Test ID:	1.3.6.1.4.1.25623.1.0.121440
Category:	Gentoo Local Security Checks
Title:	Gentoo Security Advisory GLSA 201602-01
Summary:	Gentoo Linux Local Security Checks GLSA 201602-01
Description:	Summary: Gentoo Linux Local Security Checks GLSA 201602-01 Vulnerability Insight: Multiple vulnerabilities have been discovered in QEMU. Please review the CVE identifiers referenced below for details. Solution: Update the affected packages to the latest available version. CVSS Score: 10.0 CVSS Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2015-1779 1033975 http://www.securitytracker.com/id/1033975 73303 http://www.securityfocus.com/bid/73303 DSA-3259 http://www.debian.org/security/2015/dsa-3259 FEDORA-2015-5482 http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154656.html FEDORA-2015-5541 http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155196.html GLSA-201602-01 https://security.gentoo.org/glsa/201602-01 RHSA-2015:1931 http://rhn.redhat.com/errata/RHSA-2015-1931.html RHSA-2015:1943 http://rhn.redhat.com/errata/RHSA-2015-1943.html SUSE-SU-2015:0870 http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00033.html SUSE-SU-2015:0896 http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00042.html USN-2608-1 http://www.ubuntu.com/usn/USN-2608-1 [Qemu-devel] 20150323 [PATCH 0/2] CVE-2015-1779: fix denial of service in VNC websockets https://lists.gnu.org/archive/html/qemu-devel/2015-03/msg04894.html [Qemu-devel] 20150323 [PATCH 1/2] CVE-2015-1779: incrementally decode websocket frames https://lists.gnu.org/archive/html/qemu-devel/2015-03/msg04896.html [Qemu-devel] 20150323 [PATCH 2/2] CVE-2015-1779: limit size of HTTP headers from websockets clients https://lists.gnu.org/archive/html/qemu-devel/2015-03/msg04895.html [oss-security] 20150324 CVE-2015-1779 qemu: vnc: insufficient resource limiting in VNC websockets decoder http://www.openwall.com/lists/oss-security/2015/03/24/9 [oss-security] 20150409 Re: CVE-2015-1779 qemu: vnc: insufficient resource limiting in VNC websockets decoder http://www.openwall.com/lists/oss-security/2015/04/09/6 http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html Common Vulnerability Exposure (CVE) ID: CVE-2015-3456 BugTraq ID: 74640 http://www.securityfocus.com/bid/74640 Debian Security Information: DSA-3259 (Google Search) Debian Security Information: DSA-3262 (Google Search) http://www.debian.org/security/2015/dsa-3262 Debian Security Information: DSA-3274 (Google Search) http://www.debian.org/security/2015/dsa-3274 https://www.exploit-db.com/exploits/37053/ http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158072.html https://security.gentoo.org/glsa/201604-03 https://security.gentoo.org/glsa/201612-27 HPdes Security Advisory: HPSBMU03336 http://marc.info/?l=bugtraq&m=143229451215900&w=2 HPdes Security Advisory: HPSBMU03349 http://marc.info/?l=bugtraq&m=143387998230996&w=2 HPdes Security Advisory: SSRT102076 http://venom.crowdstrike.com/ https://www.arista.com/en/support/advisories-notices/security-advisories/1128-security-advisory-10 RedHat Security Advisories: RHSA-2015:0998 http://rhn.redhat.com/errata/RHSA-2015-0998.html RedHat Security Advisories: RHSA-2015:0999 http://rhn.redhat.com/errata/RHSA-2015-0999.html RedHat Security Advisories: RHSA-2015:1000 http://rhn.redhat.com/errata/RHSA-2015-1000.html RedHat Security Advisories: RHSA-2015:1001 http://rhn.redhat.com/errata/RHSA-2015-1001.html RedHat Security Advisories: RHSA-2015:1002 http://rhn.redhat.com/errata/RHSA-2015-1002.html RedHat Security Advisories: RHSA-2015:1003 http://rhn.redhat.com/errata/RHSA-2015-1003.html RedHat Security Advisories: RHSA-2015:1004 http://rhn.redhat.com/errata/RHSA-2015-1004.html RedHat Security Advisories: RHSA-2015:1011 http://rhn.redhat.com/errata/RHSA-2015-1011.html http://www.securitytracker.com/id/1032306 http://www.securitytracker.com/id/1032311 http://www.securitytracker.com/id/1032917 SuSE Security Announcement: SUSE-SU-2015:0889 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00009.html SuSE Security Announcement: SUSE-SU-2015:0896 (Google Search) SuSE Security Announcement: SUSE-SU-2015:0923 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00018.html SuSE Security Announcement: SUSE-SU-2015:0927 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00019.html SuSE Security Announcement: SUSE-SU-2015:0929 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00021.html SuSE Security Announcement: openSUSE-SU-2015:0893 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00013.html SuSE Security Announcement: openSUSE-SU-2015:0894 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00014.html SuSE Security Announcement: openSUSE-SU-2015:0983 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00001.html SuSE Security Announcement: openSUSE-SU-2015:1400 (Google Search) http://lists.opensuse.org/opensuse-updates/2015-08/msg00021.html Common Vulnerability Exposure (CVE) ID: CVE-2015-5225 1033547 http://www.securitytracker.com/id/1033547 76506 http://www.securityfocus.com/bid/76506 DSA-3348 http://www.debian.org/security/2015/dsa-3348 FEDORA-2015-14783 http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165484.html FEDORA-2015-15364 http://lists.fedoraproject.org/pipermail/package-announce/2015-September/166798.html FEDORA-2015-16368 http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169039.html RHSA-2015:1772 http://rhn.redhat.com/errata/RHSA-2015-1772.html RHSA-2015:1837 http://rhn.redhat.com/errata/RHSA-2015-1837.html [Qemu-deve] 20150915 [ANNOUNCE] QEMU 2.4.0.1 CVE update released https://lists.gnu.org/archive/html/qemu-devel/2015-09/msg05832.html [Qemu-devel] 20150821 [PATCH] vnc: fix memory corruption (CVE-2015-5225) https://lists.gnu.org/archive/html/qemu-devel/2015-08/msg02495.html [oss-security] 20150822 CVE-2015-5225 Qemu: ui: vnc: heap memory corruption issue http://www.openwall.com/lists/oss-security/2015/08/21/6 Common Vulnerability Exposure (CVE) ID: CVE-2015-5278 http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168077.html http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168646.html http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168671.html http://www.openwall.com/lists/oss-security/2015/09/15/2 http://www.ubuntu.com/usn/USN-2745-1 https://lists.gnu.org/archive/html/qemu-devel/2015-09/msg03985.html https://www.arista.com/en/support/advisories-notices/security-advisories/1188-security-advisory-14 Common Vulnerability Exposure (CVE) ID: CVE-2015-5279 1033569 http://www.securitytracker.com/id/1033569 76746 http://www.securityfocus.com/bid/76746 DSA-3361 http://www.debian.org/security/2015/dsa-3361 DSA-3362 http://www.debian.org/security/2015/dsa-3362 FEDORA-2015-16369 http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169036.html FEDORA-2015-16370 http://lists.fedoraproject.org/pipermail/package-announce/2015-September/167369.html RHSA-2015:1896 http://rhn.redhat.com/errata/RHSA-2015-1896.html RHSA-2015:1923 http://rhn.redhat.com/errata/RHSA-2015-1923.html RHSA-2015:1924 http://rhn.redhat.com/errata/RHSA-2015-1924.html RHSA-2015:1925 http://rhn.redhat.com/errata/RHSA-2015-1925.html SUSE-SU-2015:1782 http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00019.html [Qemu-devel] 20150915 [PULL 2/3] net: add checks to validate ring buffer pointers https://lists.gnu.org/archive/html/qemu-devel/2015-09/msg03984.html [oss-security] 20150915 CVE-2015-5279 Qemu: net: add checks to validate ring buffer pointers http://www.openwall.com/lists/oss-security/2015/09/15/3 http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=7aa2bcad0ca837dd6d4bf4fa38a80314b4a6b755 Common Vulnerability Exposure (CVE) ID: CVE-2015-5745 http://www.openwall.com/lists/oss-security/2015/08/06/3 http://www.openwall.com/lists/oss-security/2015/08/06/5 https://github.com/qemu/qemu/commit/7882080388be5088e72c425b02223c02e6cb4295 https://lists.gnu.org/archive/html/qemu-devel/2015-07/msg05458.html https://www.arista.com/en/support/advisories-notices/security-advisories/1180-security-advisory-13 Common Vulnerability Exposure (CVE) ID: CVE-2015-6815 http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00026.html http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00005.html http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00011.html http://www.openwall.com/lists/oss-security/2015/09/04/4 http://www.openwall.com/lists/oss-security/2015/09/05/5 https://bugzilla.redhat.com/show_bug.cgi?id=1260076 https://lists.gnu.org/archive/html/qemu-devel/2015-09/msg01199.html Common Vulnerability Exposure (CVE) ID: CVE-2015-6855 76691 http://www.securityfocus.com/bid/76691 FEDORA-2015-4896530727 http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169327.html FEDORA-2015-8dc71ade88 http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168602.html FEDORA-2015-d6ea74993a http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169341.html USN-2745-1 [Qemu-devel] 20150907 [PATCH] ide: fix ATAPI command permissions https://lists.gnu.org/archive/html/qemu-devel/2015-09/msg02479.html [oss-security] 20150910 CVE request Qemu: ide: divide by zero issue http://www.openwall.com/lists/oss-security/2015/09/10/1 [oss-security] 20150910 Re: CVE request Qemu: ide: divide by zero issue http://www.openwall.com/lists/oss-security/2015/09/10/2 Common Vulnerability Exposure (CVE) ID: CVE-2015-7295 82672 http://www.securityfocus.com/bid/82672 DSA-3469 http://www.debian.org/security/2016/dsa-3469 DSA-3470 http://www.debian.org/security/2016/dsa-3470 DSA-3471 http://www.debian.org/security/2016/dsa-3471 FEDORA-2015-d5c1048b47 http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169802.html FEDORA-2015-d8510319c0 http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169624.html FEDORA-2015-fca1900745 http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169767.html [oss-security] 20150918 CVE request Qemu: net: virtio-net possible remote DoS http://www.openwall.com/lists/oss-security/2015/09/18/5 [oss-security] 20150918 Re: CVE request Qemu: net: virtio-net possible remote DoS http://www.openwall.com/lists/oss-security/2015/09/18/9 Common Vulnerability Exposure (CVE) ID: CVE-2015-7504 1034268 http://www.securitytracker.com/id/1034268 78227 http://www.securityfocus.com/bid/78227 GLSA-201604-03 RHSA-2015:2694 http://rhn.redhat.com/errata/RHSA-2015-2694.html RHSA-2015:2695 http://rhn.redhat.com/errata/RHSA-2015-2695.html RHSA-2015:2696 http://rhn.redhat.com/errata/RHSA-2015-2696.html [Qemu-devel] 20151130 [PATCH for 2.5 1/2] net: pcnet: add check to validate receive data size(CVE-2015-7504) https://lists.gnu.org/archive/html/qemu-devel/2015-11/msg06342.html [oss-security] 20151130 CVE-2015-7504 Qemu: net: pcnet: heap overflow vulnerability in loopback mode http://www.openwall.com/lists/oss-security/2015/11/30/2 http://xenbits.xen.org/xsa/advisory-162.html Common Vulnerability Exposure (CVE) ID: CVE-2015-7512 1034527 http://www.securitytracker.com/id/1034527 78230 http://www.securityfocus.com/bid/78230 [oss-security] 20151130 CVE-2015-7512 Qemu: net: pcnet: buffer overflow in non-loopback mode http://www.openwall.com/lists/oss-security/2015/11/30/3 http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=8b98a2f07175d46c3f7217639bd5e03f http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html Common Vulnerability Exposure (CVE) ID: CVE-2015-7549 80761 http://www.securityfocus.com/bid/80761 FEDORA-2016-e9bba2bb01 http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175380.html [oss-security] 20151214 CVE-2015-7549 Qemu: pci: msi-x: null pointer dereference issue http://www.openwall.com/lists/oss-security/2015/12/14/2 http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=43b11a91dd861a946b231b89b754285 https://bugzilla.redhat.com/show_bug.cgi?id=1291137 Common Vulnerability Exposure (CVE) ID: CVE-2015-8345 BugTraq ID: 77985 http://www.securityfocus.com/bid/77985 Debian Security Information: DSA-3469 (Google Search) Debian Security Information: DSA-3470 (Google Search) Debian Security Information: DSA-3471 (Google Search) http://www.openwall.com/lists/oss-security/2015/11/25/11 https://lists.gnu.org/archive/html/qemu-devel/2015-10/msg03911.html Common Vulnerability Exposure (CVE) ID: CVE-2015-8504 78708 http://www.securityfocus.com/bid/78708 [oss-security] 20151208 Re: CVE request: Qemu: ui: vnc: avoid floating point exception http://www.openwall.com/lists/oss-security/2015/12/08/7 http://git.qemu-project.org/?p=qemu.git%3Ba=commitdiff%3Bh=4c65fed8bdf96780735dbdb92a8 https://bugzilla.redhat.com/show_bug.cgi?id=1289541 Common Vulnerability Exposure (CVE) ID: CVE-2015-8556 https://www.exploit-db.com/exploits/39010/ http://packetstormsecurity.com/files/134948/Gentoo-QEMU-Local-Privilege-Escalation.html Common Vulnerability Exposure (CVE) ID: CVE-2015-8558 80694 http://www.securityfocus.com/bid/80694 [oss-security] 20151214 CVE request Qemu: usb: infinite loop in ehci_advance_state results in DoS http://www.openwall.com/lists/oss-security/2015/12/14/9 [oss-security] 20151214 Re: CVE request Qemu: usb: infinite loop in ehci_advance_state results in DoS http://www.openwall.com/lists/oss-security/2015/12/14/16 [qemu-devel] 20151214 [PATCH] ehci: make idt processing more robust https://lists.gnu.org/archive/html/qemu-devel/2015-12/msg02124.html http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=156a2e4dbffa85997636a7a39ef12da6f1b40254 https://bugzilla.redhat.com/show_bug.cgi?id=1277983 Common Vulnerability Exposure (CVE) ID: CVE-2015-8567 79721 http://www.securityfocus.com/bid/79721 FEDORA-2016-275e9ff483 http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176558.html FEDORA-2016-2c15b72b01 http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176300.html FEDORA-2016-42778e8c82 http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175967.html FEDORA-2016-e1784417af http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176503.html SUSE-SU-2016:0873 http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00087.html SUSE-SU-2016:0955 http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00002.html SUSE-SU-2016:1318 http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00049.html SUSE-SU-2016:1560 http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00017.html SUSE-SU-2016:1703 http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00058.html USN-2891-1 http://www.ubuntu.com/usn/USN-2891-1 [oss-security] 20151215 Re: CVE request Qemu: net: vmxnet3: host memory leakage http://www.openwall.com/lists/oss-security/2015/12/15/10 [qemu-devel] 20151215 Re: [Qemu-devel] net: vmxnet3: memory leakage issue https://lists.gnu.org/archive/html/qemu-devel/2015-12/msg02299.html openSUSE-SU-2016:0123 http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00010.html openSUSE-SU-2016:0126 http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00012.html openSUSE-SU-2016:1750 http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00003.html Common Vulnerability Exposure (CVE) ID: CVE-2015-8568 https://bugzilla.redhat.com/show_bug.cgi?id=1289816 Common Vulnerability Exposure (CVE) ID: CVE-2015-8666 79670 http://www.securityfocus.com/bid/79670 [debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html [oss-security] 20151224 CVE request Qemu: acpi: heap based buffer overrun during VM migration http://www.openwall.com/lists/oss-security/2015/12/24/1 http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=d9a3b33d2c9f996537b7f1d0246dee2d0120cefb https://bugzilla.redhat.com/show_bug.cgi?id=1283722 Common Vulnerability Exposure (CVE) ID: CVE-2015-8701 79706 http://www.securityfocus.com/bid/79706 [oss-security] 20151228 CVE request Qemu net: rocker: fix an incorrect array bounds check http://www.openwall.com/lists/oss-security/2015/12/28/6 [oss-security] 20151229 Re: CVE request Qemu net: rocker: fix an incorrect array bounds check http://www.openwall.com/lists/oss-security/2015/12/29/1 [qemu-devel] 20151226 [PATCH v2] net: rocker: fix an incorrect array bounds check https://lists.gnu.org/archive/html/qemu-devel/2015-12/msg04629.html https://bugzilla.redhat.com/show_bug.cgi?id=1286971 Common Vulnerability Exposure (CVE) ID: CVE-2015-8743 1034574 http://www.securitytracker.com/id/1034574 79820 http://www.securityfocus.com/bid/79820 [oss-security] 20160104 CVE request Qemu: net: ne2000: OOB r/w in ioport operations http://www.openwall.com/lists/oss-security/2016/01/04/1 [oss-security] 20160104 Re: CVE request Qemu: net: ne2000: OOB r/w in ioport operations http://www.openwall.com/lists/oss-security/2016/01/04/2 [qemu-devel] 20160104 Re: [PATCH v3] net: ne2000: fix bounds check in ioport operations https://lists.gnu.org/archive/html/qemu-devel/2016-01/msg00050.html https://bugzilla.redhat.com/show_bug.cgi?id=1264929 Common Vulnerability Exposure (CVE) ID: CVE-2015-8744 1034576 http://www.securitytracker.com/id/1034576 79821 http://www.securityfocus.com/bid/79821 [oss-security] 20160104 CVE request Qemu: net: vmxnet3: incorrect l2 header validation leads to a crash http://www.openwall.com/lists/oss-security/2016/01/04/3 [oss-security] 20160104 Re: CVE request Qemu: net: vmxnet3: incorrect l2 header validation leads to a crash http://www.openwall.com/lists/oss-security/2016/01/04/6 http://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=a7278b36fcab9af469563bd7b https://bugzilla.redhat.com/show_bug.cgi?id=1270871 Common Vulnerability Exposure (CVE) ID: CVE-2015-8745 1034575 http://www.securitytracker.com/id/1034575 79822 http://www.securityfocus.com/bid/79822 [oss-security] 20160104 CVE request Qemu: net: vmxnet3: reading IMR registers leads to a crash http://www.openwall.com/lists/oss-security/2016/01/04/4 [oss-security] 20160104 Re: CVE request Qemu: net: vmxnet3: reading IMR registers leads to a crash http://www.openwall.com/lists/oss-security/2016/01/04/7 http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=c6048f849c7e3f009786df76206e895 https://bugzilla.redhat.com/show_bug.cgi?id=1270876 Common Vulnerability Exposure (CVE) ID: CVE-2016-1568 1034859 http://www.securitytracker.com/id/1034859 80191 http://www.securityfocus.com/bid/80191 RHSA-2016:0084 http://rhn.redhat.com/errata/RHSA-2016-0084.html RHSA-2016:0086 http://rhn.redhat.com/errata/RHSA-2016-0086.html RHSA-2016:0087 http://rhn.redhat.com/errata/RHSA-2016-0087.html RHSA-2016:0088 http://rhn.redhat.com/errata/RHSA-2016-0088.html [oss-security] 20160109 Qemu: ide: ahci use-after-free vulnerability in aio port commands http://www.openwall.com/lists/oss-security/2016/01/09/1 [oss-security] 20160109 Re: Qemu: ide: ahci use-after-free vulnerability in aio port commands http://www.openwall.com/lists/oss-security/2016/01/09/2 http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=4ab0359a8ae182a7ac5c99609667273167703fab
Copyright	Copyright (C) 2016 Eero Volotinen

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.