| Beschreibung: | Summary:
The remote host is missing an update for the 'qemu'
package(s) announced via the referenced advisory.
Vulnerability Insight:
Laszlo Ersek discovered that QEMU incorrectly
handled memory in the vga device. A malicious guest could possibly use this issue
to read arbitrary host memory. This issue only affected Ubuntu 14.04 LTS and Ubuntu
14.10. (CVE-2014-3615)
Xavier Mehrenberger and Stephane Duverger discovered that QEMU incorrectly
handled certain udp packets when using guest networking. A malicious guest
could possibly use this issue to cause a denial of service. (CVE-2014-3640)
It was discovered that QEMU incorrectly handled parameter validation in
the vmware_vga device. A malicious guest could possibly use this issue to
write into memory of the host, leading to privilege escalation.
(CVE-2014-3689)
It was discovered that QEMU incorrectly handled USB xHCI controller live
migration. An attacker could possibly use this issue to cause a denial of
service, or possibly execute arbitrary code. This issue only affected
Ubuntu 14.04 LTS. (CVE-2014-5263)
Michael S. Tsirkin discovered that QEMU incorrectly handled memory in the
ACPI PCI hotplug interface. A malicious guest could possibly use this issue
to access memory of the host, leading to information disclosure or
privilege escalation. This issue only affected Ubuntu 14.04 LTS.
(CVE-2014-5388)
James Spadaro discovered that QEMU incorrectly handled certain VNC
bytes_per_pixel values. An attacker having access to a VNC console could
possibly use this issue to cause a guest to crash, resulting in a denial of
service. (CVE-2014-7815)
Affected Software/OS:
qemu on Ubuntu 14.10,
Ubuntu 14.04 LTS,
Ubuntu 12.04 LTS,
Ubuntu 10.04 LTS
Solution:
Please Install the Updated Packages.
CVSS Score:
7.2
CVSS Vector:
AV:L/AC:L/Au:N/C:C/I:C/A:C
|
