rhsa-2017_2408
Vulnerability from csaf_redhat
Published
2017-08-01 21:17
Modified
2024-11-14 20:53
Summary
Red Hat Security Advisory: qemu-kvm-rhev security and bug fix update
Notes
Topic
An update for qemu-kvm-rhev is now available for Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7, Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7, Red Hat OpenStack Platform 8.0 (Liberty), Red Hat OpenStack Platform 9.0 (Mitaka), Red Hat OpenStack Platform 10.0 (Newton), and Red Hat OpenStack Platform 11.0 (Ocata).
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-rhev packages provide the user-space component for running virtual machines that use KVM in environments managed by Red Hat products.
Security Fix(es):
* Quick Emulator (QEMU) built with Network Block Device (NBD) Server support was vulnerable to a null-pointer dereference issue. The flaw could occur when releasing a client that was not initialized due to failed negotiation. A remote user or process could exploit this flaw to crash the qemu-nbd server (denial of service). (CVE-2017-9524)
* An information-exposure flaw was found in Quick Emulator (QEMU) in Task Priority Register (TPR) optimizations for 32-bit Windows guests. The flaw could occur while accessing TPR. A privileged user inside a guest could use this issue to read portions of the host memory. (CVE-2016-4020)
* A memory-leak flaw was found in the Quick Emulator (QEMU) built with USB xHCI controller emulation support. The flaw could occur while doing a USB-device unplug operation. Unplugging the device repeatedly resulted in leaking host memory, which affected other services on the host. A privileged user inside the guest could exploit this flaw to cause a denial of service on the host or potentially crash the host's QEMU process instance. (CVE-2016-7466)
* Multiple CVEs were fixed as a result of rebase to QEMU 2.9.0. (CVE-2016-6888, CVE-2016-7422, CVE-2016-8576, CVE-2016-8669, CVE-2016-8909, CVE-2016-8910, CVE-2016-9907, CVE-2016-9911, CVE-2016-9921, CVE-2016-9922, CVE-2016-10155, CVE-2017-5579, CVE-2017-5973, CVE-2017-6414, CVE-2017-8309, CVE-2017-8379, CVE-2017-9310, CVE-2017-9373, CVE-2017-9374, CVE-2017-9375)
Red Hat would like to thank Donghai Zdh (Alibaba Inc.) for reporting CVE-2016-4020; Li Qiang (Qihoo 360 Inc.) for reporting CVE-2016-6888; Qinghao Tang (Marvel Team 360.cn Inc.) and Zhenhao Hong (Marvel Team 360.cn Inc.) for reporting CVE-2016-7422; Li Qiang (360.cn Inc.) for reporting CVE-2016-7466, CVE-2016-10155, CVE-2017-5579, CVE-2017-5973, and CVE-2017-6414; PSIRT (Huawei Inc.) for reporting CVE-2016-8669; Andrew Henderson (Intelligent Automation Inc.) for reporting CVE-2016-8910; Qinghao Tang (Qihoo 360), Li Qiang (Qihoo 360), and Jiangxin (Huawei Inc.) for reporting CVE-2016-9921 and CVE-2016-9922; Jiang Xin (PSIRT, Huawei Inc.) for reporting CVE-2017-8309 and CVE-2017-8379; and Li Qiang (Qihoo 360 Gear Team) for reporting CVE-2017-9310, CVE-2017-9373, CVE-2017-9374, and CVE-2017-9375.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for qemu-kvm-rhev is now available for Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7, Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7, Red Hat OpenStack Platform 8.0 (Liberty), Red Hat OpenStack Platform 9.0 (Mitaka), Red Hat OpenStack Platform 10.0 (Newton), and Red Hat OpenStack Platform 11.0 (Ocata).\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-rhev packages provide the user-space component for running virtual machines that use KVM in environments managed by Red Hat products.\n\nSecurity Fix(es):\n\n* Quick Emulator (QEMU) built with Network Block Device (NBD) Server support was vulnerable to a null-pointer dereference issue. The flaw could occur when releasing a client that was not initialized due to failed negotiation. A remote user or process could exploit this flaw to crash the qemu-nbd server (denial of service). (CVE-2017-9524)\n\n* An information-exposure flaw was found in Quick Emulator (QEMU) in Task Priority Register (TPR) optimizations for 32-bit Windows guests. The flaw could occur while accessing TPR. A privileged user inside a guest could use this issue to read portions of the host memory. (CVE-2016-4020)\n\n* A memory-leak flaw was found in the Quick Emulator (QEMU) built with USB xHCI controller emulation support. The flaw could occur while doing a USB-device unplug operation. Unplugging the device repeatedly resulted in leaking host memory, which affected other services on the host. A privileged user inside the guest could exploit this flaw to cause a denial of service on the host or potentially crash the host\u0027s QEMU process instance. (CVE-2016-7466)\n\n* Multiple CVEs were fixed as a result of rebase to QEMU 2.9.0. (CVE-2016-6888, CVE-2016-7422, CVE-2016-8576, CVE-2016-8669, CVE-2016-8909, CVE-2016-8910, CVE-2016-9907, CVE-2016-9911, CVE-2016-9921, CVE-2016-9922, CVE-2016-10155, CVE-2017-5579, CVE-2017-5973, CVE-2017-6414, CVE-2017-8309, CVE-2017-8379, CVE-2017-9310, CVE-2017-9373, CVE-2017-9374, CVE-2017-9375)\n\nRed Hat would like to thank Donghai Zdh (Alibaba Inc.) for reporting CVE-2016-4020; Li Qiang (Qihoo 360 Inc.) for reporting CVE-2016-6888; Qinghao Tang (Marvel Team 360.cn Inc.) and Zhenhao Hong (Marvel Team 360.cn Inc.) for reporting CVE-2016-7422; Li Qiang (360.cn Inc.) for reporting CVE-2016-7466, CVE-2016-10155, CVE-2017-5579, CVE-2017-5973, and CVE-2017-6414; PSIRT (Huawei Inc.) for reporting CVE-2016-8669; Andrew Henderson (Intelligent Automation Inc.) for reporting CVE-2016-8910; Qinghao Tang (Qihoo 360), Li Qiang (Qihoo 360), and Jiangxin (Huawei Inc.) for reporting CVE-2016-9921 and CVE-2016-9922; Jiang Xin (PSIRT, Huawei Inc.) for reporting CVE-2017-8309 and CVE-2017-8379; and Li Qiang (Qihoo 360 Gear Team) for reporting CVE-2017-9310, CVE-2017-9373, CVE-2017-9374, and CVE-2017-9375.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2017:2408",
"url": "https://access.redhat.com/errata/RHSA-2017:2408"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1313686",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1313686"
},
{
"category": "external",
"summary": "1333425",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1333425"
},
{
"category": "external",
"summary": "1334398",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1334398"
},
{
"category": "external",
"summary": "1369031",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1369031"
},
{
"category": "external",
"summary": "1376755",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1376755"
},
{
"category": "external",
"summary": "1377837",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1377837"
},
{
"category": "external",
"summary": "1384909",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1384909"
},
{
"category": "external",
"summary": "1388046",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1388046"
},
{
"category": "external",
"summary": "1388052",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1388052"
},
{
"category": "external",
"summary": "1402265",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1402265"
},
{
"category": "external",
"summary": "1402272",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1402272"
},
{
"category": "external",
"summary": "1415199",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1415199"
},
{
"category": "external",
"summary": "1416157",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1416157"
},
{
"category": "external",
"summary": "1421626",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1421626"
},
{
"category": "external",
"summary": "1427833",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1427833"
},
{
"category": "external",
"summary": "1446517",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1446517"
},
{
"category": "external",
"summary": "1446547",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1446547"
},
{
"category": "external",
"summary": "1452620",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1452620"
},
{
"category": "external",
"summary": "1458270",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1458270"
},
{
"category": "external",
"summary": "1458744",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1458744"
},
{
"category": "external",
"summary": "1459132",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1459132"
},
{
"category": "external",
"summary": "1459661",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1459661"
},
{
"category": "external",
"summary": "1459663",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1459663"
},
{
"category": "external",
"summary": "1459664",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1459664"
},
{
"category": "external",
"summary": "1459666",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1459666"
},
{
"category": "external",
"summary": "1459667",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1459667"
},
{
"category": "external",
"summary": "1459668",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1459668"
},
{
"category": "external",
"summary": "1460170",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1460170"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_2408.json"
}
],
"title": "Red Hat Security Advisory: qemu-kvm-rhev security and bug fix update",
"tracking": {
"current_release_date": "2024-11-14T20:53:53+00:00",
"generator": {
"date": "2024-11-14T20:53:53+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2017:2408",
"initial_release_date": "2017-08-01T21:17:55+00:00",
"revision_history": [
{
"date": "2017-08-01T21:17:55+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2017-08-01T21:17:55+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-14T20:53:53+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenStack Platform 10.0",
"product": {
"name": "Red Hat OpenStack Platform 10.0",
"product_id": "7Server-RH7-RHOS-10.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openstack:10::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat OpenStack Platform 11.0",
"product": {
"name": "Red Hat OpenStack Platform 11.0",
"product_id": "7Server-RH7-RHOS-11.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openstack:11::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7",
"product": {
"name": "Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7",
"product_id": "7Server-RH7-RHOS-6.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openstack:6::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7",
"product": {
"name": "Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7",
"product_id": "7Server-RH7-RHOS-7.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openstack:7::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat OpenStack Platform 8.0 (Liberty)",
"product": {
"name": "Red Hat OpenStack Platform 8.0 (Liberty)",
"product_id": "7Server-RH7-RHOS-8.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openstack:8::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat OpenStack Platform 9.0",
"product": {
"name": "Red Hat OpenStack Platform 9.0",
"product_id": "7Server-RH7-RHOS-9.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openstack:9::el7"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenStack Platform"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"product": {
"name": "qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"product_id": "qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-img-rhev@2.9.0-10.el7?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"product": {
"name": "qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"product_id": "qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev@2.9.0-10.el7?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"product": {
"name": "qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"product_id": "qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev-debuginfo@2.9.0-10.el7?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"product": {
"name": "qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"product_id": "qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-common-rhev@2.9.0-10.el7?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"product": {
"name": "qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"product_id": "qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-tools-rhev@2.9.0-10.el7?arch=x86_64\u0026epoch=10"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-kvm-rhev-10:2.9.0-10.el7.src",
"product": {
"name": "qemu-kvm-rhev-10:2.9.0-10.el7.src",
"product_id": "qemu-kvm-rhev-10:2.9.0-10.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev@2.9.0-10.el7?arch=src\u0026epoch=10"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-rhev-10:2.9.0-10.el7.x86_64 as a component of Red Hat OpenStack Platform 10.0",
"product_id": "7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64"
},
"product_reference": "qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-10.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64 as a component of Red Hat OpenStack Platform 10.0",
"product_id": "7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64"
},
"product_reference": "qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-10.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-10:2.9.0-10.el7.src as a component of Red Hat OpenStack Platform 10.0",
"product_id": "7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.src"
},
"product_reference": "qemu-kvm-rhev-10:2.9.0-10.el7.src",
"relates_to_product_reference": "7Server-RH7-RHOS-10.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-10:2.9.0-10.el7.x86_64 as a component of Red Hat OpenStack Platform 10.0",
"product_id": "7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64"
},
"product_reference": "qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-10.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64 as a component of Red Hat OpenStack Platform 10.0",
"product_id": "7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64"
},
"product_reference": "qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-10.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64 as a component of Red Hat OpenStack Platform 10.0",
"product_id": "7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64"
},
"product_reference": "qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-10.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-rhev-10:2.9.0-10.el7.x86_64 as a component of Red Hat OpenStack Platform 11.0",
"product_id": "7Server-RH7-RHOS-11.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64"
},
"product_reference": "qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-11.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64 as a component of Red Hat OpenStack Platform 11.0",
"product_id": "7Server-RH7-RHOS-11.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64"
},
"product_reference": "qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-11.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-10:2.9.0-10.el7.src as a component of Red Hat OpenStack Platform 11.0",
"product_id": "7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.src"
},
"product_reference": "qemu-kvm-rhev-10:2.9.0-10.el7.src",
"relates_to_product_reference": "7Server-RH7-RHOS-11.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-10:2.9.0-10.el7.x86_64 as a component of Red Hat OpenStack Platform 11.0",
"product_id": "7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64"
},
"product_reference": "qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-11.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64 as a component of Red Hat OpenStack Platform 11.0",
"product_id": "7Server-RH7-RHOS-11.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64"
},
"product_reference": "qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-11.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64 as a component of Red Hat OpenStack Platform 11.0",
"product_id": "7Server-RH7-RHOS-11.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64"
},
"product_reference": "qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-11.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-rhev-10:2.9.0-10.el7.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7",
"product_id": "7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64"
},
"product_reference": "qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7",
"product_id": "7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64"
},
"product_reference": "qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-10:2.9.0-10.el7.src as a component of Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7",
"product_id": "7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.src"
},
"product_reference": "qemu-kvm-rhev-10:2.9.0-10.el7.src",
"relates_to_product_reference": "7Server-RH7-RHOS-6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-10:2.9.0-10.el7.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7",
"product_id": "7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64"
},
"product_reference": "qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7",
"product_id": "7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64"
},
"product_reference": "qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7",
"product_id": "7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64"
},
"product_reference": "qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-rhev-10:2.9.0-10.el7.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7",
"product_id": "7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64"
},
"product_reference": "qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7",
"product_id": "7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64"
},
"product_reference": "qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-10:2.9.0-10.el7.src as a component of Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7",
"product_id": "7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.src"
},
"product_reference": "qemu-kvm-rhev-10:2.9.0-10.el7.src",
"relates_to_product_reference": "7Server-RH7-RHOS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-10:2.9.0-10.el7.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7",
"product_id": "7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64"
},
"product_reference": "qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7",
"product_id": "7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64"
},
"product_reference": "qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7",
"product_id": "7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64"
},
"product_reference": "qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-rhev-10:2.9.0-10.el7.x86_64 as a component of Red Hat OpenStack Platform 8.0 (Liberty)",
"product_id": "7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64"
},
"product_reference": "qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-8.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64 as a component of Red Hat OpenStack Platform 8.0 (Liberty)",
"product_id": "7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64"
},
"product_reference": "qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-8.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-10:2.9.0-10.el7.src as a component of Red Hat OpenStack Platform 8.0 (Liberty)",
"product_id": "7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.src"
},
"product_reference": "qemu-kvm-rhev-10:2.9.0-10.el7.src",
"relates_to_product_reference": "7Server-RH7-RHOS-8.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-10:2.9.0-10.el7.x86_64 as a component of Red Hat OpenStack Platform 8.0 (Liberty)",
"product_id": "7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64"
},
"product_reference": "qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-8.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64 as a component of Red Hat OpenStack Platform 8.0 (Liberty)",
"product_id": "7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64"
},
"product_reference": "qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-8.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64 as a component of Red Hat OpenStack Platform 8.0 (Liberty)",
"product_id": "7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64"
},
"product_reference": "qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-8.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-rhev-10:2.9.0-10.el7.x86_64 as a component of Red Hat OpenStack Platform 9.0",
"product_id": "7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64"
},
"product_reference": "qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-9.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64 as a component of Red Hat OpenStack Platform 9.0",
"product_id": "7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64"
},
"product_reference": "qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-9.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-10:2.9.0-10.el7.src as a component of Red Hat OpenStack Platform 9.0",
"product_id": "7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.src"
},
"product_reference": "qemu-kvm-rhev-10:2.9.0-10.el7.src",
"relates_to_product_reference": "7Server-RH7-RHOS-9.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-10:2.9.0-10.el7.x86_64 as a component of Red Hat OpenStack Platform 9.0",
"product_id": "7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64"
},
"product_reference": "qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-9.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64 as a component of Red Hat OpenStack Platform 9.0",
"product_id": "7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64"
},
"product_reference": "qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-9.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64 as a component of Red Hat OpenStack Platform 9.0",
"product_id": "7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64"
},
"product_reference": "qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-9.0"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Donghai Zdh"
],
"organization": "Alibaba Inc."
}
],
"cve": "CVE-2016-4020",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2016-03-02T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1313686"
}
],
"notes": [
{
"category": "description",
"text": "An information-exposure flaw was found in Quick Emulator (QEMU) in Task Priority Register (TPR) optimizations for 32-bit Windows guests. The flaw could occur while accessing TPR. A privileged user inside a guest could use this issue to read portions of the host memory.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: i386: leakage of stack memory to guest in kvmvapic.c",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle:\nhttps://access.redhat.com/support/policy/updates/errata/.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-4020"
},
{
"category": "external",
"summary": "RHBZ#1313686",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1313686"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-4020",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-4020"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-4020",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-4020"
}
],
"release_date": "2016-04-07T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-08-01T21:17:55+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:2408"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 2.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:A/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.4,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N",
"version": "3.0"
},
"products": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Qemu: i386: leakage of stack memory to guest in kvmvapic.c"
},
{
"acknowledgments": [
{
"names": [
"Li Qiang"
],
"organization": "Qihoo 360 Inc."
}
],
"cve": "CVE-2016-6888",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"discovery_date": "2016-06-08T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1369031"
}
],
"notes": [
{
"category": "description",
"text": "Integer overflow in the net_tx_pkt_init function in hw/net/net_tx_pkt.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (QEMU process crash) via the maximum fragmentation count, which triggers an unchecked multiplication and NULL pointer dereference.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: net: vmxnet: integer overflow in packet initialisation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-6888"
},
{
"category": "external",
"summary": "RHBZ#1369031",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1369031"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-6888",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-6888"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-6888",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6888"
}
],
"release_date": "2016-08-09T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-08-01T21:17:55+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:2408"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 2.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:A/AC:M/Au:S/C:N/I:N/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 3.5,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.0"
},
"products": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Qemu: net: vmxnet: integer overflow in packet initialisation"
},
{
"acknowledgments": [
{
"names": [
"Qinghao Tang",
"Zhenhao Hong"
],
"organization": "360.cn Marvel Team"
}
],
"cve": "CVE-2016-7422",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"discovery_date": "2016-06-23T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1376755"
}
],
"notes": [
{
"category": "description",
"text": "The virtqueue_map_desc function in hw/virtio/virtio.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (NULL pointer dereference and QEMU process crash) via a large I/O descriptor buffer length value.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: virtio: null pointer dereference in virtqueu_map_desc",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-7422"
},
{
"category": "external",
"summary": "RHBZ#1376755",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1376755"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-7422",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-7422"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-7422",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-7422"
}
],
"release_date": "2016-09-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-08-01T21:17:55+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:2408"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 2.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:A/AC:M/Au:S/C:N/I:N/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 2.6,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.0"
},
"products": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Qemu: virtio: null pointer dereference in virtqueu_map_desc"
},
{
"acknowledgments": [
{
"names": [
"Li Qiang"
],
"organization": "360.cn Inc."
}
],
"cve": "CVE-2016-7466",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2016-09-14T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1377837"
}
],
"notes": [
{
"category": "description",
"text": "A memory-leak flaw was found in the Quick Emulator(QEMU) built with USB xHCI controller emulation support. The flaw could occur while doing a USB-device unplug operation. Unplugging the device repeatedly resulted in leaking host memory, which affected other services on the host. A privileged user inside the guest could exploit this flaw to cause a denial of service on the host or potentially crash the host\u0027s QEMU process instance.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: usb: xhci memory leakage during device unplug",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-7466"
},
{
"category": "external",
"summary": "RHBZ#1377837",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1377837"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-7466",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-7466"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-7466",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-7466"
}
],
"release_date": "2016-09-13T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-08-01T21:17:55+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:2408"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 2.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:A/AC:M/Au:S/C:N/I:N/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 3.0,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L",
"version": "3.0"
},
"products": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Qemu: usb: xhci memory leakage during device unplug"
},
{
"acknowledgments": [
{
"names": [
"Li Qiang"
],
"organization": "Qihoo 360"
}
],
"cve": "CVE-2016-8576",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
},
"discovery_date": "2016-05-05T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1333425"
}
],
"notes": [
{
"category": "description",
"text": "The xhci_ring_fetch function in hw/usb/hcd-xhci.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) by leveraging failure to limit the number of link Transfer Request Blocks (TRB) to process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: usb: xHCI: infinite loop vulnerability in xhci_ring_fetch",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-8576"
},
{
"category": "external",
"summary": "RHBZ#1333425",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1333425"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-8576",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-8576"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-8576",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-8576"
}
],
"release_date": "2016-10-06T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-08-01T21:17:55+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:2408"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 2.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:A/AC:M/Au:S/C:N/I:N/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 3.0,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L",
"version": "3.0"
},
"products": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Qemu: usb: xHCI: infinite loop vulnerability in xhci_ring_fetch"
},
{
"acknowledgments": [
{
"names": [
"PSIRT"
],
"organization": "Huawei Inc."
}
],
"cve": "CVE-2016-8669",
"cwe": {
"id": "CWE-369",
"name": "Divide By Zero"
},
"discovery_date": "2016-09-26T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1384909"
}
],
"notes": [
{
"category": "description",
"text": "The serial_update_parameters function in hw/char/serial.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (divide-by-zero error and QEMU process crash) via vectors involving a value of divider greater than baud base.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: char: divide by zero error in serial_update_parameters",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-8669"
},
{
"category": "external",
"summary": "RHBZ#1384909",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1384909"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-8669",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-8669"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-8669",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-8669"
}
],
"release_date": "2016-10-12T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-08-01T21:17:55+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:2408"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 2.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:A/AC:M/Au:S/C:N/I:N/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 3.0,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L",
"version": "3.0"
},
"products": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Qemu: char: divide by zero error in serial_update_parameters"
},
{
"acknowledgments": [
{
"names": [
"PSIRT"
],
"organization": "Huawei Inc."
}
],
"cve": "CVE-2016-8909",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
},
"discovery_date": "2016-10-13T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1388052"
}
],
"notes": [
{
"category": "description",
"text": "The intel_hda_xfer function in hw/audio/intel-hda.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and CPU consumption) via an entry with the same value for buffer length and pointer position.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: audio: intel-hda: infinite loop in processing dma buffer stream",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-8909"
},
{
"category": "external",
"summary": "RHBZ#1388052",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1388052"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-8909",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-8909"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-8909",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-8909"
}
],
"release_date": "2016-10-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-08-01T21:17:55+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:2408"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 2.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:A/AC:M/Au:S/C:N/I:N/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 3.0,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L",
"version": "3.0"
},
"products": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Qemu: audio: intel-hda: infinite loop in processing dma buffer stream"
},
{
"acknowledgments": [
{
"names": [
"Andrew Henderson"
],
"organization": "Intelligent Automation Inc."
}
],
"cve": "CVE-2016-8910",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
},
"discovery_date": "2016-06-09T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1388046"
}
],
"notes": [
{
"category": "description",
"text": "The rtl8139_cplus_transmit function in hw/net/rtl8139.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and CPU consumption) by leveraging failure to limit the ring descriptor count.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: net: rtl8139: infinite loop while transmit in C+ mode",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-8910"
},
{
"category": "external",
"summary": "RHBZ#1388046",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1388046"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-8910",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-8910"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-8910",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-8910"
}
],
"release_date": "2016-10-21T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-08-01T21:17:55+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:2408"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 2.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:A/AC:M/Au:S/C:N/I:N/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 3.0,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L",
"version": "3.0"
},
"products": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Qemu: net: rtl8139: infinite loop while transmit in C+ mode"
},
{
"cve": "CVE-2016-9907",
"cwe": {
"id": "CWE-244",
"name": "Improper Clearing of Heap Memory Before Release (\u0027Heap Inspection\u0027)"
},
"discovery_date": "2016-12-05T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1402265"
}
],
"notes": [
{
"category": "description",
"text": "Quick Emulator (Qemu) built with the USB redirector usb-guest support is vulnerable to a memory leakage flaw. It could occur while destroying the USB redirector in \u0027usbredir_handle_destroy\u0027. A guest user/process could use this issue to leak host memory, resulting in DoS for a host.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: usb: redirector: memory leakage when destroying redirector",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-9907"
},
{
"category": "external",
"summary": "RHBZ#1402265",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1402265"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-9907",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-9907"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-9907",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-9907"
}
],
"release_date": "2016-11-07T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-08-01T21:17:55+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:2408"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 2.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:A/AC:M/Au:S/C:N/I:N/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 3.0,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L",
"version": "3.0"
},
"products": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Qemu: usb: redirector: memory leakage when destroying redirector"
},
{
"cve": "CVE-2016-9911",
"cwe": {
"id": "CWE-244",
"name": "Improper Clearing of Heap Memory Before Release (\u0027Heap Inspection\u0027)"
},
"discovery_date": "2016-12-05T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1402272"
}
],
"notes": [
{
"category": "description",
"text": "Quick Emulator (Qemu) built with the USB EHCI Emulation support is vulnerable to a memory leakage issue. It could occur while processing packet data in \u0027ehci_init_transfer\u0027. A guest user/process could use this issue to leak host memory, resulting in DoS for a host.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: usb: ehci: memory leakage in ehci_init_transfer",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-9911"
},
{
"category": "external",
"summary": "RHBZ#1402272",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1402272"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-9911",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-9911"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-9911",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-9911"
}
],
"release_date": "2016-11-08T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-08-01T21:17:55+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:2408"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 2.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:A/AC:M/Au:S/C:N/I:N/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 3.0,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L",
"version": "3.0"
},
"products": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Qemu: usb: ehci: memory leakage in ehci_init_transfer"
},
{
"acknowledgments": [
{
"names": [
"Jiangxin"
],
"organization": "Huawei Inc."
},
{
"names": [
"Li Qiang",
"Qinghao Tang"
],
"organization": "Qihoo 360"
}
],
"cve": "CVE-2016-9921",
"cwe": {
"id": "CWE-369",
"name": "Divide By Zero"
},
"discovery_date": "2016-05-06T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1334398"
}
],
"notes": [
{
"category": "description",
"text": "Quick emulator (Qemu) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to a divide by zero issue. It could occur while copying VGA data when cirrus graphics mode was set to be VGA. A privileged user inside guest could use this flaw to crash the Qemu process instance on the host, resulting in DoS.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: display: cirrus_vga: a divide by zero in cirrus_do_copy",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-9921"
},
{
"category": "external",
"summary": "RHBZ#1334398",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1334398"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-9921",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-9921"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-9921",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-9921"
}
],
"release_date": "2016-10-18T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-08-01T21:17:55+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:2408"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 2.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:A/AC:M/Au:S/C:N/I:N/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 3.0,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L",
"version": "3.0"
},
"products": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Qemu: display: cirrus_vga: a divide by zero in cirrus_do_copy"
},
{
"acknowledgments": [
{
"names": [
"Jiangxin"
],
"organization": "Huawei Inc."
},
{
"names": [
"Li Qiang",
"Qinghao Tang"
],
"organization": "Qihoo 360"
}
],
"cve": "CVE-2016-9922",
"cwe": {
"id": "CWE-369",
"name": "Divide By Zero"
},
"discovery_date": "2016-05-06T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1334398"
}
],
"notes": [
{
"category": "description",
"text": "The cirrus_do_copy function in hw/display/cirrus_vga.c in QEMU (aka Quick Emulator), when cirrus graphics mode is VGA, allows local guest OS privileged users to cause a denial of service (divide-by-zero error and QEMU process crash) via vectors involving blit pitch values.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: display: cirrus_vga: a divide by zero in cirrus_do_copy",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-9922"
},
{
"category": "external",
"summary": "RHBZ#1334398",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1334398"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-9922",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-9922"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-9922",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-9922"
}
],
"release_date": "2016-10-18T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-08-01T21:17:55+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:2408"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 2.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:A/AC:M/Au:S/C:N/I:N/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 3.0,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L",
"version": "3.0"
},
"products": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Qemu: display: cirrus_vga: a divide by zero in cirrus_do_copy"
},
{
"acknowledgments": [
{
"names": [
"Li Qiang"
],
"organization": "360.cn Inc."
}
],
"cve": "CVE-2016-10155",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2016-10-10T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1415199"
}
],
"notes": [
{
"category": "description",
"text": "Memory leak in hw/watchdog/wdt_i6300esb.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (host memory consumption and QEMU process crash) via a large number of device unplug operations.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: watchdog: memory leakage in virtual hardware watchdog wdt_i6300esb",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-10155"
},
{
"category": "external",
"summary": "RHBZ#1415199",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1415199"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-10155",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-10155"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-10155",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-10155"
}
],
"release_date": "2016-12-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-08-01T21:17:55+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:2408"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 2.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:A/AC:M/Au:S/C:N/I:N/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L",
"version": "3.0"
},
"products": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Qemu: watchdog: memory leakage in virtual hardware watchdog wdt_i6300esb"
},
{
"acknowledgments": [
{
"names": [
"Li Qiang"
],
"organization": "360.cn Inc."
}
],
"cve": "CVE-2017-5579",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2016-10-10T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1416157"
}
],
"notes": [
{
"category": "description",
"text": "Memory leak in the serial_exit_core function in hw/char/serial.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (host memory consumption and QEMU process crash) via a large number of device unplug operations.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: serial: host memory leakage 16550A UART emulation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-5579"
},
{
"category": "external",
"summary": "RHBZ#1416157",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1416157"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-5579",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-5579"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-5579",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-5579"
}
],
"release_date": "2017-01-11T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-08-01T21:17:55+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:2408"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 2.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:A/AC:M/Au:S/C:N/I:N/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L",
"version": "3.0"
},
"products": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Qemu: serial: host memory leakage 16550A UART emulation"
},
{
"acknowledgments": [
{
"names": [
"Li Qiang"
],
"organization": "360.cn Inc."
}
],
"cve": "CVE-2017-5973",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
},
"discovery_date": "2017-02-06T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1421626"
}
],
"notes": [
{
"category": "description",
"text": "The xhci_kick_epctx function in hw/usb/hcd-xhci.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (infinite loop and QEMU process crash) via vectors related to control transfer descriptor sequence.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: usb: infinite loop while doing control transfer in xhci_kick_epctx",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-5973"
},
{
"category": "external",
"summary": "RHBZ#1421626",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1421626"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-5973",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-5973"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-5973",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-5973"
}
],
"release_date": "2017-02-13T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-08-01T21:17:55+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:2408"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 2.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:A/AC:M/Au:S/C:N/I:N/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 3.0,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L",
"version": "3.0"
},
"products": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Qemu: usb: infinite loop while doing control transfer in xhci_kick_epctx"
},
{
"acknowledgments": [
{
"names": [
"Li Qiang"
],
"organization": "360.cn Inc."
}
],
"cve": "CVE-2017-6414",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2017-02-20T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1427833"
}
],
"notes": [
{
"category": "description",
"text": "Memory leak in the vcard_apdu_new function in card_7816.c in libcacard before 2.5.3 allows local guest OS users to cause a denial of service (host memory consumption) via vectors related to allocating a new APDU object.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: libcacard: host memory leakage while creating new APDU",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-6414"
},
{
"category": "external",
"summary": "RHBZ#1427833",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1427833"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-6414",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-6414"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-6414",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6414"
}
],
"release_date": "2017-02-21T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-08-01T21:17:55+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:2408"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 2.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:A/AC:M/Au:S/C:N/I:N/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 3.0,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L",
"version": "3.0"
},
"products": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Qemu: libcacard: host memory leakage while creating new APDU"
},
{
"acknowledgments": [
{
"names": [
"Jiang Xin"
],
"organization": "Huawei PSIRT"
}
],
"cve": "CVE-2017-8309",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2017-04-25T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1446517"
}
],
"notes": [
{
"category": "description",
"text": "Memory leak in the audio/audio.c in QEMU (aka Quick Emulator) allows remote attackers to cause a denial of service (memory consumption) by repeatedly starting and stopping audio capture.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: audio: host memory leakage via capture buffer",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-8309"
},
{
"category": "external",
"summary": "RHBZ#1446517",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1446517"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-8309",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-8309"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-8309",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-8309"
}
],
"release_date": "2017-04-28T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-08-01T21:17:55+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:2408"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 2.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:A/AC:M/Au:S/C:N/I:N/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 3.0,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L",
"version": "3.0"
},
"products": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Qemu: audio: host memory leakage via capture buffer"
},
{
"acknowledgments": [
{
"names": [
"Jiang Xin"
],
"organization": "Huawei PSIRT"
}
],
"cve": "CVE-2017-8379",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2017-04-27T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1446547"
}
],
"notes": [
{
"category": "description",
"text": "Memory leak in the keyboard input event handlers support in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (host memory consumption) by rapidly generating large keyboard events.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: input: host memory lekage via keyboard events",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-8379"
},
{
"category": "external",
"summary": "RHBZ#1446547",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1446547"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-8379",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-8379"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-8379",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-8379"
}
],
"release_date": "2017-04-28T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-08-01T21:17:55+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:2408"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 2.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:A/AC:M/Au:S/C:N/I:N/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 3.0,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L",
"version": "3.0"
},
"products": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Qemu: input: host memory lekage via keyboard events"
},
{
"acknowledgments": [
{
"names": [
"Li Qiang"
],
"organization": "Qihoo 360 Gear Team"
}
],
"cve": "CVE-2017-9310",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
},
"discovery_date": "2016-11-29T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1452620"
}
],
"notes": [
{
"category": "description",
"text": "QEMU (aka Quick Emulator), when built with the e1000e NIC emulation support, allows local guest OS privileged users to cause a denial of service (infinite loop) via vectors related to setting the initial receive / transmit descriptor head (TDH/RDH) outside the allocated descriptor buffer.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: net: infinite loop in e1000e NIC emulation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-9310"
},
{
"category": "external",
"summary": "RHBZ#1452620",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1452620"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-9310",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-9310"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-9310",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-9310"
}
],
"release_date": "2017-02-10T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-08-01T21:17:55+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:2408"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 2.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:A/AC:M/Au:S/C:N/I:N/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 3.0,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L",
"version": "3.0"
},
"products": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Qemu: net: infinite loop in e1000e NIC emulation"
},
{
"acknowledgments": [
{
"names": [
"Li Qiang"
],
"organization": "Qihoo 360 Gear Team"
}
],
"cve": "CVE-2017-9373",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2016-11-10T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1458270"
}
],
"notes": [
{
"category": "description",
"text": "Memory leak in QEMU (aka Quick Emulator), when built with IDE AHCI Emulation support, allows local guest OS privileged users to cause a denial of service (memory consumption) by repeatedly hot-unplugging the AHCI device.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: ide: ahci host memory leakage during hotunplug",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-9373"
},
{
"category": "external",
"summary": "RHBZ#1458270",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1458270"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-9373",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-9373"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-9373",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-9373"
}
],
"release_date": "2017-03-16T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-08-01T21:17:55+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:2408"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 2.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:A/AC:M/Au:S/C:N/I:N/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 3.0,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L",
"version": "3.0"
},
"products": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Qemu: ide: ahci host memory leakage during hotunplug"
},
{
"acknowledgments": [
{
"names": [
"Li Qiang"
],
"organization": "Qihoo 360 Gear Team"
}
],
"cve": "CVE-2017-9374",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2017-02-08T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1459132"
}
],
"notes": [
{
"category": "description",
"text": "Memory leak in QEMU (aka Quick Emulator), when built with USB EHCI Emulation support, allows local guest OS privileged users to cause a denial of service (memory consumption) by repeatedly hot-unplugging the device.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: usb: ehci host memory leakage during hotunplug",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-9374"
},
{
"category": "external",
"summary": "RHBZ#1459132",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1459132"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-9374",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-9374"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-9374",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-9374"
}
],
"release_date": "2017-02-08T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-08-01T21:17:55+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:2408"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 2.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:A/AC:M/Au:S/C:N/I:N/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 3.0,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L",
"version": "3.0"
},
"products": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Qemu: usb: ehci host memory leakage during hotunplug"
},
{
"acknowledgments": [
{
"names": [
"Li Qiang"
],
"organization": "Qihoo 360 Gear Team"
}
],
"cve": "CVE-2017-9375",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
},
"discovery_date": "2016-06-27T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1458744"
}
],
"notes": [
{
"category": "description",
"text": "QEMU (aka Quick Emulator), when built with USB xHCI controller emulator support, allows local guest OS privileged users to cause a denial of service (infinite recursive call) via vectors involving control transfer descriptors sequencing.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: usb: xhci infinite recursive call via xhci_kick_ep",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-9375"
},
{
"category": "external",
"summary": "RHBZ#1458744",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1458744"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-9375",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-9375"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-9375",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-9375"
}
],
"release_date": "2017-02-02T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-08-01T21:17:55+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:2408"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 2.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:A/AC:M/Au:S/C:N/I:N/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 3.0,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L",
"version": "3.0"
},
"products": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Qemu: usb: xhci infinite recursive call via xhci_kick_ep"
},
{
"cve": "CVE-2017-9524",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"discovery_date": "2017-05-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1460170"
}
],
"notes": [
{
"category": "description",
"text": "Quick Emulator (QEMU) built with Network Block Device (NBD) Server support was vulnerable to a null-pointer dereference issue. The flaw could occur when releasing a client that was not initialized due to failed negotiation. A remote user or process could exploit this flaw to crash the qemu-nbd server (denial of service).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: nbd: segmentation fault due to client non-negotiation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-9524"
},
{
"category": "external",
"summary": "RHBZ#1460170",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1460170"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-9524",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-9524"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-9524",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-9524"
}
],
"release_date": "2017-05-26T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-08-01T21:17:55+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:2408"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.0"
},
"products": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-11.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.9.0-10.el7.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.9.0-10.el7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Qemu: nbd: segmentation fault due to client non-negotiation"
}
]
}
Loading...
Loading...
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.