Test Kennung:	1.3.6.1.4.1.25623.1.0.123329
Kategorie:	Oracle Linux Local Security Checks
Titel:	Oracle: Security Advisory (ELSA-2014-1075)
Zusammenfassung:	The remote host is missing an update for the 'qemu-kvm' package(s) announced via the ELSA-2014-1075 advisory.
Beschreibung:	Summary: The remote host is missing an update for the 'qemu-kvm' package(s) announced via the ELSA-2014-1075 advisory. Vulnerability Insight: [0.12.1.2-2.415.el6_5.14] - The commit for zrelease .13 was incomplete, the changes to qemu-kvm.spec did not include the '%patchNNNN -p1' lines for patches 4647 through 4655, so although the patch files themselves were committed, the srpm build did not pick them up. In addition, the commit log did not describe the patches. This commit corrects these problems and bumps the zrelease to .14. [0.12.1.2-2.415.el6_5.13] - kvm-block-Create-proper-size-file-for-disk-mirror.patch [bz#1109715] - kvm-block-Fix-bdrv_is_allocated-return-value.patch [bz#1109715] - kvm-scsi-bus-prepare-scsi_req_new-for-introduction-of-pars.patch [bz#1125131] - kvm-scsi-bus-introduce-parse_cdb-in-SCSIDeviceClass-and-SC.patch [bz#1125131] - kvm-scsi-block-extract-scsi_block_is_passthrough.patch [bz#1125131] - kvm-scsi-block-scsi-generic-implement-parse_cdb.patch [bz#1125131] - kvm-virtio-scsi-implement-parse_cdb.patch [bz#1125131] - kvm-virtio-scsi-Fix-reset-callback-for-virtio-scsi.patch [bz#1123271] - kvm-virtio-scsi-add-ioeventfd-support.patch [bz#1123271] - Resolves: bz#1109715 (live incremental migration of vm with common shared base, size(disk) > size(base) transfers unallocated sectors, explodes disk on dest) - Resolves: bz#1123271 (Enable ioenventfd for virtio-scsi-pci) - Resolves: bz#1125131 ([FJ6.5 Bug] SCSI command issued from KVM guest doesn't reach target device) [0.12.1.2-2.415.el6_5.12] - kvm-qcow-Return-real-error-code-in-qcow_open.txt [bz#1097225] - kvm-qcow1-Make-padding-in-the-header-explicit.txt [bz#1097225] - kvm-qcow1-Check-maximum-cluster-size.txt [bz#1097225] - kvm-qcow1-Validate-L2-table-size-CVE-2014-0222.txt [bz#1097225] - kvm-qcow1-Validate-image-size-CVE-2014-0223.txt [bz#1097234] - kvm-qcow1-Stricter-backing-file-length-check.txt [bz#1097234] - Resolves: bz#1097225 (CVE-2014-0222 qemu-kvm: Qemu: qcow1: validate L2 table size to avoid integer overflows [rhel-6.5.z]) - Resolves: bz#1097234 (CVE-2014-0223 qemu-kvm: Qemu: qcow1: validate image size to avoid out-of-bounds memory access [rhel-6.5.z]) [0.12.1.2-2.415.el6_5.11] - kvm-block-Fix-bdrv_is_allocated-for-short-backing-files.patch [bz#1109715] - Resolves: bz#1109715 (live incremental migration of vm with common shared base, size(disk) > size(base) transfers unallocated sectors, explodes disk on dest) Affected Software/OS: 'qemu-kvm' package(s) on Oracle Linux 6. Solution: Please install the updated package(s). CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Querverweis:	Common Vulnerability Exposure (CVE) ID: CVE-2014-0222 67357 http://www.securityfocus.com/bid/67357 DSA-3044 http://www.debian.org/security/2014/dsa-3044 FEDORA-2014-6288 http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133345.html FEDORA-2014-6970 http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134053.html SUSE-SU-2015:0929 http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00021.html [Qemu-devel] 20140512 [PATCH 3/5] qcow1: Validate L2 table size (CVE-2014-0222) https://lists.gnu.org/archive/html/qemu-devel/2014-05/msg02155.html [Qemu-stable] 20140723 [ANNOUNCE] QEMU 1.7.2 Stable released http://lists.nongnu.org/archive/html/qemu-stable/2014-07/msg00187.html openSUSE-SU-2015:1965 http://lists.opensuse.org/opensuse-updates/2015-11/msg00063.html Common Vulnerability Exposure (CVE) ID: CVE-2014-0223 67391 http://www.securityfocus.com/bid/67391 [Qemu-devel] 20140512 [PATCH 4/5] qcow1: Validate image size (CVE-2014-0223) https://lists.gnu.org/archive/html/qemu-devel/2014-05/msg02156.html
Copyright	Copyright (C) 2015 Greenbone AG

Dies ist nur einer von 146377 Anfälligkeitstests in unserem Testpaket. Finden Sie mehr über unsere vollständigen Sicherheitsüberprüfungen heraus. Um einen gratis Test für diese Anfälligkeit auf Ihrem System durchlaufen zu lassen, registrieren Sie sich bitte unten.