ID de Prueba:	1.3.6.1.4.1.25623.1.0.123329
Categoría:	Oracle Linux Local Security Checks
Título:	Oracle: Security Advisory (ELSA-2014-1075)
Resumen:	The remote host is missing an update for the 'qemu-kvm' package(s) announced via the ELSA-2014-1075 advisory.
Descripción:	Summary: The remote host is missing an update for the 'qemu-kvm' package(s) announced via the ELSA-2014-1075 advisory. Vulnerability Insight: [0.12.1.2-2.415.el6_5.14] - The commit for zrelease .13 was incomplete, the changes to qemu-kvm.spec did not include the '%patchNNNN -p1' lines for patches 4647 through 4655, so although the patch files themselves were committed, the srpm build did not pick them up. In addition, the commit log did not describe the patches. This commit corrects these problems and bumps the zrelease to .14. [0.12.1.2-2.415.el6_5.13] - kvm-block-Create-proper-size-file-for-disk-mirror.patch [bz#1109715] - kvm-block-Fix-bdrv_is_allocated-return-value.patch [bz#1109715] - kvm-scsi-bus-prepare-scsi_req_new-for-introduction-of-pars.patch [bz#1125131] - kvm-scsi-bus-introduce-parse_cdb-in-SCSIDeviceClass-and-SC.patch [bz#1125131] - kvm-scsi-block-extract-scsi_block_is_passthrough.patch [bz#1125131] - kvm-scsi-block-scsi-generic-implement-parse_cdb.patch [bz#1125131] - kvm-virtio-scsi-implement-parse_cdb.patch [bz#1125131] - kvm-virtio-scsi-Fix-reset-callback-for-virtio-scsi.patch [bz#1123271] - kvm-virtio-scsi-add-ioeventfd-support.patch [bz#1123271] - Resolves: bz#1109715 (live incremental migration of vm with common shared base, size(disk) > size(base) transfers unallocated sectors, explodes disk on dest) - Resolves: bz#1123271 (Enable ioenventfd for virtio-scsi-pci) - Resolves: bz#1125131 ([FJ6.5 Bug] SCSI command issued from KVM guest doesn't reach target device) [0.12.1.2-2.415.el6_5.12] - kvm-qcow-Return-real-error-code-in-qcow_open.txt [bz#1097225] - kvm-qcow1-Make-padding-in-the-header-explicit.txt [bz#1097225] - kvm-qcow1-Check-maximum-cluster-size.txt [bz#1097225] - kvm-qcow1-Validate-L2-table-size-CVE-2014-0222.txt [bz#1097225] - kvm-qcow1-Validate-image-size-CVE-2014-0223.txt [bz#1097234] - kvm-qcow1-Stricter-backing-file-length-check.txt [bz#1097234] - Resolves: bz#1097225 (CVE-2014-0222 qemu-kvm: Qemu: qcow1: validate L2 table size to avoid integer overflows [rhel-6.5.z]) - Resolves: bz#1097234 (CVE-2014-0223 qemu-kvm: Qemu: qcow1: validate image size to avoid out-of-bounds memory access [rhel-6.5.z]) [0.12.1.2-2.415.el6_5.11] - kvm-block-Fix-bdrv_is_allocated-for-short-backing-files.patch [bz#1109715] - Resolves: bz#1109715 (live incremental migration of vm with common shared base, size(disk) > size(base) transfers unallocated sectors, explodes disk on dest) Affected Software/OS: 'qemu-kvm' package(s) on Oracle Linux 6. Solution: Please install the updated package(s). CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2014-0222 67357 http://www.securityfocus.com/bid/67357 DSA-3044 http://www.debian.org/security/2014/dsa-3044 FEDORA-2014-6288 http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133345.html FEDORA-2014-6970 http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134053.html SUSE-SU-2015:0929 http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00021.html [Qemu-devel] 20140512 [PATCH 3/5] qcow1: Validate L2 table size (CVE-2014-0222) https://lists.gnu.org/archive/html/qemu-devel/2014-05/msg02155.html [Qemu-stable] 20140723 [ANNOUNCE] QEMU 1.7.2 Stable released http://lists.nongnu.org/archive/html/qemu-stable/2014-07/msg00187.html openSUSE-SU-2015:1965 http://lists.opensuse.org/opensuse-updates/2015-11/msg00063.html Common Vulnerability Exposure (CVE) ID: CVE-2014-0223 67391 http://www.securityfocus.com/bid/67391 [Qemu-devel] 20140512 [PATCH 4/5] qcow1: Validate image size (CVE-2014-0223) https://lists.gnu.org/archive/html/qemu-devel/2014-05/msg02156.html
Copyright	Copyright (C) 2015 Greenbone AG

Esta es sólo una de 146377 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.