors.
Remediation
Install update from vendor's website.