Vulnerability   
Search   
    Search 219043 CVE descriptions
and 99761 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:1.3.6.1.4.1.25623.1.0.703284
Category:Debian Local Security Checks
Title:Debian Security Advisory DSA 3284-1 (qemu - security update)
Summary:Several vulnerabilities were discovered;in qemu, a fast processor emulator.;;CVE-2015-3209;Matt Tait of Google's Project Zero security team discovered a flaw;in the way QEMU's AMD PCnet Ethernet emulation handles multi-TMD;packets with a length above 4096 bytes. A privileged guest user in a;guest with an AMD PCNet ethernet card enabled can potentially use;this flaw to execute arbitrary code on the host with the privileges;of the hosting QEMU process.;;CVE-2015-4037;Kurt Seifried of Red Hat Product Security discovered that QEMU's;user mode networking stack uses predictable temporary file names;when the -smb option is used. An unprivileged user can use this flaw;to cause a denial of service.;;CVE-2015-4103;Jan Beulich of SUSE discovered that the QEMU Xen code does not;properly restrict write access to the host MSI message data field,;allowing a malicious guest to cause a denial of service.;;CVE-2015-4104;Jan Beulich of SUSE discovered that the QEMU Xen code does not;properly restrict access to PCI MSI mask bits, allowing a malicious;guest to cause a denial of service.;;CVE-2015-4105;Jan Beulich of SUSE reported that the QEMU Xen code enables;logging for PCI MSI-X pass-through error messages, allowing a;malicious guest to cause a denial of service.;;CVE-2015-4106;Jan Beulich of SUSE discovered that the QEMU Xen code does not;properly restrict write access to the PCI config space for certain;PCI pass-through devices, allowing a malicious guest to cause a;denial of service, obtain sensitive information or potentially;execute arbitrary code.
Description:Summary:
Several vulnerabilities were discovered
in qemu, a fast processor emulator.

CVE-2015-3209
Matt Tait of Google's Project Zero security team discovered a flaw
in the way QEMU's AMD PCnet Ethernet emulation handles multi-TMD
packets with a length above 4096 bytes. A privileged guest user in a
guest with an AMD PCNet ethernet card enabled can potentially use
this flaw to execute arbitrary code on the host with the privileges
of the hosting QEMU process.

CVE-2015-4037
Kurt Seifried of Red Hat Product Security discovered that QEMU's
user mode networking stack uses predictable temporary file names
when the -smb option is used. An unprivileged user can use this flaw
to cause a denial of service.

CVE-2015-4103
Jan Beulich of SUSE discovered that the QEMU Xen code does not
properly restrict write access to the host MSI message data field,
allowing a malicious guest to cause a denial of service.

CVE-2015-4104
Jan Beulich of SUSE discovered that the QEMU Xen code does not
properly restrict access to PCI MSI mask bits, allowing a malicious
guest to cause a denial of service.

CVE-2015-4105
Jan Beulich of SUSE reported that the QEMU Xen code enables
logging for PCI MSI-X pass-through error messages, allowing a
malicious guest to cause a denial of service.

CVE-2015-4106
Jan Beulich of SUSE discovered that the QEMU Xen code does not
properly restrict write access to the PCI config space for certain
PCI pass-through devices, allowing a malicious guest to cause a
denial of service, obtain sensitive information or potentially
execute arbitrary code.

Affected Software/OS:
qemu on Debian Linux

Solution:
For the oldstable distribution (wheezy),
these problems have been fixed in version 1.1.2+dfsg-6a+deb7u8. Only CVE-2015-3209
and CVE-2015-4037 affect oldstable.

For the stable distribution (jessie), these problems have been fixed in
version 1:2.1+dfsg-12+deb8u1.

For the unstable distribution (sid), these problems have been fixed in
version 1:2.3+dfsg-6.

We recommend that you upgrade your qemu packages.

CVSS Score:
7.8

CVSS Vector:
AV:N/AC:L/Au:N/C:N/I:N/A:C

Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2015-3209
BugTraq ID: 75123
http://www.securityfocus.com/bid/75123
Debian Security Information: DSA-3284 (Google Search)
http://www.debian.org/security/2015/dsa-3284
Debian Security Information: DSA-3285 (Google Search)
http://www.debian.org/security/2015/dsa-3285
Debian Security Information: DSA-3286 (Google Search)
http://www.debian.org/security/2015/dsa-3286
http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160669.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160685.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160677.html
https://security.gentoo.org/glsa/201510-02
https://security.gentoo.org/glsa/201604-03
RedHat Security Advisories: RHSA-2015:1087
http://rhn.redhat.com/errata/RHSA-2015-1087.html
RedHat Security Advisories: RHSA-2015:1088
http://rhn.redhat.com/errata/RHSA-2015-1088.html
RedHat Security Advisories: RHSA-2015:1089
http://rhn.redhat.com/errata/RHSA-2015-1089.html
RedHat Security Advisories: RHSA-2015:1189
http://rhn.redhat.com/errata/RHSA-2015-1189.html
http://www.securitytracker.com/id/1032545
SuSE Security Announcement: SUSE-SU-2015:1042 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00004.html
SuSE Security Announcement: SUSE-SU-2015:1045 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00007.html
SuSE Security Announcement: SUSE-SU-2015:1152 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00027.html
SuSE Security Announcement: SUSE-SU-2015:1156 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00029.html
SuSE Security Announcement: SUSE-SU-2015:1157 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00030.html
SuSE Security Announcement: SUSE-SU-2015:1206 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00014.html
SuSE Security Announcement: SUSE-SU-2015:1426 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00020.html
SuSE Security Announcement: SUSE-SU-2015:1519 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00015.html
SuSE Security Announcement: SUSE-SU-2015:1643 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00027.html
http://www.ubuntu.com/usn/USN-2630-1
Common Vulnerability Exposure (CVE) ID: CVE-2015-4037
BugTraq ID: 74809
http://www.securityfocus.com/bid/74809
http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160414.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160058.html
http://www.openwall.com/lists/oss-security/2015/05/13/7
http://www.openwall.com/lists/oss-security/2015/05/16/5
http://www.openwall.com/lists/oss-security/2015/05/23/4
http://www.securitytracker.com/id/1032547
SuSE Security Announcement: openSUSE-SU-2015:1965 (Google Search)
http://lists.opensuse.org/opensuse-updates/2015-11/msg00063.html
Common Vulnerability Exposure (CVE) ID: CVE-2015-4103
BugTraq ID: 74947
http://www.securityfocus.com/bid/74947
http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160171.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160154.html
http://www.securitytracker.com/id/1032456
Common Vulnerability Exposure (CVE) ID: CVE-2015-4104
BugTraq ID: 74950
http://www.securityfocus.com/bid/74950
http://www.securitytracker.com/id/1032464
Common Vulnerability Exposure (CVE) ID: CVE-2015-4105
BugTraq ID: 74948
http://www.securityfocus.com/bid/74948
http://www.securitytracker.com/id/1032465
Common Vulnerability Exposure (CVE) ID: CVE-2015-4106
BugTraq ID: 74949
http://www.securityfocus.com/bid/74949
http://www.securitytracker.com/id/1032467
CopyrightCopyright (C) 2015 Greenbone Networks GmbH

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.




© 1998-2021 E-Soft Inc. All rights reserved.