Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2015-3456 (GCVE-0-2015-3456)
Vulnerability from cvelistv5 – Published: 2015-05-13 18:00 – Updated: 2024-08-06 05:47
VLAI
EPSS
Summary
The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a denial of service (out-of-bounds write and guest crash) or possibly execute arbitrary code via the (1) FD_CMD_READ_ID, (2) FD_CMD_DRIVE_SPECIFICATION_COMMAND, or other unspecified commands, aka VENOM.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
49 references
Date Public
2015-05-13 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T05:47:57.892Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "37053",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/37053/"
},
{
"name": "1032306",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1032306"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html"
},
{
"name": "SUSE-SU-2015:0889",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00009.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://kb.juniper.net/JSA10783"
},
{
"name": "DSA-3259",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2015/dsa-3259"
},
{
"name": "SUSE-SU-2015:0929",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00021.html"
},
{
"name": "SUSE-SU-2015:0896",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00042.html"
},
{
"name": "GLSA-201612-27",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201612-27"
},
{
"name": "RHSA-2015:0999",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2015-0999.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10118"
},
{
"name": "SUSE-SU-2015:0923",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00018.html"
},
{
"name": "RHSA-2015:1001",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2015-1001.html"
},
{
"name": "HPSBMU03336",
"tags": [
"vendor-advisory",
"x_refsource_HP",
"x_transferred"
],
"url": "http://marc.info/?l=bugtraq\u0026m=143229451215900\u0026w=2"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://support.citrix.com/article/CTX201078"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://xenbits.xen.org/xsa/advisory-133.html"
},
{
"name": "RHSA-2015:1003",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2015-1003.html"
},
{
"name": "openSUSE-SU-2015:0893",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00013.html"
},
{
"name": "1032917",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1032917"
},
{
"name": "HPSBMU03349",
"tags": [
"vendor-advisory",
"x_refsource_HP",
"x_transferred"
],
"url": "http://marc.info/?l=bugtraq\u0026m=143387998230996\u0026w=2"
},
{
"name": "RHSA-2015:0998",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2015-0998.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.suse.com/security/cve/CVE-2015-3456.html"
},
{
"name": "openSUSE-SU-2015:0894",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00014.html"
},
{
"name": "FEDORA-2015-8249",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158072.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bto.bluecoat.com/security-advisory/sa95"
},
{
"name": "RHSA-2015:1004",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2015-1004.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://venom.crowdstrike.com/"
},
{
"name": "RHSA-2015:1011",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2015-1011.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://support.lenovo.com/us/en/product_security/venom"
},
{
"name": "SUSE-SU-2015:0927",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00019.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=e907746266721f305d67bc0718795fedee2e824c"
},
{
"name": "GLSA-201604-03",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201604-03"
},
{
"name": "RHSA-2015:1002",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2015-1002.html"
},
{
"name": "USN-2608-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "http://www.ubuntu.com/usn/USN-2608-1"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://securityblog.redhat.com/2015/05/13/venom-dont-get-bitten/"
},
{
"name": "openSUSE-SU-2015:0983",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00001.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA10693"
},
{
"name": "1032311",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1032311"
},
{
"name": "SSRT102076",
"tags": [
"vendor-advisory",
"x_refsource_HP",
"x_transferred"
],
"url": "http://marc.info/?l=bugtraq\u0026m=143229451215900\u0026w=2"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-438937.htm"
},
{
"name": "DSA-3262",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2015/dsa-3262"
},
{
"name": "GLSA-201602-01",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201602-01"
},
{
"name": "openSUSE-SU-2015:1400",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2015-08/msg00021.html"
},
{
"name": "74640",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/74640"
},
{
"name": "DSA-3274",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2015/dsa-3274"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.fortiguard.com/advisory/2015-05-19-cve-2015-3456-venom-vulnerability"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://access.redhat.com/articles/1444903"
},
{
"name": "RHSA-2015:1000",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2015-1000.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisories/1128-security-advisory-10"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2015-05-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a denial of service (out-of-bounds write and guest crash) or possibly execute arbitrary code via the (1) FD_CMD_READ_ID, (2) FD_CMD_DRIVE_SPECIFICATION_COMMAND, or other unspecified commands, aka VENOM."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-11-05T16:32:45.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "37053",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/37053/"
},
{
"name": "1032306",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1032306"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html"
},
{
"name": "SUSE-SU-2015:0889",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00009.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://kb.juniper.net/JSA10783"
},
{
"name": "DSA-3259",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2015/dsa-3259"
},
{
"name": "SUSE-SU-2015:0929",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00021.html"
},
{
"name": "SUSE-SU-2015:0896",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00042.html"
},
{
"name": "GLSA-201612-27",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201612-27"
},
{
"name": "RHSA-2015:0999",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2015-0999.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10118"
},
{
"name": "SUSE-SU-2015:0923",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00018.html"
},
{
"name": "RHSA-2015:1001",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2015-1001.html"
},
{
"name": "HPSBMU03336",
"tags": [
"vendor-advisory",
"x_refsource_HP"
],
"url": "http://marc.info/?l=bugtraq\u0026m=143229451215900\u0026w=2"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://support.citrix.com/article/CTX201078"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://xenbits.xen.org/xsa/advisory-133.html"
},
{
"name": "RHSA-2015:1003",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2015-1003.html"
},
{
"name": "openSUSE-SU-2015:0893",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00013.html"
},
{
"name": "1032917",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1032917"
},
{
"name": "HPSBMU03349",
"tags": [
"vendor-advisory",
"x_refsource_HP"
],
"url": "http://marc.info/?l=bugtraq\u0026m=143387998230996\u0026w=2"
},
{
"name": "RHSA-2015:0998",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2015-0998.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.suse.com/security/cve/CVE-2015-3456.html"
},
{
"name": "openSUSE-SU-2015:0894",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00014.html"
},
{
"name": "FEDORA-2015-8249",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158072.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bto.bluecoat.com/security-advisory/sa95"
},
{
"name": "RHSA-2015:1004",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2015-1004.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://venom.crowdstrike.com/"
},
{
"name": "RHSA-2015:1011",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2015-1011.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://support.lenovo.com/us/en/product_security/venom"
},
{
"name": "SUSE-SU-2015:0927",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00019.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=e907746266721f305d67bc0718795fedee2e824c"
},
{
"name": "GLSA-201604-03",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201604-03"
},
{
"name": "RHSA-2015:1002",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2015-1002.html"
},
{
"name": "USN-2608-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "http://www.ubuntu.com/usn/USN-2608-1"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://securityblog.redhat.com/2015/05/13/venom-dont-get-bitten/"
},
{
"name": "openSUSE-SU-2015:0983",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00001.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA10693"
},
{
"name": "1032311",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1032311"
},
{
"name": "SSRT102076",
"tags": [
"vendor-advisory",
"x_refsource_HP"
],
"url": "http://marc.info/?l=bugtraq\u0026m=143229451215900\u0026w=2"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-438937.htm"
},
{
"name": "DSA-3262",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2015/dsa-3262"
},
{
"name": "GLSA-201602-01",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201602-01"
},
{
"name": "openSUSE-SU-2015:1400",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2015-08/msg00021.html"
},
{
"name": "74640",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/74640"
},
{
"name": "DSA-3274",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2015/dsa-3274"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.fortiguard.com/advisory/2015-05-19-cve-2015-3456-venom-vulnerability"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://access.redhat.com/articles/1444903"
},
{
"name": "RHSA-2015:1000",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2015-1000.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisories/1128-security-advisory-10"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2015-3456",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a denial of service (out-of-bounds write and guest crash) or possibly execute arbitrary code via the (1) FD_CMD_READ_ID, (2) FD_CMD_DRIVE_SPECIFICATION_COMMAND, or other unspecified commands, aka VENOM."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "37053",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/37053/"
},
{
"name": "1032306",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1032306"
},
{
"name": "http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html",
"refsource": "CONFIRM",
"url": "http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html"
},
{
"name": "SUSE-SU-2015:0889",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00009.html"
},
{
"name": "https://kb.juniper.net/JSA10783",
"refsource": "CONFIRM",
"url": "https://kb.juniper.net/JSA10783"
},
{
"name": "DSA-3259",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2015/dsa-3259"
},
{
"name": "SUSE-SU-2015:0929",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00021.html"
},
{
"name": "SUSE-SU-2015:0896",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00042.html"
},
{
"name": "GLSA-201612-27",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201612-27"
},
{
"name": "RHSA-2015:0999",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2015-0999.html"
},
{
"name": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10118",
"refsource": "CONFIRM",
"url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10118"
},
{
"name": "SUSE-SU-2015:0923",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00018.html"
},
{
"name": "RHSA-2015:1001",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2015-1001.html"
},
{
"name": "HPSBMU03336",
"refsource": "HP",
"url": "http://marc.info/?l=bugtraq\u0026m=143229451215900\u0026w=2"
},
{
"name": "http://support.citrix.com/article/CTX201078",
"refsource": "CONFIRM",
"url": "http://support.citrix.com/article/CTX201078"
},
{
"name": "http://xenbits.xen.org/xsa/advisory-133.html",
"refsource": "CONFIRM",
"url": "http://xenbits.xen.org/xsa/advisory-133.html"
},
{
"name": "RHSA-2015:1003",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2015-1003.html"
},
{
"name": "openSUSE-SU-2015:0893",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00013.html"
},
{
"name": "1032917",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1032917"
},
{
"name": "HPSBMU03349",
"refsource": "HP",
"url": "http://marc.info/?l=bugtraq\u0026m=143387998230996\u0026w=2"
},
{
"name": "RHSA-2015:0998",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2015-0998.html"
},
{
"name": "https://www.suse.com/security/cve/CVE-2015-3456.html",
"refsource": "CONFIRM",
"url": "https://www.suse.com/security/cve/CVE-2015-3456.html"
},
{
"name": "openSUSE-SU-2015:0894",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00014.html"
},
{
"name": "FEDORA-2015-8249",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158072.html"
},
{
"name": "https://bto.bluecoat.com/security-advisory/sa95",
"refsource": "CONFIRM",
"url": "https://bto.bluecoat.com/security-advisory/sa95"
},
{
"name": "RHSA-2015:1004",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2015-1004.html"
},
{
"name": "http://venom.crowdstrike.com/",
"refsource": "MISC",
"url": "http://venom.crowdstrike.com/"
},
{
"name": "RHSA-2015:1011",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2015-1011.html"
},
{
"name": "https://support.lenovo.com/us/en/product_security/venom",
"refsource": "CONFIRM",
"url": "https://support.lenovo.com/us/en/product_security/venom"
},
{
"name": "SUSE-SU-2015:0927",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00019.html"
},
{
"name": "http://git.qemu.org/?p=qemu.git;a=commitdiff;h=e907746266721f305d67bc0718795fedee2e824c",
"refsource": "CONFIRM",
"url": "http://git.qemu.org/?p=qemu.git;a=commitdiff;h=e907746266721f305d67bc0718795fedee2e824c"
},
{
"name": "GLSA-201604-03",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201604-03"
},
{
"name": "RHSA-2015:1002",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2015-1002.html"
},
{
"name": "USN-2608-1",
"refsource": "UBUNTU",
"url": "http://www.ubuntu.com/usn/USN-2608-1"
},
{
"name": "https://securityblog.redhat.com/2015/05/13/venom-dont-get-bitten/",
"refsource": "CONFIRM",
"url": "https://securityblog.redhat.com/2015/05/13/venom-dont-get-bitten/"
},
{
"name": "openSUSE-SU-2015:0983",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00001.html"
},
{
"name": "http://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA10693",
"refsource": "CONFIRM",
"url": "http://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA10693"
},
{
"name": "1032311",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1032311"
},
{
"name": "SSRT102076",
"refsource": "HP",
"url": "http://marc.info/?l=bugtraq\u0026m=143229451215900\u0026w=2"
},
{
"name": "http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-438937.htm",
"refsource": "CONFIRM",
"url": "http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-438937.htm"
},
{
"name": "DSA-3262",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2015/dsa-3262"
},
{
"name": "GLSA-201602-01",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201602-01"
},
{
"name": "openSUSE-SU-2015:1400",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2015-08/msg00021.html"
},
{
"name": "74640",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/74640"
},
{
"name": "DSA-3274",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2015/dsa-3274"
},
{
"name": "http://www.fortiguard.com/advisory/2015-05-19-cve-2015-3456-venom-vulnerability",
"refsource": "CONFIRM",
"url": "http://www.fortiguard.com/advisory/2015-05-19-cve-2015-3456-venom-vulnerability"
},
{
"name": "https://access.redhat.com/articles/1444903",
"refsource": "CONFIRM",
"url": "https://access.redhat.com/articles/1444903"
},
{
"name": "RHSA-2015:1000",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2015-1000.html"
},
{
"name": "https://www.arista.com/en/support/advisories-notices/security-advisories/1128-security-advisory-10",
"refsource": "MISC",
"url": "https://www.arista.com/en/support/advisories-notices/security-advisories/1128-security-advisory-10"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2015-3456",
"datePublished": "2015-05-13T18:00:00.000Z",
"dateReserved": "2015-04-29T00:00:00.000Z",
"dateUpdated": "2024-08-06T05:47:57.892Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2015-3456",
"date": "2026-05-28",
"epss": "0.242",
"percentile": "0.96164"
},
"fkie_nvd": {
"configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"2.3.0\", \"matchCriteriaId\": \"ABF17A18-4BE8-41B7-B50C-F4A137B3B2F1\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:redhat:enterprise_virtualization:3.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"105130E9-D48E-4FB8-A715-E6438EC7E744\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:redhat:openstack:4.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"1802FDB8-C919-4D5E-A8AD-4C5B72525090\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:redhat:openstack:5.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B152EDF3-3140-4343-802F-F4F1C329F5C3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:redhat:openstack:6.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"31EC146C-A6F6-4C0D-AF87-685286262DAA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:redhat:openstack:7.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"9DAA72A4-AC7D-4544-89D4-5B07961D5A95\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:redhat:enterprise_linux:5:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"AA9B3CC0-DF1C-4A86-B2A3-A9D428A5A6E6\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"2F6AB192-9D7D-4A9A-8995-E53A9DE9EAFC\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"142AD0DD-4CF3-4D74-9442-459CE3347E3A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:xen:xen:4.5.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"90CCECD0-C0F9-45A8-8699-64428637EBCA\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a denial of service (out-of-bounds write and guest crash) or possibly execute arbitrary code via the (1) FD_CMD_READ_ID, (2) FD_CMD_DRIVE_SPECIFICATION_COMMAND, or other unspecified commands, aka VENOM.\"}, {\"lang\": \"es\", \"value\": \"Floppy Disk Controller (FDC) en QEMU, utilizado en Xen 4.5.x y anteriores y KVM, permite a usuarios locales invitados causar una denegaci\\u00f3n de servicio (escritura fuera de rango y ca\\u00edda del invitado) o posiblemente ejecutar c\\u00f3digo arbitrario a trav\\u00e9s de (1) FD_CMD_READ_ID, (2) FD_CMD_DRIVE_SPECIFICATION_COMMAND, u otros comandos sin especificar, tambi\\u00e9n conocido como VENOM.\"}]",
"evaluatorComment": "Though the VENOM vulnerability is also agnostic of the guest operating system, an attacker (or an attacker\u2019s malware) would need to have administrative or root privileges in the guest operating system in order to exploit VENOM",
"id": "CVE-2015-3456",
"lastModified": "2024-11-21T02:29:27.637",
"metrics": "{\"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:A/AC:L/Au:S/C:C/I:C/A:C\", \"baseScore\": 7.7, \"accessVector\": \"ADJACENT_NETWORK\", \"accessComplexity\": \"LOW\", \"authentication\": \"SINGLE\", \"confidentialityImpact\": \"COMPLETE\", \"integrityImpact\": \"COMPLETE\", \"availabilityImpact\": \"COMPLETE\"}, \"baseSeverity\": \"HIGH\", \"exploitabilityScore\": 5.1, \"impactScore\": 10.0, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
"published": "2015-05-13T18:59:00.157",
"references": "[{\"url\": \"http://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=e907746266721f305d67bc0718795fedee2e824c\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA10693\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158072.html\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00009.html\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00013.html\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00014.html\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00018.html\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00019.html\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00021.html\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00042.html\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00001.html\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://lists.opensuse.org/opensuse-updates/2015-08/msg00021.html\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://marc.info/?l=bugtraq\u0026m=143229451215900\u0026w=2\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://marc.info/?l=bugtraq\u0026m=143229451215900\u0026w=2\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://marc.info/?l=bugtraq\u0026m=143387998230996\u0026w=2\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://rhn.redhat.com/errata/RHSA-2015-0998.html\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://rhn.redhat.com/errata/RHSA-2015-0999.html\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://rhn.redhat.com/errata/RHSA-2015-1000.html\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://rhn.redhat.com/errata/RHSA-2015-1001.html\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://rhn.redhat.com/errata/RHSA-2015-1002.html\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://rhn.redhat.com/errata/RHSA-2015-1003.html\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://rhn.redhat.com/errata/RHSA-2015-1004.html\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://rhn.redhat.com/errata/RHSA-2015-1011.html\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://support.citrix.com/article/CTX201078\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://venom.crowdstrike.com/\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://www.debian.org/security/2015/dsa-3259\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://www.debian.org/security/2015/dsa-3262\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://www.debian.org/security/2015/dsa-3274\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://www.fortiguard.com/advisory/2015-05-19-cve-2015-3456-venom-vulnerability\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://www.securityfocus.com/bid/74640\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://www.securitytracker.com/id/1032306\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://www.securitytracker.com/id/1032311\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://www.securitytracker.com/id/1032917\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://www.ubuntu.com/usn/USN-2608-1\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-438937.htm\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://xenbits.xen.org/xsa/advisory-133.html\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://access.redhat.com/articles/1444903\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://bto.bluecoat.com/security-advisory/sa95\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://kb.juniper.net/JSA10783\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10118\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://security.gentoo.org/glsa/201602-01\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://security.gentoo.org/glsa/201604-03\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://security.gentoo.org/glsa/201612-27\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://securityblog.redhat.com/2015/05/13/venom-dont-get-bitten/\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://support.lenovo.com/us/en/product_security/venom\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://www.arista.com/en/support/advisories-notices/security-advisories/1128-security-advisory-10\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://www.exploit-db.com/exploits/37053/\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://www.suse.com/security/cve/CVE-2015-3456.html\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=e907746266721f305d67bc0718795fedee2e824c\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA10693\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158072.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00009.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00013.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00014.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00018.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00019.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00021.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00042.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00001.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://lists.opensuse.org/opensuse-updates/2015-08/msg00021.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://marc.info/?l=bugtraq\u0026m=143229451215900\u0026w=2\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://marc.info/?l=bugtraq\u0026m=143229451215900\u0026w=2\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://marc.info/?l=bugtraq\u0026m=143387998230996\u0026w=2\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://rhn.redhat.com/errata/RHSA-2015-0998.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://rhn.redhat.com/errata/RHSA-2015-0999.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://rhn.redhat.com/errata/RHSA-2015-1000.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://rhn.redhat.com/errata/RHSA-2015-1001.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://rhn.redhat.com/errata/RHSA-2015-1002.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://rhn.redhat.com/errata/RHSA-2015-1003.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://rhn.redhat.com/errata/RHSA-2015-1004.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://rhn.redhat.com/errata/RHSA-2015-1011.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://support.citrix.com/article/CTX201078\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://venom.crowdstrike.com/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.debian.org/security/2015/dsa-3259\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.debian.org/security/2015/dsa-3262\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.debian.org/security/2015/dsa-3274\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.fortiguard.com/advisory/2015-05-19-cve-2015-3456-venom-vulnerability\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.securityfocus.com/bid/74640\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.securitytracker.com/id/1032306\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.securitytracker.com/id/1032311\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.securitytracker.com/id/1032917\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.ubuntu.com/usn/USN-2608-1\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-438937.htm\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://xenbits.xen.org/xsa/advisory-133.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://access.redhat.com/articles/1444903\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://bto.bluecoat.com/security-advisory/sa95\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://kb.juniper.net/JSA10783\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10118\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://security.gentoo.org/glsa/201602-01\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://security.gentoo.org/glsa/201604-03\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://security.gentoo.org/glsa/201612-27\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://securityblog.redhat.com/2015/05/13/venom-dont-get-bitten/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://support.lenovo.com/us/en/product_security/venom\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://www.arista.com/en/support/advisories-notices/security-advisories/1128-security-advisory-10\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://www.exploit-db.com/exploits/37053/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://www.suse.com/security/cve/CVE-2015-3456.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-119\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2015-3456\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2015-05-13T18:59:00.157\",\"lastModified\":\"2026-05-06T22:30:45.220\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a denial of service (out-of-bounds write and guest crash) or possibly execute arbitrary code via the (1) FD_CMD_READ_ID, (2) FD_CMD_DRIVE_SPECIFICATION_COMMAND, or other unspecified commands, aka VENOM.\"},{\"lang\":\"es\",\"value\":\"Floppy Disk Controller (FDC) en QEMU, utilizado en Xen 4.5.x y anteriores y KVM, permite a usuarios locales invitados causar una denegaci\u00f3n de servicio (escritura fuera de rango y ca\u00edda del invitado) o posiblemente ejecutar c\u00f3digo arbitrario a trav\u00e9s de (1) FD_CMD_READ_ID, (2) FD_CMD_DRIVE_SPECIFICATION_COMMAND, u otros comandos sin especificar, tambi\u00e9n conocido como VENOM.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:A/AC:L/Au:S/C:C/I:C/A:C\",\"baseScore\":7.7,\"accessVector\":\"ADJACENT_NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"COMPLETE\",\"integrityImpact\":\"COMPLETE\",\"availabilityImpact\":\"COMPLETE\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":5.1,\"impactScore\":10.0,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-119\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"2.3.0\",\"matchCriteriaId\":\"ABF17A18-4BE8-41B7-B50C-F4A137B3B2F1\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:enterprise_virtualization:3.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"105130E9-D48E-4FB8-A715-E6438EC7E744\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:openstack:4.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1802FDB8-C919-4D5E-A8AD-4C5B72525090\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:openstack:5.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B152EDF3-3140-4343-802F-F4F1C329F5C3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:openstack:6.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"31EC146C-A6F6-4C0D-AF87-685286262DAA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:openstack:7.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9DAA72A4-AC7D-4544-89D4-5B07961D5A95\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux:5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AA9B3CC0-DF1C-4A86-B2A3-A9D428A5A6E6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2F6AB192-9D7D-4A9A-8995-E53A9DE9EAFC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"142AD0DD-4CF3-4D74-9442-459CE3347E3A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:xen:xen:4.5.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"90CCECD0-C0F9-45A8-8699-64428637EBCA\"}]}]}],\"references\":[{\"url\":\"http://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=e907746266721f305d67bc0718795fedee2e824c\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA10693\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158072.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00009.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00013.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00014.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00018.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00019.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00021.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00042.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00001.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://lists.opensuse.org/opensuse-updates/2015-08/msg00021.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://marc.info/?l=bugtraq\u0026m=143229451215900\u0026w=2\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://marc.info/?l=bugtraq\u0026m=143387998230996\u0026w=2\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2015-0998.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2015-0999.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2015-1000.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2015-1001.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2015-1002.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2015-1003.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2015-1004.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2015-1011.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://support.citrix.com/article/CTX201078\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://venom.crowdstrike.com/\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.debian.org/security/2015/dsa-3259\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.debian.org/security/2015/dsa-3262\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.debian.org/security/2015/dsa-3274\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.fortiguard.com/advisory/2015-05-19-cve-2015-3456-venom-vulnerability\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.securityfocus.com/bid/74640\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.securitytracker.com/id/1032306\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.securitytracker.com/id/1032311\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.securitytracker.com/id/1032917\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.ubuntu.com/usn/USN-2608-1\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-438937.htm\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://xenbits.xen.org/xsa/advisory-133.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://access.redhat.com/articles/1444903\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://bto.bluecoat.com/security-advisory/sa95\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://kb.juniper.net/JSA10783\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10118\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://security.gentoo.org/glsa/201602-01\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://security.gentoo.org/glsa/201604-03\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://security.gentoo.org/glsa/201612-27\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://securityblog.redhat.com/2015/05/13/venom-dont-get-bitten/\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://support.lenovo.com/us/en/product_security/venom\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://www.arista.com/en/support/advisories-notices/security-advisories/1128-security-advisory-10\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://www.exploit-db.com/exploits/37053/\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://www.suse.com/security/cve/CVE-2015-3456.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=e907746266721f305d67bc0718795fedee2e824c\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA10693\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158072.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00009.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00013.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00014.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00018.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00019.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00021.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00042.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://lists.opensuse.org/opensuse-updates/2015-08/msg00021.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://marc.info/?l=bugtraq\u0026m=143229451215900\u0026w=2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://marc.info/?l=bugtraq\u0026m=143387998230996\u0026w=2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2015-0998.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2015-0999.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2015-1000.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2015-1001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2015-1002.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2015-1003.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2015-1004.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2015-1011.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://support.citrix.com/article/CTX201078\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://venom.crowdstrike.com/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.debian.org/security/2015/dsa-3259\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.debian.org/security/2015/dsa-3262\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.debian.org/security/2015/dsa-3274\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.fortiguard.com/advisory/2015-05-19-cve-2015-3456-venom-vulnerability\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securityfocus.com/bid/74640\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securitytracker.com/id/1032306\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securitytracker.com/id/1032311\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securitytracker.com/id/1032917\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.ubuntu.com/usn/USN-2608-1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-438937.htm\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://xenbits.xen.org/xsa/advisory-133.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://access.redhat.com/articles/1444903\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://bto.bluecoat.com/security-advisory/sa95\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://kb.juniper.net/JSA10783\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10118\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://security.gentoo.org/glsa/201602-01\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://security.gentoo.org/glsa/201604-03\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://security.gentoo.org/glsa/201612-27\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://securityblog.redhat.com/2015/05/13/venom-dont-get-bitten/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://support.lenovo.com/us/en/product_security/venom\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://www.arista.com/en/support/advisories-notices/security-advisories/1128-security-advisory-10\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://www.exploit-db.com/exploits/37053/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://www.suse.com/security/cve/CVE-2015-3456.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}],\"evaluatorComment\":\"Though the VENOM vulnerability is also agnostic of the guest operating system, an attacker (or an attacker\u2019s malware) would need to have administrative or root privileges in the guest operating system in order to exploit VENOM\"}}"
}
}
RHSA-2015_1000
Vulnerability from csaf_redhat - Published: 2015-05-13 11:24 - Updated: 2024-11-14 15:26Summary
Red Hat Security Advisory: qemu-kvm-rhev security update
Severity
Important
Notes
Topic: Updated qemu-kvm-rhev packages that fix one security issue are now
available for Red Hat Enterprise Virtualization Hypervisor 7.
Red Hat Product Security has rated this update as having Important security
impact. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available from the CVE link in the
References section.
Details: KVM (Kernel-based Virtual Machine) is a full virtualization solution for
Linux on AMD64 and Intel 64 systems. The qemu-kvm-rhev package provides the
user-space component for running virtual machines using KVM.
An out-of-bounds memory access flaw was found in the way QEMU's virtual
Floppy Disk Controller (FDC) handled FIFO buffer access while processing
certain FDC commands. A privileged guest user could use this flaw to crash
the guest or, potentially, execute arbitrary code on the host with the
privileges of the host's QEMU process corresponding to the guest.
(CVE-2015-3456)
Red Hat would like to thank Jason Geffner of CrowdStrike for reporting
this issue.
All qemu-kvm-rhev users are advised to upgrade to these updated packages,
which contain a backported patch to correct this issue. After installing
this update, shut down all running virtual machines. Once all virtual
machines have shut down, start them again for this update to take effect.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
An out-of-bounds memory access flaw was found in the way QEMU's virtual Floppy Disk Controller (FDC) handled FIFO buffer access while processing certain FDC commands. A privileged guest user could use this flaw to crash the guest or, potentially, execute arbitrary code on the host with the privileges of the host's QEMU process corresponding to the guest.
6.5 ()
Affected products
Fixed
9 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-RHEV-Agents-7:libcacard-devel-rhev-10:2.1.2-23.el7_1.3.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RHEV-Agents-7:libcacard-rhev-10:2.1.2-23.el7_1.3.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RHEV-Agents-7:libcacard-tools-rhev-10:2.1.2-23.el7_1.3.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RHEV-Agents-7:qemu-img-rhev-10:2.1.2-23.el7_1.3.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RHEV-Agents-7:qemu-kvm-common-rhev-10:2.1.2-23.el7_1.3.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RHEV-Agents-7:qemu-kvm-rhev-10:2.1.2-23.el7_1.3.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RHEV-Agents-7:qemu-kvm-rhev-10:2.1.2-23.el7_1.3.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RHEV-Agents-7:qemu-kvm-rhev-debuginfo-10:2.1.2-23.el7_1.3.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RHEV-Agents-7:qemu-kvm-tools-rhev-10:2.1.2-23.el7_1.3.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Important
References
12 references
Acknowledgments
CrowdStrike
Jason Geffner
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated qemu-kvm-rhev packages that fix one security issue are now\navailable for Red Hat Enterprise Virtualization Hypervisor 7.\n\nRed Hat Product Security has rated this update as having Important security\nimpact. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available from the CVE link in the\nReferences section.",
"title": "Topic"
},
{
"category": "general",
"text": "KVM (Kernel-based Virtual Machine) is a full virtualization solution for\nLinux on AMD64 and Intel 64 systems. The qemu-kvm-rhev package provides the\nuser-space component for running virtual machines using KVM.\n\nAn out-of-bounds memory access flaw was found in the way QEMU\u0027s virtual\nFloppy Disk Controller (FDC) handled FIFO buffer access while processing\ncertain FDC commands. A privileged guest user could use this flaw to crash\nthe guest or, potentially, execute arbitrary code on the host with the\nprivileges of the host\u0027s QEMU process corresponding to the guest.\n(CVE-2015-3456)\n\nRed Hat would like to thank Jason Geffner of CrowdStrike for reporting\nthis issue.\n\nAll qemu-kvm-rhev users are advised to upgrade to these updated packages,\nwhich contain a backported patch to correct this issue. After installing\nthis update, shut down all running virtual machines. Once all virtual\nmachines have shut down, start them again for this update to take effect.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2015:1000",
"url": "https://access.redhat.com/errata/RHSA-2015:1000"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "1218611",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1218611"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1000.json"
}
],
"title": "Red Hat Security Advisory: qemu-kvm-rhev security update",
"tracking": {
"current_release_date": "2024-11-14T15:26:35+00:00",
"generator": {
"date": "2024-11-14T15:26:35+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.0"
}
},
"id": "RHSA-2015:1000",
"initial_release_date": "2015-05-13T11:24:42+00:00",
"revision_history": [
{
"date": "2015-05-13T11:24:42+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2015-05-13T11:24:42+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-14T15:26:35+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "RHEV-H and VDSM for 7 Hosts",
"product": {
"name": "RHEV-H and VDSM for 7 Hosts",
"product_id": "7Server-RHEV-Agents-7",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:7::hypervisor"
}
}
}
],
"category": "product_family",
"name": "Red Hat Virtualization"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-img-rhev-10:2.1.2-23.el7_1.3.x86_64",
"product": {
"name": "qemu-img-rhev-10:2.1.2-23.el7_1.3.x86_64",
"product_id": "qemu-img-rhev-10:2.1.2-23.el7_1.3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-img-rhev@2.1.2-23.el7_1.3?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "libcacard-rhev-10:2.1.2-23.el7_1.3.x86_64",
"product": {
"name": "libcacard-rhev-10:2.1.2-23.el7_1.3.x86_64",
"product_id": "libcacard-rhev-10:2.1.2-23.el7_1.3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libcacard-rhev@2.1.2-23.el7_1.3?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "libcacard-tools-rhev-10:2.1.2-23.el7_1.3.x86_64",
"product": {
"name": "libcacard-tools-rhev-10:2.1.2-23.el7_1.3.x86_64",
"product_id": "libcacard-tools-rhev-10:2.1.2-23.el7_1.3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libcacard-tools-rhev@2.1.2-23.el7_1.3?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "libcacard-devel-rhev-10:2.1.2-23.el7_1.3.x86_64",
"product": {
"name": "libcacard-devel-rhev-10:2.1.2-23.el7_1.3.x86_64",
"product_id": "libcacard-devel-rhev-10:2.1.2-23.el7_1.3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libcacard-devel-rhev@2.1.2-23.el7_1.3?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-tools-rhev-10:2.1.2-23.el7_1.3.x86_64",
"product": {
"name": "qemu-kvm-tools-rhev-10:2.1.2-23.el7_1.3.x86_64",
"product_id": "qemu-kvm-tools-rhev-10:2.1.2-23.el7_1.3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-tools-rhev@2.1.2-23.el7_1.3?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-common-rhev-10:2.1.2-23.el7_1.3.x86_64",
"product": {
"name": "qemu-kvm-common-rhev-10:2.1.2-23.el7_1.3.x86_64",
"product_id": "qemu-kvm-common-rhev-10:2.1.2-23.el7_1.3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-common-rhev@2.1.2-23.el7_1.3?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-rhev-debuginfo-10:2.1.2-23.el7_1.3.x86_64",
"product": {
"name": "qemu-kvm-rhev-debuginfo-10:2.1.2-23.el7_1.3.x86_64",
"product_id": "qemu-kvm-rhev-debuginfo-10:2.1.2-23.el7_1.3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev-debuginfo@2.1.2-23.el7_1.3?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-rhev-10:2.1.2-23.el7_1.3.x86_64",
"product": {
"name": "qemu-kvm-rhev-10:2.1.2-23.el7_1.3.x86_64",
"product_id": "qemu-kvm-rhev-10:2.1.2-23.el7_1.3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev@2.1.2-23.el7_1.3?arch=x86_64\u0026epoch=10"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-kvm-rhev-10:2.1.2-23.el7_1.3.src",
"product": {
"name": "qemu-kvm-rhev-10:2.1.2-23.el7_1.3.src",
"product_id": "qemu-kvm-rhev-10:2.1.2-23.el7_1.3.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev@2.1.2-23.el7_1.3?arch=src\u0026epoch=10"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "libcacard-devel-rhev-10:2.1.2-23.el7_1.3.x86_64 as a component of RHEV-H and VDSM for 7 Hosts",
"product_id": "7Server-RHEV-Agents-7:libcacard-devel-rhev-10:2.1.2-23.el7_1.3.x86_64"
},
"product_reference": "libcacard-devel-rhev-10:2.1.2-23.el7_1.3.x86_64",
"relates_to_product_reference": "7Server-RHEV-Agents-7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcacard-rhev-10:2.1.2-23.el7_1.3.x86_64 as a component of RHEV-H and VDSM for 7 Hosts",
"product_id": "7Server-RHEV-Agents-7:libcacard-rhev-10:2.1.2-23.el7_1.3.x86_64"
},
"product_reference": "libcacard-rhev-10:2.1.2-23.el7_1.3.x86_64",
"relates_to_product_reference": "7Server-RHEV-Agents-7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcacard-tools-rhev-10:2.1.2-23.el7_1.3.x86_64 as a component of RHEV-H and VDSM for 7 Hosts",
"product_id": "7Server-RHEV-Agents-7:libcacard-tools-rhev-10:2.1.2-23.el7_1.3.x86_64"
},
"product_reference": "libcacard-tools-rhev-10:2.1.2-23.el7_1.3.x86_64",
"relates_to_product_reference": "7Server-RHEV-Agents-7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-rhev-10:2.1.2-23.el7_1.3.x86_64 as a component of RHEV-H and VDSM for 7 Hosts",
"product_id": "7Server-RHEV-Agents-7:qemu-img-rhev-10:2.1.2-23.el7_1.3.x86_64"
},
"product_reference": "qemu-img-rhev-10:2.1.2-23.el7_1.3.x86_64",
"relates_to_product_reference": "7Server-RHEV-Agents-7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-common-rhev-10:2.1.2-23.el7_1.3.x86_64 as a component of RHEV-H and VDSM for 7 Hosts",
"product_id": "7Server-RHEV-Agents-7:qemu-kvm-common-rhev-10:2.1.2-23.el7_1.3.x86_64"
},
"product_reference": "qemu-kvm-common-rhev-10:2.1.2-23.el7_1.3.x86_64",
"relates_to_product_reference": "7Server-RHEV-Agents-7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-10:2.1.2-23.el7_1.3.src as a component of RHEV-H and VDSM for 7 Hosts",
"product_id": "7Server-RHEV-Agents-7:qemu-kvm-rhev-10:2.1.2-23.el7_1.3.src"
},
"product_reference": "qemu-kvm-rhev-10:2.1.2-23.el7_1.3.src",
"relates_to_product_reference": "7Server-RHEV-Agents-7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-10:2.1.2-23.el7_1.3.x86_64 as a component of RHEV-H and VDSM for 7 Hosts",
"product_id": "7Server-RHEV-Agents-7:qemu-kvm-rhev-10:2.1.2-23.el7_1.3.x86_64"
},
"product_reference": "qemu-kvm-rhev-10:2.1.2-23.el7_1.3.x86_64",
"relates_to_product_reference": "7Server-RHEV-Agents-7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-debuginfo-10:2.1.2-23.el7_1.3.x86_64 as a component of RHEV-H and VDSM for 7 Hosts",
"product_id": "7Server-RHEV-Agents-7:qemu-kvm-rhev-debuginfo-10:2.1.2-23.el7_1.3.x86_64"
},
"product_reference": "qemu-kvm-rhev-debuginfo-10:2.1.2-23.el7_1.3.x86_64",
"relates_to_product_reference": "7Server-RHEV-Agents-7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-tools-rhev-10:2.1.2-23.el7_1.3.x86_64 as a component of RHEV-H and VDSM for 7 Hosts",
"product_id": "7Server-RHEV-Agents-7:qemu-kvm-tools-rhev-10:2.1.2-23.el7_1.3.x86_64"
},
"product_reference": "qemu-kvm-tools-rhev-10:2.1.2-23.el7_1.3.x86_64",
"relates_to_product_reference": "7Server-RHEV-Agents-7"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Jason Geffner"
],
"organization": "CrowdStrike"
}
],
"cve": "CVE-2015-3456",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2015-05-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1218611"
}
],
"notes": [
{
"category": "description",
"text": "An out-of-bounds memory access flaw was found in the way QEMU\u0027s virtual Floppy Disk Controller (FDC) handled FIFO buffer access while processing certain FDC commands. A privileged guest user could use this flaw to crash the guest or, potentially, execute arbitrary code on the host with the privileges of the host\u0027s QEMU process corresponding to the guest.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "qemu: fdc: out-of-bounds fifo buffer memory access",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue affects the versions of the kvm and xen packages as shipped with Red Hat Enterprise Linux 5, the versions of the qemu-kvm packages as shipped with Red Hat Enterprise Linux 6 and 7, and the versions of qemu-kvm-rhev packages as shipped with Red Hat Enterprise Virtualization 3. Future updates for the respective releases will address this flaw.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHEV-Agents-7:libcacard-devel-rhev-10:2.1.2-23.el7_1.3.x86_64",
"7Server-RHEV-Agents-7:libcacard-rhev-10:2.1.2-23.el7_1.3.x86_64",
"7Server-RHEV-Agents-7:libcacard-tools-rhev-10:2.1.2-23.el7_1.3.x86_64",
"7Server-RHEV-Agents-7:qemu-img-rhev-10:2.1.2-23.el7_1.3.x86_64",
"7Server-RHEV-Agents-7:qemu-kvm-common-rhev-10:2.1.2-23.el7_1.3.x86_64",
"7Server-RHEV-Agents-7:qemu-kvm-rhev-10:2.1.2-23.el7_1.3.src",
"7Server-RHEV-Agents-7:qemu-kvm-rhev-10:2.1.2-23.el7_1.3.x86_64",
"7Server-RHEV-Agents-7:qemu-kvm-rhev-debuginfo-10:2.1.2-23.el7_1.3.x86_64",
"7Server-RHEV-Agents-7:qemu-kvm-tools-rhev-10:2.1.2-23.el7_1.3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-3456"
},
{
"category": "external",
"summary": "RHBZ#1218611",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1218611"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-3456",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-3456"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-3456",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-3456"
},
{
"category": "external",
"summary": "http://venom.crowdstrike.com/",
"url": "http://venom.crowdstrike.com/"
},
{
"category": "external",
"summary": "http://xenbits.xen.org/xsa/advisory-133.html",
"url": "http://xenbits.xen.org/xsa/advisory-133.html"
},
{
"category": "external",
"summary": "https://access.redhat.com/articles/1444903",
"url": "https://access.redhat.com/articles/1444903"
},
{
"category": "external",
"summary": "https://securityblog.redhat.com/2015/05/13/venom-dont-get-bitten/",
"url": "https://securityblog.redhat.com/2015/05/13/venom-dont-get-bitten/"
}
],
"release_date": "2015-05-13T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-05-13T11:24:42+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-RHEV-Agents-7:libcacard-devel-rhev-10:2.1.2-23.el7_1.3.x86_64",
"7Server-RHEV-Agents-7:libcacard-rhev-10:2.1.2-23.el7_1.3.x86_64",
"7Server-RHEV-Agents-7:libcacard-tools-rhev-10:2.1.2-23.el7_1.3.x86_64",
"7Server-RHEV-Agents-7:qemu-img-rhev-10:2.1.2-23.el7_1.3.x86_64",
"7Server-RHEV-Agents-7:qemu-kvm-common-rhev-10:2.1.2-23.el7_1.3.x86_64",
"7Server-RHEV-Agents-7:qemu-kvm-rhev-10:2.1.2-23.el7_1.3.src",
"7Server-RHEV-Agents-7:qemu-kvm-rhev-10:2.1.2-23.el7_1.3.x86_64",
"7Server-RHEV-Agents-7:qemu-kvm-rhev-debuginfo-10:2.1.2-23.el7_1.3.x86_64",
"7Server-RHEV-Agents-7:qemu-kvm-tools-rhev-10:2.1.2-23.el7_1.3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:1000"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "COMPLETE",
"baseScore": 6.5,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:A/AC:H/Au:S/C:C/I:C/A:C",
"version": "2.0"
},
"products": [
"7Server-RHEV-Agents-7:libcacard-devel-rhev-10:2.1.2-23.el7_1.3.x86_64",
"7Server-RHEV-Agents-7:libcacard-rhev-10:2.1.2-23.el7_1.3.x86_64",
"7Server-RHEV-Agents-7:libcacard-tools-rhev-10:2.1.2-23.el7_1.3.x86_64",
"7Server-RHEV-Agents-7:qemu-img-rhev-10:2.1.2-23.el7_1.3.x86_64",
"7Server-RHEV-Agents-7:qemu-kvm-common-rhev-10:2.1.2-23.el7_1.3.x86_64",
"7Server-RHEV-Agents-7:qemu-kvm-rhev-10:2.1.2-23.el7_1.3.src",
"7Server-RHEV-Agents-7:qemu-kvm-rhev-10:2.1.2-23.el7_1.3.x86_64",
"7Server-RHEV-Agents-7:qemu-kvm-rhev-debuginfo-10:2.1.2-23.el7_1.3.x86_64",
"7Server-RHEV-Agents-7:qemu-kvm-tools-rhev-10:2.1.2-23.el7_1.3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "qemu: fdc: out-of-bounds fifo buffer memory access"
}
]
}
RHSA-2015_1001
Vulnerability from csaf_redhat - Published: 2015-05-13 11:24 - Updated: 2024-11-14 15:26Summary
Red Hat Security Advisory: qemu-kvm-rhev security update
Severity
Important
Notes
Topic: Updated qemu-kvm-rhev packages that fix one security issue are now
available for Red Hat Enterprise Virtualization 3.5.
Red Hat Product Security has rated this update as having Important security
impact. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available from the CVE link in the
References section.
Details: KVM (Kernel-based Virtual Machine) is a full virtualization solution for
Linux on AMD64 and Intel 64 systems. The qemu-kvm-rhev package provides the
user-space component for running virtual machines using KVM.
An out-of-bounds memory access flaw was found in the way QEMU's virtual
Floppy Disk Controller (FDC) handled FIFO buffer access while processing
certain FDC commands. A privileged guest user could use this flaw to crash
the guest or, potentially, execute arbitrary code on the host with the
privileges of the host's QEMU process corresponding to the guest.
(CVE-2015-3456)
Red Hat would like to thank Jason Geffner of CrowdStrike for reporting
this issue.
All qemu-kvm-rhev users are advised to upgrade to these updated packages,
which contain a backported patch to correct this issue. After installing
this update, shut down all running virtual machines. Once all virtual
machines have shut down, start them again for this update to take effect.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
An out-of-bounds memory access flaw was found in the way QEMU's virtual Floppy Disk Controller (FDC) handled FIFO buffer access while processing certain FDC commands. A privileged guest user could use this flaw to crash the guest or, potentially, execute arbitrary code on the host with the privileges of the host's QEMU process corresponding to the guest.
6.5 ()
Affected products
Fixed
5 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 6Server-RHEV-Agents:qemu-img-rhev-2:0.12.1.2-2.448.el6_6.3.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.448.el6_6.3.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.448.el6_6.3.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-RHEV-Agents:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.448.el6_6.3.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-RHEV-Agents:qemu-kvm-rhev-tools-2:0.12.1.2-2.448.el6_6.3.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Important
References
12 references
Acknowledgments
CrowdStrike
Jason Geffner
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated qemu-kvm-rhev packages that fix one security issue are now\navailable for Red Hat Enterprise Virtualization 3.5.\n\nRed Hat Product Security has rated this update as having Important security\nimpact. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available from the CVE link in the\nReferences section.",
"title": "Topic"
},
{
"category": "general",
"text": "KVM (Kernel-based Virtual Machine) is a full virtualization solution for\nLinux on AMD64 and Intel 64 systems. The qemu-kvm-rhev package provides the\nuser-space component for running virtual machines using KVM.\n\nAn out-of-bounds memory access flaw was found in the way QEMU\u0027s virtual\nFloppy Disk Controller (FDC) handled FIFO buffer access while processing\ncertain FDC commands. A privileged guest user could use this flaw to crash\nthe guest or, potentially, execute arbitrary code on the host with the\nprivileges of the host\u0027s QEMU process corresponding to the guest.\n(CVE-2015-3456)\n\nRed Hat would like to thank Jason Geffner of CrowdStrike for reporting\nthis issue.\n\nAll qemu-kvm-rhev users are advised to upgrade to these updated packages,\nwhich contain a backported patch to correct this issue. After installing\nthis update, shut down all running virtual machines. Once all virtual\nmachines have shut down, start them again for this update to take effect.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2015:1001",
"url": "https://access.redhat.com/errata/RHSA-2015:1001"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "1218611",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1218611"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1001.json"
}
],
"title": "Red Hat Security Advisory: qemu-kvm-rhev security update",
"tracking": {
"current_release_date": "2024-11-14T15:26:48+00:00",
"generator": {
"date": "2024-11-14T15:26:48+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.0"
}
},
"id": "RHSA-2015:1001",
"initial_release_date": "2015-05-13T11:24:17+00:00",
"revision_history": [
{
"date": "2015-05-13T11:24:17+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2015-05-13T11:24:17+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-14T15:26:48+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "RHEV Agents (vdsm)",
"product": {
"name": "RHEV Agents (vdsm)",
"product_id": "6Server-RHEV-Agents",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:enterprise_linux:6::hypervisor"
}
}
}
],
"category": "product_family",
"name": "Red Hat Virtualization"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-img-rhev-2:0.12.1.2-2.448.el6_6.3.x86_64",
"product": {
"name": "qemu-img-rhev-2:0.12.1.2-2.448.el6_6.3.x86_64",
"product_id": "qemu-img-rhev-2:0.12.1.2-2.448.el6_6.3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-img-rhev@0.12.1.2-2.448.el6_6.3?arch=x86_64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-rhev-2:0.12.1.2-2.448.el6_6.3.x86_64",
"product": {
"name": "qemu-kvm-rhev-2:0.12.1.2-2.448.el6_6.3.x86_64",
"product_id": "qemu-kvm-rhev-2:0.12.1.2-2.448.el6_6.3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev@0.12.1.2-2.448.el6_6.3?arch=x86_64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.448.el6_6.3.x86_64",
"product": {
"name": "qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.448.el6_6.3.x86_64",
"product_id": "qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.448.el6_6.3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev-debuginfo@0.12.1.2-2.448.el6_6.3?arch=x86_64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-rhev-tools-2:0.12.1.2-2.448.el6_6.3.x86_64",
"product": {
"name": "qemu-kvm-rhev-tools-2:0.12.1.2-2.448.el6_6.3.x86_64",
"product_id": "qemu-kvm-rhev-tools-2:0.12.1.2-2.448.el6_6.3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev-tools@0.12.1.2-2.448.el6_6.3?arch=x86_64\u0026epoch=2"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-kvm-rhev-2:0.12.1.2-2.448.el6_6.3.src",
"product": {
"name": "qemu-kvm-rhev-2:0.12.1.2-2.448.el6_6.3.src",
"product_id": "qemu-kvm-rhev-2:0.12.1.2-2.448.el6_6.3.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev@0.12.1.2-2.448.el6_6.3?arch=src\u0026epoch=2"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-rhev-2:0.12.1.2-2.448.el6_6.3.x86_64 as a component of RHEV Agents (vdsm)",
"product_id": "6Server-RHEV-Agents:qemu-img-rhev-2:0.12.1.2-2.448.el6_6.3.x86_64"
},
"product_reference": "qemu-img-rhev-2:0.12.1.2-2.448.el6_6.3.x86_64",
"relates_to_product_reference": "6Server-RHEV-Agents"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-2:0.12.1.2-2.448.el6_6.3.src as a component of RHEV Agents (vdsm)",
"product_id": "6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.448.el6_6.3.src"
},
"product_reference": "qemu-kvm-rhev-2:0.12.1.2-2.448.el6_6.3.src",
"relates_to_product_reference": "6Server-RHEV-Agents"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-2:0.12.1.2-2.448.el6_6.3.x86_64 as a component of RHEV Agents (vdsm)",
"product_id": "6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.448.el6_6.3.x86_64"
},
"product_reference": "qemu-kvm-rhev-2:0.12.1.2-2.448.el6_6.3.x86_64",
"relates_to_product_reference": "6Server-RHEV-Agents"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.448.el6_6.3.x86_64 as a component of RHEV Agents (vdsm)",
"product_id": "6Server-RHEV-Agents:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.448.el6_6.3.x86_64"
},
"product_reference": "qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.448.el6_6.3.x86_64",
"relates_to_product_reference": "6Server-RHEV-Agents"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-tools-2:0.12.1.2-2.448.el6_6.3.x86_64 as a component of RHEV Agents (vdsm)",
"product_id": "6Server-RHEV-Agents:qemu-kvm-rhev-tools-2:0.12.1.2-2.448.el6_6.3.x86_64"
},
"product_reference": "qemu-kvm-rhev-tools-2:0.12.1.2-2.448.el6_6.3.x86_64",
"relates_to_product_reference": "6Server-RHEV-Agents"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Jason Geffner"
],
"organization": "CrowdStrike"
}
],
"cve": "CVE-2015-3456",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2015-05-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1218611"
}
],
"notes": [
{
"category": "description",
"text": "An out-of-bounds memory access flaw was found in the way QEMU\u0027s virtual Floppy Disk Controller (FDC) handled FIFO buffer access while processing certain FDC commands. A privileged guest user could use this flaw to crash the guest or, potentially, execute arbitrary code on the host with the privileges of the host\u0027s QEMU process corresponding to the guest.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "qemu: fdc: out-of-bounds fifo buffer memory access",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue affects the versions of the kvm and xen packages as shipped with Red Hat Enterprise Linux 5, the versions of the qemu-kvm packages as shipped with Red Hat Enterprise Linux 6 and 7, and the versions of qemu-kvm-rhev packages as shipped with Red Hat Enterprise Virtualization 3. Future updates for the respective releases will address this flaw.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RHEV-Agents:qemu-img-rhev-2:0.12.1.2-2.448.el6_6.3.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.448.el6_6.3.src",
"6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.448.el6_6.3.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.448.el6_6.3.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-tools-2:0.12.1.2-2.448.el6_6.3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-3456"
},
{
"category": "external",
"summary": "RHBZ#1218611",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1218611"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-3456",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-3456"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-3456",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-3456"
},
{
"category": "external",
"summary": "http://venom.crowdstrike.com/",
"url": "http://venom.crowdstrike.com/"
},
{
"category": "external",
"summary": "http://xenbits.xen.org/xsa/advisory-133.html",
"url": "http://xenbits.xen.org/xsa/advisory-133.html"
},
{
"category": "external",
"summary": "https://access.redhat.com/articles/1444903",
"url": "https://access.redhat.com/articles/1444903"
},
{
"category": "external",
"summary": "https://securityblog.redhat.com/2015/05/13/venom-dont-get-bitten/",
"url": "https://securityblog.redhat.com/2015/05/13/venom-dont-get-bitten/"
}
],
"release_date": "2015-05-13T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-05-13T11:24:17+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"6Server-RHEV-Agents:qemu-img-rhev-2:0.12.1.2-2.448.el6_6.3.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.448.el6_6.3.src",
"6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.448.el6_6.3.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.448.el6_6.3.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-tools-2:0.12.1.2-2.448.el6_6.3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:1001"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "COMPLETE",
"baseScore": 6.5,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:A/AC:H/Au:S/C:C/I:C/A:C",
"version": "2.0"
},
"products": [
"6Server-RHEV-Agents:qemu-img-rhev-2:0.12.1.2-2.448.el6_6.3.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.448.el6_6.3.src",
"6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.448.el6_6.3.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.448.el6_6.3.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-tools-2:0.12.1.2-2.448.el6_6.3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "qemu: fdc: out-of-bounds fifo buffer memory access"
}
]
}
RHSA-2015_1002
Vulnerability from csaf_redhat - Published: 2015-05-13 11:22 - Updated: 2024-11-14 15:26Summary
Red Hat Security Advisory: xen security update
Severity
Important
Notes
Topic: Updated xen packages that fix one security issue are now available for Red
Hat Enterprise Linux 5.
Red Hat Product Security has rated this update as having Important security
impact. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available from the CVE link in the
References section.
Details: The xen packages contain administration tools and the xend service for
managing the kernel-xen kernel for virtualization on Red Hat Enterprise
Linux.
An out-of-bounds memory access flaw was found in the way QEMU's virtual
Floppy Disk Controller (FDC) handled FIFO buffer access while processing
certain FDC commands. A privileged guest user could use this flaw to crash
the guest or, potentially, execute arbitrary code on the host with the
privileges of the host's QEMU process corresponding to the guest.
(CVE-2015-3456)
Red Hat would like to thank Jason Geffner of CrowdStrike for reporting
this issue.
All xen users are advised to upgrade to these updated packages, which
contain a backported patch to correct this issue. After installing the
updated packages, all running fully-virtualized guests must be restarted
for this update to take effect.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
An out-of-bounds memory access flaw was found in the way QEMU's virtual Floppy Disk Controller (FDC) handled FIFO buffer access while processing certain FDC commands. A privileged guest user could use this flaw to crash the guest or, potentially, execute arbitrary code on the host with the privileges of the host's QEMU process corresponding to the guest.
6.5 ()
Affected products
Fixed
52 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 5Client-5.11.Z:xen-0:3.0.3-146.el5_11.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Client-5.11.Z:xen-0:3.0.3-146.el5_11.ia64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Client-5.11.Z:xen-0:3.0.3-146.el5_11.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Client-5.11.Z:xen-0:3.0.3-146.el5_11.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Client-5.11.Z:xen-debuginfo-0:3.0.3-146.el5_11.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Client-5.11.Z:xen-debuginfo-0:3.0.3-146.el5_11.ia64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Client-5.11.Z:xen-debuginfo-0:3.0.3-146.el5_11.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Client-5.11.Z:xen-devel-0:3.0.3-146.el5_11.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Client-5.11.Z:xen-devel-0:3.0.3-146.el5_11.ia64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Client-5.11.Z:xen-devel-0:3.0.3-146.el5_11.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Client-5.11.Z:xen-libs-0:3.0.3-146.el5_11.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Client-5.11.Z:xen-libs-0:3.0.3-146.el5_11.ia64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Client-5.11.Z:xen-libs-0:3.0.3-146.el5_11.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Client-VT-5.11.Z:xen-0:3.0.3-146.el5_11.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Client-VT-5.11.Z:xen-0:3.0.3-146.el5_11.ia64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Client-VT-5.11.Z:xen-0:3.0.3-146.el5_11.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Client-VT-5.11.Z:xen-0:3.0.3-146.el5_11.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Client-VT-5.11.Z:xen-debuginfo-0:3.0.3-146.el5_11.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Client-VT-5.11.Z:xen-debuginfo-0:3.0.3-146.el5_11.ia64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Client-VT-5.11.Z:xen-debuginfo-0:3.0.3-146.el5_11.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Client-VT-5.11.Z:xen-devel-0:3.0.3-146.el5_11.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Client-VT-5.11.Z:xen-devel-0:3.0.3-146.el5_11.ia64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Client-VT-5.11.Z:xen-devel-0:3.0.3-146.el5_11.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Client-VT-5.11.Z:xen-libs-0:3.0.3-146.el5_11.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Client-VT-5.11.Z:xen-libs-0:3.0.3-146.el5_11.ia64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Client-VT-5.11.Z:xen-libs-0:3.0.3-146.el5_11.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-5.11.Z:xen-0:3.0.3-146.el5_11.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-5.11.Z:xen-0:3.0.3-146.el5_11.ia64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-5.11.Z:xen-0:3.0.3-146.el5_11.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-5.11.Z:xen-0:3.0.3-146.el5_11.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-5.11.Z:xen-debuginfo-0:3.0.3-146.el5_11.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-5.11.Z:xen-debuginfo-0:3.0.3-146.el5_11.ia64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-5.11.Z:xen-debuginfo-0:3.0.3-146.el5_11.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-5.11.Z:xen-devel-0:3.0.3-146.el5_11.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-5.11.Z:xen-devel-0:3.0.3-146.el5_11.ia64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-5.11.Z:xen-devel-0:3.0.3-146.el5_11.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-5.11.Z:xen-libs-0:3.0.3-146.el5_11.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-5.11.Z:xen-libs-0:3.0.3-146.el5_11.ia64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-5.11.Z:xen-libs-0:3.0.3-146.el5_11.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-VT-5.11.Z:xen-0:3.0.3-146.el5_11.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-VT-5.11.Z:xen-0:3.0.3-146.el5_11.ia64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-VT-5.11.Z:xen-0:3.0.3-146.el5_11.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-VT-5.11.Z:xen-0:3.0.3-146.el5_11.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-VT-5.11.Z:xen-debuginfo-0:3.0.3-146.el5_11.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-VT-5.11.Z:xen-debuginfo-0:3.0.3-146.el5_11.ia64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-VT-5.11.Z:xen-debuginfo-0:3.0.3-146.el5_11.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-VT-5.11.Z:xen-devel-0:3.0.3-146.el5_11.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-VT-5.11.Z:xen-devel-0:3.0.3-146.el5_11.ia64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-VT-5.11.Z:xen-devel-0:3.0.3-146.el5_11.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-VT-5.11.Z:xen-libs-0:3.0.3-146.el5_11.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-VT-5.11.Z:xen-libs-0:3.0.3-146.el5_11.ia64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-VT-5.11.Z:xen-libs-0:3.0.3-146.el5_11.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Important
References
12 references
Acknowledgments
CrowdStrike
Jason Geffner
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated xen packages that fix one security issue are now available for Red\nHat Enterprise Linux 5.\n\nRed Hat Product Security has rated this update as having Important security\nimpact. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available from the CVE link in the\nReferences section.",
"title": "Topic"
},
{
"category": "general",
"text": "The xen packages contain administration tools and the xend service for\nmanaging the kernel-xen kernel for virtualization on Red Hat Enterprise\nLinux.\n\nAn out-of-bounds memory access flaw was found in the way QEMU\u0027s virtual\nFloppy Disk Controller (FDC) handled FIFO buffer access while processing\ncertain FDC commands. A privileged guest user could use this flaw to crash\nthe guest or, potentially, execute arbitrary code on the host with the\nprivileges of the host\u0027s QEMU process corresponding to the guest.\n(CVE-2015-3456)\n\nRed Hat would like to thank Jason Geffner of CrowdStrike for reporting\nthis issue.\n\nAll xen users are advised to upgrade to these updated packages, which\ncontain a backported patch to correct this issue. After installing the\nupdated packages, all running fully-virtualized guests must be restarted\nfor this update to take effect.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2015:1002",
"url": "https://access.redhat.com/errata/RHSA-2015:1002"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "1218611",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1218611"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1002.json"
}
],
"title": "Red Hat Security Advisory: xen security update",
"tracking": {
"current_release_date": "2024-11-14T15:26:42+00:00",
"generator": {
"date": "2024-11-14T15:26:42+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.0"
}
},
"id": "RHSA-2015:1002",
"initial_release_date": "2015-05-13T11:22:45+00:00",
"revision_history": [
{
"date": "2015-05-13T11:22:45+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2015-05-13T11:22:45+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-14T15:26:42+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Desktop Multi OS (v. 5 client)",
"product": {
"name": "Red Hat Enterprise Linux Desktop Multi OS (v. 5 client)",
"product_id": "5Client-VT-5.11.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_virtualization:5::client"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Virtualization (v. 5 server)",
"product": {
"name": "Red Hat Enterprise Linux Virtualization (v. 5 server)",
"product_id": "5Server-VT-5.11.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_virtualization:5::server"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Desktop (v. 5 client)",
"product": {
"name": "Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client-5.11.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:5::client"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux (v. 5 server)",
"product": {
"name": "Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server-5.11.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:5::server"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "xen-0:3.0.3-146.el5_11.src",
"product": {
"name": "xen-0:3.0.3-146.el5_11.src",
"product_id": "xen-0:3.0.3-146.el5_11.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/xen@3.0.3-146.el5_11?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "xen-0:3.0.3-146.el5_11.i386",
"product": {
"name": "xen-0:3.0.3-146.el5_11.i386",
"product_id": "xen-0:3.0.3-146.el5_11.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/xen@3.0.3-146.el5_11?arch=i386"
}
}
},
{
"category": "product_version",
"name": "xen-devel-0:3.0.3-146.el5_11.i386",
"product": {
"name": "xen-devel-0:3.0.3-146.el5_11.i386",
"product_id": "xen-devel-0:3.0.3-146.el5_11.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/xen-devel@3.0.3-146.el5_11?arch=i386"
}
}
},
{
"category": "product_version",
"name": "xen-debuginfo-0:3.0.3-146.el5_11.i386",
"product": {
"name": "xen-debuginfo-0:3.0.3-146.el5_11.i386",
"product_id": "xen-debuginfo-0:3.0.3-146.el5_11.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/xen-debuginfo@3.0.3-146.el5_11?arch=i386"
}
}
},
{
"category": "product_version",
"name": "xen-libs-0:3.0.3-146.el5_11.i386",
"product": {
"name": "xen-libs-0:3.0.3-146.el5_11.i386",
"product_id": "xen-libs-0:3.0.3-146.el5_11.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/xen-libs@3.0.3-146.el5_11?arch=i386"
}
}
}
],
"category": "architecture",
"name": "i386"
},
{
"branches": [
{
"category": "product_version",
"name": "xen-devel-0:3.0.3-146.el5_11.x86_64",
"product": {
"name": "xen-devel-0:3.0.3-146.el5_11.x86_64",
"product_id": "xen-devel-0:3.0.3-146.el5_11.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/xen-devel@3.0.3-146.el5_11?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "xen-debuginfo-0:3.0.3-146.el5_11.x86_64",
"product": {
"name": "xen-debuginfo-0:3.0.3-146.el5_11.x86_64",
"product_id": "xen-debuginfo-0:3.0.3-146.el5_11.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/xen-debuginfo@3.0.3-146.el5_11?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "xen-0:3.0.3-146.el5_11.x86_64",
"product": {
"name": "xen-0:3.0.3-146.el5_11.x86_64",
"product_id": "xen-0:3.0.3-146.el5_11.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/xen@3.0.3-146.el5_11?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "xen-libs-0:3.0.3-146.el5_11.x86_64",
"product": {
"name": "xen-libs-0:3.0.3-146.el5_11.x86_64",
"product_id": "xen-libs-0:3.0.3-146.el5_11.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/xen-libs@3.0.3-146.el5_11?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "xen-0:3.0.3-146.el5_11.ia64",
"product": {
"name": "xen-0:3.0.3-146.el5_11.ia64",
"product_id": "xen-0:3.0.3-146.el5_11.ia64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/xen@3.0.3-146.el5_11?arch=ia64"
}
}
},
{
"category": "product_version",
"name": "xen-debuginfo-0:3.0.3-146.el5_11.ia64",
"product": {
"name": "xen-debuginfo-0:3.0.3-146.el5_11.ia64",
"product_id": "xen-debuginfo-0:3.0.3-146.el5_11.ia64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/xen-debuginfo@3.0.3-146.el5_11?arch=ia64"
}
}
},
{
"category": "product_version",
"name": "xen-devel-0:3.0.3-146.el5_11.ia64",
"product": {
"name": "xen-devel-0:3.0.3-146.el5_11.ia64",
"product_id": "xen-devel-0:3.0.3-146.el5_11.ia64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/xen-devel@3.0.3-146.el5_11?arch=ia64"
}
}
},
{
"category": "product_version",
"name": "xen-libs-0:3.0.3-146.el5_11.ia64",
"product": {
"name": "xen-libs-0:3.0.3-146.el5_11.ia64",
"product_id": "xen-libs-0:3.0.3-146.el5_11.ia64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/xen-libs@3.0.3-146.el5_11?arch=ia64"
}
}
}
],
"category": "architecture",
"name": "ia64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-0:3.0.3-146.el5_11.i386 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client-5.11.Z:xen-0:3.0.3-146.el5_11.i386"
},
"product_reference": "xen-0:3.0.3-146.el5_11.i386",
"relates_to_product_reference": "5Client-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-0:3.0.3-146.el5_11.ia64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client-5.11.Z:xen-0:3.0.3-146.el5_11.ia64"
},
"product_reference": "xen-0:3.0.3-146.el5_11.ia64",
"relates_to_product_reference": "5Client-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-0:3.0.3-146.el5_11.src as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client-5.11.Z:xen-0:3.0.3-146.el5_11.src"
},
"product_reference": "xen-0:3.0.3-146.el5_11.src",
"relates_to_product_reference": "5Client-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-0:3.0.3-146.el5_11.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client-5.11.Z:xen-0:3.0.3-146.el5_11.x86_64"
},
"product_reference": "xen-0:3.0.3-146.el5_11.x86_64",
"relates_to_product_reference": "5Client-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-debuginfo-0:3.0.3-146.el5_11.i386 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client-5.11.Z:xen-debuginfo-0:3.0.3-146.el5_11.i386"
},
"product_reference": "xen-debuginfo-0:3.0.3-146.el5_11.i386",
"relates_to_product_reference": "5Client-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-debuginfo-0:3.0.3-146.el5_11.ia64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client-5.11.Z:xen-debuginfo-0:3.0.3-146.el5_11.ia64"
},
"product_reference": "xen-debuginfo-0:3.0.3-146.el5_11.ia64",
"relates_to_product_reference": "5Client-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-debuginfo-0:3.0.3-146.el5_11.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client-5.11.Z:xen-debuginfo-0:3.0.3-146.el5_11.x86_64"
},
"product_reference": "xen-debuginfo-0:3.0.3-146.el5_11.x86_64",
"relates_to_product_reference": "5Client-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-devel-0:3.0.3-146.el5_11.i386 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client-5.11.Z:xen-devel-0:3.0.3-146.el5_11.i386"
},
"product_reference": "xen-devel-0:3.0.3-146.el5_11.i386",
"relates_to_product_reference": "5Client-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-devel-0:3.0.3-146.el5_11.ia64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client-5.11.Z:xen-devel-0:3.0.3-146.el5_11.ia64"
},
"product_reference": "xen-devel-0:3.0.3-146.el5_11.ia64",
"relates_to_product_reference": "5Client-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-devel-0:3.0.3-146.el5_11.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client-5.11.Z:xen-devel-0:3.0.3-146.el5_11.x86_64"
},
"product_reference": "xen-devel-0:3.0.3-146.el5_11.x86_64",
"relates_to_product_reference": "5Client-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-libs-0:3.0.3-146.el5_11.i386 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client-5.11.Z:xen-libs-0:3.0.3-146.el5_11.i386"
},
"product_reference": "xen-libs-0:3.0.3-146.el5_11.i386",
"relates_to_product_reference": "5Client-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-libs-0:3.0.3-146.el5_11.ia64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client-5.11.Z:xen-libs-0:3.0.3-146.el5_11.ia64"
},
"product_reference": "xen-libs-0:3.0.3-146.el5_11.ia64",
"relates_to_product_reference": "5Client-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-libs-0:3.0.3-146.el5_11.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client-5.11.Z:xen-libs-0:3.0.3-146.el5_11.x86_64"
},
"product_reference": "xen-libs-0:3.0.3-146.el5_11.x86_64",
"relates_to_product_reference": "5Client-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-0:3.0.3-146.el5_11.i386 as a component of Red Hat Enterprise Linux Desktop Multi OS (v. 5 client)",
"product_id": "5Client-VT-5.11.Z:xen-0:3.0.3-146.el5_11.i386"
},
"product_reference": "xen-0:3.0.3-146.el5_11.i386",
"relates_to_product_reference": "5Client-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-0:3.0.3-146.el5_11.ia64 as a component of Red Hat Enterprise Linux Desktop Multi OS (v. 5 client)",
"product_id": "5Client-VT-5.11.Z:xen-0:3.0.3-146.el5_11.ia64"
},
"product_reference": "xen-0:3.0.3-146.el5_11.ia64",
"relates_to_product_reference": "5Client-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-0:3.0.3-146.el5_11.src as a component of Red Hat Enterprise Linux Desktop Multi OS (v. 5 client)",
"product_id": "5Client-VT-5.11.Z:xen-0:3.0.3-146.el5_11.src"
},
"product_reference": "xen-0:3.0.3-146.el5_11.src",
"relates_to_product_reference": "5Client-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-0:3.0.3-146.el5_11.x86_64 as a component of Red Hat Enterprise Linux Desktop Multi OS (v. 5 client)",
"product_id": "5Client-VT-5.11.Z:xen-0:3.0.3-146.el5_11.x86_64"
},
"product_reference": "xen-0:3.0.3-146.el5_11.x86_64",
"relates_to_product_reference": "5Client-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-debuginfo-0:3.0.3-146.el5_11.i386 as a component of Red Hat Enterprise Linux Desktop Multi OS (v. 5 client)",
"product_id": "5Client-VT-5.11.Z:xen-debuginfo-0:3.0.3-146.el5_11.i386"
},
"product_reference": "xen-debuginfo-0:3.0.3-146.el5_11.i386",
"relates_to_product_reference": "5Client-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-debuginfo-0:3.0.3-146.el5_11.ia64 as a component of Red Hat Enterprise Linux Desktop Multi OS (v. 5 client)",
"product_id": "5Client-VT-5.11.Z:xen-debuginfo-0:3.0.3-146.el5_11.ia64"
},
"product_reference": "xen-debuginfo-0:3.0.3-146.el5_11.ia64",
"relates_to_product_reference": "5Client-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-debuginfo-0:3.0.3-146.el5_11.x86_64 as a component of Red Hat Enterprise Linux Desktop Multi OS (v. 5 client)",
"product_id": "5Client-VT-5.11.Z:xen-debuginfo-0:3.0.3-146.el5_11.x86_64"
},
"product_reference": "xen-debuginfo-0:3.0.3-146.el5_11.x86_64",
"relates_to_product_reference": "5Client-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-devel-0:3.0.3-146.el5_11.i386 as a component of Red Hat Enterprise Linux Desktop Multi OS (v. 5 client)",
"product_id": "5Client-VT-5.11.Z:xen-devel-0:3.0.3-146.el5_11.i386"
},
"product_reference": "xen-devel-0:3.0.3-146.el5_11.i386",
"relates_to_product_reference": "5Client-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-devel-0:3.0.3-146.el5_11.ia64 as a component of Red Hat Enterprise Linux Desktop Multi OS (v. 5 client)",
"product_id": "5Client-VT-5.11.Z:xen-devel-0:3.0.3-146.el5_11.ia64"
},
"product_reference": "xen-devel-0:3.0.3-146.el5_11.ia64",
"relates_to_product_reference": "5Client-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-devel-0:3.0.3-146.el5_11.x86_64 as a component of Red Hat Enterprise Linux Desktop Multi OS (v. 5 client)",
"product_id": "5Client-VT-5.11.Z:xen-devel-0:3.0.3-146.el5_11.x86_64"
},
"product_reference": "xen-devel-0:3.0.3-146.el5_11.x86_64",
"relates_to_product_reference": "5Client-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-libs-0:3.0.3-146.el5_11.i386 as a component of Red Hat Enterprise Linux Desktop Multi OS (v. 5 client)",
"product_id": "5Client-VT-5.11.Z:xen-libs-0:3.0.3-146.el5_11.i386"
},
"product_reference": "xen-libs-0:3.0.3-146.el5_11.i386",
"relates_to_product_reference": "5Client-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-libs-0:3.0.3-146.el5_11.ia64 as a component of Red Hat Enterprise Linux Desktop Multi OS (v. 5 client)",
"product_id": "5Client-VT-5.11.Z:xen-libs-0:3.0.3-146.el5_11.ia64"
},
"product_reference": "xen-libs-0:3.0.3-146.el5_11.ia64",
"relates_to_product_reference": "5Client-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-libs-0:3.0.3-146.el5_11.x86_64 as a component of Red Hat Enterprise Linux Desktop Multi OS (v. 5 client)",
"product_id": "5Client-VT-5.11.Z:xen-libs-0:3.0.3-146.el5_11.x86_64"
},
"product_reference": "xen-libs-0:3.0.3-146.el5_11.x86_64",
"relates_to_product_reference": "5Client-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-0:3.0.3-146.el5_11.i386 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server-5.11.Z:xen-0:3.0.3-146.el5_11.i386"
},
"product_reference": "xen-0:3.0.3-146.el5_11.i386",
"relates_to_product_reference": "5Server-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-0:3.0.3-146.el5_11.ia64 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server-5.11.Z:xen-0:3.0.3-146.el5_11.ia64"
},
"product_reference": "xen-0:3.0.3-146.el5_11.ia64",
"relates_to_product_reference": "5Server-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-0:3.0.3-146.el5_11.src as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server-5.11.Z:xen-0:3.0.3-146.el5_11.src"
},
"product_reference": "xen-0:3.0.3-146.el5_11.src",
"relates_to_product_reference": "5Server-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-0:3.0.3-146.el5_11.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server-5.11.Z:xen-0:3.0.3-146.el5_11.x86_64"
},
"product_reference": "xen-0:3.0.3-146.el5_11.x86_64",
"relates_to_product_reference": "5Server-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-debuginfo-0:3.0.3-146.el5_11.i386 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server-5.11.Z:xen-debuginfo-0:3.0.3-146.el5_11.i386"
},
"product_reference": "xen-debuginfo-0:3.0.3-146.el5_11.i386",
"relates_to_product_reference": "5Server-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-debuginfo-0:3.0.3-146.el5_11.ia64 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server-5.11.Z:xen-debuginfo-0:3.0.3-146.el5_11.ia64"
},
"product_reference": "xen-debuginfo-0:3.0.3-146.el5_11.ia64",
"relates_to_product_reference": "5Server-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-debuginfo-0:3.0.3-146.el5_11.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server-5.11.Z:xen-debuginfo-0:3.0.3-146.el5_11.x86_64"
},
"product_reference": "xen-debuginfo-0:3.0.3-146.el5_11.x86_64",
"relates_to_product_reference": "5Server-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-devel-0:3.0.3-146.el5_11.i386 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server-5.11.Z:xen-devel-0:3.0.3-146.el5_11.i386"
},
"product_reference": "xen-devel-0:3.0.3-146.el5_11.i386",
"relates_to_product_reference": "5Server-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-devel-0:3.0.3-146.el5_11.ia64 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server-5.11.Z:xen-devel-0:3.0.3-146.el5_11.ia64"
},
"product_reference": "xen-devel-0:3.0.3-146.el5_11.ia64",
"relates_to_product_reference": "5Server-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-devel-0:3.0.3-146.el5_11.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server-5.11.Z:xen-devel-0:3.0.3-146.el5_11.x86_64"
},
"product_reference": "xen-devel-0:3.0.3-146.el5_11.x86_64",
"relates_to_product_reference": "5Server-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-libs-0:3.0.3-146.el5_11.i386 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server-5.11.Z:xen-libs-0:3.0.3-146.el5_11.i386"
},
"product_reference": "xen-libs-0:3.0.3-146.el5_11.i386",
"relates_to_product_reference": "5Server-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-libs-0:3.0.3-146.el5_11.ia64 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server-5.11.Z:xen-libs-0:3.0.3-146.el5_11.ia64"
},
"product_reference": "xen-libs-0:3.0.3-146.el5_11.ia64",
"relates_to_product_reference": "5Server-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-libs-0:3.0.3-146.el5_11.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server-5.11.Z:xen-libs-0:3.0.3-146.el5_11.x86_64"
},
"product_reference": "xen-libs-0:3.0.3-146.el5_11.x86_64",
"relates_to_product_reference": "5Server-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-0:3.0.3-146.el5_11.i386 as a component of Red Hat Enterprise Linux Virtualization (v. 5 server)",
"product_id": "5Server-VT-5.11.Z:xen-0:3.0.3-146.el5_11.i386"
},
"product_reference": "xen-0:3.0.3-146.el5_11.i386",
"relates_to_product_reference": "5Server-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-0:3.0.3-146.el5_11.ia64 as a component of Red Hat Enterprise Linux Virtualization (v. 5 server)",
"product_id": "5Server-VT-5.11.Z:xen-0:3.0.3-146.el5_11.ia64"
},
"product_reference": "xen-0:3.0.3-146.el5_11.ia64",
"relates_to_product_reference": "5Server-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-0:3.0.3-146.el5_11.src as a component of Red Hat Enterprise Linux Virtualization (v. 5 server)",
"product_id": "5Server-VT-5.11.Z:xen-0:3.0.3-146.el5_11.src"
},
"product_reference": "xen-0:3.0.3-146.el5_11.src",
"relates_to_product_reference": "5Server-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-0:3.0.3-146.el5_11.x86_64 as a component of Red Hat Enterprise Linux Virtualization (v. 5 server)",
"product_id": "5Server-VT-5.11.Z:xen-0:3.0.3-146.el5_11.x86_64"
},
"product_reference": "xen-0:3.0.3-146.el5_11.x86_64",
"relates_to_product_reference": "5Server-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-debuginfo-0:3.0.3-146.el5_11.i386 as a component of Red Hat Enterprise Linux Virtualization (v. 5 server)",
"product_id": "5Server-VT-5.11.Z:xen-debuginfo-0:3.0.3-146.el5_11.i386"
},
"product_reference": "xen-debuginfo-0:3.0.3-146.el5_11.i386",
"relates_to_product_reference": "5Server-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-debuginfo-0:3.0.3-146.el5_11.ia64 as a component of Red Hat Enterprise Linux Virtualization (v. 5 server)",
"product_id": "5Server-VT-5.11.Z:xen-debuginfo-0:3.0.3-146.el5_11.ia64"
},
"product_reference": "xen-debuginfo-0:3.0.3-146.el5_11.ia64",
"relates_to_product_reference": "5Server-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-debuginfo-0:3.0.3-146.el5_11.x86_64 as a component of Red Hat Enterprise Linux Virtualization (v. 5 server)",
"product_id": "5Server-VT-5.11.Z:xen-debuginfo-0:3.0.3-146.el5_11.x86_64"
},
"product_reference": "xen-debuginfo-0:3.0.3-146.el5_11.x86_64",
"relates_to_product_reference": "5Server-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-devel-0:3.0.3-146.el5_11.i386 as a component of Red Hat Enterprise Linux Virtualization (v. 5 server)",
"product_id": "5Server-VT-5.11.Z:xen-devel-0:3.0.3-146.el5_11.i386"
},
"product_reference": "xen-devel-0:3.0.3-146.el5_11.i386",
"relates_to_product_reference": "5Server-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-devel-0:3.0.3-146.el5_11.ia64 as a component of Red Hat Enterprise Linux Virtualization (v. 5 server)",
"product_id": "5Server-VT-5.11.Z:xen-devel-0:3.0.3-146.el5_11.ia64"
},
"product_reference": "xen-devel-0:3.0.3-146.el5_11.ia64",
"relates_to_product_reference": "5Server-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-devel-0:3.0.3-146.el5_11.x86_64 as a component of Red Hat Enterprise Linux Virtualization (v. 5 server)",
"product_id": "5Server-VT-5.11.Z:xen-devel-0:3.0.3-146.el5_11.x86_64"
},
"product_reference": "xen-devel-0:3.0.3-146.el5_11.x86_64",
"relates_to_product_reference": "5Server-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-libs-0:3.0.3-146.el5_11.i386 as a component of Red Hat Enterprise Linux Virtualization (v. 5 server)",
"product_id": "5Server-VT-5.11.Z:xen-libs-0:3.0.3-146.el5_11.i386"
},
"product_reference": "xen-libs-0:3.0.3-146.el5_11.i386",
"relates_to_product_reference": "5Server-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-libs-0:3.0.3-146.el5_11.ia64 as a component of Red Hat Enterprise Linux Virtualization (v. 5 server)",
"product_id": "5Server-VT-5.11.Z:xen-libs-0:3.0.3-146.el5_11.ia64"
},
"product_reference": "xen-libs-0:3.0.3-146.el5_11.ia64",
"relates_to_product_reference": "5Server-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-libs-0:3.0.3-146.el5_11.x86_64 as a component of Red Hat Enterprise Linux Virtualization (v. 5 server)",
"product_id": "5Server-VT-5.11.Z:xen-libs-0:3.0.3-146.el5_11.x86_64"
},
"product_reference": "xen-libs-0:3.0.3-146.el5_11.x86_64",
"relates_to_product_reference": "5Server-VT-5.11.Z"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Jason Geffner"
],
"organization": "CrowdStrike"
}
],
"cve": "CVE-2015-3456",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2015-05-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1218611"
}
],
"notes": [
{
"category": "description",
"text": "An out-of-bounds memory access flaw was found in the way QEMU\u0027s virtual Floppy Disk Controller (FDC) handled FIFO buffer access while processing certain FDC commands. A privileged guest user could use this flaw to crash the guest or, potentially, execute arbitrary code on the host with the privileges of the host\u0027s QEMU process corresponding to the guest.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "qemu: fdc: out-of-bounds fifo buffer memory access",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue affects the versions of the kvm and xen packages as shipped with Red Hat Enterprise Linux 5, the versions of the qemu-kvm packages as shipped with Red Hat Enterprise Linux 6 and 7, and the versions of qemu-kvm-rhev packages as shipped with Red Hat Enterprise Virtualization 3. Future updates for the respective releases will address this flaw.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Client-5.11.Z:xen-0:3.0.3-146.el5_11.i386",
"5Client-5.11.Z:xen-0:3.0.3-146.el5_11.ia64",
"5Client-5.11.Z:xen-0:3.0.3-146.el5_11.src",
"5Client-5.11.Z:xen-0:3.0.3-146.el5_11.x86_64",
"5Client-5.11.Z:xen-debuginfo-0:3.0.3-146.el5_11.i386",
"5Client-5.11.Z:xen-debuginfo-0:3.0.3-146.el5_11.ia64",
"5Client-5.11.Z:xen-debuginfo-0:3.0.3-146.el5_11.x86_64",
"5Client-5.11.Z:xen-devel-0:3.0.3-146.el5_11.i386",
"5Client-5.11.Z:xen-devel-0:3.0.3-146.el5_11.ia64",
"5Client-5.11.Z:xen-devel-0:3.0.3-146.el5_11.x86_64",
"5Client-5.11.Z:xen-libs-0:3.0.3-146.el5_11.i386",
"5Client-5.11.Z:xen-libs-0:3.0.3-146.el5_11.ia64",
"5Client-5.11.Z:xen-libs-0:3.0.3-146.el5_11.x86_64",
"5Client-VT-5.11.Z:xen-0:3.0.3-146.el5_11.i386",
"5Client-VT-5.11.Z:xen-0:3.0.3-146.el5_11.ia64",
"5Client-VT-5.11.Z:xen-0:3.0.3-146.el5_11.src",
"5Client-VT-5.11.Z:xen-0:3.0.3-146.el5_11.x86_64",
"5Client-VT-5.11.Z:xen-debuginfo-0:3.0.3-146.el5_11.i386",
"5Client-VT-5.11.Z:xen-debuginfo-0:3.0.3-146.el5_11.ia64",
"5Client-VT-5.11.Z:xen-debuginfo-0:3.0.3-146.el5_11.x86_64",
"5Client-VT-5.11.Z:xen-devel-0:3.0.3-146.el5_11.i386",
"5Client-VT-5.11.Z:xen-devel-0:3.0.3-146.el5_11.ia64",
"5Client-VT-5.11.Z:xen-devel-0:3.0.3-146.el5_11.x86_64",
"5Client-VT-5.11.Z:xen-libs-0:3.0.3-146.el5_11.i386",
"5Client-VT-5.11.Z:xen-libs-0:3.0.3-146.el5_11.ia64",
"5Client-VT-5.11.Z:xen-libs-0:3.0.3-146.el5_11.x86_64",
"5Server-5.11.Z:xen-0:3.0.3-146.el5_11.i386",
"5Server-5.11.Z:xen-0:3.0.3-146.el5_11.ia64",
"5Server-5.11.Z:xen-0:3.0.3-146.el5_11.src",
"5Server-5.11.Z:xen-0:3.0.3-146.el5_11.x86_64",
"5Server-5.11.Z:xen-debuginfo-0:3.0.3-146.el5_11.i386",
"5Server-5.11.Z:xen-debuginfo-0:3.0.3-146.el5_11.ia64",
"5Server-5.11.Z:xen-debuginfo-0:3.0.3-146.el5_11.x86_64",
"5Server-5.11.Z:xen-devel-0:3.0.3-146.el5_11.i386",
"5Server-5.11.Z:xen-devel-0:3.0.3-146.el5_11.ia64",
"5Server-5.11.Z:xen-devel-0:3.0.3-146.el5_11.x86_64",
"5Server-5.11.Z:xen-libs-0:3.0.3-146.el5_11.i386",
"5Server-5.11.Z:xen-libs-0:3.0.3-146.el5_11.ia64",
"5Server-5.11.Z:xen-libs-0:3.0.3-146.el5_11.x86_64",
"5Server-VT-5.11.Z:xen-0:3.0.3-146.el5_11.i386",
"5Server-VT-5.11.Z:xen-0:3.0.3-146.el5_11.ia64",
"5Server-VT-5.11.Z:xen-0:3.0.3-146.el5_11.src",
"5Server-VT-5.11.Z:xen-0:3.0.3-146.el5_11.x86_64",
"5Server-VT-5.11.Z:xen-debuginfo-0:3.0.3-146.el5_11.i386",
"5Server-VT-5.11.Z:xen-debuginfo-0:3.0.3-146.el5_11.ia64",
"5Server-VT-5.11.Z:xen-debuginfo-0:3.0.3-146.el5_11.x86_64",
"5Server-VT-5.11.Z:xen-devel-0:3.0.3-146.el5_11.i386",
"5Server-VT-5.11.Z:xen-devel-0:3.0.3-146.el5_11.ia64",
"5Server-VT-5.11.Z:xen-devel-0:3.0.3-146.el5_11.x86_64",
"5Server-VT-5.11.Z:xen-libs-0:3.0.3-146.el5_11.i386",
"5Server-VT-5.11.Z:xen-libs-0:3.0.3-146.el5_11.ia64",
"5Server-VT-5.11.Z:xen-libs-0:3.0.3-146.el5_11.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-3456"
},
{
"category": "external",
"summary": "RHBZ#1218611",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1218611"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-3456",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-3456"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-3456",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-3456"
},
{
"category": "external",
"summary": "http://venom.crowdstrike.com/",
"url": "http://venom.crowdstrike.com/"
},
{
"category": "external",
"summary": "http://xenbits.xen.org/xsa/advisory-133.html",
"url": "http://xenbits.xen.org/xsa/advisory-133.html"
},
{
"category": "external",
"summary": "https://access.redhat.com/articles/1444903",
"url": "https://access.redhat.com/articles/1444903"
},
{
"category": "external",
"summary": "https://securityblog.redhat.com/2015/05/13/venom-dont-get-bitten/",
"url": "https://securityblog.redhat.com/2015/05/13/venom-dont-get-bitten/"
}
],
"release_date": "2015-05-13T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-05-13T11:22:45+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"5Client-5.11.Z:xen-0:3.0.3-146.el5_11.i386",
"5Client-5.11.Z:xen-0:3.0.3-146.el5_11.ia64",
"5Client-5.11.Z:xen-0:3.0.3-146.el5_11.src",
"5Client-5.11.Z:xen-0:3.0.3-146.el5_11.x86_64",
"5Client-5.11.Z:xen-debuginfo-0:3.0.3-146.el5_11.i386",
"5Client-5.11.Z:xen-debuginfo-0:3.0.3-146.el5_11.ia64",
"5Client-5.11.Z:xen-debuginfo-0:3.0.3-146.el5_11.x86_64",
"5Client-5.11.Z:xen-devel-0:3.0.3-146.el5_11.i386",
"5Client-5.11.Z:xen-devel-0:3.0.3-146.el5_11.ia64",
"5Client-5.11.Z:xen-devel-0:3.0.3-146.el5_11.x86_64",
"5Client-5.11.Z:xen-libs-0:3.0.3-146.el5_11.i386",
"5Client-5.11.Z:xen-libs-0:3.0.3-146.el5_11.ia64",
"5Client-5.11.Z:xen-libs-0:3.0.3-146.el5_11.x86_64",
"5Client-VT-5.11.Z:xen-0:3.0.3-146.el5_11.i386",
"5Client-VT-5.11.Z:xen-0:3.0.3-146.el5_11.ia64",
"5Client-VT-5.11.Z:xen-0:3.0.3-146.el5_11.src",
"5Client-VT-5.11.Z:xen-0:3.0.3-146.el5_11.x86_64",
"5Client-VT-5.11.Z:xen-debuginfo-0:3.0.3-146.el5_11.i386",
"5Client-VT-5.11.Z:xen-debuginfo-0:3.0.3-146.el5_11.ia64",
"5Client-VT-5.11.Z:xen-debuginfo-0:3.0.3-146.el5_11.x86_64",
"5Client-VT-5.11.Z:xen-devel-0:3.0.3-146.el5_11.i386",
"5Client-VT-5.11.Z:xen-devel-0:3.0.3-146.el5_11.ia64",
"5Client-VT-5.11.Z:xen-devel-0:3.0.3-146.el5_11.x86_64",
"5Client-VT-5.11.Z:xen-libs-0:3.0.3-146.el5_11.i386",
"5Client-VT-5.11.Z:xen-libs-0:3.0.3-146.el5_11.ia64",
"5Client-VT-5.11.Z:xen-libs-0:3.0.3-146.el5_11.x86_64",
"5Server-5.11.Z:xen-0:3.0.3-146.el5_11.i386",
"5Server-5.11.Z:xen-0:3.0.3-146.el5_11.ia64",
"5Server-5.11.Z:xen-0:3.0.3-146.el5_11.src",
"5Server-5.11.Z:xen-0:3.0.3-146.el5_11.x86_64",
"5Server-5.11.Z:xen-debuginfo-0:3.0.3-146.el5_11.i386",
"5Server-5.11.Z:xen-debuginfo-0:3.0.3-146.el5_11.ia64",
"5Server-5.11.Z:xen-debuginfo-0:3.0.3-146.el5_11.x86_64",
"5Server-5.11.Z:xen-devel-0:3.0.3-146.el5_11.i386",
"5Server-5.11.Z:xen-devel-0:3.0.3-146.el5_11.ia64",
"5Server-5.11.Z:xen-devel-0:3.0.3-146.el5_11.x86_64",
"5Server-5.11.Z:xen-libs-0:3.0.3-146.el5_11.i386",
"5Server-5.11.Z:xen-libs-0:3.0.3-146.el5_11.ia64",
"5Server-5.11.Z:xen-libs-0:3.0.3-146.el5_11.x86_64",
"5Server-VT-5.11.Z:xen-0:3.0.3-146.el5_11.i386",
"5Server-VT-5.11.Z:xen-0:3.0.3-146.el5_11.ia64",
"5Server-VT-5.11.Z:xen-0:3.0.3-146.el5_11.src",
"5Server-VT-5.11.Z:xen-0:3.0.3-146.el5_11.x86_64",
"5Server-VT-5.11.Z:xen-debuginfo-0:3.0.3-146.el5_11.i386",
"5Server-VT-5.11.Z:xen-debuginfo-0:3.0.3-146.el5_11.ia64",
"5Server-VT-5.11.Z:xen-debuginfo-0:3.0.3-146.el5_11.x86_64",
"5Server-VT-5.11.Z:xen-devel-0:3.0.3-146.el5_11.i386",
"5Server-VT-5.11.Z:xen-devel-0:3.0.3-146.el5_11.ia64",
"5Server-VT-5.11.Z:xen-devel-0:3.0.3-146.el5_11.x86_64",
"5Server-VT-5.11.Z:xen-libs-0:3.0.3-146.el5_11.i386",
"5Server-VT-5.11.Z:xen-libs-0:3.0.3-146.el5_11.ia64",
"5Server-VT-5.11.Z:xen-libs-0:3.0.3-146.el5_11.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:1002"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "COMPLETE",
"baseScore": 6.5,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:A/AC:H/Au:S/C:C/I:C/A:C",
"version": "2.0"
},
"products": [
"5Client-5.11.Z:xen-0:3.0.3-146.el5_11.i386",
"5Client-5.11.Z:xen-0:3.0.3-146.el5_11.ia64",
"5Client-5.11.Z:xen-0:3.0.3-146.el5_11.src",
"5Client-5.11.Z:xen-0:3.0.3-146.el5_11.x86_64",
"5Client-5.11.Z:xen-debuginfo-0:3.0.3-146.el5_11.i386",
"5Client-5.11.Z:xen-debuginfo-0:3.0.3-146.el5_11.ia64",
"5Client-5.11.Z:xen-debuginfo-0:3.0.3-146.el5_11.x86_64",
"5Client-5.11.Z:xen-devel-0:3.0.3-146.el5_11.i386",
"5Client-5.11.Z:xen-devel-0:3.0.3-146.el5_11.ia64",
"5Client-5.11.Z:xen-devel-0:3.0.3-146.el5_11.x86_64",
"5Client-5.11.Z:xen-libs-0:3.0.3-146.el5_11.i386",
"5Client-5.11.Z:xen-libs-0:3.0.3-146.el5_11.ia64",
"5Client-5.11.Z:xen-libs-0:3.0.3-146.el5_11.x86_64",
"5Client-VT-5.11.Z:xen-0:3.0.3-146.el5_11.i386",
"5Client-VT-5.11.Z:xen-0:3.0.3-146.el5_11.ia64",
"5Client-VT-5.11.Z:xen-0:3.0.3-146.el5_11.src",
"5Client-VT-5.11.Z:xen-0:3.0.3-146.el5_11.x86_64",
"5Client-VT-5.11.Z:xen-debuginfo-0:3.0.3-146.el5_11.i386",
"5Client-VT-5.11.Z:xen-debuginfo-0:3.0.3-146.el5_11.ia64",
"5Client-VT-5.11.Z:xen-debuginfo-0:3.0.3-146.el5_11.x86_64",
"5Client-VT-5.11.Z:xen-devel-0:3.0.3-146.el5_11.i386",
"5Client-VT-5.11.Z:xen-devel-0:3.0.3-146.el5_11.ia64",
"5Client-VT-5.11.Z:xen-devel-0:3.0.3-146.el5_11.x86_64",
"5Client-VT-5.11.Z:xen-libs-0:3.0.3-146.el5_11.i386",
"5Client-VT-5.11.Z:xen-libs-0:3.0.3-146.el5_11.ia64",
"5Client-VT-5.11.Z:xen-libs-0:3.0.3-146.el5_11.x86_64",
"5Server-5.11.Z:xen-0:3.0.3-146.el5_11.i386",
"5Server-5.11.Z:xen-0:3.0.3-146.el5_11.ia64",
"5Server-5.11.Z:xen-0:3.0.3-146.el5_11.src",
"5Server-5.11.Z:xen-0:3.0.3-146.el5_11.x86_64",
"5Server-5.11.Z:xen-debuginfo-0:3.0.3-146.el5_11.i386",
"5Server-5.11.Z:xen-debuginfo-0:3.0.3-146.el5_11.ia64",
"5Server-5.11.Z:xen-debuginfo-0:3.0.3-146.el5_11.x86_64",
"5Server-5.11.Z:xen-devel-0:3.0.3-146.el5_11.i386",
"5Server-5.11.Z:xen-devel-0:3.0.3-146.el5_11.ia64",
"5Server-5.11.Z:xen-devel-0:3.0.3-146.el5_11.x86_64",
"5Server-5.11.Z:xen-libs-0:3.0.3-146.el5_11.i386",
"5Server-5.11.Z:xen-libs-0:3.0.3-146.el5_11.ia64",
"5Server-5.11.Z:xen-libs-0:3.0.3-146.el5_11.x86_64",
"5Server-VT-5.11.Z:xen-0:3.0.3-146.el5_11.i386",
"5Server-VT-5.11.Z:xen-0:3.0.3-146.el5_11.ia64",
"5Server-VT-5.11.Z:xen-0:3.0.3-146.el5_11.src",
"5Server-VT-5.11.Z:xen-0:3.0.3-146.el5_11.x86_64",
"5Server-VT-5.11.Z:xen-debuginfo-0:3.0.3-146.el5_11.i386",
"5Server-VT-5.11.Z:xen-debuginfo-0:3.0.3-146.el5_11.ia64",
"5Server-VT-5.11.Z:xen-debuginfo-0:3.0.3-146.el5_11.x86_64",
"5Server-VT-5.11.Z:xen-devel-0:3.0.3-146.el5_11.i386",
"5Server-VT-5.11.Z:xen-devel-0:3.0.3-146.el5_11.ia64",
"5Server-VT-5.11.Z:xen-devel-0:3.0.3-146.el5_11.x86_64",
"5Server-VT-5.11.Z:xen-libs-0:3.0.3-146.el5_11.i386",
"5Server-VT-5.11.Z:xen-libs-0:3.0.3-146.el5_11.ia64",
"5Server-VT-5.11.Z:xen-libs-0:3.0.3-146.el5_11.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "qemu: fdc: out-of-bounds fifo buffer memory access"
}
]
}
RHSA-2015_1003
Vulnerability from csaf_redhat - Published: 2015-05-13 11:22 - Updated: 2024-11-14 15:27Summary
Red Hat Security Advisory: kvm security update
Severity
Important
Notes
Topic: Updated kvm packages that fix one security issue are now available for Red
Hat Enterprise Linux 5.
Red Hat Product Security has rated this update as having Important security
impact. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available from the CVE link in the
References section.
Details: KVM (Kernel-based Virtual Machine) is a full virtualization solution for
Linux on AMD64 and Intel 64 systems.
An out-of-bounds memory access flaw was found in the way QEMU's virtual
Floppy Disk Controller (FDC) handled FIFO buffer access while processing
certain FDC commands. A privileged guest user could use this flaw to crash
the guest or, potentially, execute arbitrary code on the host with the
privileges of the host's QEMU process corresponding to the guest.
(CVE-2015-3456)
Red Hat would like to thank Jason Geffner of CrowdStrike for reporting
this issue.
All kvm users are advised to upgrade to these updated packages, which
contain a backported patch to correct this issue. Note: The procedure in
the Solution section must be performed before this update will take effect.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
An out-of-bounds memory access flaw was found in the way QEMU's virtual Floppy Disk Controller (FDC) handled FIFO buffer access while processing certain FDC commands. A privileged guest user could use this flaw to crash the guest or, potentially, execute arbitrary code on the host with the privileges of the host's QEMU process corresponding to the guest.
6.5 ()
Affected products
Fixed
14 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 5Client-VT-5.11.Z:kmod-kvm-0:83-272.el5_11.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Client-VT-5.11.Z:kmod-kvm-debug-0:83-272.el5_11.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Client-VT-5.11.Z:kvm-0:83-272.el5_11.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Client-VT-5.11.Z:kvm-0:83-272.el5_11.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Client-VT-5.11.Z:kvm-debuginfo-0:83-272.el5_11.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Client-VT-5.11.Z:kvm-qemu-img-0:83-272.el5_11.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Client-VT-5.11.Z:kvm-tools-0:83-272.el5_11.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-VT-5.11.Z:kmod-kvm-0:83-272.el5_11.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-VT-5.11.Z:kmod-kvm-debug-0:83-272.el5_11.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-VT-5.11.Z:kvm-0:83-272.el5_11.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-VT-5.11.Z:kvm-0:83-272.el5_11.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-VT-5.11.Z:kvm-debuginfo-0:83-272.el5_11.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-VT-5.11.Z:kvm-qemu-img-0:83-272.el5_11.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-VT-5.11.Z:kvm-tools-0:83-272.el5_11.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Important
References
12 references
Acknowledgments
CrowdStrike
Jason Geffner
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated kvm packages that fix one security issue are now available for Red\nHat Enterprise Linux 5.\n\nRed Hat Product Security has rated this update as having Important security\nimpact. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available from the CVE link in the\nReferences section.",
"title": "Topic"
},
{
"category": "general",
"text": "KVM (Kernel-based Virtual Machine) is a full virtualization solution for\nLinux on AMD64 and Intel 64 systems.\n\nAn out-of-bounds memory access flaw was found in the way QEMU\u0027s virtual\nFloppy Disk Controller (FDC) handled FIFO buffer access while processing\ncertain FDC commands. A privileged guest user could use this flaw to crash\nthe guest or, potentially, execute arbitrary code on the host with the\nprivileges of the host\u0027s QEMU process corresponding to the guest.\n(CVE-2015-3456)\n\nRed Hat would like to thank Jason Geffner of CrowdStrike for reporting\nthis issue.\n\nAll kvm users are advised to upgrade to these updated packages, which\ncontain a backported patch to correct this issue. Note: The procedure in\nthe Solution section must be performed before this update will take effect.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2015:1003",
"url": "https://access.redhat.com/errata/RHSA-2015:1003"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "1218611",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1218611"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1003.json"
}
],
"title": "Red Hat Security Advisory: kvm security update",
"tracking": {
"current_release_date": "2024-11-14T15:27:25+00:00",
"generator": {
"date": "2024-11-14T15:27:25+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.0"
}
},
"id": "RHSA-2015:1003",
"initial_release_date": "2015-05-13T11:22:14+00:00",
"revision_history": [
{
"date": "2015-05-13T11:22:14+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2015-05-13T11:22:15+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-14T15:27:25+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Desktop Multi OS (v. 5 client)",
"product": {
"name": "Red Hat Enterprise Linux Desktop Multi OS (v. 5 client)",
"product_id": "5Client-VT-5.11.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_virtualization:5::client"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Virtualization (v. 5 server)",
"product": {
"name": "Red Hat Enterprise Linux Virtualization (v. 5 server)",
"product_id": "5Server-VT-5.11.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_virtualization:5::server"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "kvm-debuginfo-0:83-272.el5_11.x86_64",
"product": {
"name": "kvm-debuginfo-0:83-272.el5_11.x86_64",
"product_id": "kvm-debuginfo-0:83-272.el5_11.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/kvm-debuginfo@83-272.el5_11?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "kvm-0:83-272.el5_11.x86_64",
"product": {
"name": "kvm-0:83-272.el5_11.x86_64",
"product_id": "kvm-0:83-272.el5_11.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/kvm@83-272.el5_11?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "kvm-tools-0:83-272.el5_11.x86_64",
"product": {
"name": "kvm-tools-0:83-272.el5_11.x86_64",
"product_id": "kvm-tools-0:83-272.el5_11.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/kvm-tools@83-272.el5_11?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "kmod-kvm-0:83-272.el5_11.x86_64",
"product": {
"name": "kmod-kvm-0:83-272.el5_11.x86_64",
"product_id": "kmod-kvm-0:83-272.el5_11.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/kmod-kvm@83-272.el5_11?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "kmod-kvm-debug-0:83-272.el5_11.x86_64",
"product": {
"name": "kmod-kvm-debug-0:83-272.el5_11.x86_64",
"product_id": "kmod-kvm-debug-0:83-272.el5_11.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/kmod-kvm-debug@83-272.el5_11?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "kvm-qemu-img-0:83-272.el5_11.x86_64",
"product": {
"name": "kvm-qemu-img-0:83-272.el5_11.x86_64",
"product_id": "kvm-qemu-img-0:83-272.el5_11.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/kvm-qemu-img@83-272.el5_11?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "kvm-0:83-272.el5_11.src",
"product": {
"name": "kvm-0:83-272.el5_11.src",
"product_id": "kvm-0:83-272.el5_11.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/kvm@83-272.el5_11?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "kmod-kvm-0:83-272.el5_11.x86_64 as a component of Red Hat Enterprise Linux Desktop Multi OS (v. 5 client)",
"product_id": "5Client-VT-5.11.Z:kmod-kvm-0:83-272.el5_11.x86_64"
},
"product_reference": "kmod-kvm-0:83-272.el5_11.x86_64",
"relates_to_product_reference": "5Client-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kmod-kvm-debug-0:83-272.el5_11.x86_64 as a component of Red Hat Enterprise Linux Desktop Multi OS (v. 5 client)",
"product_id": "5Client-VT-5.11.Z:kmod-kvm-debug-0:83-272.el5_11.x86_64"
},
"product_reference": "kmod-kvm-debug-0:83-272.el5_11.x86_64",
"relates_to_product_reference": "5Client-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kvm-0:83-272.el5_11.src as a component of Red Hat Enterprise Linux Desktop Multi OS (v. 5 client)",
"product_id": "5Client-VT-5.11.Z:kvm-0:83-272.el5_11.src"
},
"product_reference": "kvm-0:83-272.el5_11.src",
"relates_to_product_reference": "5Client-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kvm-0:83-272.el5_11.x86_64 as a component of Red Hat Enterprise Linux Desktop Multi OS (v. 5 client)",
"product_id": "5Client-VT-5.11.Z:kvm-0:83-272.el5_11.x86_64"
},
"product_reference": "kvm-0:83-272.el5_11.x86_64",
"relates_to_product_reference": "5Client-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kvm-debuginfo-0:83-272.el5_11.x86_64 as a component of Red Hat Enterprise Linux Desktop Multi OS (v. 5 client)",
"product_id": "5Client-VT-5.11.Z:kvm-debuginfo-0:83-272.el5_11.x86_64"
},
"product_reference": "kvm-debuginfo-0:83-272.el5_11.x86_64",
"relates_to_product_reference": "5Client-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kvm-qemu-img-0:83-272.el5_11.x86_64 as a component of Red Hat Enterprise Linux Desktop Multi OS (v. 5 client)",
"product_id": "5Client-VT-5.11.Z:kvm-qemu-img-0:83-272.el5_11.x86_64"
},
"product_reference": "kvm-qemu-img-0:83-272.el5_11.x86_64",
"relates_to_product_reference": "5Client-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kvm-tools-0:83-272.el5_11.x86_64 as a component of Red Hat Enterprise Linux Desktop Multi OS (v. 5 client)",
"product_id": "5Client-VT-5.11.Z:kvm-tools-0:83-272.el5_11.x86_64"
},
"product_reference": "kvm-tools-0:83-272.el5_11.x86_64",
"relates_to_product_reference": "5Client-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kmod-kvm-0:83-272.el5_11.x86_64 as a component of Red Hat Enterprise Linux Virtualization (v. 5 server)",
"product_id": "5Server-VT-5.11.Z:kmod-kvm-0:83-272.el5_11.x86_64"
},
"product_reference": "kmod-kvm-0:83-272.el5_11.x86_64",
"relates_to_product_reference": "5Server-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kmod-kvm-debug-0:83-272.el5_11.x86_64 as a component of Red Hat Enterprise Linux Virtualization (v. 5 server)",
"product_id": "5Server-VT-5.11.Z:kmod-kvm-debug-0:83-272.el5_11.x86_64"
},
"product_reference": "kmod-kvm-debug-0:83-272.el5_11.x86_64",
"relates_to_product_reference": "5Server-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kvm-0:83-272.el5_11.src as a component of Red Hat Enterprise Linux Virtualization (v. 5 server)",
"product_id": "5Server-VT-5.11.Z:kvm-0:83-272.el5_11.src"
},
"product_reference": "kvm-0:83-272.el5_11.src",
"relates_to_product_reference": "5Server-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kvm-0:83-272.el5_11.x86_64 as a component of Red Hat Enterprise Linux Virtualization (v. 5 server)",
"product_id": "5Server-VT-5.11.Z:kvm-0:83-272.el5_11.x86_64"
},
"product_reference": "kvm-0:83-272.el5_11.x86_64",
"relates_to_product_reference": "5Server-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kvm-debuginfo-0:83-272.el5_11.x86_64 as a component of Red Hat Enterprise Linux Virtualization (v. 5 server)",
"product_id": "5Server-VT-5.11.Z:kvm-debuginfo-0:83-272.el5_11.x86_64"
},
"product_reference": "kvm-debuginfo-0:83-272.el5_11.x86_64",
"relates_to_product_reference": "5Server-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kvm-qemu-img-0:83-272.el5_11.x86_64 as a component of Red Hat Enterprise Linux Virtualization (v. 5 server)",
"product_id": "5Server-VT-5.11.Z:kvm-qemu-img-0:83-272.el5_11.x86_64"
},
"product_reference": "kvm-qemu-img-0:83-272.el5_11.x86_64",
"relates_to_product_reference": "5Server-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kvm-tools-0:83-272.el5_11.x86_64 as a component of Red Hat Enterprise Linux Virtualization (v. 5 server)",
"product_id": "5Server-VT-5.11.Z:kvm-tools-0:83-272.el5_11.x86_64"
},
"product_reference": "kvm-tools-0:83-272.el5_11.x86_64",
"relates_to_product_reference": "5Server-VT-5.11.Z"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Jason Geffner"
],
"organization": "CrowdStrike"
}
],
"cve": "CVE-2015-3456",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2015-05-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1218611"
}
],
"notes": [
{
"category": "description",
"text": "An out-of-bounds memory access flaw was found in the way QEMU\u0027s virtual Floppy Disk Controller (FDC) handled FIFO buffer access while processing certain FDC commands. A privileged guest user could use this flaw to crash the guest or, potentially, execute arbitrary code on the host with the privileges of the host\u0027s QEMU process corresponding to the guest.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "qemu: fdc: out-of-bounds fifo buffer memory access",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue affects the versions of the kvm and xen packages as shipped with Red Hat Enterprise Linux 5, the versions of the qemu-kvm packages as shipped with Red Hat Enterprise Linux 6 and 7, and the versions of qemu-kvm-rhev packages as shipped with Red Hat Enterprise Virtualization 3. Future updates for the respective releases will address this flaw.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Client-VT-5.11.Z:kmod-kvm-0:83-272.el5_11.x86_64",
"5Client-VT-5.11.Z:kmod-kvm-debug-0:83-272.el5_11.x86_64",
"5Client-VT-5.11.Z:kvm-0:83-272.el5_11.src",
"5Client-VT-5.11.Z:kvm-0:83-272.el5_11.x86_64",
"5Client-VT-5.11.Z:kvm-debuginfo-0:83-272.el5_11.x86_64",
"5Client-VT-5.11.Z:kvm-qemu-img-0:83-272.el5_11.x86_64",
"5Client-VT-5.11.Z:kvm-tools-0:83-272.el5_11.x86_64",
"5Server-VT-5.11.Z:kmod-kvm-0:83-272.el5_11.x86_64",
"5Server-VT-5.11.Z:kmod-kvm-debug-0:83-272.el5_11.x86_64",
"5Server-VT-5.11.Z:kvm-0:83-272.el5_11.src",
"5Server-VT-5.11.Z:kvm-0:83-272.el5_11.x86_64",
"5Server-VT-5.11.Z:kvm-debuginfo-0:83-272.el5_11.x86_64",
"5Server-VT-5.11.Z:kvm-qemu-img-0:83-272.el5_11.x86_64",
"5Server-VT-5.11.Z:kvm-tools-0:83-272.el5_11.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-3456"
},
{
"category": "external",
"summary": "RHBZ#1218611",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1218611"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-3456",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-3456"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-3456",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-3456"
},
{
"category": "external",
"summary": "http://venom.crowdstrike.com/",
"url": "http://venom.crowdstrike.com/"
},
{
"category": "external",
"summary": "http://xenbits.xen.org/xsa/advisory-133.html",
"url": "http://xenbits.xen.org/xsa/advisory-133.html"
},
{
"category": "external",
"summary": "https://access.redhat.com/articles/1444903",
"url": "https://access.redhat.com/articles/1444903"
},
{
"category": "external",
"summary": "https://securityblog.redhat.com/2015/05/13/venom-dont-get-bitten/",
"url": "https://securityblog.redhat.com/2015/05/13/venom-dont-get-bitten/"
}
],
"release_date": "2015-05-13T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-05-13T11:22:14+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nThe following procedure must be performed before this update will take\neffect:\n\n1) Stop all KVM guest virtual machines.\n\n2) Either reboot the hypervisor machine or, as the root user, remove (using\n\"modprobe -r [module]\") and reload (using \"modprobe [module]\") all of the\nfollowing modules which are currently running (determined using \"lsmod\"):\nkvm, ksm, kvm-intel or kvm-amd.\n\n3) Restart the KVM guest virtual machines.",
"product_ids": [
"5Client-VT-5.11.Z:kmod-kvm-0:83-272.el5_11.x86_64",
"5Client-VT-5.11.Z:kmod-kvm-debug-0:83-272.el5_11.x86_64",
"5Client-VT-5.11.Z:kvm-0:83-272.el5_11.src",
"5Client-VT-5.11.Z:kvm-0:83-272.el5_11.x86_64",
"5Client-VT-5.11.Z:kvm-debuginfo-0:83-272.el5_11.x86_64",
"5Client-VT-5.11.Z:kvm-qemu-img-0:83-272.el5_11.x86_64",
"5Client-VT-5.11.Z:kvm-tools-0:83-272.el5_11.x86_64",
"5Server-VT-5.11.Z:kmod-kvm-0:83-272.el5_11.x86_64",
"5Server-VT-5.11.Z:kmod-kvm-debug-0:83-272.el5_11.x86_64",
"5Server-VT-5.11.Z:kvm-0:83-272.el5_11.src",
"5Server-VT-5.11.Z:kvm-0:83-272.el5_11.x86_64",
"5Server-VT-5.11.Z:kvm-debuginfo-0:83-272.el5_11.x86_64",
"5Server-VT-5.11.Z:kvm-qemu-img-0:83-272.el5_11.x86_64",
"5Server-VT-5.11.Z:kvm-tools-0:83-272.el5_11.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:1003"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "COMPLETE",
"baseScore": 6.5,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:A/AC:H/Au:S/C:C/I:C/A:C",
"version": "2.0"
},
"products": [
"5Client-VT-5.11.Z:kmod-kvm-0:83-272.el5_11.x86_64",
"5Client-VT-5.11.Z:kmod-kvm-debug-0:83-272.el5_11.x86_64",
"5Client-VT-5.11.Z:kvm-0:83-272.el5_11.src",
"5Client-VT-5.11.Z:kvm-0:83-272.el5_11.x86_64",
"5Client-VT-5.11.Z:kvm-debuginfo-0:83-272.el5_11.x86_64",
"5Client-VT-5.11.Z:kvm-qemu-img-0:83-272.el5_11.x86_64",
"5Client-VT-5.11.Z:kvm-tools-0:83-272.el5_11.x86_64",
"5Server-VT-5.11.Z:kmod-kvm-0:83-272.el5_11.x86_64",
"5Server-VT-5.11.Z:kmod-kvm-debug-0:83-272.el5_11.x86_64",
"5Server-VT-5.11.Z:kvm-0:83-272.el5_11.src",
"5Server-VT-5.11.Z:kvm-0:83-272.el5_11.x86_64",
"5Server-VT-5.11.Z:kvm-debuginfo-0:83-272.el5_11.x86_64",
"5Server-VT-5.11.Z:kvm-qemu-img-0:83-272.el5_11.x86_64",
"5Server-VT-5.11.Z:kvm-tools-0:83-272.el5_11.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "qemu: fdc: out-of-bounds fifo buffer memory access"
}
]
}
RHSA-2015_1004
Vulnerability from csaf_redhat - Published: 2015-05-13 11:18 - Updated: 2024-11-14 15:27Summary
Red Hat Security Advisory: qemu-kvm-rhev security update
Severity
Important
Notes
Topic: Updated qemu-kvm-rhev packages that fix one security issue are now
available for Red Hat Enterprise Linux OpenStack Platform 4.0, Red Hat
Enterprise Linux OpenStack Platform 5.0 for Red Hat Enterprise Linux 6 and
7, and Red Hat Enterprise Linux OpenStack Platform 6.0.
Red Hat Product Security has rated this update as having Important security
impact. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available from the CVE link in the
References section.
Details: KVM (Kernel-based Virtual Machine) is a full virtualization solution for
Linux on AMD64 and Intel 64 systems. The qemu-kvm-rhev package provides the
user-space component for running virtual machines using KVM in environments
managed by Red Hat Enterprise Linux OpenStack Platform.
An out-of-bounds memory access flaw was found in the way QEMU's virtual
Floppy Disk Controller (FDC) handled FIFO buffer access while processing
certain FDC commands. A privileged guest user could use this flaw to crash
the guest or, potentially, execute arbitrary code on the host with the
privileges of the host's QEMU process corresponding to the guest.
(CVE-2015-3456)
Red Hat would like to thank Jason Geffner of CrowdStrike for reporting
this issue.
All qemu-kvm-rhev users are advised to upgrade to these updated packages,
which contain a backported patch to correct this issue. After installing
this update, shut down all running virtual machines. Once all virtual
machines have shut down, start them again for this update to take effect.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
An out-of-bounds memory access flaw was found in the way QEMU's virtual Floppy Disk Controller (FDC) handled FIFO buffer access while processing certain FDC commands. A privileged guest user could use this flaw to crash the guest or, potentially, execute arbitrary code on the host with the privileges of the host's QEMU process corresponding to the guest.
6.5 ()
Affected products
Fixed
28 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 6Server-RH6-RHOS-5.0:qemu-img-rhev-2:0.12.1.2-2.448.el6_6.3.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.448.el6_6.3.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.448.el6_6.3.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-RH6-RHOS-5.0:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.448.el6_6.3.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-RH6-RHOS-5.0:qemu-kvm-rhev-tools-2:0.12.1.2-2.448.el6_6.3.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-RHOS-4.0:qemu-img-rhev-2:0.12.1.2-2.448.el6_6.3.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-RHOS-4.0:qemu-kvm-rhev-2:0.12.1.2-2.448.el6_6.3.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-RHOS-4.0:qemu-kvm-rhev-2:0.12.1.2-2.448.el6_6.3.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-RHOS-4.0:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.448.el6_6.3.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-RHOS-4.0:qemu-kvm-rhev-tools-2:0.12.1.2-2.448.el6_6.3.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOS-5.0:libcacard-devel-rhev-10:2.1.2-23.el7_1.3.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOS-5.0:libcacard-rhev-10:2.1.2-23.el7_1.3.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOS-5.0:libcacard-tools-rhev-10:2.1.2-23.el7_1.3.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOS-5.0:qemu-img-rhev-10:2.1.2-23.el7_1.3.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOS-5.0:qemu-kvm-common-rhev-10:2.1.2-23.el7_1.3.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOS-5.0:qemu-kvm-rhev-10:2.1.2-23.el7_1.3.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOS-5.0:qemu-kvm-rhev-10:2.1.2-23.el7_1.3.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOS-5.0:qemu-kvm-rhev-debuginfo-10:2.1.2-23.el7_1.3.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOS-5.0:qemu-kvm-tools-rhev-10:2.1.2-23.el7_1.3.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOS-6.0:libcacard-devel-rhev-10:2.1.2-23.el7_1.3.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOS-6.0:libcacard-rhev-10:2.1.2-23.el7_1.3.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOS-6.0:libcacard-tools-rhev-10:2.1.2-23.el7_1.3.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.1.2-23.el7_1.3.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.1.2-23.el7_1.3.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.1.2-23.el7_1.3.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.1.2-23.el7_1.3.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.1.2-23.el7_1.3.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.1.2-23.el7_1.3.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Important
References
12 references
Acknowledgments
CrowdStrike
Jason Geffner
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated qemu-kvm-rhev packages that fix one security issue are now\navailable for Red Hat Enterprise Linux OpenStack Platform 4.0, Red Hat\nEnterprise Linux OpenStack Platform 5.0 for Red Hat Enterprise Linux 6 and\n7, and Red Hat Enterprise Linux OpenStack Platform 6.0.\n\nRed Hat Product Security has rated this update as having Important security\nimpact. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available from the CVE link in the\nReferences section.",
"title": "Topic"
},
{
"category": "general",
"text": "KVM (Kernel-based Virtual Machine) is a full virtualization solution for\nLinux on AMD64 and Intel 64 systems. The qemu-kvm-rhev package provides the\nuser-space component for running virtual machines using KVM in environments\nmanaged by Red Hat Enterprise Linux OpenStack Platform.\n\nAn out-of-bounds memory access flaw was found in the way QEMU\u0027s virtual\nFloppy Disk Controller (FDC) handled FIFO buffer access while processing\ncertain FDC commands. A privileged guest user could use this flaw to crash\nthe guest or, potentially, execute arbitrary code on the host with the\nprivileges of the host\u0027s QEMU process corresponding to the guest.\n(CVE-2015-3456)\n\nRed Hat would like to thank Jason Geffner of CrowdStrike for reporting\nthis issue.\n\nAll qemu-kvm-rhev users are advised to upgrade to these updated packages,\nwhich contain a backported patch to correct this issue. After installing\nthis update, shut down all running virtual machines. Once all virtual\nmachines have shut down, start them again for this update to take effect.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2015:1004",
"url": "https://access.redhat.com/errata/RHSA-2015:1004"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "1218611",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1218611"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1004.json"
}
],
"title": "Red Hat Security Advisory: qemu-kvm-rhev security update",
"tracking": {
"current_release_date": "2024-11-14T15:27:20+00:00",
"generator": {
"date": "2024-11-14T15:27:20+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.0"
}
},
"id": "RHSA-2015:1004",
"initial_release_date": "2015-05-13T11:18:30+00:00",
"revision_history": [
{
"date": "2015-05-13T11:18:30+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2015-05-13T11:18:30+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-14T15:27:20+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6",
"product": {
"name": "Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6",
"product_id": "6Server-RH6-RHOS-5.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openstack:5::el6"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux OpenStack Platform 4.0",
"product": {
"name": "Red Hat Enterprise Linux OpenStack Platform 4.0",
"product_id": "6Server-RHOS-4.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openstack:4::el6"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7",
"product": {
"name": "Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7",
"product_id": "7Server-RH7-RHOS-5.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openstack:5::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7",
"product": {
"name": "Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7",
"product_id": "7Server-RH7-RHOS-6.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openstack:6::el7"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenStack Platform"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-img-rhev-2:0.12.1.2-2.448.el6_6.3.x86_64",
"product": {
"name": "qemu-img-rhev-2:0.12.1.2-2.448.el6_6.3.x86_64",
"product_id": "qemu-img-rhev-2:0.12.1.2-2.448.el6_6.3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-img-rhev@0.12.1.2-2.448.el6_6.3?arch=x86_64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-rhev-2:0.12.1.2-2.448.el6_6.3.x86_64",
"product": {
"name": "qemu-kvm-rhev-2:0.12.1.2-2.448.el6_6.3.x86_64",
"product_id": "qemu-kvm-rhev-2:0.12.1.2-2.448.el6_6.3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev@0.12.1.2-2.448.el6_6.3?arch=x86_64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.448.el6_6.3.x86_64",
"product": {
"name": "qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.448.el6_6.3.x86_64",
"product_id": "qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.448.el6_6.3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev-debuginfo@0.12.1.2-2.448.el6_6.3?arch=x86_64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-rhev-tools-2:0.12.1.2-2.448.el6_6.3.x86_64",
"product": {
"name": "qemu-kvm-rhev-tools-2:0.12.1.2-2.448.el6_6.3.x86_64",
"product_id": "qemu-kvm-rhev-tools-2:0.12.1.2-2.448.el6_6.3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev-tools@0.12.1.2-2.448.el6_6.3?arch=x86_64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "qemu-img-rhev-10:2.1.2-23.el7_1.3.x86_64",
"product": {
"name": "qemu-img-rhev-10:2.1.2-23.el7_1.3.x86_64",
"product_id": "qemu-img-rhev-10:2.1.2-23.el7_1.3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-img-rhev@2.1.2-23.el7_1.3?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "libcacard-rhev-10:2.1.2-23.el7_1.3.x86_64",
"product": {
"name": "libcacard-rhev-10:2.1.2-23.el7_1.3.x86_64",
"product_id": "libcacard-rhev-10:2.1.2-23.el7_1.3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libcacard-rhev@2.1.2-23.el7_1.3?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "libcacard-tools-rhev-10:2.1.2-23.el7_1.3.x86_64",
"product": {
"name": "libcacard-tools-rhev-10:2.1.2-23.el7_1.3.x86_64",
"product_id": "libcacard-tools-rhev-10:2.1.2-23.el7_1.3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libcacard-tools-rhev@2.1.2-23.el7_1.3?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "libcacard-devel-rhev-10:2.1.2-23.el7_1.3.x86_64",
"product": {
"name": "libcacard-devel-rhev-10:2.1.2-23.el7_1.3.x86_64",
"product_id": "libcacard-devel-rhev-10:2.1.2-23.el7_1.3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libcacard-devel-rhev@2.1.2-23.el7_1.3?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-tools-rhev-10:2.1.2-23.el7_1.3.x86_64",
"product": {
"name": "qemu-kvm-tools-rhev-10:2.1.2-23.el7_1.3.x86_64",
"product_id": "qemu-kvm-tools-rhev-10:2.1.2-23.el7_1.3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-tools-rhev@2.1.2-23.el7_1.3?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-common-rhev-10:2.1.2-23.el7_1.3.x86_64",
"product": {
"name": "qemu-kvm-common-rhev-10:2.1.2-23.el7_1.3.x86_64",
"product_id": "qemu-kvm-common-rhev-10:2.1.2-23.el7_1.3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-common-rhev@2.1.2-23.el7_1.3?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-rhev-debuginfo-10:2.1.2-23.el7_1.3.x86_64",
"product": {
"name": "qemu-kvm-rhev-debuginfo-10:2.1.2-23.el7_1.3.x86_64",
"product_id": "qemu-kvm-rhev-debuginfo-10:2.1.2-23.el7_1.3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev-debuginfo@2.1.2-23.el7_1.3?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-rhev-10:2.1.2-23.el7_1.3.x86_64",
"product": {
"name": "qemu-kvm-rhev-10:2.1.2-23.el7_1.3.x86_64",
"product_id": "qemu-kvm-rhev-10:2.1.2-23.el7_1.3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev@2.1.2-23.el7_1.3?arch=x86_64\u0026epoch=10"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-kvm-rhev-2:0.12.1.2-2.448.el6_6.3.src",
"product": {
"name": "qemu-kvm-rhev-2:0.12.1.2-2.448.el6_6.3.src",
"product_id": "qemu-kvm-rhev-2:0.12.1.2-2.448.el6_6.3.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev@0.12.1.2-2.448.el6_6.3?arch=src\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-rhev-10:2.1.2-23.el7_1.3.src",
"product": {
"name": "qemu-kvm-rhev-10:2.1.2-23.el7_1.3.src",
"product_id": "qemu-kvm-rhev-10:2.1.2-23.el7_1.3.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev@2.1.2-23.el7_1.3?arch=src\u0026epoch=10"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-rhev-2:0.12.1.2-2.448.el6_6.3.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6",
"product_id": "6Server-RH6-RHOS-5.0:qemu-img-rhev-2:0.12.1.2-2.448.el6_6.3.x86_64"
},
"product_reference": "qemu-img-rhev-2:0.12.1.2-2.448.el6_6.3.x86_64",
"relates_to_product_reference": "6Server-RH6-RHOS-5.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-2:0.12.1.2-2.448.el6_6.3.src as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6",
"product_id": "6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.448.el6_6.3.src"
},
"product_reference": "qemu-kvm-rhev-2:0.12.1.2-2.448.el6_6.3.src",
"relates_to_product_reference": "6Server-RH6-RHOS-5.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-2:0.12.1.2-2.448.el6_6.3.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6",
"product_id": "6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.448.el6_6.3.x86_64"
},
"product_reference": "qemu-kvm-rhev-2:0.12.1.2-2.448.el6_6.3.x86_64",
"relates_to_product_reference": "6Server-RH6-RHOS-5.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.448.el6_6.3.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6",
"product_id": "6Server-RH6-RHOS-5.0:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.448.el6_6.3.x86_64"
},
"product_reference": "qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.448.el6_6.3.x86_64",
"relates_to_product_reference": "6Server-RH6-RHOS-5.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-tools-2:0.12.1.2-2.448.el6_6.3.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6",
"product_id": "6Server-RH6-RHOS-5.0:qemu-kvm-rhev-tools-2:0.12.1.2-2.448.el6_6.3.x86_64"
},
"product_reference": "qemu-kvm-rhev-tools-2:0.12.1.2-2.448.el6_6.3.x86_64",
"relates_to_product_reference": "6Server-RH6-RHOS-5.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-rhev-2:0.12.1.2-2.448.el6_6.3.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 4.0",
"product_id": "6Server-RHOS-4.0:qemu-img-rhev-2:0.12.1.2-2.448.el6_6.3.x86_64"
},
"product_reference": "qemu-img-rhev-2:0.12.1.2-2.448.el6_6.3.x86_64",
"relates_to_product_reference": "6Server-RHOS-4.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-2:0.12.1.2-2.448.el6_6.3.src as a component of Red Hat Enterprise Linux OpenStack Platform 4.0",
"product_id": "6Server-RHOS-4.0:qemu-kvm-rhev-2:0.12.1.2-2.448.el6_6.3.src"
},
"product_reference": "qemu-kvm-rhev-2:0.12.1.2-2.448.el6_6.3.src",
"relates_to_product_reference": "6Server-RHOS-4.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-2:0.12.1.2-2.448.el6_6.3.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 4.0",
"product_id": "6Server-RHOS-4.0:qemu-kvm-rhev-2:0.12.1.2-2.448.el6_6.3.x86_64"
},
"product_reference": "qemu-kvm-rhev-2:0.12.1.2-2.448.el6_6.3.x86_64",
"relates_to_product_reference": "6Server-RHOS-4.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.448.el6_6.3.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 4.0",
"product_id": "6Server-RHOS-4.0:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.448.el6_6.3.x86_64"
},
"product_reference": "qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.448.el6_6.3.x86_64",
"relates_to_product_reference": "6Server-RHOS-4.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-tools-2:0.12.1.2-2.448.el6_6.3.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 4.0",
"product_id": "6Server-RHOS-4.0:qemu-kvm-rhev-tools-2:0.12.1.2-2.448.el6_6.3.x86_64"
},
"product_reference": "qemu-kvm-rhev-tools-2:0.12.1.2-2.448.el6_6.3.x86_64",
"relates_to_product_reference": "6Server-RHOS-4.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcacard-devel-rhev-10:2.1.2-23.el7_1.3.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7",
"product_id": "7Server-RH7-RHOS-5.0:libcacard-devel-rhev-10:2.1.2-23.el7_1.3.x86_64"
},
"product_reference": "libcacard-devel-rhev-10:2.1.2-23.el7_1.3.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-5.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcacard-rhev-10:2.1.2-23.el7_1.3.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7",
"product_id": "7Server-RH7-RHOS-5.0:libcacard-rhev-10:2.1.2-23.el7_1.3.x86_64"
},
"product_reference": "libcacard-rhev-10:2.1.2-23.el7_1.3.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-5.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcacard-tools-rhev-10:2.1.2-23.el7_1.3.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7",
"product_id": "7Server-RH7-RHOS-5.0:libcacard-tools-rhev-10:2.1.2-23.el7_1.3.x86_64"
},
"product_reference": "libcacard-tools-rhev-10:2.1.2-23.el7_1.3.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-5.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-rhev-10:2.1.2-23.el7_1.3.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7",
"product_id": "7Server-RH7-RHOS-5.0:qemu-img-rhev-10:2.1.2-23.el7_1.3.x86_64"
},
"product_reference": "qemu-img-rhev-10:2.1.2-23.el7_1.3.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-5.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-common-rhev-10:2.1.2-23.el7_1.3.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7",
"product_id": "7Server-RH7-RHOS-5.0:qemu-kvm-common-rhev-10:2.1.2-23.el7_1.3.x86_64"
},
"product_reference": "qemu-kvm-common-rhev-10:2.1.2-23.el7_1.3.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-5.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-10:2.1.2-23.el7_1.3.src as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7",
"product_id": "7Server-RH7-RHOS-5.0:qemu-kvm-rhev-10:2.1.2-23.el7_1.3.src"
},
"product_reference": "qemu-kvm-rhev-10:2.1.2-23.el7_1.3.src",
"relates_to_product_reference": "7Server-RH7-RHOS-5.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-10:2.1.2-23.el7_1.3.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7",
"product_id": "7Server-RH7-RHOS-5.0:qemu-kvm-rhev-10:2.1.2-23.el7_1.3.x86_64"
},
"product_reference": "qemu-kvm-rhev-10:2.1.2-23.el7_1.3.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-5.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-debuginfo-10:2.1.2-23.el7_1.3.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7",
"product_id": "7Server-RH7-RHOS-5.0:qemu-kvm-rhev-debuginfo-10:2.1.2-23.el7_1.3.x86_64"
},
"product_reference": "qemu-kvm-rhev-debuginfo-10:2.1.2-23.el7_1.3.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-5.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-tools-rhev-10:2.1.2-23.el7_1.3.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7",
"product_id": "7Server-RH7-RHOS-5.0:qemu-kvm-tools-rhev-10:2.1.2-23.el7_1.3.x86_64"
},
"product_reference": "qemu-kvm-tools-rhev-10:2.1.2-23.el7_1.3.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-5.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcacard-devel-rhev-10:2.1.2-23.el7_1.3.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7",
"product_id": "7Server-RH7-RHOS-6.0:libcacard-devel-rhev-10:2.1.2-23.el7_1.3.x86_64"
},
"product_reference": "libcacard-devel-rhev-10:2.1.2-23.el7_1.3.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcacard-rhev-10:2.1.2-23.el7_1.3.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7",
"product_id": "7Server-RH7-RHOS-6.0:libcacard-rhev-10:2.1.2-23.el7_1.3.x86_64"
},
"product_reference": "libcacard-rhev-10:2.1.2-23.el7_1.3.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcacard-tools-rhev-10:2.1.2-23.el7_1.3.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7",
"product_id": "7Server-RH7-RHOS-6.0:libcacard-tools-rhev-10:2.1.2-23.el7_1.3.x86_64"
},
"product_reference": "libcacard-tools-rhev-10:2.1.2-23.el7_1.3.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-rhev-10:2.1.2-23.el7_1.3.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7",
"product_id": "7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.1.2-23.el7_1.3.x86_64"
},
"product_reference": "qemu-img-rhev-10:2.1.2-23.el7_1.3.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-common-rhev-10:2.1.2-23.el7_1.3.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7",
"product_id": "7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.1.2-23.el7_1.3.x86_64"
},
"product_reference": "qemu-kvm-common-rhev-10:2.1.2-23.el7_1.3.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-10:2.1.2-23.el7_1.3.src as a component of Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7",
"product_id": "7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.1.2-23.el7_1.3.src"
},
"product_reference": "qemu-kvm-rhev-10:2.1.2-23.el7_1.3.src",
"relates_to_product_reference": "7Server-RH7-RHOS-6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-10:2.1.2-23.el7_1.3.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7",
"product_id": "7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.1.2-23.el7_1.3.x86_64"
},
"product_reference": "qemu-kvm-rhev-10:2.1.2-23.el7_1.3.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-debuginfo-10:2.1.2-23.el7_1.3.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7",
"product_id": "7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.1.2-23.el7_1.3.x86_64"
},
"product_reference": "qemu-kvm-rhev-debuginfo-10:2.1.2-23.el7_1.3.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-tools-rhev-10:2.1.2-23.el7_1.3.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7",
"product_id": "7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.1.2-23.el7_1.3.x86_64"
},
"product_reference": "qemu-kvm-tools-rhev-10:2.1.2-23.el7_1.3.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-6.0"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Jason Geffner"
],
"organization": "CrowdStrike"
}
],
"cve": "CVE-2015-3456",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2015-05-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1218611"
}
],
"notes": [
{
"category": "description",
"text": "An out-of-bounds memory access flaw was found in the way QEMU\u0027s virtual Floppy Disk Controller (FDC) handled FIFO buffer access while processing certain FDC commands. A privileged guest user could use this flaw to crash the guest or, potentially, execute arbitrary code on the host with the privileges of the host\u0027s QEMU process corresponding to the guest.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "qemu: fdc: out-of-bounds fifo buffer memory access",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue affects the versions of the kvm and xen packages as shipped with Red Hat Enterprise Linux 5, the versions of the qemu-kvm packages as shipped with Red Hat Enterprise Linux 6 and 7, and the versions of qemu-kvm-rhev packages as shipped with Red Hat Enterprise Virtualization 3. Future updates for the respective releases will address this flaw.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RH6-RHOS-5.0:qemu-img-rhev-2:0.12.1.2-2.448.el6_6.3.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.448.el6_6.3.src",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.448.el6_6.3.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.448.el6_6.3.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-tools-2:0.12.1.2-2.448.el6_6.3.x86_64",
"6Server-RHOS-4.0:qemu-img-rhev-2:0.12.1.2-2.448.el6_6.3.x86_64",
"6Server-RHOS-4.0:qemu-kvm-rhev-2:0.12.1.2-2.448.el6_6.3.src",
"6Server-RHOS-4.0:qemu-kvm-rhev-2:0.12.1.2-2.448.el6_6.3.x86_64",
"6Server-RHOS-4.0:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.448.el6_6.3.x86_64",
"6Server-RHOS-4.0:qemu-kvm-rhev-tools-2:0.12.1.2-2.448.el6_6.3.x86_64",
"7Server-RH7-RHOS-5.0:libcacard-devel-rhev-10:2.1.2-23.el7_1.3.x86_64",
"7Server-RH7-RHOS-5.0:libcacard-rhev-10:2.1.2-23.el7_1.3.x86_64",
"7Server-RH7-RHOS-5.0:libcacard-tools-rhev-10:2.1.2-23.el7_1.3.x86_64",
"7Server-RH7-RHOS-5.0:qemu-img-rhev-10:2.1.2-23.el7_1.3.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-common-rhev-10:2.1.2-23.el7_1.3.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-rhev-10:2.1.2-23.el7_1.3.src",
"7Server-RH7-RHOS-5.0:qemu-kvm-rhev-10:2.1.2-23.el7_1.3.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-rhev-debuginfo-10:2.1.2-23.el7_1.3.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-tools-rhev-10:2.1.2-23.el7_1.3.x86_64",
"7Server-RH7-RHOS-6.0:libcacard-devel-rhev-10:2.1.2-23.el7_1.3.x86_64",
"7Server-RH7-RHOS-6.0:libcacard-rhev-10:2.1.2-23.el7_1.3.x86_64",
"7Server-RH7-RHOS-6.0:libcacard-tools-rhev-10:2.1.2-23.el7_1.3.x86_64",
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.1.2-23.el7_1.3.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.1.2-23.el7_1.3.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.1.2-23.el7_1.3.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.1.2-23.el7_1.3.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.1.2-23.el7_1.3.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.1.2-23.el7_1.3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-3456"
},
{
"category": "external",
"summary": "RHBZ#1218611",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1218611"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-3456",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-3456"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-3456",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-3456"
},
{
"category": "external",
"summary": "http://venom.crowdstrike.com/",
"url": "http://venom.crowdstrike.com/"
},
{
"category": "external",
"summary": "http://xenbits.xen.org/xsa/advisory-133.html",
"url": "http://xenbits.xen.org/xsa/advisory-133.html"
},
{
"category": "external",
"summary": "https://access.redhat.com/articles/1444903",
"url": "https://access.redhat.com/articles/1444903"
},
{
"category": "external",
"summary": "https://securityblog.redhat.com/2015/05/13/venom-dont-get-bitten/",
"url": "https://securityblog.redhat.com/2015/05/13/venom-dont-get-bitten/"
}
],
"release_date": "2015-05-13T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-05-13T11:18:30+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"6Server-RH6-RHOS-5.0:qemu-img-rhev-2:0.12.1.2-2.448.el6_6.3.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.448.el6_6.3.src",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.448.el6_6.3.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.448.el6_6.3.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-tools-2:0.12.1.2-2.448.el6_6.3.x86_64",
"6Server-RHOS-4.0:qemu-img-rhev-2:0.12.1.2-2.448.el6_6.3.x86_64",
"6Server-RHOS-4.0:qemu-kvm-rhev-2:0.12.1.2-2.448.el6_6.3.src",
"6Server-RHOS-4.0:qemu-kvm-rhev-2:0.12.1.2-2.448.el6_6.3.x86_64",
"6Server-RHOS-4.0:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.448.el6_6.3.x86_64",
"6Server-RHOS-4.0:qemu-kvm-rhev-tools-2:0.12.1.2-2.448.el6_6.3.x86_64",
"7Server-RH7-RHOS-5.0:libcacard-devel-rhev-10:2.1.2-23.el7_1.3.x86_64",
"7Server-RH7-RHOS-5.0:libcacard-rhev-10:2.1.2-23.el7_1.3.x86_64",
"7Server-RH7-RHOS-5.0:libcacard-tools-rhev-10:2.1.2-23.el7_1.3.x86_64",
"7Server-RH7-RHOS-5.0:qemu-img-rhev-10:2.1.2-23.el7_1.3.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-common-rhev-10:2.1.2-23.el7_1.3.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-rhev-10:2.1.2-23.el7_1.3.src",
"7Server-RH7-RHOS-5.0:qemu-kvm-rhev-10:2.1.2-23.el7_1.3.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-rhev-debuginfo-10:2.1.2-23.el7_1.3.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-tools-rhev-10:2.1.2-23.el7_1.3.x86_64",
"7Server-RH7-RHOS-6.0:libcacard-devel-rhev-10:2.1.2-23.el7_1.3.x86_64",
"7Server-RH7-RHOS-6.0:libcacard-rhev-10:2.1.2-23.el7_1.3.x86_64",
"7Server-RH7-RHOS-6.0:libcacard-tools-rhev-10:2.1.2-23.el7_1.3.x86_64",
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.1.2-23.el7_1.3.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.1.2-23.el7_1.3.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.1.2-23.el7_1.3.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.1.2-23.el7_1.3.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.1.2-23.el7_1.3.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.1.2-23.el7_1.3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:1004"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "COMPLETE",
"baseScore": 6.5,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:A/AC:H/Au:S/C:C/I:C/A:C",
"version": "2.0"
},
"products": [
"6Server-RH6-RHOS-5.0:qemu-img-rhev-2:0.12.1.2-2.448.el6_6.3.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.448.el6_6.3.src",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.448.el6_6.3.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.448.el6_6.3.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-tools-2:0.12.1.2-2.448.el6_6.3.x86_64",
"6Server-RHOS-4.0:qemu-img-rhev-2:0.12.1.2-2.448.el6_6.3.x86_64",
"6Server-RHOS-4.0:qemu-kvm-rhev-2:0.12.1.2-2.448.el6_6.3.src",
"6Server-RHOS-4.0:qemu-kvm-rhev-2:0.12.1.2-2.448.el6_6.3.x86_64",
"6Server-RHOS-4.0:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.448.el6_6.3.x86_64",
"6Server-RHOS-4.0:qemu-kvm-rhev-tools-2:0.12.1.2-2.448.el6_6.3.x86_64",
"7Server-RH7-RHOS-5.0:libcacard-devel-rhev-10:2.1.2-23.el7_1.3.x86_64",
"7Server-RH7-RHOS-5.0:libcacard-rhev-10:2.1.2-23.el7_1.3.x86_64",
"7Server-RH7-RHOS-5.0:libcacard-tools-rhev-10:2.1.2-23.el7_1.3.x86_64",
"7Server-RH7-RHOS-5.0:qemu-img-rhev-10:2.1.2-23.el7_1.3.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-common-rhev-10:2.1.2-23.el7_1.3.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-rhev-10:2.1.2-23.el7_1.3.src",
"7Server-RH7-RHOS-5.0:qemu-kvm-rhev-10:2.1.2-23.el7_1.3.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-rhev-debuginfo-10:2.1.2-23.el7_1.3.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-tools-rhev-10:2.1.2-23.el7_1.3.x86_64",
"7Server-RH7-RHOS-6.0:libcacard-devel-rhev-10:2.1.2-23.el7_1.3.x86_64",
"7Server-RH7-RHOS-6.0:libcacard-rhev-10:2.1.2-23.el7_1.3.x86_64",
"7Server-RH7-RHOS-6.0:libcacard-tools-rhev-10:2.1.2-23.el7_1.3.x86_64",
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.1.2-23.el7_1.3.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.1.2-23.el7_1.3.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.1.2-23.el7_1.3.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.1.2-23.el7_1.3.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.1.2-23.el7_1.3.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.1.2-23.el7_1.3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "qemu: fdc: out-of-bounds fifo buffer memory access"
}
]
}
RHSA-2015_1011
Vulnerability from csaf_redhat - Published: 2015-05-15 19:38 - Updated: 2024-11-14 15:27Summary
Red Hat Security Advisory: rhev-hypervisor security update
Severity
Important
Notes
Topic: Updated rhev-hypervisor packages that fix one security issue are now
available.
Red Hat Product Security has rated this update as having Important security
impact. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available from the CVE link in the
References section.
Details: The rhev-hypervisor packages provide a Red Hat Enterprise Virtualization
Hypervisor ISO disk image. The Red Hat Enterprise Virtualization Hypervisor
is a dedicated Kernel-based Virtual Machine (KVM) hypervisor. It includes
everything necessary to run and manage virtual machines: a subset of the
Red Hat Enterprise Linux operating environment and the Red Hat Enterprise
Virtualization Agent.
Note: Red Hat Enterprise Virtualization Hypervisor is only available for
the Intel 64 and AMD64 architectures with virtualization extensions.
An out-of-bounds memory access flaw was found in the way QEMU's virtual
Floppy Disk Controller (FDC) handled FIFO buffer access while processing
certain FDC commands. A privileged guest user could use this flaw to crash
the guest or, potentially, execute arbitrary code on the host with the
privileges of the host's QEMU process corresponding to the guest.
(CVE-2015-3456)
Red Hat would like to thank Jason Geffner of CrowdStrike for reporting
this issue.
Users of the Red Hat Enterprise Virtualization Hypervisor are advised to
upgrade to this updated package.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
An out-of-bounds memory access flaw was found in the way QEMU's virtual Floppy Disk Controller (FDC) handled FIFO buffer access while processing certain FDC commands. A privileged guest user could use this flaw to crash the guest or, potentially, execute arbitrary code on the host with the privileges of the host's QEMU process corresponding to the guest.
6.5 ()
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 6Server-RHEV-Hypervisor:rhev-hypervisor6-0:6.6-20150512.0.el6ev.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RHEV-Hypervisor-7:rhev-hypervisor7-0:7.1-20150512.1.el7ev.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RHEV-Hypervisor-7:rhev-hypervisor7-0:7.1-20150512.1.el7ev.src | — |
Vendor Fix
fix
|
Threats
Impact
Important
References
12 references
Acknowledgments
CrowdStrike
Jason Geffner
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated rhev-hypervisor packages that fix one security issue are now\navailable.\n\nRed Hat Product Security has rated this update as having Important security\nimpact. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available from the CVE link in the\nReferences section.",
"title": "Topic"
},
{
"category": "general",
"text": "The rhev-hypervisor packages provide a Red Hat Enterprise Virtualization\nHypervisor ISO disk image. The Red Hat Enterprise Virtualization Hypervisor\nis a dedicated Kernel-based Virtual Machine (KVM) hypervisor. It includes\neverything necessary to run and manage virtual machines: a subset of the\nRed Hat Enterprise Linux operating environment and the Red Hat Enterprise\nVirtualization Agent.\n\nNote: Red Hat Enterprise Virtualization Hypervisor is only available for\nthe Intel 64 and AMD64 architectures with virtualization extensions.\n\nAn out-of-bounds memory access flaw was found in the way QEMU\u0027s virtual\nFloppy Disk Controller (FDC) handled FIFO buffer access while processing\ncertain FDC commands. A privileged guest user could use this flaw to crash\nthe guest or, potentially, execute arbitrary code on the host with the\nprivileges of the host\u0027s QEMU process corresponding to the guest.\n(CVE-2015-3456)\n\nRed Hat would like to thank Jason Geffner of CrowdStrike for reporting\nthis issue.\n\nUsers of the Red Hat Enterprise Virtualization Hypervisor are advised to\nupgrade to this updated package.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2015:1011",
"url": "https://access.redhat.com/errata/RHSA-2015:1011"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "1218611",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1218611"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1011.json"
}
],
"title": "Red Hat Security Advisory: rhev-hypervisor security update",
"tracking": {
"current_release_date": "2024-11-14T15:27:31+00:00",
"generator": {
"date": "2024-11-14T15:27:31+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.0"
}
},
"id": "RHSA-2015:1011",
"initial_release_date": "2015-05-15T19:38:54+00:00",
"revision_history": [
{
"date": "2015-05-15T19:38:54+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2015-05-15T19:38:54+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-14T15:27:31+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "RHEL 7-based RHEV-H",
"product": {
"name": "RHEL 7-based RHEV-H",
"product_id": "7Server-RHEV-Hypervisor-7",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:7::hypervisor"
}
}
},
{
"category": "product_name",
"name": "RHEV Hypervisor for RHEL-6",
"product": {
"name": "RHEV Hypervisor for RHEL-6",
"product_id": "6Server-RHEV-Hypervisor",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:6::hypervisor"
}
}
}
],
"category": "product_family",
"name": "Red Hat Virtualization"
},
{
"branches": [
{
"category": "product_version",
"name": "rhev-hypervisor7-0:7.1-20150512.1.el7ev.noarch",
"product": {
"name": "rhev-hypervisor7-0:7.1-20150512.1.el7ev.noarch",
"product_id": "rhev-hypervisor7-0:7.1-20150512.1.el7ev.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rhev-hypervisor7@7.1-20150512.1.el7ev?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rhev-hypervisor6-0:6.6-20150512.0.el6ev.noarch",
"product": {
"name": "rhev-hypervisor6-0:6.6-20150512.0.el6ev.noarch",
"product_id": "rhev-hypervisor6-0:6.6-20150512.0.el6ev.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rhev-hypervisor6@6.6-20150512.0.el6ev?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "rhev-hypervisor7-0:7.1-20150512.1.el7ev.src",
"product": {
"name": "rhev-hypervisor7-0:7.1-20150512.1.el7ev.src",
"product_id": "rhev-hypervisor7-0:7.1-20150512.1.el7ev.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rhev-hypervisor7@7.1-20150512.1.el7ev?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "rhev-hypervisor6-0:6.6-20150512.0.el6ev.noarch as a component of RHEV Hypervisor for RHEL-6",
"product_id": "6Server-RHEV-Hypervisor:rhev-hypervisor6-0:6.6-20150512.0.el6ev.noarch"
},
"product_reference": "rhev-hypervisor6-0:6.6-20150512.0.el6ev.noarch",
"relates_to_product_reference": "6Server-RHEV-Hypervisor"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhev-hypervisor7-0:7.1-20150512.1.el7ev.noarch as a component of RHEL 7-based RHEV-H",
"product_id": "7Server-RHEV-Hypervisor-7:rhev-hypervisor7-0:7.1-20150512.1.el7ev.noarch"
},
"product_reference": "rhev-hypervisor7-0:7.1-20150512.1.el7ev.noarch",
"relates_to_product_reference": "7Server-RHEV-Hypervisor-7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhev-hypervisor7-0:7.1-20150512.1.el7ev.src as a component of RHEL 7-based RHEV-H",
"product_id": "7Server-RHEV-Hypervisor-7:rhev-hypervisor7-0:7.1-20150512.1.el7ev.src"
},
"product_reference": "rhev-hypervisor7-0:7.1-20150512.1.el7ev.src",
"relates_to_product_reference": "7Server-RHEV-Hypervisor-7"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Jason Geffner"
],
"organization": "CrowdStrike"
}
],
"cve": "CVE-2015-3456",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2015-05-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1218611"
}
],
"notes": [
{
"category": "description",
"text": "An out-of-bounds memory access flaw was found in the way QEMU\u0027s virtual Floppy Disk Controller (FDC) handled FIFO buffer access while processing certain FDC commands. A privileged guest user could use this flaw to crash the guest or, potentially, execute arbitrary code on the host with the privileges of the host\u0027s QEMU process corresponding to the guest.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "qemu: fdc: out-of-bounds fifo buffer memory access",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue affects the versions of the kvm and xen packages as shipped with Red Hat Enterprise Linux 5, the versions of the qemu-kvm packages as shipped with Red Hat Enterprise Linux 6 and 7, and the versions of qemu-kvm-rhev packages as shipped with Red Hat Enterprise Virtualization 3. Future updates for the respective releases will address this flaw.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RHEV-Hypervisor:rhev-hypervisor6-0:6.6-20150512.0.el6ev.noarch",
"7Server-RHEV-Hypervisor-7:rhev-hypervisor7-0:7.1-20150512.1.el7ev.noarch",
"7Server-RHEV-Hypervisor-7:rhev-hypervisor7-0:7.1-20150512.1.el7ev.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-3456"
},
{
"category": "external",
"summary": "RHBZ#1218611",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1218611"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-3456",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-3456"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-3456",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-3456"
},
{
"category": "external",
"summary": "http://venom.crowdstrike.com/",
"url": "http://venom.crowdstrike.com/"
},
{
"category": "external",
"summary": "http://xenbits.xen.org/xsa/advisory-133.html",
"url": "http://xenbits.xen.org/xsa/advisory-133.html"
},
{
"category": "external",
"summary": "https://access.redhat.com/articles/1444903",
"url": "https://access.redhat.com/articles/1444903"
},
{
"category": "external",
"summary": "https://securityblog.redhat.com/2015/05/13/venom-dont-get-bitten/",
"url": "https://securityblog.redhat.com/2015/05/13/venom-dont-get-bitten/"
}
],
"release_date": "2015-05-13T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-05-15T19:38:54+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"6Server-RHEV-Hypervisor:rhev-hypervisor6-0:6.6-20150512.0.el6ev.noarch",
"7Server-RHEV-Hypervisor-7:rhev-hypervisor7-0:7.1-20150512.1.el7ev.noarch",
"7Server-RHEV-Hypervisor-7:rhev-hypervisor7-0:7.1-20150512.1.el7ev.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:1011"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "COMPLETE",
"baseScore": 6.5,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:A/AC:H/Au:S/C:C/I:C/A:C",
"version": "2.0"
},
"products": [
"6Server-RHEV-Hypervisor:rhev-hypervisor6-0:6.6-20150512.0.el6ev.noarch",
"7Server-RHEV-Hypervisor-7:rhev-hypervisor7-0:7.1-20150512.1.el7ev.noarch",
"7Server-RHEV-Hypervisor-7:rhev-hypervisor7-0:7.1-20150512.1.el7ev.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "qemu: fdc: out-of-bounds fifo buffer memory access"
}
]
}
RHSA-2015_1031
Vulnerability from csaf_redhat - Published: 2015-05-27 11:46 - Updated: 2024-11-14 15:27Summary
Red Hat Security Advisory: qemu-kvm security update
Severity
Important
Notes
Topic: Updated qemu-kvm packages that fix one security issue are now available for
Red Hat Enterprise Linux 6.5 Extended Update Support.
Red Hat Product Security has rated this update as having Important security
impact. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available from the CVE link in the
References section.
Details: KVM (Kernel-based Virtual Machine) is a full virtualization solution for
Linux on AMD64 and Intel 64 systems. The qemu-kvm package provides the
user-space component for running virtual machines using KVM.
An out-of-bounds memory access flaw was found in the way QEMU's virtual
Floppy Disk Controller (FDC) handled FIFO buffer access while processing
certain FDC commands. A privileged guest user could use this flaw to crash
the guest or, potentially, execute arbitrary code on the host with the
privileges of the host's QEMU process corresponding to the guest.
(CVE-2015-3456)
Red Hat would like to thank Jason Geffner of CrowdStrike for reporting
this issue.
All qemu-kvm users are advised to upgrade to these updated packages, which
contain a backported patch to correct this issue. After installing this
update, shut down all running virtual machines. Once all virtual machines
have shut down, start them again for this update to take effect.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
An out-of-bounds memory access flaw was found in the way QEMU's virtual Floppy Disk Controller (FDC) handled FIFO buffer access while processing certain FDC commands. A privileged guest user could use this flaw to crash the guest or, potentially, execute arbitrary code on the host with the privileges of the host's QEMU process corresponding to the guest.
6.5 ()
Affected products
Fixed
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 6ComputeNode-6.5.EUS:qemu-guest-agent-2:0.12.1.2-2.415.el6_5.15.i686 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6ComputeNode-6.5.EUS:qemu-guest-agent-2:0.12.1.2-2.415.el6_5.15.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6ComputeNode-6.5.EUS:qemu-img-2:0.12.1.2-2.415.el6_5.15.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6ComputeNode-6.5.EUS:qemu-kvm-2:0.12.1.2-2.415.el6_5.15.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6ComputeNode-6.5.EUS:qemu-kvm-2:0.12.1.2-2.415.el6_5.15.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6ComputeNode-6.5.EUS:qemu-kvm-debuginfo-2:0.12.1.2-2.415.el6_5.15.i686 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6ComputeNode-6.5.EUS:qemu-kvm-debuginfo-2:0.12.1.2-2.415.el6_5.15.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6ComputeNode-6.5.EUS:qemu-kvm-tools-2:0.12.1.2-2.415.el6_5.15.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-6.5.EUS:qemu-guest-agent-2:0.12.1.2-2.415.el6_5.15.i686 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-6.5.EUS:qemu-guest-agent-2:0.12.1.2-2.415.el6_5.15.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-6.5.EUS:qemu-img-2:0.12.1.2-2.415.el6_5.15.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-6.5.EUS:qemu-kvm-2:0.12.1.2-2.415.el6_5.15.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-6.5.EUS:qemu-kvm-2:0.12.1.2-2.415.el6_5.15.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-6.5.EUS:qemu-kvm-debuginfo-2:0.12.1.2-2.415.el6_5.15.i686 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-6.5.EUS:qemu-kvm-debuginfo-2:0.12.1.2-2.415.el6_5.15.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-6.5.EUS:qemu-kvm-tools-2:0.12.1.2-2.415.el6_5.15.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Important
References
12 references
Acknowledgments
CrowdStrike
Jason Geffner
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated qemu-kvm packages that fix one security issue are now available for\nRed Hat Enterprise Linux 6.5 Extended Update Support.\n\nRed Hat Product Security has rated this update as having Important security\nimpact. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available from the CVE link in the\nReferences section.",
"title": "Topic"
},
{
"category": "general",
"text": "KVM (Kernel-based Virtual Machine) is a full virtualization solution for\nLinux on AMD64 and Intel 64 systems. The qemu-kvm package provides the\nuser-space component for running virtual machines using KVM.\n\nAn out-of-bounds memory access flaw was found in the way QEMU\u0027s virtual\nFloppy Disk Controller (FDC) handled FIFO buffer access while processing\ncertain FDC commands. A privileged guest user could use this flaw to crash\nthe guest or, potentially, execute arbitrary code on the host with the\nprivileges of the host\u0027s QEMU process corresponding to the guest.\n(CVE-2015-3456)\n\nRed Hat would like to thank Jason Geffner of CrowdStrike for reporting\nthis issue.\n\nAll qemu-kvm users are advised to upgrade to these updated packages, which\ncontain a backported patch to correct this issue. After installing this\nupdate, shut down all running virtual machines. Once all virtual machines\nhave shut down, start them again for this update to take effect.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2015:1031",
"url": "https://access.redhat.com/errata/RHSA-2015:1031"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "1218611",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1218611"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1031.json"
}
],
"title": "Red Hat Security Advisory: qemu-kvm security update",
"tracking": {
"current_release_date": "2024-11-14T15:27:36+00:00",
"generator": {
"date": "2024-11-14T15:27:36+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.0"
}
},
"id": "RHSA-2015:1031",
"initial_release_date": "2015-05-27T11:46:22+00:00",
"revision_history": [
{
"date": "2015-05-27T11:46:22+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2015-05-27T11:46:22+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-14T15:27:36+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux HPC Node EUS (v. 6.5)",
"product": {
"name": "Red Hat Enterprise Linux HPC Node EUS (v. 6.5)",
"product_id": "6ComputeNode-6.5.EUS",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:rhel_eus:6.5::computenode"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Server EUS (v. 6.5)",
"product": {
"name": "Red Hat Enterprise Linux Server EUS (v. 6.5)",
"product_id": "6Server-6.5.EUS",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:rhel_eus:6.5::server"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-kvm-debuginfo-2:0.12.1.2-2.415.el6_5.15.x86_64",
"product": {
"name": "qemu-kvm-debuginfo-2:0.12.1.2-2.415.el6_5.15.x86_64",
"product_id": "qemu-kvm-debuginfo-2:0.12.1.2-2.415.el6_5.15.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-debuginfo@0.12.1.2-2.415.el6_5.15?arch=x86_64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-2:0.12.1.2-2.415.el6_5.15.x86_64",
"product": {
"name": "qemu-kvm-2:0.12.1.2-2.415.el6_5.15.x86_64",
"product_id": "qemu-kvm-2:0.12.1.2-2.415.el6_5.15.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm@0.12.1.2-2.415.el6_5.15?arch=x86_64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "qemu-img-2:0.12.1.2-2.415.el6_5.15.x86_64",
"product": {
"name": "qemu-img-2:0.12.1.2-2.415.el6_5.15.x86_64",
"product_id": "qemu-img-2:0.12.1.2-2.415.el6_5.15.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-img@0.12.1.2-2.415.el6_5.15?arch=x86_64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "qemu-guest-agent-2:0.12.1.2-2.415.el6_5.15.x86_64",
"product": {
"name": "qemu-guest-agent-2:0.12.1.2-2.415.el6_5.15.x86_64",
"product_id": "qemu-guest-agent-2:0.12.1.2-2.415.el6_5.15.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-guest-agent@0.12.1.2-2.415.el6_5.15?arch=x86_64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-tools-2:0.12.1.2-2.415.el6_5.15.x86_64",
"product": {
"name": "qemu-kvm-tools-2:0.12.1.2-2.415.el6_5.15.x86_64",
"product_id": "qemu-kvm-tools-2:0.12.1.2-2.415.el6_5.15.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-tools@0.12.1.2-2.415.el6_5.15?arch=x86_64\u0026epoch=2"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-kvm-2:0.12.1.2-2.415.el6_5.15.src",
"product": {
"name": "qemu-kvm-2:0.12.1.2-2.415.el6_5.15.src",
"product_id": "qemu-kvm-2:0.12.1.2-2.415.el6_5.15.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm@0.12.1.2-2.415.el6_5.15?arch=src\u0026epoch=2"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-kvm-debuginfo-2:0.12.1.2-2.415.el6_5.15.i686",
"product": {
"name": "qemu-kvm-debuginfo-2:0.12.1.2-2.415.el6_5.15.i686",
"product_id": "qemu-kvm-debuginfo-2:0.12.1.2-2.415.el6_5.15.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-debuginfo@0.12.1.2-2.415.el6_5.15?arch=i686\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "qemu-guest-agent-2:0.12.1.2-2.415.el6_5.15.i686",
"product": {
"name": "qemu-guest-agent-2:0.12.1.2-2.415.el6_5.15.i686",
"product_id": "qemu-guest-agent-2:0.12.1.2-2.415.el6_5.15.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-guest-agent@0.12.1.2-2.415.el6_5.15?arch=i686\u0026epoch=2"
}
}
}
],
"category": "architecture",
"name": "i686"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-guest-agent-2:0.12.1.2-2.415.el6_5.15.i686 as a component of Red Hat Enterprise Linux HPC Node EUS (v. 6.5)",
"product_id": "6ComputeNode-6.5.EUS:qemu-guest-agent-2:0.12.1.2-2.415.el6_5.15.i686"
},
"product_reference": "qemu-guest-agent-2:0.12.1.2-2.415.el6_5.15.i686",
"relates_to_product_reference": "6ComputeNode-6.5.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-guest-agent-2:0.12.1.2-2.415.el6_5.15.x86_64 as a component of Red Hat Enterprise Linux HPC Node EUS (v. 6.5)",
"product_id": "6ComputeNode-6.5.EUS:qemu-guest-agent-2:0.12.1.2-2.415.el6_5.15.x86_64"
},
"product_reference": "qemu-guest-agent-2:0.12.1.2-2.415.el6_5.15.x86_64",
"relates_to_product_reference": "6ComputeNode-6.5.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-2:0.12.1.2-2.415.el6_5.15.x86_64 as a component of Red Hat Enterprise Linux HPC Node EUS (v. 6.5)",
"product_id": "6ComputeNode-6.5.EUS:qemu-img-2:0.12.1.2-2.415.el6_5.15.x86_64"
},
"product_reference": "qemu-img-2:0.12.1.2-2.415.el6_5.15.x86_64",
"relates_to_product_reference": "6ComputeNode-6.5.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-2:0.12.1.2-2.415.el6_5.15.src as a component of Red Hat Enterprise Linux HPC Node EUS (v. 6.5)",
"product_id": "6ComputeNode-6.5.EUS:qemu-kvm-2:0.12.1.2-2.415.el6_5.15.src"
},
"product_reference": "qemu-kvm-2:0.12.1.2-2.415.el6_5.15.src",
"relates_to_product_reference": "6ComputeNode-6.5.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-2:0.12.1.2-2.415.el6_5.15.x86_64 as a component of Red Hat Enterprise Linux HPC Node EUS (v. 6.5)",
"product_id": "6ComputeNode-6.5.EUS:qemu-kvm-2:0.12.1.2-2.415.el6_5.15.x86_64"
},
"product_reference": "qemu-kvm-2:0.12.1.2-2.415.el6_5.15.x86_64",
"relates_to_product_reference": "6ComputeNode-6.5.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-2:0.12.1.2-2.415.el6_5.15.i686 as a component of Red Hat Enterprise Linux HPC Node EUS (v. 6.5)",
"product_id": "6ComputeNode-6.5.EUS:qemu-kvm-debuginfo-2:0.12.1.2-2.415.el6_5.15.i686"
},
"product_reference": "qemu-kvm-debuginfo-2:0.12.1.2-2.415.el6_5.15.i686",
"relates_to_product_reference": "6ComputeNode-6.5.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-2:0.12.1.2-2.415.el6_5.15.x86_64 as a component of Red Hat Enterprise Linux HPC Node EUS (v. 6.5)",
"product_id": "6ComputeNode-6.5.EUS:qemu-kvm-debuginfo-2:0.12.1.2-2.415.el6_5.15.x86_64"
},
"product_reference": "qemu-kvm-debuginfo-2:0.12.1.2-2.415.el6_5.15.x86_64",
"relates_to_product_reference": "6ComputeNode-6.5.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-tools-2:0.12.1.2-2.415.el6_5.15.x86_64 as a component of Red Hat Enterprise Linux HPC Node EUS (v. 6.5)",
"product_id": "6ComputeNode-6.5.EUS:qemu-kvm-tools-2:0.12.1.2-2.415.el6_5.15.x86_64"
},
"product_reference": "qemu-kvm-tools-2:0.12.1.2-2.415.el6_5.15.x86_64",
"relates_to_product_reference": "6ComputeNode-6.5.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-guest-agent-2:0.12.1.2-2.415.el6_5.15.i686 as a component of Red Hat Enterprise Linux Server EUS (v. 6.5)",
"product_id": "6Server-6.5.EUS:qemu-guest-agent-2:0.12.1.2-2.415.el6_5.15.i686"
},
"product_reference": "qemu-guest-agent-2:0.12.1.2-2.415.el6_5.15.i686",
"relates_to_product_reference": "6Server-6.5.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-guest-agent-2:0.12.1.2-2.415.el6_5.15.x86_64 as a component of Red Hat Enterprise Linux Server EUS (v. 6.5)",
"product_id": "6Server-6.5.EUS:qemu-guest-agent-2:0.12.1.2-2.415.el6_5.15.x86_64"
},
"product_reference": "qemu-guest-agent-2:0.12.1.2-2.415.el6_5.15.x86_64",
"relates_to_product_reference": "6Server-6.5.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-2:0.12.1.2-2.415.el6_5.15.x86_64 as a component of Red Hat Enterprise Linux Server EUS (v. 6.5)",
"product_id": "6Server-6.5.EUS:qemu-img-2:0.12.1.2-2.415.el6_5.15.x86_64"
},
"product_reference": "qemu-img-2:0.12.1.2-2.415.el6_5.15.x86_64",
"relates_to_product_reference": "6Server-6.5.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-2:0.12.1.2-2.415.el6_5.15.src as a component of Red Hat Enterprise Linux Server EUS (v. 6.5)",
"product_id": "6Server-6.5.EUS:qemu-kvm-2:0.12.1.2-2.415.el6_5.15.src"
},
"product_reference": "qemu-kvm-2:0.12.1.2-2.415.el6_5.15.src",
"relates_to_product_reference": "6Server-6.5.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-2:0.12.1.2-2.415.el6_5.15.x86_64 as a component of Red Hat Enterprise Linux Server EUS (v. 6.5)",
"product_id": "6Server-6.5.EUS:qemu-kvm-2:0.12.1.2-2.415.el6_5.15.x86_64"
},
"product_reference": "qemu-kvm-2:0.12.1.2-2.415.el6_5.15.x86_64",
"relates_to_product_reference": "6Server-6.5.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-2:0.12.1.2-2.415.el6_5.15.i686 as a component of Red Hat Enterprise Linux Server EUS (v. 6.5)",
"product_id": "6Server-6.5.EUS:qemu-kvm-debuginfo-2:0.12.1.2-2.415.el6_5.15.i686"
},
"product_reference": "qemu-kvm-debuginfo-2:0.12.1.2-2.415.el6_5.15.i686",
"relates_to_product_reference": "6Server-6.5.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-2:0.12.1.2-2.415.el6_5.15.x86_64 as a component of Red Hat Enterprise Linux Server EUS (v. 6.5)",
"product_id": "6Server-6.5.EUS:qemu-kvm-debuginfo-2:0.12.1.2-2.415.el6_5.15.x86_64"
},
"product_reference": "qemu-kvm-debuginfo-2:0.12.1.2-2.415.el6_5.15.x86_64",
"relates_to_product_reference": "6Server-6.5.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-tools-2:0.12.1.2-2.415.el6_5.15.x86_64 as a component of Red Hat Enterprise Linux Server EUS (v. 6.5)",
"product_id": "6Server-6.5.EUS:qemu-kvm-tools-2:0.12.1.2-2.415.el6_5.15.x86_64"
},
"product_reference": "qemu-kvm-tools-2:0.12.1.2-2.415.el6_5.15.x86_64",
"relates_to_product_reference": "6Server-6.5.EUS"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Jason Geffner"
],
"organization": "CrowdStrike"
}
],
"cve": "CVE-2015-3456",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2015-05-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1218611"
}
],
"notes": [
{
"category": "description",
"text": "An out-of-bounds memory access flaw was found in the way QEMU\u0027s virtual Floppy Disk Controller (FDC) handled FIFO buffer access while processing certain FDC commands. A privileged guest user could use this flaw to crash the guest or, potentially, execute arbitrary code on the host with the privileges of the host\u0027s QEMU process corresponding to the guest.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "qemu: fdc: out-of-bounds fifo buffer memory access",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue affects the versions of the kvm and xen packages as shipped with Red Hat Enterprise Linux 5, the versions of the qemu-kvm packages as shipped with Red Hat Enterprise Linux 6 and 7, and the versions of qemu-kvm-rhev packages as shipped with Red Hat Enterprise Virtualization 3. Future updates for the respective releases will address this flaw.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6ComputeNode-6.5.EUS:qemu-guest-agent-2:0.12.1.2-2.415.el6_5.15.i686",
"6ComputeNode-6.5.EUS:qemu-guest-agent-2:0.12.1.2-2.415.el6_5.15.x86_64",
"6ComputeNode-6.5.EUS:qemu-img-2:0.12.1.2-2.415.el6_5.15.x86_64",
"6ComputeNode-6.5.EUS:qemu-kvm-2:0.12.1.2-2.415.el6_5.15.src",
"6ComputeNode-6.5.EUS:qemu-kvm-2:0.12.1.2-2.415.el6_5.15.x86_64",
"6ComputeNode-6.5.EUS:qemu-kvm-debuginfo-2:0.12.1.2-2.415.el6_5.15.i686",
"6ComputeNode-6.5.EUS:qemu-kvm-debuginfo-2:0.12.1.2-2.415.el6_5.15.x86_64",
"6ComputeNode-6.5.EUS:qemu-kvm-tools-2:0.12.1.2-2.415.el6_5.15.x86_64",
"6Server-6.5.EUS:qemu-guest-agent-2:0.12.1.2-2.415.el6_5.15.i686",
"6Server-6.5.EUS:qemu-guest-agent-2:0.12.1.2-2.415.el6_5.15.x86_64",
"6Server-6.5.EUS:qemu-img-2:0.12.1.2-2.415.el6_5.15.x86_64",
"6Server-6.5.EUS:qemu-kvm-2:0.12.1.2-2.415.el6_5.15.src",
"6Server-6.5.EUS:qemu-kvm-2:0.12.1.2-2.415.el6_5.15.x86_64",
"6Server-6.5.EUS:qemu-kvm-debuginfo-2:0.12.1.2-2.415.el6_5.15.i686",
"6Server-6.5.EUS:qemu-kvm-debuginfo-2:0.12.1.2-2.415.el6_5.15.x86_64",
"6Server-6.5.EUS:qemu-kvm-tools-2:0.12.1.2-2.415.el6_5.15.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-3456"
},
{
"category": "external",
"summary": "RHBZ#1218611",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1218611"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-3456",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-3456"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-3456",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-3456"
},
{
"category": "external",
"summary": "http://venom.crowdstrike.com/",
"url": "http://venom.crowdstrike.com/"
},
{
"category": "external",
"summary": "http://xenbits.xen.org/xsa/advisory-133.html",
"url": "http://xenbits.xen.org/xsa/advisory-133.html"
},
{
"category": "external",
"summary": "https://access.redhat.com/articles/1444903",
"url": "https://access.redhat.com/articles/1444903"
},
{
"category": "external",
"summary": "https://securityblog.redhat.com/2015/05/13/venom-dont-get-bitten/",
"url": "https://securityblog.redhat.com/2015/05/13/venom-dont-get-bitten/"
}
],
"release_date": "2015-05-13T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-05-27T11:46:22+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"6ComputeNode-6.5.EUS:qemu-guest-agent-2:0.12.1.2-2.415.el6_5.15.i686",
"6ComputeNode-6.5.EUS:qemu-guest-agent-2:0.12.1.2-2.415.el6_5.15.x86_64",
"6ComputeNode-6.5.EUS:qemu-img-2:0.12.1.2-2.415.el6_5.15.x86_64",
"6ComputeNode-6.5.EUS:qemu-kvm-2:0.12.1.2-2.415.el6_5.15.src",
"6ComputeNode-6.5.EUS:qemu-kvm-2:0.12.1.2-2.415.el6_5.15.x86_64",
"6ComputeNode-6.5.EUS:qemu-kvm-debuginfo-2:0.12.1.2-2.415.el6_5.15.i686",
"6ComputeNode-6.5.EUS:qemu-kvm-debuginfo-2:0.12.1.2-2.415.el6_5.15.x86_64",
"6ComputeNode-6.5.EUS:qemu-kvm-tools-2:0.12.1.2-2.415.el6_5.15.x86_64",
"6Server-6.5.EUS:qemu-guest-agent-2:0.12.1.2-2.415.el6_5.15.i686",
"6Server-6.5.EUS:qemu-guest-agent-2:0.12.1.2-2.415.el6_5.15.x86_64",
"6Server-6.5.EUS:qemu-img-2:0.12.1.2-2.415.el6_5.15.x86_64",
"6Server-6.5.EUS:qemu-kvm-2:0.12.1.2-2.415.el6_5.15.src",
"6Server-6.5.EUS:qemu-kvm-2:0.12.1.2-2.415.el6_5.15.x86_64",
"6Server-6.5.EUS:qemu-kvm-debuginfo-2:0.12.1.2-2.415.el6_5.15.i686",
"6Server-6.5.EUS:qemu-kvm-debuginfo-2:0.12.1.2-2.415.el6_5.15.x86_64",
"6Server-6.5.EUS:qemu-kvm-tools-2:0.12.1.2-2.415.el6_5.15.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:1031"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "COMPLETE",
"baseScore": 6.5,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:A/AC:H/Au:S/C:C/I:C/A:C",
"version": "2.0"
},
"products": [
"6ComputeNode-6.5.EUS:qemu-guest-agent-2:0.12.1.2-2.415.el6_5.15.i686",
"6ComputeNode-6.5.EUS:qemu-guest-agent-2:0.12.1.2-2.415.el6_5.15.x86_64",
"6ComputeNode-6.5.EUS:qemu-img-2:0.12.1.2-2.415.el6_5.15.x86_64",
"6ComputeNode-6.5.EUS:qemu-kvm-2:0.12.1.2-2.415.el6_5.15.src",
"6ComputeNode-6.5.EUS:qemu-kvm-2:0.12.1.2-2.415.el6_5.15.x86_64",
"6ComputeNode-6.5.EUS:qemu-kvm-debuginfo-2:0.12.1.2-2.415.el6_5.15.i686",
"6ComputeNode-6.5.EUS:qemu-kvm-debuginfo-2:0.12.1.2-2.415.el6_5.15.x86_64",
"6ComputeNode-6.5.EUS:qemu-kvm-tools-2:0.12.1.2-2.415.el6_5.15.x86_64",
"6Server-6.5.EUS:qemu-guest-agent-2:0.12.1.2-2.415.el6_5.15.i686",
"6Server-6.5.EUS:qemu-guest-agent-2:0.12.1.2-2.415.el6_5.15.x86_64",
"6Server-6.5.EUS:qemu-img-2:0.12.1.2-2.415.el6_5.15.x86_64",
"6Server-6.5.EUS:qemu-kvm-2:0.12.1.2-2.415.el6_5.15.src",
"6Server-6.5.EUS:qemu-kvm-2:0.12.1.2-2.415.el6_5.15.x86_64",
"6Server-6.5.EUS:qemu-kvm-debuginfo-2:0.12.1.2-2.415.el6_5.15.i686",
"6Server-6.5.EUS:qemu-kvm-debuginfo-2:0.12.1.2-2.415.el6_5.15.x86_64",
"6Server-6.5.EUS:qemu-kvm-tools-2:0.12.1.2-2.415.el6_5.15.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "qemu: fdc: out-of-bounds fifo buffer memory access"
}
]
}
SUSE-SU-2015:0870-1
Vulnerability from csaf_suse - Published: 2014-09-19 14:41 - Updated: 2014-09-19 14:41Summary
Security update for kvm
Severity
Moderate
Notes
Title of the patch: Security update for kvm
Description of the patch:
kvm has been updated to fix issues in the embedded qemu:
*
CVE-2014-0223: An integer overflow flaw was found in the QEMU block
driver for QCOW version 1 disk images. A user able to alter the QEMU
disk image files loaded by a guest could have used this flaw to
corrupt QEMU process memory on the host, which could potentially have
resulted in arbitrary code execution on the host with the privileges
of the QEMU process.
*
CVE-2014-3461: A user able to alter the savevm data (either on the
disk or over the wire during migration) could have used this flaw to
to corrupt QEMU process memory on the (destination) host, which could
have potentially resulted in arbitrary code execution on the host
with the privileges of the QEMU process.
*
CVE-2014-0222: An integer overflow flaw was found in the QEMU block
driver for QCOW version 1 disk images. A user able to alter the QEMU
disk image files loaded by a guest could have used this flaw to
corrupt QEMU process memory on the host, which could have potentially
resulted in arbitrary code execution on the host with the privileges
of the QEMU process.
Non-security bugs fixed:
* Fix exceeding IRQ routes that could have caused freezes of guests.
(bnc#876842)
* Fix CPUID emulation bugs that may have broken Windows guests with
newer -cpu types (bnc#886535)
Security Issues:
* CVE-2014-0222
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0222>
* CVE-2014-0223
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0223>
* CVE-2014-3461
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3461>
Patchnames: sledsp3-kvm,slessp3-kvm
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
7.8 (High)
Affected products
Recommended
11 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
Affected products
Recommended
11 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
Affected products
Recommended
11 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
5.5 (Medium)
Affected products
Recommended
11 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
Affected products
Recommended
11 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
8.6 (High)
Affected products
Recommended
11 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
7.8 (High)
Affected products
Recommended
11 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
5.5 (Medium)
Affected products
Recommended
11 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
6.2 (Medium)
Affected products
Recommended
11 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
Affected products
Recommended
11 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
Affected products
Recommended
11 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
Affected products
Recommended
11 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
Affected products
Recommended
11 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
Affected products
Recommended
11 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
8.6 (High)
Affected products
Recommended
11 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
Affected products
Recommended
11 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
Affected products
Recommended
11 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
References
116 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for kvm",
"title": "Title of the patch"
},
{
"category": "description",
"text": "\nkvm has been updated to fix issues in the embedded qemu:\n\n * \n\n CVE-2014-0223: An integer overflow flaw was found in the QEMU block\n driver for QCOW version 1 disk images. A user able to alter the QEMU\n disk image files loaded by a guest could have used this flaw to\n corrupt QEMU process memory on the host, which could potentially have\n resulted in arbitrary code execution on the host with the privileges\n of the QEMU process.\n\n * \n\n CVE-2014-3461: A user able to alter the savevm data (either on the\n disk or over the wire during migration) could have used this flaw to\n to corrupt QEMU process memory on the (destination) host, which could\n have potentially resulted in arbitrary code execution on the host\n with the privileges of the QEMU process.\n\n * \n\n CVE-2014-0222: An integer overflow flaw was found in the QEMU block\n driver for QCOW version 1 disk images. A user able to alter the QEMU\n disk image files loaded by a guest could have used this flaw to\n corrupt QEMU process memory on the host, which could have potentially\n resulted in arbitrary code execution on the host with the privileges\n of the QEMU process.\n\nNon-security bugs fixed:\n\n * Fix exceeding IRQ routes that could have caused freezes of guests.\n (bnc#876842)\n * Fix CPUID emulation bugs that may have broken Windows guests with\n newer -cpu types (bnc#886535)\n\nSecurity Issues:\n\n * CVE-2014-0222\n \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0222\u003e\n * CVE-2014-0223\n \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0223\u003e\n * CVE-2014-3461\n \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3461\u003e\n\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "sledsp3-kvm,slessp3-kvm",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2015_0870-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2015:0870-1",
"url": "https://www.suse.com/support/update/announcement/2015/suse-su-20150870-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2015:0870-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2015-May/001381.html"
},
{
"category": "self",
"summary": "SUSE Bug 812836",
"url": "https://bugzilla.suse.com/812836"
},
{
"category": "self",
"summary": "SUSE Bug 812983",
"url": "https://bugzilla.suse.com/812983"
},
{
"category": "self",
"summary": "SUSE Bug 817593",
"url": "https://bugzilla.suse.com/817593"
},
{
"category": "self",
"summary": "SUSE Bug 821819",
"url": "https://bugzilla.suse.com/821819"
},
{
"category": "self",
"summary": "SUSE Bug 824340",
"url": "https://bugzilla.suse.com/824340"
},
{
"category": "self",
"summary": "SUSE Bug 829800",
"url": "https://bugzilla.suse.com/829800"
},
{
"category": "self",
"summary": "SUSE Bug 841080",
"url": "https://bugzilla.suse.com/841080"
},
{
"category": "self",
"summary": "SUSE Bug 842006",
"url": "https://bugzilla.suse.com/842006"
},
{
"category": "self",
"summary": "SUSE Bug 842088",
"url": "https://bugzilla.suse.com/842088"
},
{
"category": "self",
"summary": "SUSE Bug 858858",
"url": "https://bugzilla.suse.com/858858"
},
{
"category": "self",
"summary": "SUSE Bug 864391",
"url": "https://bugzilla.suse.com/864391"
},
{
"category": "self",
"summary": "SUSE Bug 864649",
"url": "https://bugzilla.suse.com/864649"
},
{
"category": "self",
"summary": "SUSE Bug 864650",
"url": "https://bugzilla.suse.com/864650"
},
{
"category": "self",
"summary": "SUSE Bug 864653",
"url": "https://bugzilla.suse.com/864653"
},
{
"category": "self",
"summary": "SUSE Bug 864655",
"url": "https://bugzilla.suse.com/864655"
},
{
"category": "self",
"summary": "SUSE Bug 864665",
"url": "https://bugzilla.suse.com/864665"
},
{
"category": "self",
"summary": "SUSE Bug 864671",
"url": "https://bugzilla.suse.com/864671"
},
{
"category": "self",
"summary": "SUSE Bug 864673",
"url": "https://bugzilla.suse.com/864673"
},
{
"category": "self",
"summary": "SUSE Bug 864678",
"url": "https://bugzilla.suse.com/864678"
},
{
"category": "self",
"summary": "SUSE Bug 864682",
"url": "https://bugzilla.suse.com/864682"
},
{
"category": "self",
"summary": "SUSE Bug 864769",
"url": "https://bugzilla.suse.com/864769"
},
{
"category": "self",
"summary": "SUSE Bug 864796",
"url": "https://bugzilla.suse.com/864796"
},
{
"category": "self",
"summary": "SUSE Bug 864801",
"url": "https://bugzilla.suse.com/864801"
},
{
"category": "self",
"summary": "SUSE Bug 864802",
"url": "https://bugzilla.suse.com/864802"
},
{
"category": "self",
"summary": "SUSE Bug 864804",
"url": "https://bugzilla.suse.com/864804"
},
{
"category": "self",
"summary": "SUSE Bug 864805",
"url": "https://bugzilla.suse.com/864805"
},
{
"category": "self",
"summary": "SUSE Bug 864811",
"url": "https://bugzilla.suse.com/864811"
},
{
"category": "self",
"summary": "SUSE Bug 864812",
"url": "https://bugzilla.suse.com/864812"
},
{
"category": "self",
"summary": "SUSE Bug 864814",
"url": "https://bugzilla.suse.com/864814"
},
{
"category": "self",
"summary": "SUSE Bug 870439",
"url": "https://bugzilla.suse.com/870439"
},
{
"category": "self",
"summary": "SUSE Bug 873235",
"url": "https://bugzilla.suse.com/873235"
},
{
"category": "self",
"summary": "SUSE Bug 874749",
"url": "https://bugzilla.suse.com/874749"
},
{
"category": "self",
"summary": "SUSE Bug 874788",
"url": "https://bugzilla.suse.com/874788"
},
{
"category": "self",
"summary": "SUSE Bug 876842",
"url": "https://bugzilla.suse.com/876842"
},
{
"category": "self",
"summary": "SUSE Bug 877642",
"url": "https://bugzilla.suse.com/877642"
},
{
"category": "self",
"summary": "SUSE Bug 877645",
"url": "https://bugzilla.suse.com/877645"
},
{
"category": "self",
"summary": "SUSE Bug 878541",
"url": "https://bugzilla.suse.com/878541"
},
{
"category": "self",
"summary": "SUSE Bug 886535",
"url": "https://bugzilla.suse.com/886535"
},
{
"category": "self",
"summary": "SUSE Bug 920571",
"url": "https://bugzilla.suse.com/920571"
},
{
"category": "self",
"summary": "SUSE Bug 924018",
"url": "https://bugzilla.suse.com/924018"
},
{
"category": "self",
"summary": "SUSE Bug 929339",
"url": "https://bugzilla.suse.com/929339"
},
{
"category": "self",
"summary": "SUSE Bug 932267",
"url": "https://bugzilla.suse.com/932267"
},
{
"category": "self",
"summary": "SUSE Bug 932770",
"url": "https://bugzilla.suse.com/932770"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2013-2016 page",
"url": "https://www.suse.com/security/cve/CVE-2013-2016/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2013-4344 page",
"url": "https://www.suse.com/security/cve/CVE-2013-4344/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2013-4541 page",
"url": "https://www.suse.com/security/cve/CVE-2013-4541/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2014-0142 page",
"url": "https://www.suse.com/security/cve/CVE-2014-0142/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2014-0143 page",
"url": "https://www.suse.com/security/cve/CVE-2014-0143/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2014-0144 page",
"url": "https://www.suse.com/security/cve/CVE-2014-0144/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2014-0145 page",
"url": "https://www.suse.com/security/cve/CVE-2014-0145/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2014-0146 page",
"url": "https://www.suse.com/security/cve/CVE-2014-0146/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2014-0147 page",
"url": "https://www.suse.com/security/cve/CVE-2014-0147/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2014-0150 page",
"url": "https://www.suse.com/security/cve/CVE-2014-0150/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2014-0222 page",
"url": "https://www.suse.com/security/cve/CVE-2014-0222/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2014-0223 page",
"url": "https://www.suse.com/security/cve/CVE-2014-0223/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2014-2894 page",
"url": "https://www.suse.com/security/cve/CVE-2014-2894/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2014-3461 page",
"url": "https://www.suse.com/security/cve/CVE-2014-3461/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-1779 page",
"url": "https://www.suse.com/security/cve/CVE-2015-1779/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-3209 page",
"url": "https://www.suse.com/security/cve/CVE-2015-3209/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-3456 page",
"url": "https://www.suse.com/security/cve/CVE-2015-3456/"
}
],
"title": "Security update for kvm",
"tracking": {
"current_release_date": "2014-09-19T14:41:45Z",
"generator": {
"date": "2014-09-19T14:41:45Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2015:0870-1",
"initial_release_date": "2014-09-19T14:41:45Z",
"revision_history": [
{
"date": "2014-09-19T14:41:45Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "kvm-1.4.2-0.17.1.i586",
"product": {
"name": "kvm-1.4.2-0.17.1.i586",
"product_id": "kvm-1.4.2-0.17.1.i586"
}
}
],
"category": "architecture",
"name": "i586"
},
{
"branches": [
{
"category": "product_version",
"name": "kvm-1.4.2-0.17.1.s390x",
"product": {
"name": "kvm-1.4.2-0.17.1.s390x",
"product_id": "kvm-1.4.2-0.17.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "kvm-1.4.2-0.17.1.x86_64",
"product": {
"name": "kvm-1.4.2-0.17.1.x86_64",
"product_id": "kvm-1.4.2-0.17.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Desktop 11 SP3",
"product": {
"name": "SUSE Linux Enterprise Desktop 11 SP3",
"product_id": "SUSE Linux Enterprise Desktop 11 SP3",
"product_identification_helper": {
"cpe": "cpe:/o:suse:suse_sled:11:sp3"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 11 SP3",
"product": {
"name": "SUSE Linux Enterprise Server 11 SP3",
"product_id": "SUSE Linux Enterprise Server 11 SP3",
"product_identification_helper": {
"cpe": "cpe:/o:suse:suse_sles:11:sp3"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 11 SP3-TERADATA",
"product": {
"name": "SUSE Linux Enterprise Server 11 SP3-TERADATA",
"product_id": "SUSE Linux Enterprise Server 11 SP3-TERADATA",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:11:sp3:teradata"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP Applications 11 SP3",
"product": {
"name": "SUSE Linux Enterprise Server for SAP Applications 11 SP3",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 11 SP3",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles_sap:11:sp3"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "kvm-1.4.2-0.17.1.i586 as component of SUSE Linux Enterprise Desktop 11 SP3",
"product_id": "SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586"
},
"product_reference": "kvm-1.4.2-0.17.1.i586",
"relates_to_product_reference": "SUSE Linux Enterprise Desktop 11 SP3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kvm-1.4.2-0.17.1.x86_64 as component of SUSE Linux Enterprise Desktop 11 SP3",
"product_id": "SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64"
},
"product_reference": "kvm-1.4.2-0.17.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Desktop 11 SP3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kvm-1.4.2-0.17.1.i586 as component of SUSE Linux Enterprise Server 11 SP3",
"product_id": "SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586"
},
"product_reference": "kvm-1.4.2-0.17.1.i586",
"relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kvm-1.4.2-0.17.1.s390x as component of SUSE Linux Enterprise Server 11 SP3",
"product_id": "SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x"
},
"product_reference": "kvm-1.4.2-0.17.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kvm-1.4.2-0.17.1.x86_64 as component of SUSE Linux Enterprise Server 11 SP3",
"product_id": "SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64"
},
"product_reference": "kvm-1.4.2-0.17.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kvm-1.4.2-0.17.1.i586 as component of SUSE Linux Enterprise Server 11 SP3-TERADATA",
"product_id": "SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586"
},
"product_reference": "kvm-1.4.2-0.17.1.i586",
"relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP3-TERADATA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kvm-1.4.2-0.17.1.s390x as component of SUSE Linux Enterprise Server 11 SP3-TERADATA",
"product_id": "SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x"
},
"product_reference": "kvm-1.4.2-0.17.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP3-TERADATA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kvm-1.4.2-0.17.1.x86_64 as component of SUSE Linux Enterprise Server 11 SP3-TERADATA",
"product_id": "SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64"
},
"product_reference": "kvm-1.4.2-0.17.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP3-TERADATA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kvm-1.4.2-0.17.1.i586 as component of SUSE Linux Enterprise Server for SAP Applications 11 SP3",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586"
},
"product_reference": "kvm-1.4.2-0.17.1.i586",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 11 SP3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kvm-1.4.2-0.17.1.s390x as component of SUSE Linux Enterprise Server for SAP Applications 11 SP3",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x"
},
"product_reference": "kvm-1.4.2-0.17.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 11 SP3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kvm-1.4.2-0.17.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 11 SP3",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
},
"product_reference": "kvm-1.4.2-0.17.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 11 SP3"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2013-2016",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2013-2016"
}
],
"notes": [
{
"category": "general",
"text": "A flaw was found in the way qemu v1.3.0 and later (virtio-rng) validates addresses when guest accesses the config space of a virtio device. If the virtio device has zero/small sized config space, such as virtio-rng, a privileged guest user could use this flaw to access the matching host\u0027s qemu address space and thus increase their privileges on the host.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2013-2016",
"url": "https://www.suse.com/security/cve/CVE-2013-2016"
},
{
"category": "external",
"summary": "SUSE Bug 817593 for CVE-2013-2016",
"url": "https://bugzilla.suse.com/817593"
},
{
"category": "external",
"summary": "SUSE Bug 871442 for CVE-2013-2016",
"url": "https://bugzilla.suse.com/871442"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2014-09-19T14:41:45Z",
"details": "important"
}
],
"title": "CVE-2013-2016"
},
{
"cve": "CVE-2013-4344",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2013-4344"
}
],
"notes": [
{
"category": "general",
"text": "Buffer overflow in the SCSI implementation in QEMU, as used in Xen, when a SCSI controller has more than 256 attached devices, allows local users to gain privileges via a small transfer buffer in a REPORT LUNS command.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2013-4344",
"url": "https://www.suse.com/security/cve/CVE-2013-4344"
},
{
"category": "external",
"summary": "SUSE Bug 842006 for CVE-2013-4344",
"url": "https://bugzilla.suse.com/842006"
},
{
"category": "external",
"summary": "SUSE Bug 871442 for CVE-2013-4344",
"url": "https://bugzilla.suse.com/871442"
},
{
"category": "external",
"summary": "SUSE Bug 880751 for CVE-2013-4344",
"url": "https://bugzilla.suse.com/880751"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2014-09-19T14:41:45Z",
"details": "moderate"
}
],
"title": "CVE-2013-4344"
},
{
"cve": "CVE-2013-4541",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2013-4541"
}
],
"notes": [
{
"category": "general",
"text": "The usb_device_post_load function in hw/usb/bus.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a crafted savevm image, related to a negative setup_len or setup_index value.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2013-4541",
"url": "https://www.suse.com/security/cve/CVE-2013-4541"
},
{
"category": "external",
"summary": "SUSE Bug 864802 for CVE-2013-4541",
"url": "https://bugzilla.suse.com/864802"
},
{
"category": "external",
"summary": "SUSE Bug 871442 for CVE-2013-4541",
"url": "https://bugzilla.suse.com/871442"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2014-09-19T14:41:45Z",
"details": "moderate"
}
],
"title": "CVE-2013-4541"
},
{
"cve": "CVE-2014-0142",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2014-0142"
}
],
"notes": [
{
"category": "general",
"text": "QEMU, possibly before 2.0.0, allows local users to cause a denial of service (divide-by-zero error and crash) via a zero value in the (1) tracks field to the seek_to_sector function in block/parallels.c or (2) extent_size field in the bochs function in block/bochs.c.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2014-0142",
"url": "https://www.suse.com/security/cve/CVE-2014-0142"
},
{
"category": "external",
"summary": "SUSE Bug 870439 for CVE-2014-0142",
"url": "https://bugzilla.suse.com/870439"
},
{
"category": "external",
"summary": "SUSE Bug 871442 for CVE-2014-0142",
"url": "https://bugzilla.suse.com/871442"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2014-09-19T14:41:45Z",
"details": "moderate"
}
],
"title": "CVE-2014-0142"
},
{
"cve": "CVE-2014-0143",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2014-0143"
}
],
"notes": [
{
"category": "general",
"text": "Multiple integer overflows in the block drivers in QEMU, possibly before 2.0.0, allow local users to cause a denial of service (crash) via a crafted catalog size in (1) the parallels_open function in block/parallels.c or (2) bochs_open function in bochs.c, a large L1 table in the (3) qcow2_snapshot_load_tmp in qcow2-snapshot.c or (4) qcow2_grow_l1_table function in qcow2-cluster.c, (5) a large request in the bdrv_check_byte_request function in block.c and other block drivers, (6) crafted cluster indexes in the get_refcount function in qcow2-refcount.c, or (7) a large number of blocks in the cloop_open function in cloop.c, which trigger buffer overflows, memory corruption, large memory allocations and out-of-bounds read and writes.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2014-0143",
"url": "https://www.suse.com/security/cve/CVE-2014-0143"
},
{
"category": "external",
"summary": "SUSE Bug 870439 for CVE-2014-0143",
"url": "https://bugzilla.suse.com/870439"
},
{
"category": "external",
"summary": "SUSE Bug 871442 for CVE-2014-0143",
"url": "https://bugzilla.suse.com/871442"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2014-09-19T14:41:45Z",
"details": "moderate"
}
],
"title": "CVE-2014-0143"
},
{
"cve": "CVE-2014-0144",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2014-0144"
}
],
"notes": [
{
"category": "general",
"text": "QEMU before 2.0.0 block drivers for CLOOP, QCOW2 version 2 and various other image formats are vulnerable to potential memory corruptions, integer/buffer overflows or crash caused by missing input validations which could allow a remote user to execute arbitrary code on the host with the privileges of the QEMU process.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2014-0144",
"url": "https://www.suse.com/security/cve/CVE-2014-0144"
},
{
"category": "external",
"summary": "SUSE Bug 870439 for CVE-2014-0144",
"url": "https://bugzilla.suse.com/870439"
},
{
"category": "external",
"summary": "SUSE Bug 871442 for CVE-2014-0144",
"url": "https://bugzilla.suse.com/871442"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2014-09-19T14:41:45Z",
"details": "moderate"
}
],
"title": "CVE-2014-0144"
},
{
"cve": "CVE-2014-0145",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2014-0145"
}
],
"notes": [
{
"category": "general",
"text": "Multiple buffer overflows in QEMU before 1.7.2 and 2.x before 2.0.0, allow local users to cause a denial of service (crash) or possibly execute arbitrary code via a large (1) L1 table in the qcow2_snapshot_load_tmp in the QCOW 2 block driver (block/qcow2-snapshot.c) or (2) uncompressed chunk, (3) chunk length, or (4) number of sectors in the DMG block driver (block/dmg.c).",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2014-0145",
"url": "https://www.suse.com/security/cve/CVE-2014-0145"
},
{
"category": "external",
"summary": "SUSE Bug 870439 for CVE-2014-0145",
"url": "https://bugzilla.suse.com/870439"
},
{
"category": "external",
"summary": "SUSE Bug 871442 for CVE-2014-0145",
"url": "https://bugzilla.suse.com/871442"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2014-09-19T14:41:45Z",
"details": "important"
}
],
"title": "CVE-2014-0145"
},
{
"cve": "CVE-2014-0146",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2014-0146"
}
],
"notes": [
{
"category": "general",
"text": "The qcow2_open function in the (block/qcow2.c) in QEMU before 1.7.2 and 2.x before 2.0.0 allows local users to cause a denial of service (NULL pointer dereference) via a crafted image which causes an error, related to the initialization of the snapshot_offset and nb_snapshots fields.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2014-0146",
"url": "https://www.suse.com/security/cve/CVE-2014-0146"
},
{
"category": "external",
"summary": "SUSE Bug 870439 for CVE-2014-0146",
"url": "https://bugzilla.suse.com/870439"
},
{
"category": "external",
"summary": "SUSE Bug 871442 for CVE-2014-0146",
"url": "https://bugzilla.suse.com/871442"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2014-09-19T14:41:45Z",
"details": "moderate"
}
],
"title": "CVE-2014-0146"
},
{
"cve": "CVE-2014-0147",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2014-0147"
}
],
"notes": [
{
"category": "general",
"text": "Qemu before 1.6.2 block diver for the various disk image formats used by Bochs and for the QCOW version 2 format, are vulnerable to a possible crash caused by signed data types or a logic error while creating QCOW2 snapshots, which leads to incorrectly calling update_refcount() routine.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2014-0147",
"url": "https://www.suse.com/security/cve/CVE-2014-0147"
},
{
"category": "external",
"summary": "SUSE Bug 870439 for CVE-2014-0147",
"url": "https://bugzilla.suse.com/870439"
},
{
"category": "external",
"summary": "SUSE Bug 871442 for CVE-2014-0147",
"url": "https://bugzilla.suse.com/871442"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2014-09-19T14:41:45Z",
"details": "moderate"
}
],
"title": "CVE-2014-0147"
},
{
"cve": "CVE-2014-0150",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2014-0150"
}
],
"notes": [
{
"category": "general",
"text": "Integer overflow in the virtio_net_handle_mac function in hw/net/virtio-net.c in QEMU 2.0 and earlier allows local guest users to execute arbitrary code via a MAC addresses table update request, which triggers a heap-based buffer overflow.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2014-0150",
"url": "https://www.suse.com/security/cve/CVE-2014-0150"
},
{
"category": "external",
"summary": "SUSE Bug 873235 for CVE-2014-0150",
"url": "https://bugzilla.suse.com/873235"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2014-09-19T14:41:45Z",
"details": "moderate"
}
],
"title": "CVE-2014-0150"
},
{
"cve": "CVE-2014-0222",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2014-0222"
}
],
"notes": [
{
"category": "general",
"text": "Integer overflow in the qcow_open function in block/qcow.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service (crash) via a large L2 table in a QCOW version 1 image.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2014-0222",
"url": "https://www.suse.com/security/cve/CVE-2014-0222"
},
{
"category": "external",
"summary": "SUSE Bug 1072223 for CVE-2014-0222",
"url": "https://bugzilla.suse.com/1072223"
},
{
"category": "external",
"summary": "SUSE Bug 877642 for CVE-2014-0222",
"url": "https://bugzilla.suse.com/877642"
},
{
"category": "external",
"summary": "SUSE Bug 950367 for CVE-2014-0222",
"url": "https://bugzilla.suse.com/950367"
},
{
"category": "external",
"summary": "SUSE Bug 964925 for CVE-2014-0222",
"url": "https://bugzilla.suse.com/964925"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2014-09-19T14:41:45Z",
"details": "moderate"
}
],
"title": "CVE-2014-0222"
},
{
"cve": "CVE-2014-0223",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2014-0223"
}
],
"notes": [
{
"category": "general",
"text": "Integer overflow in the qcow_open function in block/qcow.c in QEMU before 1.7.2 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a large image size, which triggers a buffer overflow or out-of-bounds read.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2014-0223",
"url": "https://www.suse.com/security/cve/CVE-2014-0223"
},
{
"category": "external",
"summary": "SUSE Bug 877645 for CVE-2014-0223",
"url": "https://bugzilla.suse.com/877645"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2014-09-19T14:41:45Z",
"details": "moderate"
}
],
"title": "CVE-2014-0223"
},
{
"cve": "CVE-2014-2894",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2014-2894"
}
],
"notes": [
{
"category": "general",
"text": "Off-by-one error in the cmd_smart function in the smart self test in hw/ide/core.c in QEMU before 2.0 allows local users to have unspecified impact via a SMART EXECUTE OFFLINE command that triggers a buffer underflow and memory corruption.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2014-2894",
"url": "https://www.suse.com/security/cve/CVE-2014-2894"
},
{
"category": "external",
"summary": "SUSE Bug 874749 for CVE-2014-2894",
"url": "https://bugzilla.suse.com/874749"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2014-09-19T14:41:45Z",
"details": "moderate"
}
],
"title": "CVE-2014-2894"
},
{
"cve": "CVE-2014-3461",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2014-3461"
}
],
"notes": [
{
"category": "general",
"text": "hw/usb/bus.c in QEMU 1.6.2 allows remote attackers to execute arbitrary code via crafted savevm data, which triggers a heap-based buffer overflow, related to \"USB post load checks.\"",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2014-3461",
"url": "https://www.suse.com/security/cve/CVE-2014-3461"
},
{
"category": "external",
"summary": "SUSE Bug 878541 for CVE-2014-3461",
"url": "https://bugzilla.suse.com/878541"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2014-09-19T14:41:45Z",
"details": "moderate"
}
],
"title": "CVE-2014-3461"
},
{
"cve": "CVE-2015-1779",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-1779"
}
],
"notes": [
{
"category": "general",
"text": "The VNC websocket frame decoder in QEMU allows remote attackers to cause a denial of service (memory and CPU consumption) via a large (1) websocket payload or (2) HTTP headers section.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-1779",
"url": "https://www.suse.com/security/cve/CVE-2015-1779"
},
{
"category": "external",
"summary": "SUSE Bug 924018 for CVE-2015-1779",
"url": "https://bugzilla.suse.com/924018"
},
{
"category": "external",
"summary": "SUSE Bug 962632 for CVE-2015-1779",
"url": "https://bugzilla.suse.com/962632"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2014-09-19T14:41:45Z",
"details": "moderate"
}
],
"title": "CVE-2015-1779"
},
{
"cve": "CVE-2015-3209",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-3209"
}
],
"notes": [
{
"category": "general",
"text": "Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary code by sending a packet with TXSTATUS_STARTPACKET set and then a crafted packet with TXSTATUS_DEVICEOWNS set.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-3209",
"url": "https://www.suse.com/security/cve/CVE-2015-3209"
},
{
"category": "external",
"summary": "SUSE Bug 932267 for CVE-2015-3209",
"url": "https://bugzilla.suse.com/932267"
},
{
"category": "external",
"summary": "SUSE Bug 932770 for CVE-2015-3209",
"url": "https://bugzilla.suse.com/932770"
},
{
"category": "external",
"summary": "SUSE Bug 932823 for CVE-2015-3209",
"url": "https://bugzilla.suse.com/932823"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2014-09-19T14:41:45Z",
"details": "important"
}
],
"title": "CVE-2015-3209"
},
{
"cve": "CVE-2015-3456",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-3456"
}
],
"notes": [
{
"category": "general",
"text": "The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a denial of service (out-of-bounds write and guest crash) or possibly execute arbitrary code via the (1) FD_CMD_READ_ID, (2) FD_CMD_DRIVE_SPECIFICATION_COMMAND, or other unspecified commands, aka VENOM.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-3456",
"url": "https://www.suse.com/security/cve/CVE-2015-3456"
},
{
"category": "external",
"summary": "SUSE Bug 929339 for CVE-2015-3456",
"url": "https://bugzilla.suse.com/929339"
},
{
"category": "external",
"summary": "SUSE Bug 932770 for CVE-2015-3456",
"url": "https://bugzilla.suse.com/932770"
},
{
"category": "external",
"summary": "SUSE Bug 935900 for CVE-2015-3456",
"url": "https://bugzilla.suse.com/935900"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2014-09-19T14:41:45Z",
"details": "moderate"
}
],
"title": "CVE-2015-3456"
}
]
}
SUSE-SU-2015:0889-1
Vulnerability from csaf_suse - Published: 2014-09-19 14:41 - Updated: 2014-09-19 14:41Summary
Security update for kvm
Severity
Moderate
Notes
Title of the patch: Security update for kvm
Description of the patch:
kvm has been updated to fix issues in the embedded qemu:
*
CVE-2014-0223: An integer overflow flaw was found in the QEMU block
driver for QCOW version 1 disk images. A user able to alter the QEMU
disk image files loaded by a guest could have used this flaw to
corrupt QEMU process memory on the host, which could potentially have
resulted in arbitrary code execution on the host with the privileges
of the QEMU process.
*
CVE-2014-3461: A user able to alter the savevm data (either on the
disk or over the wire during migration) could have used this flaw to
to corrupt QEMU process memory on the (destination) host, which could
have potentially resulted in arbitrary code execution on the host
with the privileges of the QEMU process.
*
CVE-2014-0222: An integer overflow flaw was found in the QEMU block
driver for QCOW version 1 disk images. A user able to alter the QEMU
disk image files loaded by a guest could have used this flaw to
corrupt QEMU process memory on the host, which could have potentially
resulted in arbitrary code execution on the host with the privileges
of the QEMU process.
Non-security bugs fixed:
* Fix exceeding IRQ routes that could have caused freezes of guests.
(bnc#876842)
* Fix CPUID emulation bugs that may have broken Windows guests with
newer -cpu types (bnc#886535)
Security Issues:
* CVE-2014-0222
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0222>
* CVE-2014-0223
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0223>
* CVE-2014-3461
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3461>
Patchnames: sledsp3-kvm,slessp3-kvm
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
7.8 (High)
Affected products
Recommended
11 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
Affected products
Recommended
11 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
Affected products
Recommended
11 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
5.5 (Medium)
Affected products
Recommended
11 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
Affected products
Recommended
11 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
8.6 (High)
Affected products
Recommended
11 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
7.8 (High)
Affected products
Recommended
11 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
5.5 (Medium)
Affected products
Recommended
11 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
6.2 (Medium)
Affected products
Recommended
11 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
Affected products
Recommended
11 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
Affected products
Recommended
11 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
Affected products
Recommended
11 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
Affected products
Recommended
11 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
Affected products
Recommended
11 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
8.6 (High)
Affected products
Recommended
11 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
Affected products
Recommended
11 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
Affected products
Recommended
11 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
References
116 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for kvm",
"title": "Title of the patch"
},
{
"category": "description",
"text": "\nkvm has been updated to fix issues in the embedded qemu:\n\n * \n\n CVE-2014-0223: An integer overflow flaw was found in the QEMU block\n driver for QCOW version 1 disk images. A user able to alter the QEMU\n disk image files loaded by a guest could have used this flaw to\n corrupt QEMU process memory on the host, which could potentially have\n resulted in arbitrary code execution on the host with the privileges\n of the QEMU process.\n\n * \n\n CVE-2014-3461: A user able to alter the savevm data (either on the\n disk or over the wire during migration) could have used this flaw to\n to corrupt QEMU process memory on the (destination) host, which could\n have potentially resulted in arbitrary code execution on the host\n with the privileges of the QEMU process.\n\n * \n\n CVE-2014-0222: An integer overflow flaw was found in the QEMU block\n driver for QCOW version 1 disk images. A user able to alter the QEMU\n disk image files loaded by a guest could have used this flaw to\n corrupt QEMU process memory on the host, which could have potentially\n resulted in arbitrary code execution on the host with the privileges\n of the QEMU process.\n\nNon-security bugs fixed:\n\n * Fix exceeding IRQ routes that could have caused freezes of guests.\n (bnc#876842)\n * Fix CPUID emulation bugs that may have broken Windows guests with\n newer -cpu types (bnc#886535)\n\nSecurity Issues:\n\n * CVE-2014-0222\n \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0222\u003e\n * CVE-2014-0223\n \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0223\u003e\n * CVE-2014-3461\n \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3461\u003e\n\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "sledsp3-kvm,slessp3-kvm",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2015_0889-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2015:0889-1",
"url": "https://www.suse.com/support/update/announcement/2015/suse-su-20150889-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2015:0889-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2015-May/001390.html"
},
{
"category": "self",
"summary": "SUSE Bug 812836",
"url": "https://bugzilla.suse.com/812836"
},
{
"category": "self",
"summary": "SUSE Bug 812983",
"url": "https://bugzilla.suse.com/812983"
},
{
"category": "self",
"summary": "SUSE Bug 817593",
"url": "https://bugzilla.suse.com/817593"
},
{
"category": "self",
"summary": "SUSE Bug 821819",
"url": "https://bugzilla.suse.com/821819"
},
{
"category": "self",
"summary": "SUSE Bug 824340",
"url": "https://bugzilla.suse.com/824340"
},
{
"category": "self",
"summary": "SUSE Bug 829800",
"url": "https://bugzilla.suse.com/829800"
},
{
"category": "self",
"summary": "SUSE Bug 841080",
"url": "https://bugzilla.suse.com/841080"
},
{
"category": "self",
"summary": "SUSE Bug 842006",
"url": "https://bugzilla.suse.com/842006"
},
{
"category": "self",
"summary": "SUSE Bug 842088",
"url": "https://bugzilla.suse.com/842088"
},
{
"category": "self",
"summary": "SUSE Bug 858858",
"url": "https://bugzilla.suse.com/858858"
},
{
"category": "self",
"summary": "SUSE Bug 864391",
"url": "https://bugzilla.suse.com/864391"
},
{
"category": "self",
"summary": "SUSE Bug 864649",
"url": "https://bugzilla.suse.com/864649"
},
{
"category": "self",
"summary": "SUSE Bug 864650",
"url": "https://bugzilla.suse.com/864650"
},
{
"category": "self",
"summary": "SUSE Bug 864653",
"url": "https://bugzilla.suse.com/864653"
},
{
"category": "self",
"summary": "SUSE Bug 864655",
"url": "https://bugzilla.suse.com/864655"
},
{
"category": "self",
"summary": "SUSE Bug 864665",
"url": "https://bugzilla.suse.com/864665"
},
{
"category": "self",
"summary": "SUSE Bug 864671",
"url": "https://bugzilla.suse.com/864671"
},
{
"category": "self",
"summary": "SUSE Bug 864673",
"url": "https://bugzilla.suse.com/864673"
},
{
"category": "self",
"summary": "SUSE Bug 864678",
"url": "https://bugzilla.suse.com/864678"
},
{
"category": "self",
"summary": "SUSE Bug 864682",
"url": "https://bugzilla.suse.com/864682"
},
{
"category": "self",
"summary": "SUSE Bug 864769",
"url": "https://bugzilla.suse.com/864769"
},
{
"category": "self",
"summary": "SUSE Bug 864796",
"url": "https://bugzilla.suse.com/864796"
},
{
"category": "self",
"summary": "SUSE Bug 864801",
"url": "https://bugzilla.suse.com/864801"
},
{
"category": "self",
"summary": "SUSE Bug 864802",
"url": "https://bugzilla.suse.com/864802"
},
{
"category": "self",
"summary": "SUSE Bug 864804",
"url": "https://bugzilla.suse.com/864804"
},
{
"category": "self",
"summary": "SUSE Bug 864805",
"url": "https://bugzilla.suse.com/864805"
},
{
"category": "self",
"summary": "SUSE Bug 864811",
"url": "https://bugzilla.suse.com/864811"
},
{
"category": "self",
"summary": "SUSE Bug 864812",
"url": "https://bugzilla.suse.com/864812"
},
{
"category": "self",
"summary": "SUSE Bug 864814",
"url": "https://bugzilla.suse.com/864814"
},
{
"category": "self",
"summary": "SUSE Bug 870439",
"url": "https://bugzilla.suse.com/870439"
},
{
"category": "self",
"summary": "SUSE Bug 873235",
"url": "https://bugzilla.suse.com/873235"
},
{
"category": "self",
"summary": "SUSE Bug 874749",
"url": "https://bugzilla.suse.com/874749"
},
{
"category": "self",
"summary": "SUSE Bug 874788",
"url": "https://bugzilla.suse.com/874788"
},
{
"category": "self",
"summary": "SUSE Bug 876842",
"url": "https://bugzilla.suse.com/876842"
},
{
"category": "self",
"summary": "SUSE Bug 877642",
"url": "https://bugzilla.suse.com/877642"
},
{
"category": "self",
"summary": "SUSE Bug 877645",
"url": "https://bugzilla.suse.com/877645"
},
{
"category": "self",
"summary": "SUSE Bug 878541",
"url": "https://bugzilla.suse.com/878541"
},
{
"category": "self",
"summary": "SUSE Bug 886535",
"url": "https://bugzilla.suse.com/886535"
},
{
"category": "self",
"summary": "SUSE Bug 920571",
"url": "https://bugzilla.suse.com/920571"
},
{
"category": "self",
"summary": "SUSE Bug 924018",
"url": "https://bugzilla.suse.com/924018"
},
{
"category": "self",
"summary": "SUSE Bug 929339",
"url": "https://bugzilla.suse.com/929339"
},
{
"category": "self",
"summary": "SUSE Bug 932267",
"url": "https://bugzilla.suse.com/932267"
},
{
"category": "self",
"summary": "SUSE Bug 932770",
"url": "https://bugzilla.suse.com/932770"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2013-2016 page",
"url": "https://www.suse.com/security/cve/CVE-2013-2016/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2013-4344 page",
"url": "https://www.suse.com/security/cve/CVE-2013-4344/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2013-4541 page",
"url": "https://www.suse.com/security/cve/CVE-2013-4541/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2014-0142 page",
"url": "https://www.suse.com/security/cve/CVE-2014-0142/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2014-0143 page",
"url": "https://www.suse.com/security/cve/CVE-2014-0143/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2014-0144 page",
"url": "https://www.suse.com/security/cve/CVE-2014-0144/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2014-0145 page",
"url": "https://www.suse.com/security/cve/CVE-2014-0145/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2014-0146 page",
"url": "https://www.suse.com/security/cve/CVE-2014-0146/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2014-0147 page",
"url": "https://www.suse.com/security/cve/CVE-2014-0147/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2014-0150 page",
"url": "https://www.suse.com/security/cve/CVE-2014-0150/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2014-0222 page",
"url": "https://www.suse.com/security/cve/CVE-2014-0222/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2014-0223 page",
"url": "https://www.suse.com/security/cve/CVE-2014-0223/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2014-2894 page",
"url": "https://www.suse.com/security/cve/CVE-2014-2894/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2014-3461 page",
"url": "https://www.suse.com/security/cve/CVE-2014-3461/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-1779 page",
"url": "https://www.suse.com/security/cve/CVE-2015-1779/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-3209 page",
"url": "https://www.suse.com/security/cve/CVE-2015-3209/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-3456 page",
"url": "https://www.suse.com/security/cve/CVE-2015-3456/"
}
],
"title": "Security update for kvm",
"tracking": {
"current_release_date": "2014-09-19T14:41:45Z",
"generator": {
"date": "2014-09-19T14:41:45Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2015:0889-1",
"initial_release_date": "2014-09-19T14:41:45Z",
"revision_history": [
{
"date": "2014-09-19T14:41:45Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "kvm-1.4.2-0.17.1.i586",
"product": {
"name": "kvm-1.4.2-0.17.1.i586",
"product_id": "kvm-1.4.2-0.17.1.i586"
}
}
],
"category": "architecture",
"name": "i586"
},
{
"branches": [
{
"category": "product_version",
"name": "kvm-1.4.2-0.17.1.s390x",
"product": {
"name": "kvm-1.4.2-0.17.1.s390x",
"product_id": "kvm-1.4.2-0.17.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "kvm-1.4.2-0.17.1.x86_64",
"product": {
"name": "kvm-1.4.2-0.17.1.x86_64",
"product_id": "kvm-1.4.2-0.17.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Desktop 11 SP3",
"product": {
"name": "SUSE Linux Enterprise Desktop 11 SP3",
"product_id": "SUSE Linux Enterprise Desktop 11 SP3",
"product_identification_helper": {
"cpe": "cpe:/o:suse:suse_sled:11:sp3"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 11 SP3",
"product": {
"name": "SUSE Linux Enterprise Server 11 SP3",
"product_id": "SUSE Linux Enterprise Server 11 SP3",
"product_identification_helper": {
"cpe": "cpe:/o:suse:suse_sles:11:sp3"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 11 SP3-TERADATA",
"product": {
"name": "SUSE Linux Enterprise Server 11 SP3-TERADATA",
"product_id": "SUSE Linux Enterprise Server 11 SP3-TERADATA",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:11:sp3:teradata"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP Applications 11 SP3",
"product": {
"name": "SUSE Linux Enterprise Server for SAP Applications 11 SP3",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 11 SP3",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles_sap:11:sp3"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "kvm-1.4.2-0.17.1.i586 as component of SUSE Linux Enterprise Desktop 11 SP3",
"product_id": "SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586"
},
"product_reference": "kvm-1.4.2-0.17.1.i586",
"relates_to_product_reference": "SUSE Linux Enterprise Desktop 11 SP3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kvm-1.4.2-0.17.1.x86_64 as component of SUSE Linux Enterprise Desktop 11 SP3",
"product_id": "SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64"
},
"product_reference": "kvm-1.4.2-0.17.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Desktop 11 SP3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kvm-1.4.2-0.17.1.i586 as component of SUSE Linux Enterprise Server 11 SP3",
"product_id": "SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586"
},
"product_reference": "kvm-1.4.2-0.17.1.i586",
"relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kvm-1.4.2-0.17.1.s390x as component of SUSE Linux Enterprise Server 11 SP3",
"product_id": "SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x"
},
"product_reference": "kvm-1.4.2-0.17.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kvm-1.4.2-0.17.1.x86_64 as component of SUSE Linux Enterprise Server 11 SP3",
"product_id": "SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64"
},
"product_reference": "kvm-1.4.2-0.17.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kvm-1.4.2-0.17.1.i586 as component of SUSE Linux Enterprise Server 11 SP3-TERADATA",
"product_id": "SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586"
},
"product_reference": "kvm-1.4.2-0.17.1.i586",
"relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP3-TERADATA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kvm-1.4.2-0.17.1.s390x as component of SUSE Linux Enterprise Server 11 SP3-TERADATA",
"product_id": "SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x"
},
"product_reference": "kvm-1.4.2-0.17.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP3-TERADATA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kvm-1.4.2-0.17.1.x86_64 as component of SUSE Linux Enterprise Server 11 SP3-TERADATA",
"product_id": "SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64"
},
"product_reference": "kvm-1.4.2-0.17.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP3-TERADATA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kvm-1.4.2-0.17.1.i586 as component of SUSE Linux Enterprise Server for SAP Applications 11 SP3",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586"
},
"product_reference": "kvm-1.4.2-0.17.1.i586",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 11 SP3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kvm-1.4.2-0.17.1.s390x as component of SUSE Linux Enterprise Server for SAP Applications 11 SP3",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x"
},
"product_reference": "kvm-1.4.2-0.17.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 11 SP3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kvm-1.4.2-0.17.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 11 SP3",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
},
"product_reference": "kvm-1.4.2-0.17.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 11 SP3"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2013-2016",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2013-2016"
}
],
"notes": [
{
"category": "general",
"text": "A flaw was found in the way qemu v1.3.0 and later (virtio-rng) validates addresses when guest accesses the config space of a virtio device. If the virtio device has zero/small sized config space, such as virtio-rng, a privileged guest user could use this flaw to access the matching host\u0027s qemu address space and thus increase their privileges on the host.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2013-2016",
"url": "https://www.suse.com/security/cve/CVE-2013-2016"
},
{
"category": "external",
"summary": "SUSE Bug 817593 for CVE-2013-2016",
"url": "https://bugzilla.suse.com/817593"
},
{
"category": "external",
"summary": "SUSE Bug 871442 for CVE-2013-2016",
"url": "https://bugzilla.suse.com/871442"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2014-09-19T14:41:45Z",
"details": "important"
}
],
"title": "CVE-2013-2016"
},
{
"cve": "CVE-2013-4344",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2013-4344"
}
],
"notes": [
{
"category": "general",
"text": "Buffer overflow in the SCSI implementation in QEMU, as used in Xen, when a SCSI controller has more than 256 attached devices, allows local users to gain privileges via a small transfer buffer in a REPORT LUNS command.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2013-4344",
"url": "https://www.suse.com/security/cve/CVE-2013-4344"
},
{
"category": "external",
"summary": "SUSE Bug 842006 for CVE-2013-4344",
"url": "https://bugzilla.suse.com/842006"
},
{
"category": "external",
"summary": "SUSE Bug 871442 for CVE-2013-4344",
"url": "https://bugzilla.suse.com/871442"
},
{
"category": "external",
"summary": "SUSE Bug 880751 for CVE-2013-4344",
"url": "https://bugzilla.suse.com/880751"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2014-09-19T14:41:45Z",
"details": "moderate"
}
],
"title": "CVE-2013-4344"
},
{
"cve": "CVE-2013-4541",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2013-4541"
}
],
"notes": [
{
"category": "general",
"text": "The usb_device_post_load function in hw/usb/bus.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a crafted savevm image, related to a negative setup_len or setup_index value.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2013-4541",
"url": "https://www.suse.com/security/cve/CVE-2013-4541"
},
{
"category": "external",
"summary": "SUSE Bug 864802 for CVE-2013-4541",
"url": "https://bugzilla.suse.com/864802"
},
{
"category": "external",
"summary": "SUSE Bug 871442 for CVE-2013-4541",
"url": "https://bugzilla.suse.com/871442"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2014-09-19T14:41:45Z",
"details": "moderate"
}
],
"title": "CVE-2013-4541"
},
{
"cve": "CVE-2014-0142",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2014-0142"
}
],
"notes": [
{
"category": "general",
"text": "QEMU, possibly before 2.0.0, allows local users to cause a denial of service (divide-by-zero error and crash) via a zero value in the (1) tracks field to the seek_to_sector function in block/parallels.c or (2) extent_size field in the bochs function in block/bochs.c.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2014-0142",
"url": "https://www.suse.com/security/cve/CVE-2014-0142"
},
{
"category": "external",
"summary": "SUSE Bug 870439 for CVE-2014-0142",
"url": "https://bugzilla.suse.com/870439"
},
{
"category": "external",
"summary": "SUSE Bug 871442 for CVE-2014-0142",
"url": "https://bugzilla.suse.com/871442"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2014-09-19T14:41:45Z",
"details": "moderate"
}
],
"title": "CVE-2014-0142"
},
{
"cve": "CVE-2014-0143",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2014-0143"
}
],
"notes": [
{
"category": "general",
"text": "Multiple integer overflows in the block drivers in QEMU, possibly before 2.0.0, allow local users to cause a denial of service (crash) via a crafted catalog size in (1) the parallels_open function in block/parallels.c or (2) bochs_open function in bochs.c, a large L1 table in the (3) qcow2_snapshot_load_tmp in qcow2-snapshot.c or (4) qcow2_grow_l1_table function in qcow2-cluster.c, (5) a large request in the bdrv_check_byte_request function in block.c and other block drivers, (6) crafted cluster indexes in the get_refcount function in qcow2-refcount.c, or (7) a large number of blocks in the cloop_open function in cloop.c, which trigger buffer overflows, memory corruption, large memory allocations and out-of-bounds read and writes.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2014-0143",
"url": "https://www.suse.com/security/cve/CVE-2014-0143"
},
{
"category": "external",
"summary": "SUSE Bug 870439 for CVE-2014-0143",
"url": "https://bugzilla.suse.com/870439"
},
{
"category": "external",
"summary": "SUSE Bug 871442 for CVE-2014-0143",
"url": "https://bugzilla.suse.com/871442"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2014-09-19T14:41:45Z",
"details": "moderate"
}
],
"title": "CVE-2014-0143"
},
{
"cve": "CVE-2014-0144",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2014-0144"
}
],
"notes": [
{
"category": "general",
"text": "QEMU before 2.0.0 block drivers for CLOOP, QCOW2 version 2 and various other image formats are vulnerable to potential memory corruptions, integer/buffer overflows or crash caused by missing input validations which could allow a remote user to execute arbitrary code on the host with the privileges of the QEMU process.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2014-0144",
"url": "https://www.suse.com/security/cve/CVE-2014-0144"
},
{
"category": "external",
"summary": "SUSE Bug 870439 for CVE-2014-0144",
"url": "https://bugzilla.suse.com/870439"
},
{
"category": "external",
"summary": "SUSE Bug 871442 for CVE-2014-0144",
"url": "https://bugzilla.suse.com/871442"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2014-09-19T14:41:45Z",
"details": "moderate"
}
],
"title": "CVE-2014-0144"
},
{
"cve": "CVE-2014-0145",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2014-0145"
}
],
"notes": [
{
"category": "general",
"text": "Multiple buffer overflows in QEMU before 1.7.2 and 2.x before 2.0.0, allow local users to cause a denial of service (crash) or possibly execute arbitrary code via a large (1) L1 table in the qcow2_snapshot_load_tmp in the QCOW 2 block driver (block/qcow2-snapshot.c) or (2) uncompressed chunk, (3) chunk length, or (4) number of sectors in the DMG block driver (block/dmg.c).",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2014-0145",
"url": "https://www.suse.com/security/cve/CVE-2014-0145"
},
{
"category": "external",
"summary": "SUSE Bug 870439 for CVE-2014-0145",
"url": "https://bugzilla.suse.com/870439"
},
{
"category": "external",
"summary": "SUSE Bug 871442 for CVE-2014-0145",
"url": "https://bugzilla.suse.com/871442"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2014-09-19T14:41:45Z",
"details": "important"
}
],
"title": "CVE-2014-0145"
},
{
"cve": "CVE-2014-0146",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2014-0146"
}
],
"notes": [
{
"category": "general",
"text": "The qcow2_open function in the (block/qcow2.c) in QEMU before 1.7.2 and 2.x before 2.0.0 allows local users to cause a denial of service (NULL pointer dereference) via a crafted image which causes an error, related to the initialization of the snapshot_offset and nb_snapshots fields.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2014-0146",
"url": "https://www.suse.com/security/cve/CVE-2014-0146"
},
{
"category": "external",
"summary": "SUSE Bug 870439 for CVE-2014-0146",
"url": "https://bugzilla.suse.com/870439"
},
{
"category": "external",
"summary": "SUSE Bug 871442 for CVE-2014-0146",
"url": "https://bugzilla.suse.com/871442"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2014-09-19T14:41:45Z",
"details": "moderate"
}
],
"title": "CVE-2014-0146"
},
{
"cve": "CVE-2014-0147",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2014-0147"
}
],
"notes": [
{
"category": "general",
"text": "Qemu before 1.6.2 block diver for the various disk image formats used by Bochs and for the QCOW version 2 format, are vulnerable to a possible crash caused by signed data types or a logic error while creating QCOW2 snapshots, which leads to incorrectly calling update_refcount() routine.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2014-0147",
"url": "https://www.suse.com/security/cve/CVE-2014-0147"
},
{
"category": "external",
"summary": "SUSE Bug 870439 for CVE-2014-0147",
"url": "https://bugzilla.suse.com/870439"
},
{
"category": "external",
"summary": "SUSE Bug 871442 for CVE-2014-0147",
"url": "https://bugzilla.suse.com/871442"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2014-09-19T14:41:45Z",
"details": "moderate"
}
],
"title": "CVE-2014-0147"
},
{
"cve": "CVE-2014-0150",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2014-0150"
}
],
"notes": [
{
"category": "general",
"text": "Integer overflow in the virtio_net_handle_mac function in hw/net/virtio-net.c in QEMU 2.0 and earlier allows local guest users to execute arbitrary code via a MAC addresses table update request, which triggers a heap-based buffer overflow.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2014-0150",
"url": "https://www.suse.com/security/cve/CVE-2014-0150"
},
{
"category": "external",
"summary": "SUSE Bug 873235 for CVE-2014-0150",
"url": "https://bugzilla.suse.com/873235"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2014-09-19T14:41:45Z",
"details": "moderate"
}
],
"title": "CVE-2014-0150"
},
{
"cve": "CVE-2014-0222",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2014-0222"
}
],
"notes": [
{
"category": "general",
"text": "Integer overflow in the qcow_open function in block/qcow.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service (crash) via a large L2 table in a QCOW version 1 image.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2014-0222",
"url": "https://www.suse.com/security/cve/CVE-2014-0222"
},
{
"category": "external",
"summary": "SUSE Bug 1072223 for CVE-2014-0222",
"url": "https://bugzilla.suse.com/1072223"
},
{
"category": "external",
"summary": "SUSE Bug 877642 for CVE-2014-0222",
"url": "https://bugzilla.suse.com/877642"
},
{
"category": "external",
"summary": "SUSE Bug 950367 for CVE-2014-0222",
"url": "https://bugzilla.suse.com/950367"
},
{
"category": "external",
"summary": "SUSE Bug 964925 for CVE-2014-0222",
"url": "https://bugzilla.suse.com/964925"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2014-09-19T14:41:45Z",
"details": "moderate"
}
],
"title": "CVE-2014-0222"
},
{
"cve": "CVE-2014-0223",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2014-0223"
}
],
"notes": [
{
"category": "general",
"text": "Integer overflow in the qcow_open function in block/qcow.c in QEMU before 1.7.2 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a large image size, which triggers a buffer overflow or out-of-bounds read.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2014-0223",
"url": "https://www.suse.com/security/cve/CVE-2014-0223"
},
{
"category": "external",
"summary": "SUSE Bug 877645 for CVE-2014-0223",
"url": "https://bugzilla.suse.com/877645"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2014-09-19T14:41:45Z",
"details": "moderate"
}
],
"title": "CVE-2014-0223"
},
{
"cve": "CVE-2014-2894",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2014-2894"
}
],
"notes": [
{
"category": "general",
"text": "Off-by-one error in the cmd_smart function in the smart self test in hw/ide/core.c in QEMU before 2.0 allows local users to have unspecified impact via a SMART EXECUTE OFFLINE command that triggers a buffer underflow and memory corruption.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2014-2894",
"url": "https://www.suse.com/security/cve/CVE-2014-2894"
},
{
"category": "external",
"summary": "SUSE Bug 874749 for CVE-2014-2894",
"url": "https://bugzilla.suse.com/874749"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2014-09-19T14:41:45Z",
"details": "moderate"
}
],
"title": "CVE-2014-2894"
},
{
"cve": "CVE-2014-3461",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2014-3461"
}
],
"notes": [
{
"category": "general",
"text": "hw/usb/bus.c in QEMU 1.6.2 allows remote attackers to execute arbitrary code via crafted savevm data, which triggers a heap-based buffer overflow, related to \"USB post load checks.\"",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2014-3461",
"url": "https://www.suse.com/security/cve/CVE-2014-3461"
},
{
"category": "external",
"summary": "SUSE Bug 878541 for CVE-2014-3461",
"url": "https://bugzilla.suse.com/878541"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2014-09-19T14:41:45Z",
"details": "moderate"
}
],
"title": "CVE-2014-3461"
},
{
"cve": "CVE-2015-1779",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-1779"
}
],
"notes": [
{
"category": "general",
"text": "The VNC websocket frame decoder in QEMU allows remote attackers to cause a denial of service (memory and CPU consumption) via a large (1) websocket payload or (2) HTTP headers section.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-1779",
"url": "https://www.suse.com/security/cve/CVE-2015-1779"
},
{
"category": "external",
"summary": "SUSE Bug 924018 for CVE-2015-1779",
"url": "https://bugzilla.suse.com/924018"
},
{
"category": "external",
"summary": "SUSE Bug 962632 for CVE-2015-1779",
"url": "https://bugzilla.suse.com/962632"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2014-09-19T14:41:45Z",
"details": "moderate"
}
],
"title": "CVE-2015-1779"
},
{
"cve": "CVE-2015-3209",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-3209"
}
],
"notes": [
{
"category": "general",
"text": "Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary code by sending a packet with TXSTATUS_STARTPACKET set and then a crafted packet with TXSTATUS_DEVICEOWNS set.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-3209",
"url": "https://www.suse.com/security/cve/CVE-2015-3209"
},
{
"category": "external",
"summary": "SUSE Bug 932267 for CVE-2015-3209",
"url": "https://bugzilla.suse.com/932267"
},
{
"category": "external",
"summary": "SUSE Bug 932770 for CVE-2015-3209",
"url": "https://bugzilla.suse.com/932770"
},
{
"category": "external",
"summary": "SUSE Bug 932823 for CVE-2015-3209",
"url": "https://bugzilla.suse.com/932823"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2014-09-19T14:41:45Z",
"details": "important"
}
],
"title": "CVE-2015-3209"
},
{
"cve": "CVE-2015-3456",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-3456"
}
],
"notes": [
{
"category": "general",
"text": "The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a denial of service (out-of-bounds write and guest crash) or possibly execute arbitrary code via the (1) FD_CMD_READ_ID, (2) FD_CMD_DRIVE_SPECIFICATION_COMMAND, or other unspecified commands, aka VENOM.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-3456",
"url": "https://www.suse.com/security/cve/CVE-2015-3456"
},
{
"category": "external",
"summary": "SUSE Bug 929339 for CVE-2015-3456",
"url": "https://bugzilla.suse.com/929339"
},
{
"category": "external",
"summary": "SUSE Bug 932770 for CVE-2015-3456",
"url": "https://bugzilla.suse.com/932770"
},
{
"category": "external",
"summary": "SUSE Bug 935900 for CVE-2015-3456",
"url": "https://bugzilla.suse.com/935900"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Desktop 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server 11 SP3:kvm-1.4.2-0.17.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP3:kvm-1.4.2-0.17.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2014-09-19T14:41:45Z",
"details": "moderate"
}
],
"title": "CVE-2015-3456"
}
]
}
SUSE-SU-2015:0896-1
Vulnerability from csaf_suse - Published: 2015-05-12 21:54 - Updated: 2015-05-12 21:54Summary
Security update for qemu
Severity
Important
Notes
Title of the patch: Security update for qemu
Description of the patch:
qemu / kvm was updated to fix a security issue and some bugs.
Security issue fixed:
* CVE-2015-3456: Fixed a buffer overflow in the floppy drive emulation, which could be used
to denial of service attacks or potential code execution against the host.
* CVE-2015-1779: Fixed insufficient resource limiting in the VNC websockets decoder.
Bugs fixed:
- qemu truncates vhd images in virt-rescue (bsc#886378)
- Update kvm-supported.txt with the current rbd support status.
- enable rbd build on x86_64 (qemu-block-rbd package) (FATE#318349)
Patchnames: SUSE-SLE-DESKTOP-12-2015-200,SUSE-SLE-SERVER-12-2015-200
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
8.6 (High)
Affected products
Recommended
59 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Desktop 12:qemu-2.0.2-46.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Desktop 12:qemu-block-curl-2.0.2-46.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Desktop 12:qemu-ipxe-1.0.0-46.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Desktop 12:qemu-kvm-2.0.2-46.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Desktop 12:qemu-seabios-1.7.4-46.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Desktop 12:qemu-sgabios-8-46.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Desktop 12:qemu-tools-2.0.2-46.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Desktop 12:qemu-vgabios-1.7.4-46.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Desktop 12:qemu-x86-2.0.2-46.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12:qemu-2.0.2-46.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12:qemu-2.0.2-46.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12:qemu-2.0.2-46.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12:qemu-block-curl-2.0.2-46.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12:qemu-block-curl-2.0.2-46.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12:qemu-block-curl-2.0.2-46.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12:qemu-block-rbd-2.0.2-46.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12:qemu-guest-agent-2.0.2-46.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12:qemu-guest-agent-2.0.2-46.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12:qemu-guest-agent-2.0.2-46.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12:qemu-ipxe-1.0.0-46.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12:qemu-kvm-2.0.2-46.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12:qemu-kvm-2.0.2-46.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12:qemu-lang-2.0.2-46.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12:qemu-lang-2.0.2-46.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12:qemu-lang-2.0.2-46.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12:qemu-ppc-2.0.2-46.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12:qemu-s390-2.0.2-46.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12:qemu-seabios-1.7.4-46.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12:qemu-sgabios-8-46.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12:qemu-tools-2.0.2-46.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12:qemu-tools-2.0.2-46.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12:qemu-tools-2.0.2-46.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12:qemu-vgabios-1.7.4-46.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12:qemu-x86-2.0.2-46.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12:qemu-2.0.2-46.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12:qemu-2.0.2-46.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12:qemu-2.0.2-46.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-curl-2.0.2-46.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-curl-2.0.2-46.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-curl-2.0.2-46.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-rbd-2.0.2-46.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12:qemu-guest-agent-2.0.2-46.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12:qemu-guest-agent-2.0.2-46.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12:qemu-guest-agent-2.0.2-46.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12:qemu-ipxe-1.0.0-46.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12:qemu-kvm-2.0.2-46.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12:qemu-kvm-2.0.2-46.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12:qemu-lang-2.0.2-46.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12:qemu-lang-2.0.2-46.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12:qemu-lang-2.0.2-46.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12:qemu-ppc-2.0.2-46.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12:qemu-s390-2.0.2-46.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12:qemu-seabios-1.7.4-46.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12:qemu-sgabios-8-46.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12:qemu-tools-2.0.2-46.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12:qemu-tools-2.0.2-46.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12:qemu-tools-2.0.2-46.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12:qemu-vgabios-1.7.4-46.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12:qemu-x86-2.0.2-46.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
Affected products
Recommended
59 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Desktop 12:qemu-2.0.2-46.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Desktop 12:qemu-block-curl-2.0.2-46.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Desktop 12:qemu-ipxe-1.0.0-46.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Desktop 12:qemu-kvm-2.0.2-46.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Desktop 12:qemu-seabios-1.7.4-46.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Desktop 12:qemu-sgabios-8-46.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Desktop 12:qemu-tools-2.0.2-46.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Desktop 12:qemu-vgabios-1.7.4-46.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Desktop 12:qemu-x86-2.0.2-46.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12:qemu-2.0.2-46.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12:qemu-2.0.2-46.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12:qemu-2.0.2-46.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12:qemu-block-curl-2.0.2-46.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12:qemu-block-curl-2.0.2-46.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12:qemu-block-curl-2.0.2-46.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12:qemu-block-rbd-2.0.2-46.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12:qemu-guest-agent-2.0.2-46.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12:qemu-guest-agent-2.0.2-46.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12:qemu-guest-agent-2.0.2-46.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12:qemu-ipxe-1.0.0-46.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12:qemu-kvm-2.0.2-46.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12:qemu-kvm-2.0.2-46.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12:qemu-lang-2.0.2-46.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12:qemu-lang-2.0.2-46.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12:qemu-lang-2.0.2-46.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12:qemu-ppc-2.0.2-46.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12:qemu-s390-2.0.2-46.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12:qemu-seabios-1.7.4-46.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12:qemu-sgabios-8-46.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12:qemu-tools-2.0.2-46.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12:qemu-tools-2.0.2-46.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12:qemu-tools-2.0.2-46.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12:qemu-vgabios-1.7.4-46.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12:qemu-x86-2.0.2-46.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12:qemu-2.0.2-46.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12:qemu-2.0.2-46.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12:qemu-2.0.2-46.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-curl-2.0.2-46.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-curl-2.0.2-46.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-curl-2.0.2-46.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-rbd-2.0.2-46.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12:qemu-guest-agent-2.0.2-46.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12:qemu-guest-agent-2.0.2-46.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12:qemu-guest-agent-2.0.2-46.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12:qemu-ipxe-1.0.0-46.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12:qemu-kvm-2.0.2-46.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12:qemu-kvm-2.0.2-46.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12:qemu-lang-2.0.2-46.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12:qemu-lang-2.0.2-46.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12:qemu-lang-2.0.2-46.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12:qemu-ppc-2.0.2-46.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12:qemu-s390-2.0.2-46.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12:qemu-seabios-1.7.4-46.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12:qemu-sgabios-8-46.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12:qemu-tools-2.0.2-46.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12:qemu-tools-2.0.2-46.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12:qemu-tools-2.0.2-46.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12:qemu-vgabios-1.7.4-46.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12:qemu-x86-2.0.2-46.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
References
16 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for qemu",
"title": "Title of the patch"
},
{
"category": "description",
"text": "\nqemu / kvm was updated to fix a security issue and some bugs.\n\nSecurity issue fixed:\n\n* CVE-2015-3456: Fixed a buffer overflow in the floppy drive emulation, which could be used\n to denial of service attacks or potential code execution against the host.\n\n* CVE-2015-1779: Fixed insufficient resource limiting in the VNC websockets decoder.\n\n\nBugs fixed:\n- qemu truncates vhd images in virt-rescue (bsc#886378)\n\n- Update kvm-supported.txt with the current rbd support status.\n\n- enable rbd build on x86_64 (qemu-block-rbd package) (FATE#318349)",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-SLE-DESKTOP-12-2015-200,SUSE-SLE-SERVER-12-2015-200",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2015_0896-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2015:0896-1",
"url": "https://www.suse.com/support/update/announcement/2015/suse-su-20150896-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2015:0896-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2015-May/001392.html"
},
{
"category": "self",
"summary": "SUSE Bug 886378",
"url": "https://bugzilla.suse.com/886378"
},
{
"category": "self",
"summary": "SUSE Bug 924018",
"url": "https://bugzilla.suse.com/924018"
},
{
"category": "self",
"summary": "SUSE Bug 929339",
"url": "https://bugzilla.suse.com/929339"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-1779 page",
"url": "https://www.suse.com/security/cve/CVE-2015-1779/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-3456 page",
"url": "https://www.suse.com/security/cve/CVE-2015-3456/"
}
],
"title": "Security update for qemu",
"tracking": {
"current_release_date": "2015-05-12T21:54:11Z",
"generator": {
"date": "2015-05-12T21:54:11Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2015:0896-1",
"initial_release_date": "2015-05-12T21:54:11Z",
"revision_history": [
{
"date": "2015-05-12T21:54:11Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "qemu-ipxe-1.0.0-46.1.noarch",
"product": {
"name": "qemu-ipxe-1.0.0-46.1.noarch",
"product_id": "qemu-ipxe-1.0.0-46.1.noarch"
}
},
{
"category": "product_version",
"name": "qemu-seabios-1.7.4-46.1.noarch",
"product": {
"name": "qemu-seabios-1.7.4-46.1.noarch",
"product_id": "qemu-seabios-1.7.4-46.1.noarch"
}
},
{
"category": "product_version",
"name": "qemu-sgabios-8-46.1.noarch",
"product": {
"name": "qemu-sgabios-8-46.1.noarch",
"product_id": "qemu-sgabios-8-46.1.noarch"
}
},
{
"category": "product_version",
"name": "qemu-vgabios-1.7.4-46.1.noarch",
"product": {
"name": "qemu-vgabios-1.7.4-46.1.noarch",
"product_id": "qemu-vgabios-1.7.4-46.1.noarch"
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-2.0.2-46.1.ppc64le",
"product": {
"name": "qemu-2.0.2-46.1.ppc64le",
"product_id": "qemu-2.0.2-46.1.ppc64le"
}
},
{
"category": "product_version",
"name": "qemu-block-curl-2.0.2-46.1.ppc64le",
"product": {
"name": "qemu-block-curl-2.0.2-46.1.ppc64le",
"product_id": "qemu-block-curl-2.0.2-46.1.ppc64le"
}
},
{
"category": "product_version",
"name": "qemu-guest-agent-2.0.2-46.1.ppc64le",
"product": {
"name": "qemu-guest-agent-2.0.2-46.1.ppc64le",
"product_id": "qemu-guest-agent-2.0.2-46.1.ppc64le"
}
},
{
"category": "product_version",
"name": "qemu-lang-2.0.2-46.1.ppc64le",
"product": {
"name": "qemu-lang-2.0.2-46.1.ppc64le",
"product_id": "qemu-lang-2.0.2-46.1.ppc64le"
}
},
{
"category": "product_version",
"name": "qemu-ppc-2.0.2-46.1.ppc64le",
"product": {
"name": "qemu-ppc-2.0.2-46.1.ppc64le",
"product_id": "qemu-ppc-2.0.2-46.1.ppc64le"
}
},
{
"category": "product_version",
"name": "qemu-tools-2.0.2-46.1.ppc64le",
"product": {
"name": "qemu-tools-2.0.2-46.1.ppc64le",
"product_id": "qemu-tools-2.0.2-46.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-2.0.2-46.1.s390x",
"product": {
"name": "qemu-2.0.2-46.1.s390x",
"product_id": "qemu-2.0.2-46.1.s390x"
}
},
{
"category": "product_version",
"name": "qemu-block-curl-2.0.2-46.1.s390x",
"product": {
"name": "qemu-block-curl-2.0.2-46.1.s390x",
"product_id": "qemu-block-curl-2.0.2-46.1.s390x"
}
},
{
"category": "product_version",
"name": "qemu-guest-agent-2.0.2-46.1.s390x",
"product": {
"name": "qemu-guest-agent-2.0.2-46.1.s390x",
"product_id": "qemu-guest-agent-2.0.2-46.1.s390x"
}
},
{
"category": "product_version",
"name": "qemu-kvm-2.0.2-46.1.s390x",
"product": {
"name": "qemu-kvm-2.0.2-46.1.s390x",
"product_id": "qemu-kvm-2.0.2-46.1.s390x"
}
},
{
"category": "product_version",
"name": "qemu-lang-2.0.2-46.1.s390x",
"product": {
"name": "qemu-lang-2.0.2-46.1.s390x",
"product_id": "qemu-lang-2.0.2-46.1.s390x"
}
},
{
"category": "product_version",
"name": "qemu-s390-2.0.2-46.1.s390x",
"product": {
"name": "qemu-s390-2.0.2-46.1.s390x",
"product_id": "qemu-s390-2.0.2-46.1.s390x"
}
},
{
"category": "product_version",
"name": "qemu-tools-2.0.2-46.1.s390x",
"product": {
"name": "qemu-tools-2.0.2-46.1.s390x",
"product_id": "qemu-tools-2.0.2-46.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-2.0.2-46.1.x86_64",
"product": {
"name": "qemu-2.0.2-46.1.x86_64",
"product_id": "qemu-2.0.2-46.1.x86_64"
}
},
{
"category": "product_version",
"name": "qemu-block-curl-2.0.2-46.1.x86_64",
"product": {
"name": "qemu-block-curl-2.0.2-46.1.x86_64",
"product_id": "qemu-block-curl-2.0.2-46.1.x86_64"
}
},
{
"category": "product_version",
"name": "qemu-kvm-2.0.2-46.1.x86_64",
"product": {
"name": "qemu-kvm-2.0.2-46.1.x86_64",
"product_id": "qemu-kvm-2.0.2-46.1.x86_64"
}
},
{
"category": "product_version",
"name": "qemu-tools-2.0.2-46.1.x86_64",
"product": {
"name": "qemu-tools-2.0.2-46.1.x86_64",
"product_id": "qemu-tools-2.0.2-46.1.x86_64"
}
},
{
"category": "product_version",
"name": "qemu-x86-2.0.2-46.1.x86_64",
"product": {
"name": "qemu-x86-2.0.2-46.1.x86_64",
"product_id": "qemu-x86-2.0.2-46.1.x86_64"
}
},
{
"category": "product_version",
"name": "qemu-block-rbd-2.0.2-46.1.x86_64",
"product": {
"name": "qemu-block-rbd-2.0.2-46.1.x86_64",
"product_id": "qemu-block-rbd-2.0.2-46.1.x86_64"
}
},
{
"category": "product_version",
"name": "qemu-guest-agent-2.0.2-46.1.x86_64",
"product": {
"name": "qemu-guest-agent-2.0.2-46.1.x86_64",
"product_id": "qemu-guest-agent-2.0.2-46.1.x86_64"
}
},
{
"category": "product_version",
"name": "qemu-lang-2.0.2-46.1.x86_64",
"product": {
"name": "qemu-lang-2.0.2-46.1.x86_64",
"product_id": "qemu-lang-2.0.2-46.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Desktop 12",
"product": {
"name": "SUSE Linux Enterprise Desktop 12",
"product_id": "SUSE Linux Enterprise Desktop 12",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sled:12"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 12",
"product": {
"name": "SUSE Linux Enterprise Server 12",
"product_id": "SUSE Linux Enterprise Server 12",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:12"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP Applications 12",
"product": {
"name": "SUSE Linux Enterprise Server for SAP Applications 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles_sap:12"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-2.0.2-46.1.x86_64 as component of SUSE Linux Enterprise Desktop 12",
"product_id": "SUSE Linux Enterprise Desktop 12:qemu-2.0.2-46.1.x86_64"
},
"product_reference": "qemu-2.0.2-46.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Desktop 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-block-curl-2.0.2-46.1.x86_64 as component of SUSE Linux Enterprise Desktop 12",
"product_id": "SUSE Linux Enterprise Desktop 12:qemu-block-curl-2.0.2-46.1.x86_64"
},
"product_reference": "qemu-block-curl-2.0.2-46.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Desktop 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-ipxe-1.0.0-46.1.noarch as component of SUSE Linux Enterprise Desktop 12",
"product_id": "SUSE Linux Enterprise Desktop 12:qemu-ipxe-1.0.0-46.1.noarch"
},
"product_reference": "qemu-ipxe-1.0.0-46.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Desktop 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-2.0.2-46.1.x86_64 as component of SUSE Linux Enterprise Desktop 12",
"product_id": "SUSE Linux Enterprise Desktop 12:qemu-kvm-2.0.2-46.1.x86_64"
},
"product_reference": "qemu-kvm-2.0.2-46.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Desktop 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-seabios-1.7.4-46.1.noarch as component of SUSE Linux Enterprise Desktop 12",
"product_id": "SUSE Linux Enterprise Desktop 12:qemu-seabios-1.7.4-46.1.noarch"
},
"product_reference": "qemu-seabios-1.7.4-46.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Desktop 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-sgabios-8-46.1.noarch as component of SUSE Linux Enterprise Desktop 12",
"product_id": "SUSE Linux Enterprise Desktop 12:qemu-sgabios-8-46.1.noarch"
},
"product_reference": "qemu-sgabios-8-46.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Desktop 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-tools-2.0.2-46.1.x86_64 as component of SUSE Linux Enterprise Desktop 12",
"product_id": "SUSE Linux Enterprise Desktop 12:qemu-tools-2.0.2-46.1.x86_64"
},
"product_reference": "qemu-tools-2.0.2-46.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Desktop 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-vgabios-1.7.4-46.1.noarch as component of SUSE Linux Enterprise Desktop 12",
"product_id": "SUSE Linux Enterprise Desktop 12:qemu-vgabios-1.7.4-46.1.noarch"
},
"product_reference": "qemu-vgabios-1.7.4-46.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Desktop 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-x86-2.0.2-46.1.x86_64 as component of SUSE Linux Enterprise Desktop 12",
"product_id": "SUSE Linux Enterprise Desktop 12:qemu-x86-2.0.2-46.1.x86_64"
},
"product_reference": "qemu-x86-2.0.2-46.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Desktop 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-2.0.2-46.1.ppc64le as component of SUSE Linux Enterprise Server 12",
"product_id": "SUSE Linux Enterprise Server 12:qemu-2.0.2-46.1.ppc64le"
},
"product_reference": "qemu-2.0.2-46.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-2.0.2-46.1.s390x as component of SUSE Linux Enterprise Server 12",
"product_id": "SUSE Linux Enterprise Server 12:qemu-2.0.2-46.1.s390x"
},
"product_reference": "qemu-2.0.2-46.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-2.0.2-46.1.x86_64 as component of SUSE Linux Enterprise Server 12",
"product_id": "SUSE Linux Enterprise Server 12:qemu-2.0.2-46.1.x86_64"
},
"product_reference": "qemu-2.0.2-46.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-block-curl-2.0.2-46.1.ppc64le as component of SUSE Linux Enterprise Server 12",
"product_id": "SUSE Linux Enterprise Server 12:qemu-block-curl-2.0.2-46.1.ppc64le"
},
"product_reference": "qemu-block-curl-2.0.2-46.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-block-curl-2.0.2-46.1.s390x as component of SUSE Linux Enterprise Server 12",
"product_id": "SUSE Linux Enterprise Server 12:qemu-block-curl-2.0.2-46.1.s390x"
},
"product_reference": "qemu-block-curl-2.0.2-46.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-block-curl-2.0.2-46.1.x86_64 as component of SUSE Linux Enterprise Server 12",
"product_id": "SUSE Linux Enterprise Server 12:qemu-block-curl-2.0.2-46.1.x86_64"
},
"product_reference": "qemu-block-curl-2.0.2-46.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-block-rbd-2.0.2-46.1.x86_64 as component of SUSE Linux Enterprise Server 12",
"product_id": "SUSE Linux Enterprise Server 12:qemu-block-rbd-2.0.2-46.1.x86_64"
},
"product_reference": "qemu-block-rbd-2.0.2-46.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-guest-agent-2.0.2-46.1.ppc64le as component of SUSE Linux Enterprise Server 12",
"product_id": "SUSE Linux Enterprise Server 12:qemu-guest-agent-2.0.2-46.1.ppc64le"
},
"product_reference": "qemu-guest-agent-2.0.2-46.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-guest-agent-2.0.2-46.1.s390x as component of SUSE Linux Enterprise Server 12",
"product_id": "SUSE Linux Enterprise Server 12:qemu-guest-agent-2.0.2-46.1.s390x"
},
"product_reference": "qemu-guest-agent-2.0.2-46.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-guest-agent-2.0.2-46.1.x86_64 as component of SUSE Linux Enterprise Server 12",
"product_id": "SUSE Linux Enterprise Server 12:qemu-guest-agent-2.0.2-46.1.x86_64"
},
"product_reference": "qemu-guest-agent-2.0.2-46.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-ipxe-1.0.0-46.1.noarch as component of SUSE Linux Enterprise Server 12",
"product_id": "SUSE Linux Enterprise Server 12:qemu-ipxe-1.0.0-46.1.noarch"
},
"product_reference": "qemu-ipxe-1.0.0-46.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-2.0.2-46.1.s390x as component of SUSE Linux Enterprise Server 12",
"product_id": "SUSE Linux Enterprise Server 12:qemu-kvm-2.0.2-46.1.s390x"
},
"product_reference": "qemu-kvm-2.0.2-46.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-2.0.2-46.1.x86_64 as component of SUSE Linux Enterprise Server 12",
"product_id": "SUSE Linux Enterprise Server 12:qemu-kvm-2.0.2-46.1.x86_64"
},
"product_reference": "qemu-kvm-2.0.2-46.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-lang-2.0.2-46.1.ppc64le as component of SUSE Linux Enterprise Server 12",
"product_id": "SUSE Linux Enterprise Server 12:qemu-lang-2.0.2-46.1.ppc64le"
},
"product_reference": "qemu-lang-2.0.2-46.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-lang-2.0.2-46.1.s390x as component of SUSE Linux Enterprise Server 12",
"product_id": "SUSE Linux Enterprise Server 12:qemu-lang-2.0.2-46.1.s390x"
},
"product_reference": "qemu-lang-2.0.2-46.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-lang-2.0.2-46.1.x86_64 as component of SUSE Linux Enterprise Server 12",
"product_id": "SUSE Linux Enterprise Server 12:qemu-lang-2.0.2-46.1.x86_64"
},
"product_reference": "qemu-lang-2.0.2-46.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-ppc-2.0.2-46.1.ppc64le as component of SUSE Linux Enterprise Server 12",
"product_id": "SUSE Linux Enterprise Server 12:qemu-ppc-2.0.2-46.1.ppc64le"
},
"product_reference": "qemu-ppc-2.0.2-46.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-s390-2.0.2-46.1.s390x as component of SUSE Linux Enterprise Server 12",
"product_id": "SUSE Linux Enterprise Server 12:qemu-s390-2.0.2-46.1.s390x"
},
"product_reference": "qemu-s390-2.0.2-46.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-seabios-1.7.4-46.1.noarch as component of SUSE Linux Enterprise Server 12",
"product_id": "SUSE Linux Enterprise Server 12:qemu-seabios-1.7.4-46.1.noarch"
},
"product_reference": "qemu-seabios-1.7.4-46.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-sgabios-8-46.1.noarch as component of SUSE Linux Enterprise Server 12",
"product_id": "SUSE Linux Enterprise Server 12:qemu-sgabios-8-46.1.noarch"
},
"product_reference": "qemu-sgabios-8-46.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-tools-2.0.2-46.1.ppc64le as component of SUSE Linux Enterprise Server 12",
"product_id": "SUSE Linux Enterprise Server 12:qemu-tools-2.0.2-46.1.ppc64le"
},
"product_reference": "qemu-tools-2.0.2-46.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-tools-2.0.2-46.1.s390x as component of SUSE Linux Enterprise Server 12",
"product_id": "SUSE Linux Enterprise Server 12:qemu-tools-2.0.2-46.1.s390x"
},
"product_reference": "qemu-tools-2.0.2-46.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-tools-2.0.2-46.1.x86_64 as component of SUSE Linux Enterprise Server 12",
"product_id": "SUSE Linux Enterprise Server 12:qemu-tools-2.0.2-46.1.x86_64"
},
"product_reference": "qemu-tools-2.0.2-46.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-vgabios-1.7.4-46.1.noarch as component of SUSE Linux Enterprise Server 12",
"product_id": "SUSE Linux Enterprise Server 12:qemu-vgabios-1.7.4-46.1.noarch"
},
"product_reference": "qemu-vgabios-1.7.4-46.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-x86-2.0.2-46.1.x86_64 as component of SUSE Linux Enterprise Server 12",
"product_id": "SUSE Linux Enterprise Server 12:qemu-x86-2.0.2-46.1.x86_64"
},
"product_reference": "qemu-x86-2.0.2-46.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-2.0.2-46.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12:qemu-2.0.2-46.1.ppc64le"
},
"product_reference": "qemu-2.0.2-46.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-2.0.2-46.1.s390x as component of SUSE Linux Enterprise Server for SAP Applications 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12:qemu-2.0.2-46.1.s390x"
},
"product_reference": "qemu-2.0.2-46.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-2.0.2-46.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12:qemu-2.0.2-46.1.x86_64"
},
"product_reference": "qemu-2.0.2-46.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-block-curl-2.0.2-46.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-curl-2.0.2-46.1.ppc64le"
},
"product_reference": "qemu-block-curl-2.0.2-46.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-block-curl-2.0.2-46.1.s390x as component of SUSE Linux Enterprise Server for SAP Applications 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-curl-2.0.2-46.1.s390x"
},
"product_reference": "qemu-block-curl-2.0.2-46.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-block-curl-2.0.2-46.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-curl-2.0.2-46.1.x86_64"
},
"product_reference": "qemu-block-curl-2.0.2-46.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-block-rbd-2.0.2-46.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-rbd-2.0.2-46.1.x86_64"
},
"product_reference": "qemu-block-rbd-2.0.2-46.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-guest-agent-2.0.2-46.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12:qemu-guest-agent-2.0.2-46.1.ppc64le"
},
"product_reference": "qemu-guest-agent-2.0.2-46.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-guest-agent-2.0.2-46.1.s390x as component of SUSE Linux Enterprise Server for SAP Applications 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12:qemu-guest-agent-2.0.2-46.1.s390x"
},
"product_reference": "qemu-guest-agent-2.0.2-46.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-guest-agent-2.0.2-46.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12:qemu-guest-agent-2.0.2-46.1.x86_64"
},
"product_reference": "qemu-guest-agent-2.0.2-46.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-ipxe-1.0.0-46.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12:qemu-ipxe-1.0.0-46.1.noarch"
},
"product_reference": "qemu-ipxe-1.0.0-46.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-2.0.2-46.1.s390x as component of SUSE Linux Enterprise Server for SAP Applications 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12:qemu-kvm-2.0.2-46.1.s390x"
},
"product_reference": "qemu-kvm-2.0.2-46.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-2.0.2-46.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12:qemu-kvm-2.0.2-46.1.x86_64"
},
"product_reference": "qemu-kvm-2.0.2-46.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-lang-2.0.2-46.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12:qemu-lang-2.0.2-46.1.ppc64le"
},
"product_reference": "qemu-lang-2.0.2-46.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-lang-2.0.2-46.1.s390x as component of SUSE Linux Enterprise Server for SAP Applications 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12:qemu-lang-2.0.2-46.1.s390x"
},
"product_reference": "qemu-lang-2.0.2-46.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-lang-2.0.2-46.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12:qemu-lang-2.0.2-46.1.x86_64"
},
"product_reference": "qemu-lang-2.0.2-46.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-ppc-2.0.2-46.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12:qemu-ppc-2.0.2-46.1.ppc64le"
},
"product_reference": "qemu-ppc-2.0.2-46.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-s390-2.0.2-46.1.s390x as component of SUSE Linux Enterprise Server for SAP Applications 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12:qemu-s390-2.0.2-46.1.s390x"
},
"product_reference": "qemu-s390-2.0.2-46.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-seabios-1.7.4-46.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12:qemu-seabios-1.7.4-46.1.noarch"
},
"product_reference": "qemu-seabios-1.7.4-46.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-sgabios-8-46.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12:qemu-sgabios-8-46.1.noarch"
},
"product_reference": "qemu-sgabios-8-46.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-tools-2.0.2-46.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12:qemu-tools-2.0.2-46.1.ppc64le"
},
"product_reference": "qemu-tools-2.0.2-46.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-tools-2.0.2-46.1.s390x as component of SUSE Linux Enterprise Server for SAP Applications 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12:qemu-tools-2.0.2-46.1.s390x"
},
"product_reference": "qemu-tools-2.0.2-46.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-tools-2.0.2-46.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12:qemu-tools-2.0.2-46.1.x86_64"
},
"product_reference": "qemu-tools-2.0.2-46.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-vgabios-1.7.4-46.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12:qemu-vgabios-1.7.4-46.1.noarch"
},
"product_reference": "qemu-vgabios-1.7.4-46.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-x86-2.0.2-46.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12:qemu-x86-2.0.2-46.1.x86_64"
},
"product_reference": "qemu-x86-2.0.2-46.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2015-1779",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-1779"
}
],
"notes": [
{
"category": "general",
"text": "The VNC websocket frame decoder in QEMU allows remote attackers to cause a denial of service (memory and CPU consumption) via a large (1) websocket payload or (2) HTTP headers section.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Desktop 12:qemu-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Desktop 12:qemu-block-curl-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Desktop 12:qemu-ipxe-1.0.0-46.1.noarch",
"SUSE Linux Enterprise Desktop 12:qemu-kvm-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Desktop 12:qemu-seabios-1.7.4-46.1.noarch",
"SUSE Linux Enterprise Desktop 12:qemu-sgabios-8-46.1.noarch",
"SUSE Linux Enterprise Desktop 12:qemu-tools-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Desktop 12:qemu-vgabios-1.7.4-46.1.noarch",
"SUSE Linux Enterprise Desktop 12:qemu-x86-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-2.0.2-46.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-2.0.2-46.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-block-curl-2.0.2-46.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-block-curl-2.0.2-46.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-block-curl-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-block-rbd-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-guest-agent-2.0.2-46.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-guest-agent-2.0.2-46.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-guest-agent-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-ipxe-1.0.0-46.1.noarch",
"SUSE Linux Enterprise Server 12:qemu-kvm-2.0.2-46.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-kvm-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-lang-2.0.2-46.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-lang-2.0.2-46.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-lang-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-ppc-2.0.2-46.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-s390-2.0.2-46.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-seabios-1.7.4-46.1.noarch",
"SUSE Linux Enterprise Server 12:qemu-sgabios-8-46.1.noarch",
"SUSE Linux Enterprise Server 12:qemu-tools-2.0.2-46.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-tools-2.0.2-46.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-tools-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-vgabios-1.7.4-46.1.noarch",
"SUSE Linux Enterprise Server 12:qemu-x86-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-2.0.2-46.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-2.0.2-46.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-curl-2.0.2-46.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-curl-2.0.2-46.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-curl-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-rbd-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-guest-agent-2.0.2-46.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-guest-agent-2.0.2-46.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-guest-agent-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-ipxe-1.0.0-46.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-kvm-2.0.2-46.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-kvm-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-lang-2.0.2-46.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-lang-2.0.2-46.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-lang-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-ppc-2.0.2-46.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-s390-2.0.2-46.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-seabios-1.7.4-46.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-sgabios-8-46.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-tools-2.0.2-46.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-tools-2.0.2-46.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-tools-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-vgabios-1.7.4-46.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-x86-2.0.2-46.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-1779",
"url": "https://www.suse.com/security/cve/CVE-2015-1779"
},
{
"category": "external",
"summary": "SUSE Bug 924018 for CVE-2015-1779",
"url": "https://bugzilla.suse.com/924018"
},
{
"category": "external",
"summary": "SUSE Bug 962632 for CVE-2015-1779",
"url": "https://bugzilla.suse.com/962632"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Desktop 12:qemu-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Desktop 12:qemu-block-curl-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Desktop 12:qemu-ipxe-1.0.0-46.1.noarch",
"SUSE Linux Enterprise Desktop 12:qemu-kvm-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Desktop 12:qemu-seabios-1.7.4-46.1.noarch",
"SUSE Linux Enterprise Desktop 12:qemu-sgabios-8-46.1.noarch",
"SUSE Linux Enterprise Desktop 12:qemu-tools-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Desktop 12:qemu-vgabios-1.7.4-46.1.noarch",
"SUSE Linux Enterprise Desktop 12:qemu-x86-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-2.0.2-46.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-2.0.2-46.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-block-curl-2.0.2-46.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-block-curl-2.0.2-46.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-block-curl-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-block-rbd-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-guest-agent-2.0.2-46.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-guest-agent-2.0.2-46.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-guest-agent-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-ipxe-1.0.0-46.1.noarch",
"SUSE Linux Enterprise Server 12:qemu-kvm-2.0.2-46.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-kvm-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-lang-2.0.2-46.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-lang-2.0.2-46.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-lang-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-ppc-2.0.2-46.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-s390-2.0.2-46.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-seabios-1.7.4-46.1.noarch",
"SUSE Linux Enterprise Server 12:qemu-sgabios-8-46.1.noarch",
"SUSE Linux Enterprise Server 12:qemu-tools-2.0.2-46.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-tools-2.0.2-46.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-tools-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-vgabios-1.7.4-46.1.noarch",
"SUSE Linux Enterprise Server 12:qemu-x86-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-2.0.2-46.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-2.0.2-46.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-curl-2.0.2-46.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-curl-2.0.2-46.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-curl-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-rbd-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-guest-agent-2.0.2-46.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-guest-agent-2.0.2-46.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-guest-agent-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-ipxe-1.0.0-46.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-kvm-2.0.2-46.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-kvm-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-lang-2.0.2-46.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-lang-2.0.2-46.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-lang-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-ppc-2.0.2-46.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-s390-2.0.2-46.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-seabios-1.7.4-46.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-sgabios-8-46.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-tools-2.0.2-46.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-tools-2.0.2-46.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-tools-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-vgabios-1.7.4-46.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-x86-2.0.2-46.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Desktop 12:qemu-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Desktop 12:qemu-block-curl-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Desktop 12:qemu-ipxe-1.0.0-46.1.noarch",
"SUSE Linux Enterprise Desktop 12:qemu-kvm-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Desktop 12:qemu-seabios-1.7.4-46.1.noarch",
"SUSE Linux Enterprise Desktop 12:qemu-sgabios-8-46.1.noarch",
"SUSE Linux Enterprise Desktop 12:qemu-tools-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Desktop 12:qemu-vgabios-1.7.4-46.1.noarch",
"SUSE Linux Enterprise Desktop 12:qemu-x86-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-2.0.2-46.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-2.0.2-46.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-block-curl-2.0.2-46.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-block-curl-2.0.2-46.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-block-curl-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-block-rbd-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-guest-agent-2.0.2-46.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-guest-agent-2.0.2-46.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-guest-agent-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-ipxe-1.0.0-46.1.noarch",
"SUSE Linux Enterprise Server 12:qemu-kvm-2.0.2-46.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-kvm-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-lang-2.0.2-46.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-lang-2.0.2-46.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-lang-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-ppc-2.0.2-46.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-s390-2.0.2-46.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-seabios-1.7.4-46.1.noarch",
"SUSE Linux Enterprise Server 12:qemu-sgabios-8-46.1.noarch",
"SUSE Linux Enterprise Server 12:qemu-tools-2.0.2-46.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-tools-2.0.2-46.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-tools-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-vgabios-1.7.4-46.1.noarch",
"SUSE Linux Enterprise Server 12:qemu-x86-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-2.0.2-46.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-2.0.2-46.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-curl-2.0.2-46.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-curl-2.0.2-46.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-curl-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-rbd-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-guest-agent-2.0.2-46.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-guest-agent-2.0.2-46.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-guest-agent-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-ipxe-1.0.0-46.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-kvm-2.0.2-46.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-kvm-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-lang-2.0.2-46.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-lang-2.0.2-46.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-lang-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-ppc-2.0.2-46.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-s390-2.0.2-46.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-seabios-1.7.4-46.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-sgabios-8-46.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-tools-2.0.2-46.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-tools-2.0.2-46.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-tools-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-vgabios-1.7.4-46.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-x86-2.0.2-46.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2015-05-12T21:54:11Z",
"details": "moderate"
}
],
"title": "CVE-2015-1779"
},
{
"cve": "CVE-2015-3456",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-3456"
}
],
"notes": [
{
"category": "general",
"text": "The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a denial of service (out-of-bounds write and guest crash) or possibly execute arbitrary code via the (1) FD_CMD_READ_ID, (2) FD_CMD_DRIVE_SPECIFICATION_COMMAND, or other unspecified commands, aka VENOM.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Desktop 12:qemu-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Desktop 12:qemu-block-curl-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Desktop 12:qemu-ipxe-1.0.0-46.1.noarch",
"SUSE Linux Enterprise Desktop 12:qemu-kvm-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Desktop 12:qemu-seabios-1.7.4-46.1.noarch",
"SUSE Linux Enterprise Desktop 12:qemu-sgabios-8-46.1.noarch",
"SUSE Linux Enterprise Desktop 12:qemu-tools-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Desktop 12:qemu-vgabios-1.7.4-46.1.noarch",
"SUSE Linux Enterprise Desktop 12:qemu-x86-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-2.0.2-46.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-2.0.2-46.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-block-curl-2.0.2-46.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-block-curl-2.0.2-46.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-block-curl-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-block-rbd-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-guest-agent-2.0.2-46.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-guest-agent-2.0.2-46.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-guest-agent-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-ipxe-1.0.0-46.1.noarch",
"SUSE Linux Enterprise Server 12:qemu-kvm-2.0.2-46.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-kvm-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-lang-2.0.2-46.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-lang-2.0.2-46.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-lang-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-ppc-2.0.2-46.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-s390-2.0.2-46.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-seabios-1.7.4-46.1.noarch",
"SUSE Linux Enterprise Server 12:qemu-sgabios-8-46.1.noarch",
"SUSE Linux Enterprise Server 12:qemu-tools-2.0.2-46.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-tools-2.0.2-46.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-tools-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-vgabios-1.7.4-46.1.noarch",
"SUSE Linux Enterprise Server 12:qemu-x86-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-2.0.2-46.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-2.0.2-46.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-curl-2.0.2-46.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-curl-2.0.2-46.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-curl-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-rbd-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-guest-agent-2.0.2-46.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-guest-agent-2.0.2-46.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-guest-agent-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-ipxe-1.0.0-46.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-kvm-2.0.2-46.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-kvm-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-lang-2.0.2-46.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-lang-2.0.2-46.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-lang-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-ppc-2.0.2-46.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-s390-2.0.2-46.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-seabios-1.7.4-46.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-sgabios-8-46.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-tools-2.0.2-46.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-tools-2.0.2-46.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-tools-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-vgabios-1.7.4-46.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-x86-2.0.2-46.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-3456",
"url": "https://www.suse.com/security/cve/CVE-2015-3456"
},
{
"category": "external",
"summary": "SUSE Bug 929339 for CVE-2015-3456",
"url": "https://bugzilla.suse.com/929339"
},
{
"category": "external",
"summary": "SUSE Bug 932770 for CVE-2015-3456",
"url": "https://bugzilla.suse.com/932770"
},
{
"category": "external",
"summary": "SUSE Bug 935900 for CVE-2015-3456",
"url": "https://bugzilla.suse.com/935900"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Desktop 12:qemu-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Desktop 12:qemu-block-curl-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Desktop 12:qemu-ipxe-1.0.0-46.1.noarch",
"SUSE Linux Enterprise Desktop 12:qemu-kvm-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Desktop 12:qemu-seabios-1.7.4-46.1.noarch",
"SUSE Linux Enterprise Desktop 12:qemu-sgabios-8-46.1.noarch",
"SUSE Linux Enterprise Desktop 12:qemu-tools-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Desktop 12:qemu-vgabios-1.7.4-46.1.noarch",
"SUSE Linux Enterprise Desktop 12:qemu-x86-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-2.0.2-46.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-2.0.2-46.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-block-curl-2.0.2-46.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-block-curl-2.0.2-46.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-block-curl-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-block-rbd-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-guest-agent-2.0.2-46.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-guest-agent-2.0.2-46.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-guest-agent-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-ipxe-1.0.0-46.1.noarch",
"SUSE Linux Enterprise Server 12:qemu-kvm-2.0.2-46.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-kvm-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-lang-2.0.2-46.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-lang-2.0.2-46.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-lang-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-ppc-2.0.2-46.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-s390-2.0.2-46.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-seabios-1.7.4-46.1.noarch",
"SUSE Linux Enterprise Server 12:qemu-sgabios-8-46.1.noarch",
"SUSE Linux Enterprise Server 12:qemu-tools-2.0.2-46.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-tools-2.0.2-46.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-tools-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-vgabios-1.7.4-46.1.noarch",
"SUSE Linux Enterprise Server 12:qemu-x86-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-2.0.2-46.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-2.0.2-46.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-curl-2.0.2-46.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-curl-2.0.2-46.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-curl-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-rbd-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-guest-agent-2.0.2-46.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-guest-agent-2.0.2-46.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-guest-agent-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-ipxe-1.0.0-46.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-kvm-2.0.2-46.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-kvm-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-lang-2.0.2-46.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-lang-2.0.2-46.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-lang-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-ppc-2.0.2-46.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-s390-2.0.2-46.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-seabios-1.7.4-46.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-sgabios-8-46.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-tools-2.0.2-46.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-tools-2.0.2-46.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-tools-2.0.2-46.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-vgabios-1.7.4-46.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-x86-2.0.2-46.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2015-05-12T21:54:11Z",
"details": "moderate"
}
],
"title": "CVE-2015-3456"
}
]
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…