Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2015-5279 (GCVE-0-2015-5279)
Vulnerability from cvelistv5
Published
2015-09-28 16:00
Modified
2024-08-06 06:41
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
Heap-based buffer overflow in the ne2000_receive function in hw/net/ne2000.c in QEMU before 2.4.0.1 allows guest OS users to cause a denial of service (instance crash) or possibly execute arbitrary code via vectors related to receiving packets.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T06:41:09.328Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "DSA-3361",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2015/dsa-3361"
},
{
"name": "FEDORA-2015-16369",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169036.html"
},
{
"name": "FEDORA-2015-16370",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-September/167369.html"
},
{
"name": "[oss-security] 20150915 CVE-2015-5279 Qemu: net: add checks to validate ring buffer pointers",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2015/09/15/3"
},
{
"name": "[Qemu-devel] 20150915 [PULL 2/3] net: add checks to validate ring buffer pointers",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.gnu.org/archive/html/qemu-devel/2015-09/msg03984.html"
},
{
"name": "RHSA-2015:1896",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2015-1896.html"
},
{
"name": "SUSE-SU-2015:1782",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00019.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=7aa2bcad0ca837dd6d4bf4fa38a80314b4a6b755"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html"
},
{
"name": "FEDORA-2015-16368",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169039.html"
},
{
"name": "RHSA-2015:1924",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2015-1924.html"
},
{
"name": "76746",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/76746"
},
{
"name": "DSA-3362",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2015/dsa-3362"
},
{
"name": "1033569",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1033569"
},
{
"name": "RHSA-2015:1923",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2015-1923.html"
},
{
"name": "RHSA-2015:1925",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2015-1925.html"
},
{
"name": "GLSA-201602-01",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201602-01"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisories/1188-security-advisory-14"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2015-09-15T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Heap-based buffer overflow in the ne2000_receive function in hw/net/ne2000.c in QEMU before 2.4.0.1 allows guest OS users to cause a denial of service (instance crash) or possibly execute arbitrary code via vectors related to receiving packets."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-11-05T17:02:34",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "DSA-3361",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2015/dsa-3361"
},
{
"name": "FEDORA-2015-16369",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169036.html"
},
{
"name": "FEDORA-2015-16370",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-September/167369.html"
},
{
"name": "[oss-security] 20150915 CVE-2015-5279 Qemu: net: add checks to validate ring buffer pointers",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2015/09/15/3"
},
{
"name": "[Qemu-devel] 20150915 [PULL 2/3] net: add checks to validate ring buffer pointers",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.gnu.org/archive/html/qemu-devel/2015-09/msg03984.html"
},
{
"name": "RHSA-2015:1896",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2015-1896.html"
},
{
"name": "SUSE-SU-2015:1782",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00019.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=7aa2bcad0ca837dd6d4bf4fa38a80314b4a6b755"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html"
},
{
"name": "FEDORA-2015-16368",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169039.html"
},
{
"name": "RHSA-2015:1924",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2015-1924.html"
},
{
"name": "76746",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/76746"
},
{
"name": "DSA-3362",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2015/dsa-3362"
},
{
"name": "1033569",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1033569"
},
{
"name": "RHSA-2015:1923",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2015-1923.html"
},
{
"name": "RHSA-2015:1925",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2015-1925.html"
},
{
"name": "GLSA-201602-01",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201602-01"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisories/1188-security-advisory-14"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2015-5279",
"datePublished": "2015-09-28T16:00:00",
"dateReserved": "2015-07-01T00:00:00",
"dateUpdated": "2024-08-06T06:41:09.328Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2015-5279\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2015-09-28T16:59:02.270\",\"lastModified\":\"2025-04-12T10:46:40.837\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Heap-based buffer overflow in the ne2000_receive function in hw/net/ne2000.c in QEMU before 2.4.0.1 allows guest OS users to cause a denial of service (instance crash) or possibly execute arbitrary code via vectors related to receiving packets.\"},{\"lang\":\"es\",\"value\":\"Desbordamiento de buffer basado en memoria din\u00e1mica en la funci\u00f3n ne2000_receive en hw/net/ne2000.c en QEMU en versiones anteriores a 2.4.0.1, permite a usuarios invitados del SO provocar una denegaci\u00f3n de servicio (ca\u00edda de la instancia) o posiblemente ejecutar c\u00f3digo arbitrario a trav\u00e9s de vectores relacionados con la recepci\u00f3n de paquetes.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:L/AC:L/Au:N/C:C/I:C/A:C\",\"baseScore\":7.2,\"accessVector\":\"LOCAL\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"COMPLETE\",\"integrityImpact\":\"COMPLETE\",\"availabilityImpact\":\"COMPLETE\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":3.9,\"impactScore\":10.0,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-119\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"2.4.0\",\"matchCriteriaId\":\"AD6602DD-7B3E-4AD9-940C-D960B77C41C2\"}]}]}],\"references\":[{\"url\":\"http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=7aa2bcad0ca837dd6d4bf4fa38a80314b4a6b755\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169036.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169039.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://lists.fedoraproject.org/pipermail/package-announce/2015-September/167369.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00019.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2015-1896.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2015-1923.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2015-1924.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2015-1925.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.debian.org/security/2015/dsa-3361\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.debian.org/security/2015/dsa-3362\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.openwall.com/lists/oss-security/2015/09/15/3\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.securityfocus.com/bid/76746\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.securitytracker.com/id/1033569\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://lists.gnu.org/archive/html/qemu-devel/2015-09/msg03984.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://security.gentoo.org/glsa/201602-01\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://www.arista.com/en/support/advisories-notices/security-advisories/1188-security-advisory-14\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=7aa2bcad0ca837dd6d4bf4fa38a80314b4a6b755\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169036.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169039.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://lists.fedoraproject.org/pipermail/package-announce/2015-September/167369.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00019.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2015-1896.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2015-1923.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2015-1924.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2015-1925.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.debian.org/security/2015/dsa-3361\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.debian.org/security/2015/dsa-3362\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.openwall.com/lists/oss-security/2015/09/15/3\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securityfocus.com/bid/76746\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securitytracker.com/id/1033569\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.gnu.org/archive/html/qemu-devel/2015-09/msg03984.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://security.gentoo.org/glsa/201602-01\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://www.arista.com/en/support/advisories-notices/security-advisories/1188-security-advisory-14\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
}
}
gsd-2015-5279
Vulnerability from gsd
Modified
2023-12-13 01:20
Details
Heap-based buffer overflow in the ne2000_receive function in hw/net/ne2000.c in QEMU before 2.4.0.1 allows guest OS users to cause a denial of service (instance crash) or possibly execute arbitrary code via vectors related to receiving packets.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2015-5279",
"description": "Heap-based buffer overflow in the ne2000_receive function in hw/net/ne2000.c in QEMU before 2.4.0.1 allows guest OS users to cause a denial of service (instance crash) or possibly execute arbitrary code via vectors related to receiving packets.",
"id": "GSD-2015-5279",
"references": [
"https://www.suse.com/security/cve/CVE-2015-5279.html",
"https://www.debian.org/security/2015/dsa-3361",
"https://www.debian.org/security/2015/dsa-3362",
"https://access.redhat.com/errata/RHSA-2015:2065",
"https://access.redhat.com/errata/RHSA-2015:1925",
"https://access.redhat.com/errata/RHSA-2015:1924",
"https://access.redhat.com/errata/RHSA-2015:1923",
"https://access.redhat.com/errata/RHSA-2015:1896",
"https://ubuntu.com/security/CVE-2015-5279",
"https://advisories.mageia.org/CVE-2015-5279.html",
"https://linux.oracle.com/cve/CVE-2015-5279.html"
]
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2015-5279"
],
"details": "Heap-based buffer overflow in the ne2000_receive function in hw/net/ne2000.c in QEMU before 2.4.0.1 allows guest OS users to cause a denial of service (instance crash) or possibly execute arbitrary code via vectors related to receiving packets.",
"id": "GSD-2015-5279",
"modified": "2023-12-13T01:20:06.729842Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2015-5279",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Heap-based buffer overflow in the ne2000_receive function in hw/net/ne2000.c in QEMU before 2.4.0.1 allows guest OS users to cause a denial of service (instance crash) or possibly execute arbitrary code via vectors related to receiving packets."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html",
"refsource": "MISC",
"url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html"
},
{
"name": "https://security.gentoo.org/glsa/201602-01",
"refsource": "MISC",
"url": "https://security.gentoo.org/glsa/201602-01"
},
{
"name": "http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00019.html",
"refsource": "MISC",
"url": "http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00019.html"
},
{
"name": "http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169039.html",
"refsource": "MISC",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169039.html"
},
{
"name": "https://www.arista.com/en/support/advisories-notices/security-advisories/1188-security-advisory-14",
"refsource": "MISC",
"url": "https://www.arista.com/en/support/advisories-notices/security-advisories/1188-security-advisory-14"
},
{
"name": "http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=7aa2bcad0ca837dd6d4bf4fa38a80314b4a6b755",
"refsource": "MISC",
"url": "http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=7aa2bcad0ca837dd6d4bf4fa38a80314b4a6b755"
},
{
"name": "http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169036.html",
"refsource": "MISC",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169036.html"
},
{
"name": "http://lists.fedoraproject.org/pipermail/package-announce/2015-September/167369.html",
"refsource": "MISC",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-September/167369.html"
},
{
"name": "http://rhn.redhat.com/errata/RHSA-2015-1896.html",
"refsource": "MISC",
"url": "http://rhn.redhat.com/errata/RHSA-2015-1896.html"
},
{
"name": "http://rhn.redhat.com/errata/RHSA-2015-1923.html",
"refsource": "MISC",
"url": "http://rhn.redhat.com/errata/RHSA-2015-1923.html"
},
{
"name": "http://rhn.redhat.com/errata/RHSA-2015-1924.html",
"refsource": "MISC",
"url": "http://rhn.redhat.com/errata/RHSA-2015-1924.html"
},
{
"name": "http://rhn.redhat.com/errata/RHSA-2015-1925.html",
"refsource": "MISC",
"url": "http://rhn.redhat.com/errata/RHSA-2015-1925.html"
},
{
"name": "http://www.debian.org/security/2015/dsa-3361",
"refsource": "MISC",
"url": "http://www.debian.org/security/2015/dsa-3361"
},
{
"name": "http://www.debian.org/security/2015/dsa-3362",
"refsource": "MISC",
"url": "http://www.debian.org/security/2015/dsa-3362"
},
{
"name": "http://www.openwall.com/lists/oss-security/2015/09/15/3",
"refsource": "MISC",
"url": "http://www.openwall.com/lists/oss-security/2015/09/15/3"
},
{
"name": "http://www.securityfocus.com/bid/76746",
"refsource": "MISC",
"url": "http://www.securityfocus.com/bid/76746"
},
{
"name": "http://www.securitytracker.com/id/1033569",
"refsource": "MISC",
"url": "http://www.securitytracker.com/id/1033569"
},
{
"name": "https://lists.gnu.org/archive/html/qemu-devel/2015-09/msg03984.html",
"refsource": "MISC",
"url": "https://lists.gnu.org/archive/html/qemu-devel/2015-09/msg03984.html"
}
]
}
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "2.4.0",
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2015-5279"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "Heap-based buffer overflow in the ne2000_receive function in hw/net/ne2000.c in QEMU before 2.4.0.1 allows guest OS users to cause a denial of service (instance crash) or possibly execute arbitrary code via vectors related to receiving packets."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-119"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "1033569",
"refsource": "SECTRACK",
"tags": [],
"url": "http://www.securitytracker.com/id/1033569"
},
{
"name": "[oss-security] 20150915 CVE-2015-5279 Qemu: net: add checks to validate ring buffer pointers",
"refsource": "MLIST",
"tags": [],
"url": "http://www.openwall.com/lists/oss-security/2015/09/15/3"
},
{
"name": "[Qemu-devel] 20150915 [PULL 2/3] net: add checks to validate ring buffer pointers",
"refsource": "MLIST",
"tags": [],
"url": "https://lists.gnu.org/archive/html/qemu-devel/2015-09/msg03984.html"
},
{
"name": "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html",
"refsource": "CONFIRM",
"tags": [],
"url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html"
},
{
"name": "76746",
"refsource": "BID",
"tags": [],
"url": "http://www.securityfocus.com/bid/76746"
},
{
"name": "RHSA-2015:1896",
"refsource": "REDHAT",
"tags": [],
"url": "http://rhn.redhat.com/errata/RHSA-2015-1896.html"
},
{
"name": "RHSA-2015:1925",
"refsource": "REDHAT",
"tags": [],
"url": "http://rhn.redhat.com/errata/RHSA-2015-1925.html"
},
{
"name": "RHSA-2015:1924",
"refsource": "REDHAT",
"tags": [],
"url": "http://rhn.redhat.com/errata/RHSA-2015-1924.html"
},
{
"name": "RHSA-2015:1923",
"refsource": "REDHAT",
"tags": [],
"url": "http://rhn.redhat.com/errata/RHSA-2015-1923.html"
},
{
"name": "GLSA-201602-01",
"refsource": "GENTOO",
"tags": [],
"url": "https://security.gentoo.org/glsa/201602-01"
},
{
"name": "DSA-3362",
"refsource": "DEBIAN",
"tags": [],
"url": "http://www.debian.org/security/2015/dsa-3362"
},
{
"name": "DSA-3361",
"refsource": "DEBIAN",
"tags": [],
"url": "http://www.debian.org/security/2015/dsa-3361"
},
{
"name": "SUSE-SU-2015:1782",
"refsource": "SUSE",
"tags": [],
"url": "http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00019.html"
},
{
"name": "FEDORA-2015-16370",
"refsource": "FEDORA",
"tags": [],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-September/167369.html"
},
{
"name": "FEDORA-2015-16368",
"refsource": "FEDORA",
"tags": [],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169039.html"
},
{
"name": "FEDORA-2015-16369",
"refsource": "FEDORA",
"tags": [],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169036.html"
},
{
"name": "https://www.arista.com/en/support/advisories-notices/security-advisories/1188-security-advisory-14",
"refsource": "MISC",
"tags": [],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisories/1188-security-advisory-14"
},
{
"name": "http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=7aa2bcad0ca837dd6d4bf4fa38a80314b4a6b755",
"refsource": "MISC",
"tags": [],
"url": "http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=7aa2bcad0ca837dd6d4bf4fa38a80314b4a6b755"
}
]
}
},
"impact": {
"baseMetricV2": {
"acInsufInfo": false,
"cvssV2": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 7.2,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"userInteractionRequired": false
}
},
"lastModifiedDate": "2023-02-13T00:52Z",
"publishedDate": "2015-09-28T16:59Z"
}
}
}
suse-su-2016:1698-1
Vulnerability from csaf_suse
Published
2016-06-28 14:31
Modified
2016-06-28 14:31
Summary
Security update for kvm
Notes
Title of the patch
Security update for kvm
Description of the patch
kvm was updated to fix 33 security issues.
These security issues were fixed:
- CVE-2016-4439: Avoid OOB access in 53C9X emulation (bsc#980711)
- CVE-2016-4441: Avoid OOB access in 53C9X emulation (bsc#980723)
- CVE-2016-3710: Fixed VGA emulation based OOB access with potential for guest escape (bsc#978158)
- CVE-2016-3712: Fixed VGa emulation based DOS and OOB read access exploit (bsc#978160)
- CVE-2016-4037: Fixed USB ehci based DOS (bsc#976109)
- CVE-2016-2538: Fixed potential OOB access in USB net device emulation (bsc#967969)
- CVE-2016-2841: Fixed OOB access / hang in ne2000 emulation (bsc#969350)
- CVE-2016-2858: Avoid potential DOS when using QEMU pseudo random number generator (bsc#970036)
- CVE-2016-2857: Fixed OOB access when processing IP checksums (bsc#970037)
- CVE-2016-4001: Fixed OOB access in Stellaris enet emulated nic (bsc#975128)
- CVE-2016-4002: Fixed OOB access in MIPSnet emulated controller (bsc#975136)
- CVE-2016-4020: Fixed possible host data leakage to guest from TPR access (bsc#975700)
- CVE-2015-3214: Fixed OOB read in i8254 PIC (bsc#934069)
- CVE-2014-9718: Fixed the handling of malformed or short ide PRDTs to avoid any opportunity for guest to cause DoS by abusing that interface (bsc#928393)
- CVE-2014-3689: Fixed insufficient parameter validation in rectangle functions (bsc#901508)
- CVE-2014-3615: The VGA emulator in QEMU allowed local guest users to read host memory by setting the display to a high resolution (bsc#895528).
- CVE-2015-5239: Integer overflow in vnc_client_read() and protocol_client_msg() (bsc#944463).
- CVE-2015-5278: Infinite loop in ne2000_receive() function (bsc#945989).
- CVE-2015-5279: Heap-based buffer overflow in the ne2000_receive function in hw/net/ne2000.c in QEMU allowed guest OS users to cause a denial of service (instance crash) or possibly execute arbitrary code via vectors related to receiving packets (bsc#945987).
- CVE-2015-5745: Buffer overflow in virtio-serial (bsc#940929).
- CVE-2015-6855: hw/ide/core.c in QEMU did not properly restrict the commands accepted by an ATAPI device, which allowed guest users to cause a denial of service or possibly have unspecified other impact via certain IDE commands, as demonstrated by a WIN_READ_NATIVE_MAX command to an empty drive, which triggers a divide-by-zero error and instance crash (bsc#945404).
- CVE-2015-7295: hw/virtio/virtio.c in the Virtual Network Device (virtio-net) support in QEMU, when big or mergeable receive buffers are not supported, allowed remote attackers to cause a denial of service (guest network consumption) via a flood of jumbo frames on the (1) tuntap or (2) macvtap interface (bsc#947159).
- CVE-2015-7549: PCI null pointer dereferences (bsc#958917).
- CVE-2015-8504: VNC floating point exception (bsc#958491).
- CVE-2015-8558: Infinite loop in ehci_advance_state resulting in DoS (bsc#959005).
- CVE-2015-8613: Wrong sized memset in megasas command handler (bsc#961358).
- CVE-2015-8619: Potential DoS for long HMP sendkey command argument (bsc#960334).
- CVE-2015-8743: OOB memory access in ne2000 ioport r/w functions (bsc#960725).
- CVE-2016-1568: AHCI use-after-free in aio port commands (bsc#961332).
- CVE-2016-1714: Potential OOB memory access in processing firmware configuration (bsc#961691).
- CVE-2016-1922: NULL pointer dereference when processing hmp i/o command (bsc#962320).
- CVE-2016-1981: Potential DoS (infinite loop) in e1000 device emulation by malicious privileged user within guest (bsc#963782).
- CVE-2016-2198: Malicious privileged guest user were able to cause DoS by writing to read-only EHCI capabilities registers (bsc#964413).
This non-security issue was fixed:
- Fix case of IDE interface needing busy status set before flush (bsc#936132)
Patchnames
slessp3-kvm-12634
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for kvm",
"title": "Title of the patch"
},
{
"category": "description",
"text": "kvm was updated to fix 33 security issues.\n\nThese security issues were fixed:\n- CVE-2016-4439: Avoid OOB access in 53C9X emulation (bsc#980711)\n- CVE-2016-4441: Avoid OOB access in 53C9X emulation (bsc#980723)\n- CVE-2016-3710: Fixed VGA emulation based OOB access with potential for guest escape (bsc#978158)\n- CVE-2016-3712: Fixed VGa emulation based DOS and OOB read access exploit (bsc#978160)\n- CVE-2016-4037: Fixed USB ehci based DOS (bsc#976109) \n- CVE-2016-2538: Fixed potential OOB access in USB net device emulation (bsc#967969)\n- CVE-2016-2841: Fixed OOB access / hang in ne2000 emulation (bsc#969350)\n- CVE-2016-2858: Avoid potential DOS when using QEMU pseudo random number generator (bsc#970036)\n- CVE-2016-2857: Fixed OOB access when processing IP checksums (bsc#970037)\n- CVE-2016-4001: Fixed OOB access in Stellaris enet emulated nic (bsc#975128)\n- CVE-2016-4002: Fixed OOB access in MIPSnet emulated controller (bsc#975136)\n- CVE-2016-4020: Fixed possible host data leakage to guest from TPR access (bsc#975700)\n- CVE-2015-3214: Fixed OOB read in i8254 PIC (bsc#934069)\n- CVE-2014-9718: Fixed the handling of malformed or short ide PRDTs to avoid any opportunity for guest to cause DoS by abusing that interface (bsc#928393)\n- CVE-2014-3689: Fixed insufficient parameter validation in rectangle functions (bsc#901508)\n- CVE-2014-3615: The VGA emulator in QEMU allowed local guest users to read host memory by setting the display to a high resolution (bsc#895528).\n- CVE-2015-5239: Integer overflow in vnc_client_read() and protocol_client_msg() (bsc#944463).\n- CVE-2015-5278: Infinite loop in ne2000_receive() function (bsc#945989).\n- CVE-2015-5279: Heap-based buffer overflow in the ne2000_receive function in hw/net/ne2000.c in QEMU allowed guest OS users to cause a denial of service (instance crash) or possibly execute arbitrary code via vectors related to receiving packets (bsc#945987).\n- CVE-2015-5745: Buffer overflow in virtio-serial (bsc#940929).\n- CVE-2015-6855: hw/ide/core.c in QEMU did not properly restrict the commands accepted by an ATAPI device, which allowed guest users to cause a denial of service or possibly have unspecified other impact via certain IDE commands, as demonstrated by a WIN_READ_NATIVE_MAX command to an empty drive, which triggers a divide-by-zero error and instance crash (bsc#945404).\n- CVE-2015-7295: hw/virtio/virtio.c in the Virtual Network Device (virtio-net) support in QEMU, when big or mergeable receive buffers are not supported, allowed remote attackers to cause a denial of service (guest network consumption) via a flood of jumbo frames on the (1) tuntap or (2) macvtap interface (bsc#947159).\n- CVE-2015-7549: PCI null pointer dereferences (bsc#958917).\n- CVE-2015-8504: VNC floating point exception (bsc#958491).\n- CVE-2015-8558: Infinite loop in ehci_advance_state resulting in DoS (bsc#959005).\n- CVE-2015-8613: Wrong sized memset in megasas command handler (bsc#961358).\n- CVE-2015-8619: Potential DoS for long HMP sendkey command argument (bsc#960334).\n- CVE-2015-8743: OOB memory access in ne2000 ioport r/w functions (bsc#960725).\n- CVE-2016-1568: AHCI use-after-free in aio port commands (bsc#961332).\n- CVE-2016-1714: Potential OOB memory access in processing firmware configuration (bsc#961691).\n- CVE-2016-1922: NULL pointer dereference when processing hmp i/o command (bsc#962320).\n- CVE-2016-1981: Potential DoS (infinite loop) in e1000 device emulation by malicious privileged user within guest (bsc#963782).\n- CVE-2016-2198: Malicious privileged guest user were able to cause DoS by writing to read-only EHCI capabilities registers (bsc#964413).\n\nThis non-security issue was fixed:\n- Fix case of IDE interface needing busy status set before flush (bsc#936132)\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "slessp3-kvm-12634",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2016_1698-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2016:1698-1",
"url": "https://www.suse.com/support/update/announcement/2016/suse-su-20161698-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2016:1698-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2016-June/002140.html"
},
{
"category": "self",
"summary": "SUSE Bug 895528",
"url": "https://bugzilla.suse.com/895528"
},
{
"category": "self",
"summary": "SUSE Bug 901508",
"url": "https://bugzilla.suse.com/901508"
},
{
"category": "self",
"summary": "SUSE Bug 928393",
"url": "https://bugzilla.suse.com/928393"
},
{
"category": "self",
"summary": "SUSE Bug 934069",
"url": "https://bugzilla.suse.com/934069"
},
{
"category": "self",
"summary": "SUSE Bug 936132",
"url": "https://bugzilla.suse.com/936132"
},
{
"category": "self",
"summary": "SUSE Bug 940929",
"url": "https://bugzilla.suse.com/940929"
},
{
"category": "self",
"summary": "SUSE Bug 944463",
"url": "https://bugzilla.suse.com/944463"
},
{
"category": "self",
"summary": "SUSE Bug 945404",
"url": "https://bugzilla.suse.com/945404"
},
{
"category": "self",
"summary": "SUSE Bug 945987",
"url": "https://bugzilla.suse.com/945987"
},
{
"category": "self",
"summary": "SUSE Bug 945989",
"url": "https://bugzilla.suse.com/945989"
},
{
"category": "self",
"summary": "SUSE Bug 947159",
"url": "https://bugzilla.suse.com/947159"
},
{
"category": "self",
"summary": "SUSE Bug 958491",
"url": "https://bugzilla.suse.com/958491"
},
{
"category": "self",
"summary": "SUSE Bug 958917",
"url": "https://bugzilla.suse.com/958917"
},
{
"category": "self",
"summary": "SUSE Bug 959005",
"url": "https://bugzilla.suse.com/959005"
},
{
"category": "self",
"summary": "SUSE Bug 960334",
"url": "https://bugzilla.suse.com/960334"
},
{
"category": "self",
"summary": "SUSE Bug 960725",
"url": "https://bugzilla.suse.com/960725"
},
{
"category": "self",
"summary": "SUSE Bug 961332",
"url": "https://bugzilla.suse.com/961332"
},
{
"category": "self",
"summary": "SUSE Bug 961333",
"url": "https://bugzilla.suse.com/961333"
},
{
"category": "self",
"summary": "SUSE Bug 961358",
"url": "https://bugzilla.suse.com/961358"
},
{
"category": "self",
"summary": "SUSE Bug 961556",
"url": "https://bugzilla.suse.com/961556"
},
{
"category": "self",
"summary": "SUSE Bug 961691",
"url": "https://bugzilla.suse.com/961691"
},
{
"category": "self",
"summary": "SUSE Bug 962320",
"url": "https://bugzilla.suse.com/962320"
},
{
"category": "self",
"summary": "SUSE Bug 963782",
"url": "https://bugzilla.suse.com/963782"
},
{
"category": "self",
"summary": "SUSE Bug 964413",
"url": "https://bugzilla.suse.com/964413"
},
{
"category": "self",
"summary": "SUSE Bug 967969",
"url": "https://bugzilla.suse.com/967969"
},
{
"category": "self",
"summary": "SUSE Bug 969350",
"url": "https://bugzilla.suse.com/969350"
},
{
"category": "self",
"summary": "SUSE Bug 970036",
"url": "https://bugzilla.suse.com/970036"
},
{
"category": "self",
"summary": "SUSE Bug 970037",
"url": "https://bugzilla.suse.com/970037"
},
{
"category": "self",
"summary": "SUSE Bug 975128",
"url": "https://bugzilla.suse.com/975128"
},
{
"category": "self",
"summary": "SUSE Bug 975136",
"url": "https://bugzilla.suse.com/975136"
},
{
"category": "self",
"summary": "SUSE Bug 975700",
"url": "https://bugzilla.suse.com/975700"
},
{
"category": "self",
"summary": "SUSE Bug 976109",
"url": "https://bugzilla.suse.com/976109"
},
{
"category": "self",
"summary": "SUSE Bug 978158",
"url": "https://bugzilla.suse.com/978158"
},
{
"category": "self",
"summary": "SUSE Bug 978160",
"url": "https://bugzilla.suse.com/978160"
},
{
"category": "self",
"summary": "SUSE Bug 980711",
"url": "https://bugzilla.suse.com/980711"
},
{
"category": "self",
"summary": "SUSE Bug 980723",
"url": "https://bugzilla.suse.com/980723"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2014-3615 page",
"url": "https://www.suse.com/security/cve/CVE-2014-3615/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2014-3689 page",
"url": "https://www.suse.com/security/cve/CVE-2014-3689/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2014-9718 page",
"url": "https://www.suse.com/security/cve/CVE-2014-9718/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-3214 page",
"url": "https://www.suse.com/security/cve/CVE-2015-3214/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-5239 page",
"url": "https://www.suse.com/security/cve/CVE-2015-5239/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-5278 page",
"url": "https://www.suse.com/security/cve/CVE-2015-5278/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-5279 page",
"url": "https://www.suse.com/security/cve/CVE-2015-5279/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-5745 page",
"url": "https://www.suse.com/security/cve/CVE-2015-5745/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-6855 page",
"url": "https://www.suse.com/security/cve/CVE-2015-6855/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-7295 page",
"url": "https://www.suse.com/security/cve/CVE-2015-7295/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-7549 page",
"url": "https://www.suse.com/security/cve/CVE-2015-7549/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-8504 page",
"url": "https://www.suse.com/security/cve/CVE-2015-8504/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-8558 page",
"url": "https://www.suse.com/security/cve/CVE-2015-8558/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-8613 page",
"url": "https://www.suse.com/security/cve/CVE-2015-8613/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-8619 page",
"url": "https://www.suse.com/security/cve/CVE-2015-8619/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-8743 page",
"url": "https://www.suse.com/security/cve/CVE-2015-8743/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-1568 page",
"url": "https://www.suse.com/security/cve/CVE-2016-1568/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-1714 page",
"url": "https://www.suse.com/security/cve/CVE-2016-1714/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-1922 page",
"url": "https://www.suse.com/security/cve/CVE-2016-1922/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-1981 page",
"url": "https://www.suse.com/security/cve/CVE-2016-1981/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-2198 page",
"url": "https://www.suse.com/security/cve/CVE-2016-2198/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-2538 page",
"url": "https://www.suse.com/security/cve/CVE-2016-2538/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-2841 page",
"url": "https://www.suse.com/security/cve/CVE-2016-2841/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-2857 page",
"url": "https://www.suse.com/security/cve/CVE-2016-2857/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-2858 page",
"url": "https://www.suse.com/security/cve/CVE-2016-2858/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-3710 page",
"url": "https://www.suse.com/security/cve/CVE-2016-3710/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-3712 page",
"url": "https://www.suse.com/security/cve/CVE-2016-3712/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-4001 page",
"url": "https://www.suse.com/security/cve/CVE-2016-4001/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-4002 page",
"url": "https://www.suse.com/security/cve/CVE-2016-4002/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-4020 page",
"url": "https://www.suse.com/security/cve/CVE-2016-4020/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-4037 page",
"url": "https://www.suse.com/security/cve/CVE-2016-4037/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-4439 page",
"url": "https://www.suse.com/security/cve/CVE-2016-4439/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-4441 page",
"url": "https://www.suse.com/security/cve/CVE-2016-4441/"
}
],
"title": "Security update for kvm",
"tracking": {
"current_release_date": "2016-06-28T14:31:01Z",
"generator": {
"date": "2016-06-28T14:31:01Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2016:1698-1",
"initial_release_date": "2016-06-28T14:31:01Z",
"revision_history": [
{
"date": "2016-06-28T14:31:01Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "kvm-1.4.2-46.1.i586",
"product": {
"name": "kvm-1.4.2-46.1.i586",
"product_id": "kvm-1.4.2-46.1.i586"
}
}
],
"category": "architecture",
"name": "i586"
},
{
"branches": [
{
"category": "product_version",
"name": "kvm-1.4.2-46.1.s390x",
"product": {
"name": "kvm-1.4.2-46.1.s390x",
"product_id": "kvm-1.4.2-46.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "kvm-1.4.2-46.1.x86_64",
"product": {
"name": "kvm-1.4.2-46.1.x86_64",
"product_id": "kvm-1.4.2-46.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 11 SP3-LTSS",
"product": {
"name": "SUSE Linux Enterprise Server 11 SP3-LTSS",
"product_id": "SUSE Linux Enterprise Server 11 SP3-LTSS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:suse_sles_ltss:11:sp3"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 11 SP3-TERADATA",
"product": {
"name": "SUSE Linux Enterprise Server 11 SP3-TERADATA",
"product_id": "SUSE Linux Enterprise Server 11 SP3-TERADATA",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:11:sp3:teradata"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "kvm-1.4.2-46.1.i586 as component of SUSE Linux Enterprise Server 11 SP3-LTSS",
"product_id": "SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586"
},
"product_reference": "kvm-1.4.2-46.1.i586",
"relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP3-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kvm-1.4.2-46.1.s390x as component of SUSE Linux Enterprise Server 11 SP3-LTSS",
"product_id": "SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x"
},
"product_reference": "kvm-1.4.2-46.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP3-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kvm-1.4.2-46.1.x86_64 as component of SUSE Linux Enterprise Server 11 SP3-LTSS",
"product_id": "SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64"
},
"product_reference": "kvm-1.4.2-46.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP3-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kvm-1.4.2-46.1.i586 as component of SUSE Linux Enterprise Server 11 SP3-TERADATA",
"product_id": "SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586"
},
"product_reference": "kvm-1.4.2-46.1.i586",
"relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP3-TERADATA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kvm-1.4.2-46.1.s390x as component of SUSE Linux Enterprise Server 11 SP3-TERADATA",
"product_id": "SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x"
},
"product_reference": "kvm-1.4.2-46.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP3-TERADATA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kvm-1.4.2-46.1.x86_64 as component of SUSE Linux Enterprise Server 11 SP3-TERADATA",
"product_id": "SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
},
"product_reference": "kvm-1.4.2-46.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP3-TERADATA"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2014-3615",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2014-3615"
}
],
"notes": [
{
"category": "general",
"text": "The VGA emulator in QEMU allows local guest users to read host memory by setting the display to a high resolution.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2014-3615",
"url": "https://www.suse.com/security/cve/CVE-2014-3615"
},
{
"category": "external",
"summary": "SUSE Bug 895528 for CVE-2014-3615",
"url": "https://bugzilla.suse.com/895528"
},
{
"category": "external",
"summary": "SUSE Bug 918998 for CVE-2014-3615",
"url": "https://bugzilla.suse.com/918998"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-06-28T14:31:01Z",
"details": "moderate"
}
],
"title": "CVE-2014-3615"
},
{
"cve": "CVE-2014-3689",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2014-3689"
}
],
"notes": [
{
"category": "general",
"text": "The vmware-vga driver (hw/display/vmware_vga.c) in QEMU allows local guest users to write to qemu memory locations and gain privileges via unspecified parameters related to rectangle handling.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2014-3689",
"url": "https://www.suse.com/security/cve/CVE-2014-3689"
},
{
"category": "external",
"summary": "SUSE Bug 1072223 for CVE-2014-3689",
"url": "https://bugzilla.suse.com/1072223"
},
{
"category": "external",
"summary": "SUSE Bug 1189862 for CVE-2014-3689",
"url": "https://bugzilla.suse.com/1189862"
},
{
"category": "external",
"summary": "SUSE Bug 901508 for CVE-2014-3689",
"url": "https://bugzilla.suse.com/901508"
},
{
"category": "external",
"summary": "SUSE Bug 962611 for CVE-2014-3689",
"url": "https://bugzilla.suse.com/962611"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-06-28T14:31:01Z",
"details": "important"
}
],
"title": "CVE-2014-3689"
},
{
"cve": "CVE-2014-9718",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2014-9718"
}
],
"notes": [
{
"category": "general",
"text": "The (1) BMDMA and (2) AHCI HBA interfaces in the IDE functionality in QEMU 1.0 through 2.1.3 have multiple interpretations of a function\u0027s return value, which allows guest OS users to cause a host OS denial of service (memory consumption or infinite loop, and system crash) via a PRDT with zero complete sectors, related to the bmdma_prepare_buf and ahci_dma_prepare_buf functions.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2014-9718",
"url": "https://www.suse.com/security/cve/CVE-2014-9718"
},
{
"category": "external",
"summary": "SUSE Bug 928393 for CVE-2014-9718",
"url": "https://bugzilla.suse.com/928393"
},
{
"category": "external",
"summary": "SUSE Bug 964431 for CVE-2014-9718",
"url": "https://bugzilla.suse.com/964431"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-06-28T14:31:01Z",
"details": "moderate"
}
],
"title": "CVE-2014-9718"
},
{
"cve": "CVE-2015-3214",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-3214"
}
],
"notes": [
{
"category": "general",
"text": "The pit_ioport_read in i8254.c in the Linux kernel before 2.6.33 and QEMU before 2.3.1 does not distinguish between read lengths and write lengths, which might allow guest OS users to execute arbitrary code on the host OS by triggering use of an invalid index.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-3214",
"url": "https://www.suse.com/security/cve/CVE-2015-3214"
},
{
"category": "external",
"summary": "SUSE Bug 934069 for CVE-2015-3214",
"url": "https://bugzilla.suse.com/934069"
},
{
"category": "external",
"summary": "SUSE Bug 936025 for CVE-2015-3214",
"url": "https://bugzilla.suse.com/936025"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-06-28T14:31:01Z",
"details": "moderate"
}
],
"title": "CVE-2015-3214"
},
{
"cve": "CVE-2015-5239",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-5239"
}
],
"notes": [
{
"category": "general",
"text": "Integer overflow in the VNC display driver in QEMU before 2.1.0 allows attachers to cause a denial of service (process crash) via a CLIENT_CUT_TEXT message, which triggers an infinite loop.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-5239",
"url": "https://www.suse.com/security/cve/CVE-2015-5239"
},
{
"category": "external",
"summary": "SUSE Bug 944463 for CVE-2015-5239",
"url": "https://bugzilla.suse.com/944463"
},
{
"category": "external",
"summary": "SUSE Bug 950367 for CVE-2015-5239",
"url": "https://bugzilla.suse.com/950367"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-06-28T14:31:01Z",
"details": "moderate"
}
],
"title": "CVE-2015-5239"
},
{
"cve": "CVE-2015-5278",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-5278"
}
],
"notes": [
{
"category": "general",
"text": "The ne2000_receive function in hw/net/ne2000.c in QEMU before 2.4.0.1 allows attackers to cause a denial of service (infinite loop and instance crash) or possibly execute arbitrary code via vectors related to receiving packets.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-5278",
"url": "https://www.suse.com/security/cve/CVE-2015-5278"
},
{
"category": "external",
"summary": "SUSE Bug 945989 for CVE-2015-5278",
"url": "https://bugzilla.suse.com/945989"
},
{
"category": "external",
"summary": "SUSE Bug 964947 for CVE-2015-5278",
"url": "https://bugzilla.suse.com/964947"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-06-28T14:31:01Z",
"details": "moderate"
}
],
"title": "CVE-2015-5278"
},
{
"cve": "CVE-2015-5279",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-5279"
}
],
"notes": [
{
"category": "general",
"text": "Heap-based buffer overflow in the ne2000_receive function in hw/net/ne2000.c in QEMU before 2.4.0.1 allows guest OS users to cause a denial of service (instance crash) or possibly execute arbitrary code via vectors related to receiving packets.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-5279",
"url": "https://www.suse.com/security/cve/CVE-2015-5279"
},
{
"category": "external",
"summary": "SUSE Bug 945987 for CVE-2015-5279",
"url": "https://bugzilla.suse.com/945987"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-06-28T14:31:01Z",
"details": "important"
}
],
"title": "CVE-2015-5279"
},
{
"cve": "CVE-2015-5745",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-5745"
}
],
"notes": [
{
"category": "general",
"text": "Buffer overflow in the send_control_msg function in hw/char/virtio-serial-bus.c in QEMU before 2.4.0 allows guest users to cause a denial of service (QEMU process crash) via a crafted virtio control message.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-5745",
"url": "https://www.suse.com/security/cve/CVE-2015-5745"
},
{
"category": "external",
"summary": "SUSE Bug 940929 for CVE-2015-5745",
"url": "https://bugzilla.suse.com/940929"
},
{
"category": "external",
"summary": "SUSE Bug 950367 for CVE-2015-5745",
"url": "https://bugzilla.suse.com/950367"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-06-28T14:31:01Z",
"details": "low"
}
],
"title": "CVE-2015-5745"
},
{
"cve": "CVE-2015-6855",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-6855"
}
],
"notes": [
{
"category": "general",
"text": "hw/ide/core.c in QEMU does not properly restrict the commands accepted by an ATAPI device, which allows guest users to cause a denial of service or possibly have unspecified other impact via certain IDE commands, as demonstrated by a WIN_READ_NATIVE_MAX command to an empty drive, which triggers a divide-by-zero error and instance crash.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-6855",
"url": "https://www.suse.com/security/cve/CVE-2015-6855"
},
{
"category": "external",
"summary": "SUSE Bug 945404 for CVE-2015-6855",
"url": "https://bugzilla.suse.com/945404"
},
{
"category": "external",
"summary": "SUSE Bug 965156 for CVE-2015-6855",
"url": "https://bugzilla.suse.com/965156"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-06-28T14:31:01Z",
"details": "important"
}
],
"title": "CVE-2015-6855"
},
{
"cve": "CVE-2015-7295",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-7295"
}
],
"notes": [
{
"category": "general",
"text": "hw/virtio/virtio.c in the Virtual Network Device (virtio-net) support in QEMU, when big or mergeable receive buffers are not supported, allows remote attackers to cause a denial of service (guest network consumption) via a flood of jumbo frames on the (1) tuntap or (2) macvtap interface.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-7295",
"url": "https://www.suse.com/security/cve/CVE-2015-7295"
},
{
"category": "external",
"summary": "SUSE Bug 947159 for CVE-2015-7295",
"url": "https://bugzilla.suse.com/947159"
},
{
"category": "external",
"summary": "SUSE Bug 950367 for CVE-2015-7295",
"url": "https://bugzilla.suse.com/950367"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-06-28T14:31:01Z",
"details": "moderate"
}
],
"title": "CVE-2015-7295"
},
{
"cve": "CVE-2015-7549",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-7549"
}
],
"notes": [
{
"category": "general",
"text": "The MSI-X MMIO support in hw/pci/msix.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (NULL pointer dereference and QEMU process crash) by leveraging failure to define the .write method.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-7549",
"url": "https://www.suse.com/security/cve/CVE-2015-7549"
},
{
"category": "external",
"summary": "SUSE Bug 958917 for CVE-2015-7549",
"url": "https://bugzilla.suse.com/958917"
},
{
"category": "external",
"summary": "SUSE Bug 958918 for CVE-2015-7549",
"url": "https://bugzilla.suse.com/958918"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-06-28T14:31:01Z",
"details": "low"
}
],
"title": "CVE-2015-7549"
},
{
"cve": "CVE-2015-8504",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-8504"
}
],
"notes": [
{
"category": "general",
"text": "Qemu, when built with VNC display driver support, allows remote attackers to cause a denial of service (arithmetic exception and application crash) via crafted SetPixelFormat messages from a client.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-8504",
"url": "https://www.suse.com/security/cve/CVE-2015-8504"
},
{
"category": "external",
"summary": "SUSE Bug 958491 for CVE-2015-8504",
"url": "https://bugzilla.suse.com/958491"
},
{
"category": "external",
"summary": "SUSE Bug 958493 for CVE-2015-8504",
"url": "https://bugzilla.suse.com/958493"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-06-28T14:31:01Z",
"details": "moderate"
}
],
"title": "CVE-2015-8504"
},
{
"cve": "CVE-2015-8558",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-8558"
}
],
"notes": [
{
"category": "general",
"text": "The ehci_process_itd function in hw/usb/hcd-ehci.c in QEMU allows local guest OS administrators to cause a denial of service (infinite loop and CPU consumption) via a circular isochronous transfer descriptor (iTD) list.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-8558",
"url": "https://www.suse.com/security/cve/CVE-2015-8558"
},
{
"category": "external",
"summary": "SUSE Bug 959005 for CVE-2015-8558",
"url": "https://bugzilla.suse.com/959005"
},
{
"category": "external",
"summary": "SUSE Bug 959006 for CVE-2015-8558",
"url": "https://bugzilla.suse.com/959006"
},
{
"category": "external",
"summary": "SUSE Bug 976109 for CVE-2015-8558",
"url": "https://bugzilla.suse.com/976109"
},
{
"category": "external",
"summary": "SUSE Bug 976111 for CVE-2015-8558",
"url": "https://bugzilla.suse.com/976111"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-06-28T14:31:01Z",
"details": "moderate"
}
],
"title": "CVE-2015-8558"
},
{
"cve": "CVE-2015-8613",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-8613"
}
],
"notes": [
{
"category": "general",
"text": "Stack-based buffer overflow in the megasas_ctrl_get_info function in QEMU, when built with SCSI MegaRAID SAS HBA emulation support, allows local guest users to cause a denial of service (QEMU instance crash) via a crafted SCSI controller CTRL_GET_INFO command.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-8613",
"url": "https://www.suse.com/security/cve/CVE-2015-8613"
},
{
"category": "external",
"summary": "SUSE Bug 961358 for CVE-2015-8613",
"url": "https://bugzilla.suse.com/961358"
},
{
"category": "external",
"summary": "SUSE Bug 961556 for CVE-2015-8613",
"url": "https://bugzilla.suse.com/961556"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-06-28T14:31:01Z",
"details": "moderate"
}
],
"title": "CVE-2015-8613"
},
{
"cve": "CVE-2015-8619",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-8619"
}
],
"notes": [
{
"category": "general",
"text": "The Human Monitor Interface support in QEMU allows remote attackers to cause a denial of service (out-of-bounds write and application crash).",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-8619",
"url": "https://www.suse.com/security/cve/CVE-2015-8619"
},
{
"category": "external",
"summary": "SUSE Bug 960334 for CVE-2015-8619",
"url": "https://bugzilla.suse.com/960334"
},
{
"category": "external",
"summary": "SUSE Bug 965269 for CVE-2015-8619",
"url": "https://bugzilla.suse.com/965269"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-06-28T14:31:01Z",
"details": "important"
}
],
"title": "CVE-2015-8619"
},
{
"cve": "CVE-2015-8743",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-8743"
}
],
"notes": [
{
"category": "general",
"text": "QEMU (aka Quick Emulator) built with the NE2000 device emulation support is vulnerable to an OOB r/w access issue. It could occur while performing \u0027ioport\u0027 r/w operations. A privileged (CAP_SYS_RAWIO) user/process could use this flaw to leak or corrupt QEMU memory bytes.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-8743",
"url": "https://www.suse.com/security/cve/CVE-2015-8743"
},
{
"category": "external",
"summary": "SUSE Bug 960725 for CVE-2015-8743",
"url": "https://bugzilla.suse.com/960725"
},
{
"category": "external",
"summary": "SUSE Bug 960726 for CVE-2015-8743",
"url": "https://bugzilla.suse.com/960726"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-06-28T14:31:01Z",
"details": "moderate"
}
],
"title": "CVE-2015-8743"
},
{
"cve": "CVE-2016-1568",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-1568"
}
],
"notes": [
{
"category": "general",
"text": "Use-after-free vulnerability in hw/ide/ahci.c in QEMU, when built with IDE AHCI Emulation support, allows guest OS users to cause a denial of service (instance crash) or possibly execute arbitrary code via an invalid AHCI Native Command Queuing (NCQ) AIO command.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-1568",
"url": "https://www.suse.com/security/cve/CVE-2016-1568"
},
{
"category": "external",
"summary": "SUSE Bug 961332 for CVE-2016-1568",
"url": "https://bugzilla.suse.com/961332"
},
{
"category": "external",
"summary": "SUSE Bug 961333 for CVE-2016-1568",
"url": "https://bugzilla.suse.com/961333"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-06-28T14:31:01Z",
"details": "moderate"
}
],
"title": "CVE-2016-1568"
},
{
"cve": "CVE-2016-1714",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-1714"
}
],
"notes": [
{
"category": "general",
"text": "The (1) fw_cfg_write and (2) fw_cfg_read functions in hw/nvram/fw_cfg.c in QEMU before 2.4, when built with the Firmware Configuration device emulation support, allow guest OS users with the CAP_SYS_RAWIO privilege to cause a denial of service (out-of-bounds read or write access and process crash) or possibly execute arbitrary code via an invalid current entry value in a firmware configuration.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-1714",
"url": "https://www.suse.com/security/cve/CVE-2016-1714"
},
{
"category": "external",
"summary": "SUSE Bug 961691 for CVE-2016-1714",
"url": "https://bugzilla.suse.com/961691"
},
{
"category": "external",
"summary": "SUSE Bug 961692 for CVE-2016-1714",
"url": "https://bugzilla.suse.com/961692"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-06-28T14:31:01Z",
"details": "moderate"
}
],
"title": "CVE-2016-1714"
},
{
"cve": "CVE-2016-1922",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-1922"
}
],
"notes": [
{
"category": "general",
"text": "QEMU (aka Quick Emulator) built with the TPR optimization for 32-bit Windows guests support is vulnerable to a null pointer dereference flaw. It occurs while doing I/O port write operations via hmp interface. In that, \u0027current_cpu\u0027 remains null, which leads to the null pointer dereference. A user or process could use this flaw to crash the QEMU instance, resulting in DoS issue.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-1922",
"url": "https://www.suse.com/security/cve/CVE-2016-1922"
},
{
"category": "external",
"summary": "SUSE Bug 962320 for CVE-2016-1922",
"url": "https://bugzilla.suse.com/962320"
},
{
"category": "external",
"summary": "SUSE Bug 962321 for CVE-2016-1922",
"url": "https://bugzilla.suse.com/962321"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-06-28T14:31:01Z",
"details": "low"
}
],
"title": "CVE-2016-1922"
},
{
"cve": "CVE-2016-1981",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-1981"
}
],
"notes": [
{
"category": "general",
"text": "QEMU (aka Quick Emulator) built with the e1000 NIC emulation support is vulnerable to an infinite loop issue. It could occur while processing data via transmit or receive descriptors, provided the initial receive/transmit descriptor head (TDH/RDH) is set outside the allocated descriptor buffer. A privileged user inside guest could use this flaw to crash the QEMU instance resulting in DoS.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-1981",
"url": "https://www.suse.com/security/cve/CVE-2016-1981"
},
{
"category": "external",
"summary": "SUSE Bug 963782 for CVE-2016-1981",
"url": "https://bugzilla.suse.com/963782"
},
{
"category": "external",
"summary": "SUSE Bug 963783 for CVE-2016-1981",
"url": "https://bugzilla.suse.com/963783"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-06-28T14:31:01Z",
"details": "low"
}
],
"title": "CVE-2016-1981"
},
{
"cve": "CVE-2016-2198",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-2198"
}
],
"notes": [
{
"category": "general",
"text": "QEMU (aka Quick Emulator) built with the USB EHCI emulation support is vulnerable to a null pointer dereference flaw. It could occur when an application attempts to write to EHCI capabilities registers. A privileged user inside quest could use this flaw to crash the QEMU process instance resulting in DoS.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-2198",
"url": "https://www.suse.com/security/cve/CVE-2016-2198"
},
{
"category": "external",
"summary": "SUSE Bug 964413 for CVE-2016-2198",
"url": "https://bugzilla.suse.com/964413"
},
{
"category": "external",
"summary": "SUSE Bug 964415 for CVE-2016-2198",
"url": "https://bugzilla.suse.com/964415"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-06-28T14:31:01Z",
"details": "low"
}
],
"title": "CVE-2016-2198"
},
{
"cve": "CVE-2016-2538",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-2538"
}
],
"notes": [
{
"category": "general",
"text": "Multiple integer overflows in the USB Net device emulator (hw/usb/dev-network.c) in QEMU before 2.5.1 allow local guest OS administrators to cause a denial of service (QEMU process crash) or obtain sensitive host memory information via a remote NDIS control message packet that is mishandled in the (1) rndis_query_response, (2) rndis_set_response, or (3) usb_net_handle_dataout function.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-2538",
"url": "https://www.suse.com/security/cve/CVE-2016-2538"
},
{
"category": "external",
"summary": "SUSE Bug 967969 for CVE-2016-2538",
"url": "https://bugzilla.suse.com/967969"
},
{
"category": "external",
"summary": "SUSE Bug 968004 for CVE-2016-2538",
"url": "https://bugzilla.suse.com/968004"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-06-28T14:31:01Z",
"details": "important"
}
],
"title": "CVE-2016-2538"
},
{
"cve": "CVE-2016-2841",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-2841"
}
],
"notes": [
{
"category": "general",
"text": "The ne2000_receive function in the NE2000 NIC emulation support (hw/net/ne2000.c) in QEMU before 2.5.1 allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via crafted values for the PSTART and PSTOP registers, involving ring buffer control.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-2841",
"url": "https://www.suse.com/security/cve/CVE-2016-2841"
},
{
"category": "external",
"summary": "SUSE Bug 969350 for CVE-2016-2841",
"url": "https://bugzilla.suse.com/969350"
},
{
"category": "external",
"summary": "SUSE Bug 969351 for CVE-2016-2841",
"url": "https://bugzilla.suse.com/969351"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-06-28T14:31:01Z",
"details": "low"
}
],
"title": "CVE-2016-2841"
},
{
"cve": "CVE-2016-2857",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-2857"
}
],
"notes": [
{
"category": "general",
"text": "The net_checksum_calculate function in net/checksum.c in QEMU allows local guest OS users to cause a denial of service (out-of-bounds heap read and crash) via the payload length in a crafted packet.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-2857",
"url": "https://www.suse.com/security/cve/CVE-2016-2857"
},
{
"category": "external",
"summary": "SUSE Bug 970037 for CVE-2016-2857",
"url": "https://bugzilla.suse.com/970037"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-06-28T14:31:01Z",
"details": "low"
}
],
"title": "CVE-2016-2857"
},
{
"cve": "CVE-2016-2858",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-2858"
}
],
"notes": [
{
"category": "general",
"text": "QEMU, when built with the Pseudo Random Number Generator (PRNG) back-end support, allows local guest OS users to cause a denial of service (process crash) via an entropy request, which triggers arbitrary stack based allocation and memory corruption.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-2858",
"url": "https://www.suse.com/security/cve/CVE-2016-2858"
},
{
"category": "external",
"summary": "SUSE Bug 970036 for CVE-2016-2858",
"url": "https://bugzilla.suse.com/970036"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-06-28T14:31:01Z",
"details": "low"
}
],
"title": "CVE-2016-2858"
},
{
"cve": "CVE-2016-3710",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-3710"
}
],
"notes": [
{
"category": "general",
"text": "The VGA module in QEMU improperly performs bounds checking on banked access to video memory, which allows local guest OS administrators to execute arbitrary code on the host by changing access modes after setting the bank register, aka the \"Dark Portal\" issue.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-3710",
"url": "https://www.suse.com/security/cve/CVE-2016-3710"
},
{
"category": "external",
"summary": "SUSE Bug 978158 for CVE-2016-3710",
"url": "https://bugzilla.suse.com/978158"
},
{
"category": "external",
"summary": "SUSE Bug 978164 for CVE-2016-3710",
"url": "https://bugzilla.suse.com/978164"
},
{
"category": "external",
"summary": "SUSE Bug 978167 for CVE-2016-3710",
"url": "https://bugzilla.suse.com/978167"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-06-28T14:31:01Z",
"details": "moderate"
}
],
"title": "CVE-2016-3710"
},
{
"cve": "CVE-2016-3712",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-3712"
}
],
"notes": [
{
"category": "general",
"text": "Integer overflow in the VGA module in QEMU allows local guest OS users to cause a denial of service (out-of-bounds read and QEMU process crash) by editing VGA registers in VBE mode.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-3712",
"url": "https://www.suse.com/security/cve/CVE-2016-3712"
},
{
"category": "external",
"summary": "SUSE Bug 978160 for CVE-2016-3712",
"url": "https://bugzilla.suse.com/978160"
},
{
"category": "external",
"summary": "SUSE Bug 978164 for CVE-2016-3712",
"url": "https://bugzilla.suse.com/978164"
},
{
"category": "external",
"summary": "SUSE Bug 978167 for CVE-2016-3712",
"url": "https://bugzilla.suse.com/978167"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-06-28T14:31:01Z",
"details": "low"
}
],
"title": "CVE-2016-3712"
},
{
"cve": "CVE-2016-4001",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-4001"
}
],
"notes": [
{
"category": "general",
"text": "Buffer overflow in the stellaris_enet_receive function in hw/net/stellaris_enet.c in QEMU, when the Stellaris ethernet controller is configured to accept large packets, allows remote attackers to cause a denial of service (QEMU crash) via a large packet.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-4001",
"url": "https://www.suse.com/security/cve/CVE-2016-4001"
},
{
"category": "external",
"summary": "SUSE Bug 975128 for CVE-2016-4001",
"url": "https://bugzilla.suse.com/975128"
},
{
"category": "external",
"summary": "SUSE Bug 975130 for CVE-2016-4001",
"url": "https://bugzilla.suse.com/975130"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-06-28T14:31:01Z",
"details": "moderate"
}
],
"title": "CVE-2016-4001"
},
{
"cve": "CVE-2016-4002",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-4002"
}
],
"notes": [
{
"category": "general",
"text": "Buffer overflow in the mipsnet_receive function in hw/net/mipsnet.c in QEMU, when the guest NIC is configured to accept large packets, allows remote attackers to cause a denial of service (memory corruption and QEMU crash) or possibly execute arbitrary code via a packet larger than 1514 bytes.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-4002",
"url": "https://www.suse.com/security/cve/CVE-2016-4002"
},
{
"category": "external",
"summary": "SUSE Bug 975136 for CVE-2016-4002",
"url": "https://bugzilla.suse.com/975136"
},
{
"category": "external",
"summary": "SUSE Bug 975138 for CVE-2016-4002",
"url": "https://bugzilla.suse.com/975138"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-06-28T14:31:01Z",
"details": "moderate"
}
],
"title": "CVE-2016-4002"
},
{
"cve": "CVE-2016-4020",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-4020"
}
],
"notes": [
{
"category": "general",
"text": "The patch_instruction function in hw/i386/kvmvapic.c in QEMU does not initialize the imm32 variable, which allows local guest OS administrators to obtain sensitive information from host stack memory by accessing the Task Priority Register (TPR).",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-4020",
"url": "https://www.suse.com/security/cve/CVE-2016-4020"
},
{
"category": "external",
"summary": "SUSE Bug 975700 for CVE-2016-4020",
"url": "https://bugzilla.suse.com/975700"
},
{
"category": "external",
"summary": "SUSE Bug 975907 for CVE-2016-4020",
"url": "https://bugzilla.suse.com/975907"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-06-28T14:31:01Z",
"details": "low"
}
],
"title": "CVE-2016-4020"
},
{
"cve": "CVE-2016-4037",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-4037"
}
],
"notes": [
{
"category": "general",
"text": "The ehci_advance_state function in hw/usb/hcd-ehci.c in QEMU allows local guest OS administrators to cause a denial of service (infinite loop and CPU consumption) via a circular split isochronous transfer descriptor (siTD) list, a related issue to CVE-2015-8558.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-4037",
"url": "https://www.suse.com/security/cve/CVE-2016-4037"
},
{
"category": "external",
"summary": "SUSE Bug 959005 for CVE-2016-4037",
"url": "https://bugzilla.suse.com/959005"
},
{
"category": "external",
"summary": "SUSE Bug 959006 for CVE-2016-4037",
"url": "https://bugzilla.suse.com/959006"
},
{
"category": "external",
"summary": "SUSE Bug 976109 for CVE-2016-4037",
"url": "https://bugzilla.suse.com/976109"
},
{
"category": "external",
"summary": "SUSE Bug 976111 for CVE-2016-4037",
"url": "https://bugzilla.suse.com/976111"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-06-28T14:31:01Z",
"details": "low"
}
],
"title": "CVE-2016-4037"
},
{
"cve": "CVE-2016-4439",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-4439"
}
],
"notes": [
{
"category": "general",
"text": "The esp_reg_write function in hw/scsi/esp.c in the 53C9X Fast SCSI Controller (FSC) support in QEMU does not properly check command buffer length, which allows local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) or potentially execute arbitrary code on the QEMU host via unspecified vectors.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-4439",
"url": "https://www.suse.com/security/cve/CVE-2016-4439"
},
{
"category": "external",
"summary": "SUSE Bug 980711 for CVE-2016-4439",
"url": "https://bugzilla.suse.com/980711"
},
{
"category": "external",
"summary": "SUSE Bug 980716 for CVE-2016-4439",
"url": "https://bugzilla.suse.com/980716"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-06-28T14:31:01Z",
"details": "low"
}
],
"title": "CVE-2016-4439"
},
{
"cve": "CVE-2016-4441",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-4441"
}
],
"notes": [
{
"category": "general",
"text": "The get_cmd function in hw/scsi/esp.c in the 53C9X Fast SCSI Controller (FSC) support in QEMU does not properly check DMA length, which allows local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) via unspecified vectors, involving an SCSI command.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-4441",
"url": "https://www.suse.com/security/cve/CVE-2016-4441"
},
{
"category": "external",
"summary": "SUSE Bug 980723 for CVE-2016-4441",
"url": "https://bugzilla.suse.com/980723"
},
{
"category": "external",
"summary": "SUSE Bug 980724 for CVE-2016-4441",
"url": "https://bugzilla.suse.com/980724"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:kvm-1.4.2-46.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:kvm-1.4.2-46.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-06-28T14:31:01Z",
"details": "low"
}
],
"title": "CVE-2016-4441"
}
]
}
suse-su-2016:1785-1
Vulnerability from csaf_suse
Published
2016-07-11 11:31
Modified
2016-07-11 11:31
Summary
Security update for kvm
Notes
Title of the patch
Security update for kvm
Description of the patch
kvm was updated to fix 33 security issues.
These security issues were fixed:
- CVE-2016-4439: Avoid OOB access in 53C9X emulation (bsc#980711)
- CVE-2016-4441: Avoid OOB access in 53C9X emulation (bsc#980723)
- CVE-2016-3710: Fixed VGA emulation based OOB access with potential for guest escape (bsc#978158)
- CVE-2016-3712: Fixed VGa emulation based DOS and OOB read access exploit (bsc#978160)
- CVE-2016-4037: Fixed USB ehci based DOS (bsc#976109)
- CVE-2016-2538: Fixed potential OOB access in USB net device emulation (bsc#967969)
- CVE-2016-2841: Fixed OOB access / hang in ne2000 emulation (bsc#969350)
- CVE-2016-2858: Avoid potential DOS when using QEMU pseudo random number generator (bsc#970036)
- CVE-2016-2857: Fixed OOB access when processing IP checksums (bsc#970037)
- CVE-2016-4001: Fixed OOB access in Stellaris enet emulated nic (bsc#975128)
- CVE-2016-4002: Fixed OOB access in MIPSnet emulated controller (bsc#975136)
- CVE-2016-4020: Fixed possible host data leakage to guest from TPR access (bsc#975700)
- CVE-2015-3214: Fixed OOB read in i8254 PIC (bsc#934069)
- CVE-2014-9718: Fixed the handling of malformed or short ide PRDTs to avoid any opportunity for guest to cause DoS by abusing that interface (bsc#928393)
- CVE-2014-3689: Fixed insufficient parameter validation in rectangle functions (bsc#901508)
- CVE-2014-3615: The VGA emulator in QEMU allowed local guest users to read host memory by setting the display to a high resolution (bsc#895528).
- CVE-2015-5239: Integer overflow in vnc_client_read() and protocol_client_msg() (bsc#944463).
- CVE-2015-5278: Infinite loop in ne2000_receive() function (bsc#945989).
- CVE-2015-5279: Heap-based buffer overflow in the ne2000_receive function in hw/net/ne2000.c in QEMU allowed guest OS users to cause a denial of service (instance crash) or possibly execute arbitrary code via vectors related to receiving packets (bsc#945987).
- CVE-2015-5745: Buffer overflow in virtio-serial (bsc#940929).
- CVE-2015-6855: hw/ide/core.c in QEMU did not properly restrict the commands accepted by an ATAPI device, which allowed guest users to cause a denial of service or possibly have unspecified other impact via certain IDE commands, as demonstrated by a WIN_READ_NATIVE_MAX command to an empty drive, which triggers a divide-by-zero error and instance crash (bsc#945404).
- CVE-2015-7295: hw/virtio/virtio.c in the Virtual Network Device (virtio-net) support in QEMU, when big or mergeable receive buffers are not supported, allowed remote attackers to cause a denial of service (guest network consumption) via a flood of jumbo frames on the (1) tuntap or (2) macvtap interface (bsc#947159).
- CVE-2015-7549: PCI null pointer dereferences (bsc#958917).
- CVE-2015-8504: VNC floating point exception (bsc#958491).
- CVE-2015-8558: Infinite loop in ehci_advance_state resulting in DoS (bsc#959005).
- CVE-2015-8613: Wrong sized memset in megasas command handler (bsc#961358).
- CVE-2015-8619: Potential DoS for long HMP sendkey command argument (bsc#960334).
- CVE-2015-8743: OOB memory access in ne2000 ioport r/w functions (bsc#960725).
- CVE-2016-1568: AHCI use-after-free in aio port commands (bsc#961332).
- CVE-2016-1714: Potential OOB memory access in processing firmware configuration (bsc#961691).
- CVE-2016-1922: NULL pointer dereference when processing hmp i/o command (bsc#962320).
- CVE-2016-1981: Potential DoS (infinite loop) in e1000 device emulation by malicious privileged user within guest (bsc#963782).
- CVE-2016-2198: Malicious privileged guest user were able to cause DoS by writing to read-only EHCI capabilities registers (bsc#964413).
This non-security issue was fixed:
- Fix case of IDE interface needing busy status set before flush (bsc#936132)
Patchnames
slessp4-kvm-12645
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for kvm",
"title": "Title of the patch"
},
{
"category": "description",
"text": "kvm was updated to fix 33 security issues.\n\nThese security issues were fixed:\n- CVE-2016-4439: Avoid OOB access in 53C9X emulation (bsc#980711)\n- CVE-2016-4441: Avoid OOB access in 53C9X emulation (bsc#980723)\n- CVE-2016-3710: Fixed VGA emulation based OOB access with potential for guest escape (bsc#978158)\n- CVE-2016-3712: Fixed VGa emulation based DOS and OOB read access exploit (bsc#978160)\n- CVE-2016-4037: Fixed USB ehci based DOS (bsc#976109)\n- CVE-2016-2538: Fixed potential OOB access in USB net device emulation (bsc#967969)\n- CVE-2016-2841: Fixed OOB access / hang in ne2000 emulation (bsc#969350)\n- CVE-2016-2858: Avoid potential DOS when using QEMU pseudo random number generator (bsc#970036)\n- CVE-2016-2857: Fixed OOB access when processing IP checksums (bsc#970037)\n- CVE-2016-4001: Fixed OOB access in Stellaris enet emulated nic (bsc#975128)\n- CVE-2016-4002: Fixed OOB access in MIPSnet emulated controller (bsc#975136)\n- CVE-2016-4020: Fixed possible host data leakage to guest from TPR access (bsc#975700)\n- CVE-2015-3214: Fixed OOB read in i8254 PIC (bsc#934069)\n- CVE-2014-9718: Fixed the handling of malformed or short ide PRDTs to avoid any opportunity for guest to cause DoS by abusing that interface (bsc#928393)\n- CVE-2014-3689: Fixed insufficient parameter validation in rectangle functions (bsc#901508)\n- CVE-2014-3615: The VGA emulator in QEMU allowed local guest users to read host memory by setting the display to a high resolution (bsc#895528).\n- CVE-2015-5239: Integer overflow in vnc_client_read() and protocol_client_msg() (bsc#944463).\n- CVE-2015-5278: Infinite loop in ne2000_receive() function (bsc#945989).\n- CVE-2015-5279: Heap-based buffer overflow in the ne2000_receive function in hw/net/ne2000.c in QEMU allowed guest OS users to cause a denial of service (instance crash) or possibly execute arbitrary code via vectors related to receiving packets (bsc#945987).\n- CVE-2015-5745: Buffer overflow in virtio-serial (bsc#940929).\n- CVE-2015-6855: hw/ide/core.c in QEMU did not properly restrict the commands accepted by an ATAPI device, which allowed guest users to cause a denial of service or possibly have unspecified other impact via certain IDE commands, as demonstrated by a WIN_READ_NATIVE_MAX command to an empty drive, which triggers a divide-by-zero error and instance crash (bsc#945404).\n- CVE-2015-7295: hw/virtio/virtio.c in the Virtual Network Device (virtio-net) support in QEMU, when big or mergeable receive buffers are not supported, allowed remote attackers to cause a denial of service (guest network consumption) via a flood of jumbo frames on the (1) tuntap or (2) macvtap interface (bsc#947159).\n- CVE-2015-7549: PCI null pointer dereferences (bsc#958917).\n- CVE-2015-8504: VNC floating point exception (bsc#958491).\n- CVE-2015-8558: Infinite loop in ehci_advance_state resulting in DoS (bsc#959005).\n- CVE-2015-8613: Wrong sized memset in megasas command handler (bsc#961358).\n- CVE-2015-8619: Potential DoS for long HMP sendkey command argument (bsc#960334).\n- CVE-2015-8743: OOB memory access in ne2000 ioport r/w functions (bsc#960725).\n- CVE-2016-1568: AHCI use-after-free in aio port commands (bsc#961332).\n- CVE-2016-1714: Potential OOB memory access in processing firmware configuration (bsc#961691).\n- CVE-2016-1922: NULL pointer dereference when processing hmp i/o command (bsc#962320).\n- CVE-2016-1981: Potential DoS (infinite loop) in e1000 device emulation by malicious privileged user within guest (bsc#963782).\n- CVE-2016-2198: Malicious privileged guest user were able to cause DoS by writing to read-only EHCI capabilities registers (bsc#964413).\n\nThis non-security issue was fixed:\n- Fix case of IDE interface needing busy status set before flush (bsc#936132)\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "slessp4-kvm-12645",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2016_1785-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2016:1785-1",
"url": "https://www.suse.com/support/update/announcement/2016/suse-su-20161785-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2016:1785-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2016-July/002154.html"
},
{
"category": "self",
"summary": "SUSE Bug 895528",
"url": "https://bugzilla.suse.com/895528"
},
{
"category": "self",
"summary": "SUSE Bug 901508",
"url": "https://bugzilla.suse.com/901508"
},
{
"category": "self",
"summary": "SUSE Bug 928393",
"url": "https://bugzilla.suse.com/928393"
},
{
"category": "self",
"summary": "SUSE Bug 934069",
"url": "https://bugzilla.suse.com/934069"
},
{
"category": "self",
"summary": "SUSE Bug 936132",
"url": "https://bugzilla.suse.com/936132"
},
{
"category": "self",
"summary": "SUSE Bug 940929",
"url": "https://bugzilla.suse.com/940929"
},
{
"category": "self",
"summary": "SUSE Bug 944463",
"url": "https://bugzilla.suse.com/944463"
},
{
"category": "self",
"summary": "SUSE Bug 945404",
"url": "https://bugzilla.suse.com/945404"
},
{
"category": "self",
"summary": "SUSE Bug 945987",
"url": "https://bugzilla.suse.com/945987"
},
{
"category": "self",
"summary": "SUSE Bug 945989",
"url": "https://bugzilla.suse.com/945989"
},
{
"category": "self",
"summary": "SUSE Bug 947159",
"url": "https://bugzilla.suse.com/947159"
},
{
"category": "self",
"summary": "SUSE Bug 958491",
"url": "https://bugzilla.suse.com/958491"
},
{
"category": "self",
"summary": "SUSE Bug 958917",
"url": "https://bugzilla.suse.com/958917"
},
{
"category": "self",
"summary": "SUSE Bug 959005",
"url": "https://bugzilla.suse.com/959005"
},
{
"category": "self",
"summary": "SUSE Bug 960334",
"url": "https://bugzilla.suse.com/960334"
},
{
"category": "self",
"summary": "SUSE Bug 960725",
"url": "https://bugzilla.suse.com/960725"
},
{
"category": "self",
"summary": "SUSE Bug 961332",
"url": "https://bugzilla.suse.com/961332"
},
{
"category": "self",
"summary": "SUSE Bug 961333",
"url": "https://bugzilla.suse.com/961333"
},
{
"category": "self",
"summary": "SUSE Bug 961358",
"url": "https://bugzilla.suse.com/961358"
},
{
"category": "self",
"summary": "SUSE Bug 961556",
"url": "https://bugzilla.suse.com/961556"
},
{
"category": "self",
"summary": "SUSE Bug 961691",
"url": "https://bugzilla.suse.com/961691"
},
{
"category": "self",
"summary": "SUSE Bug 962320",
"url": "https://bugzilla.suse.com/962320"
},
{
"category": "self",
"summary": "SUSE Bug 963782",
"url": "https://bugzilla.suse.com/963782"
},
{
"category": "self",
"summary": "SUSE Bug 964413",
"url": "https://bugzilla.suse.com/964413"
},
{
"category": "self",
"summary": "SUSE Bug 967969",
"url": "https://bugzilla.suse.com/967969"
},
{
"category": "self",
"summary": "SUSE Bug 969350",
"url": "https://bugzilla.suse.com/969350"
},
{
"category": "self",
"summary": "SUSE Bug 970036",
"url": "https://bugzilla.suse.com/970036"
},
{
"category": "self",
"summary": "SUSE Bug 970037",
"url": "https://bugzilla.suse.com/970037"
},
{
"category": "self",
"summary": "SUSE Bug 975128",
"url": "https://bugzilla.suse.com/975128"
},
{
"category": "self",
"summary": "SUSE Bug 975136",
"url": "https://bugzilla.suse.com/975136"
},
{
"category": "self",
"summary": "SUSE Bug 975700",
"url": "https://bugzilla.suse.com/975700"
},
{
"category": "self",
"summary": "SUSE Bug 976109",
"url": "https://bugzilla.suse.com/976109"
},
{
"category": "self",
"summary": "SUSE Bug 978158",
"url": "https://bugzilla.suse.com/978158"
},
{
"category": "self",
"summary": "SUSE Bug 978160",
"url": "https://bugzilla.suse.com/978160"
},
{
"category": "self",
"summary": "SUSE Bug 980711",
"url": "https://bugzilla.suse.com/980711"
},
{
"category": "self",
"summary": "SUSE Bug 980723",
"url": "https://bugzilla.suse.com/980723"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2014-3615 page",
"url": "https://www.suse.com/security/cve/CVE-2014-3615/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2014-3689 page",
"url": "https://www.suse.com/security/cve/CVE-2014-3689/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2014-9718 page",
"url": "https://www.suse.com/security/cve/CVE-2014-9718/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-3214 page",
"url": "https://www.suse.com/security/cve/CVE-2015-3214/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-5239 page",
"url": "https://www.suse.com/security/cve/CVE-2015-5239/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-5278 page",
"url": "https://www.suse.com/security/cve/CVE-2015-5278/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-5279 page",
"url": "https://www.suse.com/security/cve/CVE-2015-5279/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-5745 page",
"url": "https://www.suse.com/security/cve/CVE-2015-5745/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-6855 page",
"url": "https://www.suse.com/security/cve/CVE-2015-6855/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-7295 page",
"url": "https://www.suse.com/security/cve/CVE-2015-7295/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-7549 page",
"url": "https://www.suse.com/security/cve/CVE-2015-7549/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-8504 page",
"url": "https://www.suse.com/security/cve/CVE-2015-8504/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-8558 page",
"url": "https://www.suse.com/security/cve/CVE-2015-8558/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-8613 page",
"url": "https://www.suse.com/security/cve/CVE-2015-8613/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-8619 page",
"url": "https://www.suse.com/security/cve/CVE-2015-8619/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-8743 page",
"url": "https://www.suse.com/security/cve/CVE-2015-8743/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-1568 page",
"url": "https://www.suse.com/security/cve/CVE-2016-1568/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-1714 page",
"url": "https://www.suse.com/security/cve/CVE-2016-1714/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-1922 page",
"url": "https://www.suse.com/security/cve/CVE-2016-1922/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-1981 page",
"url": "https://www.suse.com/security/cve/CVE-2016-1981/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-2198 page",
"url": "https://www.suse.com/security/cve/CVE-2016-2198/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-2538 page",
"url": "https://www.suse.com/security/cve/CVE-2016-2538/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-2841 page",
"url": "https://www.suse.com/security/cve/CVE-2016-2841/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-2857 page",
"url": "https://www.suse.com/security/cve/CVE-2016-2857/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-2858 page",
"url": "https://www.suse.com/security/cve/CVE-2016-2858/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-3710 page",
"url": "https://www.suse.com/security/cve/CVE-2016-3710/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-3712 page",
"url": "https://www.suse.com/security/cve/CVE-2016-3712/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-4001 page",
"url": "https://www.suse.com/security/cve/CVE-2016-4001/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-4002 page",
"url": "https://www.suse.com/security/cve/CVE-2016-4002/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-4020 page",
"url": "https://www.suse.com/security/cve/CVE-2016-4020/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-4037 page",
"url": "https://www.suse.com/security/cve/CVE-2016-4037/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-4439 page",
"url": "https://www.suse.com/security/cve/CVE-2016-4439/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-4441 page",
"url": "https://www.suse.com/security/cve/CVE-2016-4441/"
}
],
"title": "Security update for kvm",
"tracking": {
"current_release_date": "2016-07-11T11:31:17Z",
"generator": {
"date": "2016-07-11T11:31:17Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2016:1785-1",
"initial_release_date": "2016-07-11T11:31:17Z",
"revision_history": [
{
"date": "2016-07-11T11:31:17Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "kvm-1.4.2-44.1.i586",
"product": {
"name": "kvm-1.4.2-44.1.i586",
"product_id": "kvm-1.4.2-44.1.i586"
}
}
],
"category": "architecture",
"name": "i586"
},
{
"branches": [
{
"category": "product_version",
"name": "kvm-1.4.2-44.1.s390x",
"product": {
"name": "kvm-1.4.2-44.1.s390x",
"product_id": "kvm-1.4.2-44.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "kvm-1.4.2-44.1.x86_64",
"product": {
"name": "kvm-1.4.2-44.1.x86_64",
"product_id": "kvm-1.4.2-44.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 11 SP4",
"product": {
"name": "SUSE Linux Enterprise Server 11 SP4",
"product_id": "SUSE Linux Enterprise Server 11 SP4",
"product_identification_helper": {
"cpe": "cpe:/o:suse:suse_sles:11:sp4"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP Applications 11 SP4",
"product": {
"name": "SUSE Linux Enterprise Server for SAP Applications 11 SP4",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 11 SP4",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles_sap:11:sp4"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "kvm-1.4.2-44.1.i586 as component of SUSE Linux Enterprise Server 11 SP4",
"product_id": "SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586"
},
"product_reference": "kvm-1.4.2-44.1.i586",
"relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kvm-1.4.2-44.1.s390x as component of SUSE Linux Enterprise Server 11 SP4",
"product_id": "SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x"
},
"product_reference": "kvm-1.4.2-44.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kvm-1.4.2-44.1.x86_64 as component of SUSE Linux Enterprise Server 11 SP4",
"product_id": "SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64"
},
"product_reference": "kvm-1.4.2-44.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kvm-1.4.2-44.1.i586 as component of SUSE Linux Enterprise Server for SAP Applications 11 SP4",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586"
},
"product_reference": "kvm-1.4.2-44.1.i586",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 11 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kvm-1.4.2-44.1.s390x as component of SUSE Linux Enterprise Server for SAP Applications 11 SP4",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x"
},
"product_reference": "kvm-1.4.2-44.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 11 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kvm-1.4.2-44.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 11 SP4",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
},
"product_reference": "kvm-1.4.2-44.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 11 SP4"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2014-3615",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2014-3615"
}
],
"notes": [
{
"category": "general",
"text": "The VGA emulator in QEMU allows local guest users to read host memory by setting the display to a high resolution.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2014-3615",
"url": "https://www.suse.com/security/cve/CVE-2014-3615"
},
{
"category": "external",
"summary": "SUSE Bug 895528 for CVE-2014-3615",
"url": "https://bugzilla.suse.com/895528"
},
{
"category": "external",
"summary": "SUSE Bug 918998 for CVE-2014-3615",
"url": "https://bugzilla.suse.com/918998"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-07-11T11:31:17Z",
"details": "moderate"
}
],
"title": "CVE-2014-3615"
},
{
"cve": "CVE-2014-3689",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2014-3689"
}
],
"notes": [
{
"category": "general",
"text": "The vmware-vga driver (hw/display/vmware_vga.c) in QEMU allows local guest users to write to qemu memory locations and gain privileges via unspecified parameters related to rectangle handling.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2014-3689",
"url": "https://www.suse.com/security/cve/CVE-2014-3689"
},
{
"category": "external",
"summary": "SUSE Bug 1072223 for CVE-2014-3689",
"url": "https://bugzilla.suse.com/1072223"
},
{
"category": "external",
"summary": "SUSE Bug 1189862 for CVE-2014-3689",
"url": "https://bugzilla.suse.com/1189862"
},
{
"category": "external",
"summary": "SUSE Bug 901508 for CVE-2014-3689",
"url": "https://bugzilla.suse.com/901508"
},
{
"category": "external",
"summary": "SUSE Bug 962611 for CVE-2014-3689",
"url": "https://bugzilla.suse.com/962611"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-07-11T11:31:17Z",
"details": "important"
}
],
"title": "CVE-2014-3689"
},
{
"cve": "CVE-2014-9718",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2014-9718"
}
],
"notes": [
{
"category": "general",
"text": "The (1) BMDMA and (2) AHCI HBA interfaces in the IDE functionality in QEMU 1.0 through 2.1.3 have multiple interpretations of a function\u0027s return value, which allows guest OS users to cause a host OS denial of service (memory consumption or infinite loop, and system crash) via a PRDT with zero complete sectors, related to the bmdma_prepare_buf and ahci_dma_prepare_buf functions.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2014-9718",
"url": "https://www.suse.com/security/cve/CVE-2014-9718"
},
{
"category": "external",
"summary": "SUSE Bug 928393 for CVE-2014-9718",
"url": "https://bugzilla.suse.com/928393"
},
{
"category": "external",
"summary": "SUSE Bug 964431 for CVE-2014-9718",
"url": "https://bugzilla.suse.com/964431"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-07-11T11:31:17Z",
"details": "moderate"
}
],
"title": "CVE-2014-9718"
},
{
"cve": "CVE-2015-3214",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-3214"
}
],
"notes": [
{
"category": "general",
"text": "The pit_ioport_read in i8254.c in the Linux kernel before 2.6.33 and QEMU before 2.3.1 does not distinguish between read lengths and write lengths, which might allow guest OS users to execute arbitrary code on the host OS by triggering use of an invalid index.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-3214",
"url": "https://www.suse.com/security/cve/CVE-2015-3214"
},
{
"category": "external",
"summary": "SUSE Bug 934069 for CVE-2015-3214",
"url": "https://bugzilla.suse.com/934069"
},
{
"category": "external",
"summary": "SUSE Bug 936025 for CVE-2015-3214",
"url": "https://bugzilla.suse.com/936025"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-07-11T11:31:17Z",
"details": "moderate"
}
],
"title": "CVE-2015-3214"
},
{
"cve": "CVE-2015-5239",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-5239"
}
],
"notes": [
{
"category": "general",
"text": "Integer overflow in the VNC display driver in QEMU before 2.1.0 allows attachers to cause a denial of service (process crash) via a CLIENT_CUT_TEXT message, which triggers an infinite loop.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-5239",
"url": "https://www.suse.com/security/cve/CVE-2015-5239"
},
{
"category": "external",
"summary": "SUSE Bug 944463 for CVE-2015-5239",
"url": "https://bugzilla.suse.com/944463"
},
{
"category": "external",
"summary": "SUSE Bug 950367 for CVE-2015-5239",
"url": "https://bugzilla.suse.com/950367"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-07-11T11:31:17Z",
"details": "moderate"
}
],
"title": "CVE-2015-5239"
},
{
"cve": "CVE-2015-5278",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-5278"
}
],
"notes": [
{
"category": "general",
"text": "The ne2000_receive function in hw/net/ne2000.c in QEMU before 2.4.0.1 allows attackers to cause a denial of service (infinite loop and instance crash) or possibly execute arbitrary code via vectors related to receiving packets.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-5278",
"url": "https://www.suse.com/security/cve/CVE-2015-5278"
},
{
"category": "external",
"summary": "SUSE Bug 945989 for CVE-2015-5278",
"url": "https://bugzilla.suse.com/945989"
},
{
"category": "external",
"summary": "SUSE Bug 964947 for CVE-2015-5278",
"url": "https://bugzilla.suse.com/964947"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-07-11T11:31:17Z",
"details": "moderate"
}
],
"title": "CVE-2015-5278"
},
{
"cve": "CVE-2015-5279",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-5279"
}
],
"notes": [
{
"category": "general",
"text": "Heap-based buffer overflow in the ne2000_receive function in hw/net/ne2000.c in QEMU before 2.4.0.1 allows guest OS users to cause a denial of service (instance crash) or possibly execute arbitrary code via vectors related to receiving packets.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-5279",
"url": "https://www.suse.com/security/cve/CVE-2015-5279"
},
{
"category": "external",
"summary": "SUSE Bug 945987 for CVE-2015-5279",
"url": "https://bugzilla.suse.com/945987"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-07-11T11:31:17Z",
"details": "important"
}
],
"title": "CVE-2015-5279"
},
{
"cve": "CVE-2015-5745",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-5745"
}
],
"notes": [
{
"category": "general",
"text": "Buffer overflow in the send_control_msg function in hw/char/virtio-serial-bus.c in QEMU before 2.4.0 allows guest users to cause a denial of service (QEMU process crash) via a crafted virtio control message.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-5745",
"url": "https://www.suse.com/security/cve/CVE-2015-5745"
},
{
"category": "external",
"summary": "SUSE Bug 940929 for CVE-2015-5745",
"url": "https://bugzilla.suse.com/940929"
},
{
"category": "external",
"summary": "SUSE Bug 950367 for CVE-2015-5745",
"url": "https://bugzilla.suse.com/950367"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-07-11T11:31:17Z",
"details": "low"
}
],
"title": "CVE-2015-5745"
},
{
"cve": "CVE-2015-6855",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-6855"
}
],
"notes": [
{
"category": "general",
"text": "hw/ide/core.c in QEMU does not properly restrict the commands accepted by an ATAPI device, which allows guest users to cause a denial of service or possibly have unspecified other impact via certain IDE commands, as demonstrated by a WIN_READ_NATIVE_MAX command to an empty drive, which triggers a divide-by-zero error and instance crash.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-6855",
"url": "https://www.suse.com/security/cve/CVE-2015-6855"
},
{
"category": "external",
"summary": "SUSE Bug 945404 for CVE-2015-6855",
"url": "https://bugzilla.suse.com/945404"
},
{
"category": "external",
"summary": "SUSE Bug 965156 for CVE-2015-6855",
"url": "https://bugzilla.suse.com/965156"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-07-11T11:31:17Z",
"details": "important"
}
],
"title": "CVE-2015-6855"
},
{
"cve": "CVE-2015-7295",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-7295"
}
],
"notes": [
{
"category": "general",
"text": "hw/virtio/virtio.c in the Virtual Network Device (virtio-net) support in QEMU, when big or mergeable receive buffers are not supported, allows remote attackers to cause a denial of service (guest network consumption) via a flood of jumbo frames on the (1) tuntap or (2) macvtap interface.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-7295",
"url": "https://www.suse.com/security/cve/CVE-2015-7295"
},
{
"category": "external",
"summary": "SUSE Bug 947159 for CVE-2015-7295",
"url": "https://bugzilla.suse.com/947159"
},
{
"category": "external",
"summary": "SUSE Bug 950367 for CVE-2015-7295",
"url": "https://bugzilla.suse.com/950367"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-07-11T11:31:17Z",
"details": "moderate"
}
],
"title": "CVE-2015-7295"
},
{
"cve": "CVE-2015-7549",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-7549"
}
],
"notes": [
{
"category": "general",
"text": "The MSI-X MMIO support in hw/pci/msix.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (NULL pointer dereference and QEMU process crash) by leveraging failure to define the .write method.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-7549",
"url": "https://www.suse.com/security/cve/CVE-2015-7549"
},
{
"category": "external",
"summary": "SUSE Bug 958917 for CVE-2015-7549",
"url": "https://bugzilla.suse.com/958917"
},
{
"category": "external",
"summary": "SUSE Bug 958918 for CVE-2015-7549",
"url": "https://bugzilla.suse.com/958918"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-07-11T11:31:17Z",
"details": "low"
}
],
"title": "CVE-2015-7549"
},
{
"cve": "CVE-2015-8504",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-8504"
}
],
"notes": [
{
"category": "general",
"text": "Qemu, when built with VNC display driver support, allows remote attackers to cause a denial of service (arithmetic exception and application crash) via crafted SetPixelFormat messages from a client.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-8504",
"url": "https://www.suse.com/security/cve/CVE-2015-8504"
},
{
"category": "external",
"summary": "SUSE Bug 958491 for CVE-2015-8504",
"url": "https://bugzilla.suse.com/958491"
},
{
"category": "external",
"summary": "SUSE Bug 958493 for CVE-2015-8504",
"url": "https://bugzilla.suse.com/958493"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-07-11T11:31:17Z",
"details": "moderate"
}
],
"title": "CVE-2015-8504"
},
{
"cve": "CVE-2015-8558",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-8558"
}
],
"notes": [
{
"category": "general",
"text": "The ehci_process_itd function in hw/usb/hcd-ehci.c in QEMU allows local guest OS administrators to cause a denial of service (infinite loop and CPU consumption) via a circular isochronous transfer descriptor (iTD) list.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-8558",
"url": "https://www.suse.com/security/cve/CVE-2015-8558"
},
{
"category": "external",
"summary": "SUSE Bug 959005 for CVE-2015-8558",
"url": "https://bugzilla.suse.com/959005"
},
{
"category": "external",
"summary": "SUSE Bug 959006 for CVE-2015-8558",
"url": "https://bugzilla.suse.com/959006"
},
{
"category": "external",
"summary": "SUSE Bug 976109 for CVE-2015-8558",
"url": "https://bugzilla.suse.com/976109"
},
{
"category": "external",
"summary": "SUSE Bug 976111 for CVE-2015-8558",
"url": "https://bugzilla.suse.com/976111"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-07-11T11:31:17Z",
"details": "moderate"
}
],
"title": "CVE-2015-8558"
},
{
"cve": "CVE-2015-8613",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-8613"
}
],
"notes": [
{
"category": "general",
"text": "Stack-based buffer overflow in the megasas_ctrl_get_info function in QEMU, when built with SCSI MegaRAID SAS HBA emulation support, allows local guest users to cause a denial of service (QEMU instance crash) via a crafted SCSI controller CTRL_GET_INFO command.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-8613",
"url": "https://www.suse.com/security/cve/CVE-2015-8613"
},
{
"category": "external",
"summary": "SUSE Bug 961358 for CVE-2015-8613",
"url": "https://bugzilla.suse.com/961358"
},
{
"category": "external",
"summary": "SUSE Bug 961556 for CVE-2015-8613",
"url": "https://bugzilla.suse.com/961556"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-07-11T11:31:17Z",
"details": "moderate"
}
],
"title": "CVE-2015-8613"
},
{
"cve": "CVE-2015-8619",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-8619"
}
],
"notes": [
{
"category": "general",
"text": "The Human Monitor Interface support in QEMU allows remote attackers to cause a denial of service (out-of-bounds write and application crash).",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-8619",
"url": "https://www.suse.com/security/cve/CVE-2015-8619"
},
{
"category": "external",
"summary": "SUSE Bug 960334 for CVE-2015-8619",
"url": "https://bugzilla.suse.com/960334"
},
{
"category": "external",
"summary": "SUSE Bug 965269 for CVE-2015-8619",
"url": "https://bugzilla.suse.com/965269"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-07-11T11:31:17Z",
"details": "important"
}
],
"title": "CVE-2015-8619"
},
{
"cve": "CVE-2015-8743",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-8743"
}
],
"notes": [
{
"category": "general",
"text": "QEMU (aka Quick Emulator) built with the NE2000 device emulation support is vulnerable to an OOB r/w access issue. It could occur while performing \u0027ioport\u0027 r/w operations. A privileged (CAP_SYS_RAWIO) user/process could use this flaw to leak or corrupt QEMU memory bytes.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-8743",
"url": "https://www.suse.com/security/cve/CVE-2015-8743"
},
{
"category": "external",
"summary": "SUSE Bug 960725 for CVE-2015-8743",
"url": "https://bugzilla.suse.com/960725"
},
{
"category": "external",
"summary": "SUSE Bug 960726 for CVE-2015-8743",
"url": "https://bugzilla.suse.com/960726"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-07-11T11:31:17Z",
"details": "moderate"
}
],
"title": "CVE-2015-8743"
},
{
"cve": "CVE-2016-1568",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-1568"
}
],
"notes": [
{
"category": "general",
"text": "Use-after-free vulnerability in hw/ide/ahci.c in QEMU, when built with IDE AHCI Emulation support, allows guest OS users to cause a denial of service (instance crash) or possibly execute arbitrary code via an invalid AHCI Native Command Queuing (NCQ) AIO command.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-1568",
"url": "https://www.suse.com/security/cve/CVE-2016-1568"
},
{
"category": "external",
"summary": "SUSE Bug 961332 for CVE-2016-1568",
"url": "https://bugzilla.suse.com/961332"
},
{
"category": "external",
"summary": "SUSE Bug 961333 for CVE-2016-1568",
"url": "https://bugzilla.suse.com/961333"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-07-11T11:31:17Z",
"details": "moderate"
}
],
"title": "CVE-2016-1568"
},
{
"cve": "CVE-2016-1714",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-1714"
}
],
"notes": [
{
"category": "general",
"text": "The (1) fw_cfg_write and (2) fw_cfg_read functions in hw/nvram/fw_cfg.c in QEMU before 2.4, when built with the Firmware Configuration device emulation support, allow guest OS users with the CAP_SYS_RAWIO privilege to cause a denial of service (out-of-bounds read or write access and process crash) or possibly execute arbitrary code via an invalid current entry value in a firmware configuration.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-1714",
"url": "https://www.suse.com/security/cve/CVE-2016-1714"
},
{
"category": "external",
"summary": "SUSE Bug 961691 for CVE-2016-1714",
"url": "https://bugzilla.suse.com/961691"
},
{
"category": "external",
"summary": "SUSE Bug 961692 for CVE-2016-1714",
"url": "https://bugzilla.suse.com/961692"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-07-11T11:31:17Z",
"details": "moderate"
}
],
"title": "CVE-2016-1714"
},
{
"cve": "CVE-2016-1922",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-1922"
}
],
"notes": [
{
"category": "general",
"text": "QEMU (aka Quick Emulator) built with the TPR optimization for 32-bit Windows guests support is vulnerable to a null pointer dereference flaw. It occurs while doing I/O port write operations via hmp interface. In that, \u0027current_cpu\u0027 remains null, which leads to the null pointer dereference. A user or process could use this flaw to crash the QEMU instance, resulting in DoS issue.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-1922",
"url": "https://www.suse.com/security/cve/CVE-2016-1922"
},
{
"category": "external",
"summary": "SUSE Bug 962320 for CVE-2016-1922",
"url": "https://bugzilla.suse.com/962320"
},
{
"category": "external",
"summary": "SUSE Bug 962321 for CVE-2016-1922",
"url": "https://bugzilla.suse.com/962321"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-07-11T11:31:17Z",
"details": "low"
}
],
"title": "CVE-2016-1922"
},
{
"cve": "CVE-2016-1981",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-1981"
}
],
"notes": [
{
"category": "general",
"text": "QEMU (aka Quick Emulator) built with the e1000 NIC emulation support is vulnerable to an infinite loop issue. It could occur while processing data via transmit or receive descriptors, provided the initial receive/transmit descriptor head (TDH/RDH) is set outside the allocated descriptor buffer. A privileged user inside guest could use this flaw to crash the QEMU instance resulting in DoS.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-1981",
"url": "https://www.suse.com/security/cve/CVE-2016-1981"
},
{
"category": "external",
"summary": "SUSE Bug 963782 for CVE-2016-1981",
"url": "https://bugzilla.suse.com/963782"
},
{
"category": "external",
"summary": "SUSE Bug 963783 for CVE-2016-1981",
"url": "https://bugzilla.suse.com/963783"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-07-11T11:31:17Z",
"details": "low"
}
],
"title": "CVE-2016-1981"
},
{
"cve": "CVE-2016-2198",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-2198"
}
],
"notes": [
{
"category": "general",
"text": "QEMU (aka Quick Emulator) built with the USB EHCI emulation support is vulnerable to a null pointer dereference flaw. It could occur when an application attempts to write to EHCI capabilities registers. A privileged user inside quest could use this flaw to crash the QEMU process instance resulting in DoS.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-2198",
"url": "https://www.suse.com/security/cve/CVE-2016-2198"
},
{
"category": "external",
"summary": "SUSE Bug 964413 for CVE-2016-2198",
"url": "https://bugzilla.suse.com/964413"
},
{
"category": "external",
"summary": "SUSE Bug 964415 for CVE-2016-2198",
"url": "https://bugzilla.suse.com/964415"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-07-11T11:31:17Z",
"details": "low"
}
],
"title": "CVE-2016-2198"
},
{
"cve": "CVE-2016-2538",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-2538"
}
],
"notes": [
{
"category": "general",
"text": "Multiple integer overflows in the USB Net device emulator (hw/usb/dev-network.c) in QEMU before 2.5.1 allow local guest OS administrators to cause a denial of service (QEMU process crash) or obtain sensitive host memory information via a remote NDIS control message packet that is mishandled in the (1) rndis_query_response, (2) rndis_set_response, or (3) usb_net_handle_dataout function.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-2538",
"url": "https://www.suse.com/security/cve/CVE-2016-2538"
},
{
"category": "external",
"summary": "SUSE Bug 967969 for CVE-2016-2538",
"url": "https://bugzilla.suse.com/967969"
},
{
"category": "external",
"summary": "SUSE Bug 968004 for CVE-2016-2538",
"url": "https://bugzilla.suse.com/968004"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-07-11T11:31:17Z",
"details": "important"
}
],
"title": "CVE-2016-2538"
},
{
"cve": "CVE-2016-2841",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-2841"
}
],
"notes": [
{
"category": "general",
"text": "The ne2000_receive function in the NE2000 NIC emulation support (hw/net/ne2000.c) in QEMU before 2.5.1 allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via crafted values for the PSTART and PSTOP registers, involving ring buffer control.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-2841",
"url": "https://www.suse.com/security/cve/CVE-2016-2841"
},
{
"category": "external",
"summary": "SUSE Bug 969350 for CVE-2016-2841",
"url": "https://bugzilla.suse.com/969350"
},
{
"category": "external",
"summary": "SUSE Bug 969351 for CVE-2016-2841",
"url": "https://bugzilla.suse.com/969351"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-07-11T11:31:17Z",
"details": "low"
}
],
"title": "CVE-2016-2841"
},
{
"cve": "CVE-2016-2857",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-2857"
}
],
"notes": [
{
"category": "general",
"text": "The net_checksum_calculate function in net/checksum.c in QEMU allows local guest OS users to cause a denial of service (out-of-bounds heap read and crash) via the payload length in a crafted packet.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-2857",
"url": "https://www.suse.com/security/cve/CVE-2016-2857"
},
{
"category": "external",
"summary": "SUSE Bug 970037 for CVE-2016-2857",
"url": "https://bugzilla.suse.com/970037"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-07-11T11:31:17Z",
"details": "low"
}
],
"title": "CVE-2016-2857"
},
{
"cve": "CVE-2016-2858",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-2858"
}
],
"notes": [
{
"category": "general",
"text": "QEMU, when built with the Pseudo Random Number Generator (PRNG) back-end support, allows local guest OS users to cause a denial of service (process crash) via an entropy request, which triggers arbitrary stack based allocation and memory corruption.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-2858",
"url": "https://www.suse.com/security/cve/CVE-2016-2858"
},
{
"category": "external",
"summary": "SUSE Bug 970036 for CVE-2016-2858",
"url": "https://bugzilla.suse.com/970036"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-07-11T11:31:17Z",
"details": "low"
}
],
"title": "CVE-2016-2858"
},
{
"cve": "CVE-2016-3710",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-3710"
}
],
"notes": [
{
"category": "general",
"text": "The VGA module in QEMU improperly performs bounds checking on banked access to video memory, which allows local guest OS administrators to execute arbitrary code on the host by changing access modes after setting the bank register, aka the \"Dark Portal\" issue.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-3710",
"url": "https://www.suse.com/security/cve/CVE-2016-3710"
},
{
"category": "external",
"summary": "SUSE Bug 978158 for CVE-2016-3710",
"url": "https://bugzilla.suse.com/978158"
},
{
"category": "external",
"summary": "SUSE Bug 978164 for CVE-2016-3710",
"url": "https://bugzilla.suse.com/978164"
},
{
"category": "external",
"summary": "SUSE Bug 978167 for CVE-2016-3710",
"url": "https://bugzilla.suse.com/978167"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-07-11T11:31:17Z",
"details": "moderate"
}
],
"title": "CVE-2016-3710"
},
{
"cve": "CVE-2016-3712",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-3712"
}
],
"notes": [
{
"category": "general",
"text": "Integer overflow in the VGA module in QEMU allows local guest OS users to cause a denial of service (out-of-bounds read and QEMU process crash) by editing VGA registers in VBE mode.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-3712",
"url": "https://www.suse.com/security/cve/CVE-2016-3712"
},
{
"category": "external",
"summary": "SUSE Bug 978160 for CVE-2016-3712",
"url": "https://bugzilla.suse.com/978160"
},
{
"category": "external",
"summary": "SUSE Bug 978164 for CVE-2016-3712",
"url": "https://bugzilla.suse.com/978164"
},
{
"category": "external",
"summary": "SUSE Bug 978167 for CVE-2016-3712",
"url": "https://bugzilla.suse.com/978167"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-07-11T11:31:17Z",
"details": "low"
}
],
"title": "CVE-2016-3712"
},
{
"cve": "CVE-2016-4001",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-4001"
}
],
"notes": [
{
"category": "general",
"text": "Buffer overflow in the stellaris_enet_receive function in hw/net/stellaris_enet.c in QEMU, when the Stellaris ethernet controller is configured to accept large packets, allows remote attackers to cause a denial of service (QEMU crash) via a large packet.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-4001",
"url": "https://www.suse.com/security/cve/CVE-2016-4001"
},
{
"category": "external",
"summary": "SUSE Bug 975128 for CVE-2016-4001",
"url": "https://bugzilla.suse.com/975128"
},
{
"category": "external",
"summary": "SUSE Bug 975130 for CVE-2016-4001",
"url": "https://bugzilla.suse.com/975130"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-07-11T11:31:17Z",
"details": "moderate"
}
],
"title": "CVE-2016-4001"
},
{
"cve": "CVE-2016-4002",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-4002"
}
],
"notes": [
{
"category": "general",
"text": "Buffer overflow in the mipsnet_receive function in hw/net/mipsnet.c in QEMU, when the guest NIC is configured to accept large packets, allows remote attackers to cause a denial of service (memory corruption and QEMU crash) or possibly execute arbitrary code via a packet larger than 1514 bytes.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-4002",
"url": "https://www.suse.com/security/cve/CVE-2016-4002"
},
{
"category": "external",
"summary": "SUSE Bug 975136 for CVE-2016-4002",
"url": "https://bugzilla.suse.com/975136"
},
{
"category": "external",
"summary": "SUSE Bug 975138 for CVE-2016-4002",
"url": "https://bugzilla.suse.com/975138"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-07-11T11:31:17Z",
"details": "moderate"
}
],
"title": "CVE-2016-4002"
},
{
"cve": "CVE-2016-4020",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-4020"
}
],
"notes": [
{
"category": "general",
"text": "The patch_instruction function in hw/i386/kvmvapic.c in QEMU does not initialize the imm32 variable, which allows local guest OS administrators to obtain sensitive information from host stack memory by accessing the Task Priority Register (TPR).",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-4020",
"url": "https://www.suse.com/security/cve/CVE-2016-4020"
},
{
"category": "external",
"summary": "SUSE Bug 975700 for CVE-2016-4020",
"url": "https://bugzilla.suse.com/975700"
},
{
"category": "external",
"summary": "SUSE Bug 975907 for CVE-2016-4020",
"url": "https://bugzilla.suse.com/975907"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-07-11T11:31:17Z",
"details": "low"
}
],
"title": "CVE-2016-4020"
},
{
"cve": "CVE-2016-4037",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-4037"
}
],
"notes": [
{
"category": "general",
"text": "The ehci_advance_state function in hw/usb/hcd-ehci.c in QEMU allows local guest OS administrators to cause a denial of service (infinite loop and CPU consumption) via a circular split isochronous transfer descriptor (siTD) list, a related issue to CVE-2015-8558.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-4037",
"url": "https://www.suse.com/security/cve/CVE-2016-4037"
},
{
"category": "external",
"summary": "SUSE Bug 959005 for CVE-2016-4037",
"url": "https://bugzilla.suse.com/959005"
},
{
"category": "external",
"summary": "SUSE Bug 959006 for CVE-2016-4037",
"url": "https://bugzilla.suse.com/959006"
},
{
"category": "external",
"summary": "SUSE Bug 976109 for CVE-2016-4037",
"url": "https://bugzilla.suse.com/976109"
},
{
"category": "external",
"summary": "SUSE Bug 976111 for CVE-2016-4037",
"url": "https://bugzilla.suse.com/976111"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-07-11T11:31:17Z",
"details": "low"
}
],
"title": "CVE-2016-4037"
},
{
"cve": "CVE-2016-4439",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-4439"
}
],
"notes": [
{
"category": "general",
"text": "The esp_reg_write function in hw/scsi/esp.c in the 53C9X Fast SCSI Controller (FSC) support in QEMU does not properly check command buffer length, which allows local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) or potentially execute arbitrary code on the QEMU host via unspecified vectors.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-4439",
"url": "https://www.suse.com/security/cve/CVE-2016-4439"
},
{
"category": "external",
"summary": "SUSE Bug 980711 for CVE-2016-4439",
"url": "https://bugzilla.suse.com/980711"
},
{
"category": "external",
"summary": "SUSE Bug 980716 for CVE-2016-4439",
"url": "https://bugzilla.suse.com/980716"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-07-11T11:31:17Z",
"details": "low"
}
],
"title": "CVE-2016-4439"
},
{
"cve": "CVE-2016-4441",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-4441"
}
],
"notes": [
{
"category": "general",
"text": "The get_cmd function in hw/scsi/esp.c in the 53C9X Fast SCSI Controller (FSC) support in QEMU does not properly check DMA length, which allows local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) via unspecified vectors, involving an SCSI command.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-4441",
"url": "https://www.suse.com/security/cve/CVE-2016-4441"
},
{
"category": "external",
"summary": "SUSE Bug 980723 for CVE-2016-4441",
"url": "https://bugzilla.suse.com/980723"
},
{
"category": "external",
"summary": "SUSE Bug 980724 for CVE-2016-4441",
"url": "https://bugzilla.suse.com/980724"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:kvm-1.4.2-44.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:kvm-1.4.2-44.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-07-11T11:31:17Z",
"details": "low"
}
],
"title": "CVE-2016-4441"
}
]
}
suse-su-2015:1782-1
Vulnerability from csaf_suse
Published
2015-09-28 09:38
Modified
2015-09-28 09:38
Summary
Security update for qemu
Notes
Title of the patch
Security update for qemu
Description of the patch
qemu was updated to fix several security issues and bugs.
The following vulnerabilities were fixed:
- CVE-2015-5154: Heap-based buffer overflow in the IDE subsystem in QEMU,
when the container has a CDROM drive enabled, allows local guest users
to execute arbitrary code on the host via unspecified ATAPI commands.
(bsc#938344).
- CVE-2015-5278: QEMU was vulnerable to an infinite loop issue that
could occur when receiving packets over the network. (bsc#945989)
- CVE-2015-5279: QEMU was vulnerable to a heap buffer overflow issue
that could occur when receiving packets over the network. (bsc#945987)
- CVE-2015-6855: QEMU was vulnerable to a divide by zero issue that could
occur while executing an IDE command WIN_READ_NATIVE_MAX to determine
the maximum size of a drive. (bsc#945404)
- CVE-2014-7815: The set_pixel_format function in ui/vnc.c in QEMU
allowed remote attackers to cause a denial of service (crash) via a small
bytes_per_pixel value. (bsc#902737):
Also these non-security issues were fixed:
- bsc#937572: Fixed dictzip on big endian systems
- bsc#934517: Fix 'info tlb' causes guest to freeze
- bsc#934506: Fix vte monitor consol looks empy
- bsc#937125: Fix parsing of scsi-disk wwn uint64 property
- bsc#945778: Drop .probe hooks for DictZip and tar block drivers
- bsc#937572: Fold common-obj-y -> block-obj-y change into original patches
- bsc#928308,bsc#944017: Fix virtio-ccw index errors when initrd gets too large
- bsc#936537: Fix possible qemu-img error when converting to compressed qcow2 image
- bsc#939216: Fix reboot fail after install using uefi
- bsc#943446: qemu-img convert doesn't create MB aligned VHDs anymore
Patchnames
SUSE-SLE-DESKTOP-12-2015-715,SUSE-SLE-SERVER-12-2015-715
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for qemu",
"title": "Title of the patch"
},
{
"category": "description",
"text": "qemu was updated to fix several security issues and bugs.\n\nThe following vulnerabilities were fixed:\n- CVE-2015-5154: Heap-based buffer overflow in the IDE subsystem in QEMU,\n when the container has a CDROM drive enabled, allows local guest users\n to execute arbitrary code on the host via unspecified ATAPI commands.\n (bsc#938344).\n- CVE-2015-5278: QEMU was vulnerable to an infinite loop issue that\n could occur when receiving packets over the network. (bsc#945989)\n- CVE-2015-5279: QEMU was vulnerable to a heap buffer overflow issue\n that could occur when receiving packets over the network. (bsc#945987)\n- CVE-2015-6855: QEMU was vulnerable to a divide by zero issue that could\n occur while executing an IDE command WIN_READ_NATIVE_MAX to determine\n the maximum size of a drive. (bsc#945404)\n- CVE-2014-7815: The set_pixel_format function in ui/vnc.c in QEMU\n allowed remote attackers to cause a denial of service (crash) via a small\n bytes_per_pixel value. (bsc#902737):\n\nAlso these non-security issues were fixed:\n- bsc#937572: Fixed dictzip on big endian systems \n- bsc#934517: Fix \u0027info tlb\u0027 causes guest to freeze\n- bsc#934506: Fix vte monitor consol looks empy\n- bsc#937125: Fix parsing of scsi-disk wwn uint64 property \n- bsc#945778: Drop .probe hooks for DictZip and tar block drivers\n- bsc#937572: Fold common-obj-y -\u003e block-obj-y change into original patches\n- bsc#928308,bsc#944017: Fix virtio-ccw index errors when initrd gets too large \n- bsc#936537: Fix possible qemu-img error when converting to compressed qcow2 image\n- bsc#939216: Fix reboot fail after install using uefi\n- bsc#943446: qemu-img convert doesn\u0027t create MB aligned VHDs anymore\n\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-SLE-DESKTOP-12-2015-715,SUSE-SLE-SERVER-12-2015-715",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2015_1782-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2015:1782-1",
"url": "https://www.suse.com/support/update/announcement/2015/suse-su-20151782-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2015:1782-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2015-October/001636.html"
},
{
"category": "self",
"summary": "SUSE Bug 902737",
"url": "https://bugzilla.suse.com/902737"
},
{
"category": "self",
"summary": "SUSE Bug 928308",
"url": "https://bugzilla.suse.com/928308"
},
{
"category": "self",
"summary": "SUSE Bug 934506",
"url": "https://bugzilla.suse.com/934506"
},
{
"category": "self",
"summary": "SUSE Bug 934517",
"url": "https://bugzilla.suse.com/934517"
},
{
"category": "self",
"summary": "SUSE Bug 936537",
"url": "https://bugzilla.suse.com/936537"
},
{
"category": "self",
"summary": "SUSE Bug 937125",
"url": "https://bugzilla.suse.com/937125"
},
{
"category": "self",
"summary": "SUSE Bug 937572",
"url": "https://bugzilla.suse.com/937572"
},
{
"category": "self",
"summary": "SUSE Bug 938344",
"url": "https://bugzilla.suse.com/938344"
},
{
"category": "self",
"summary": "SUSE Bug 939216",
"url": "https://bugzilla.suse.com/939216"
},
{
"category": "self",
"summary": "SUSE Bug 943446",
"url": "https://bugzilla.suse.com/943446"
},
{
"category": "self",
"summary": "SUSE Bug 944017",
"url": "https://bugzilla.suse.com/944017"
},
{
"category": "self",
"summary": "SUSE Bug 945404",
"url": "https://bugzilla.suse.com/945404"
},
{
"category": "self",
"summary": "SUSE Bug 945778",
"url": "https://bugzilla.suse.com/945778"
},
{
"category": "self",
"summary": "SUSE Bug 945987",
"url": "https://bugzilla.suse.com/945987"
},
{
"category": "self",
"summary": "SUSE Bug 945989",
"url": "https://bugzilla.suse.com/945989"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2014-7815 page",
"url": "https://www.suse.com/security/cve/CVE-2014-7815/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-5154 page",
"url": "https://www.suse.com/security/cve/CVE-2015-5154/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-5278 page",
"url": "https://www.suse.com/security/cve/CVE-2015-5278/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-5279 page",
"url": "https://www.suse.com/security/cve/CVE-2015-5279/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-6855 page",
"url": "https://www.suse.com/security/cve/CVE-2015-6855/"
}
],
"title": "Security update for qemu",
"tracking": {
"current_release_date": "2015-09-28T09:38:55Z",
"generator": {
"date": "2015-09-28T09:38:55Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2015:1782-1",
"initial_release_date": "2015-09-28T09:38:55Z",
"revision_history": [
{
"date": "2015-09-28T09:38:55Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "qemu-ipxe-1.0.0-48.9.1.noarch",
"product": {
"name": "qemu-ipxe-1.0.0-48.9.1.noarch",
"product_id": "qemu-ipxe-1.0.0-48.9.1.noarch"
}
},
{
"category": "product_version",
"name": "qemu-seabios-1.7.4-48.9.1.noarch",
"product": {
"name": "qemu-seabios-1.7.4-48.9.1.noarch",
"product_id": "qemu-seabios-1.7.4-48.9.1.noarch"
}
},
{
"category": "product_version",
"name": "qemu-sgabios-8-48.9.1.noarch",
"product": {
"name": "qemu-sgabios-8-48.9.1.noarch",
"product_id": "qemu-sgabios-8-48.9.1.noarch"
}
},
{
"category": "product_version",
"name": "qemu-vgabios-1.7.4-48.9.1.noarch",
"product": {
"name": "qemu-vgabios-1.7.4-48.9.1.noarch",
"product_id": "qemu-vgabios-1.7.4-48.9.1.noarch"
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-2.0.2-48.9.1.ppc64le",
"product": {
"name": "qemu-2.0.2-48.9.1.ppc64le",
"product_id": "qemu-2.0.2-48.9.1.ppc64le"
}
},
{
"category": "product_version",
"name": "qemu-block-curl-2.0.2-48.9.1.ppc64le",
"product": {
"name": "qemu-block-curl-2.0.2-48.9.1.ppc64le",
"product_id": "qemu-block-curl-2.0.2-48.9.1.ppc64le"
}
},
{
"category": "product_version",
"name": "qemu-guest-agent-2.0.2-48.9.1.ppc64le",
"product": {
"name": "qemu-guest-agent-2.0.2-48.9.1.ppc64le",
"product_id": "qemu-guest-agent-2.0.2-48.9.1.ppc64le"
}
},
{
"category": "product_version",
"name": "qemu-lang-2.0.2-48.9.1.ppc64le",
"product": {
"name": "qemu-lang-2.0.2-48.9.1.ppc64le",
"product_id": "qemu-lang-2.0.2-48.9.1.ppc64le"
}
},
{
"category": "product_version",
"name": "qemu-ppc-2.0.2-48.9.1.ppc64le",
"product": {
"name": "qemu-ppc-2.0.2-48.9.1.ppc64le",
"product_id": "qemu-ppc-2.0.2-48.9.1.ppc64le"
}
},
{
"category": "product_version",
"name": "qemu-tools-2.0.2-48.9.1.ppc64le",
"product": {
"name": "qemu-tools-2.0.2-48.9.1.ppc64le",
"product_id": "qemu-tools-2.0.2-48.9.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-2.0.2-48.9.1.s390x",
"product": {
"name": "qemu-2.0.2-48.9.1.s390x",
"product_id": "qemu-2.0.2-48.9.1.s390x"
}
},
{
"category": "product_version",
"name": "qemu-block-curl-2.0.2-48.9.1.s390x",
"product": {
"name": "qemu-block-curl-2.0.2-48.9.1.s390x",
"product_id": "qemu-block-curl-2.0.2-48.9.1.s390x"
}
},
{
"category": "product_version",
"name": "qemu-guest-agent-2.0.2-48.9.1.s390x",
"product": {
"name": "qemu-guest-agent-2.0.2-48.9.1.s390x",
"product_id": "qemu-guest-agent-2.0.2-48.9.1.s390x"
}
},
{
"category": "product_version",
"name": "qemu-kvm-2.0.2-48.9.1.s390x",
"product": {
"name": "qemu-kvm-2.0.2-48.9.1.s390x",
"product_id": "qemu-kvm-2.0.2-48.9.1.s390x"
}
},
{
"category": "product_version",
"name": "qemu-lang-2.0.2-48.9.1.s390x",
"product": {
"name": "qemu-lang-2.0.2-48.9.1.s390x",
"product_id": "qemu-lang-2.0.2-48.9.1.s390x"
}
},
{
"category": "product_version",
"name": "qemu-s390-2.0.2-48.9.1.s390x",
"product": {
"name": "qemu-s390-2.0.2-48.9.1.s390x",
"product_id": "qemu-s390-2.0.2-48.9.1.s390x"
}
},
{
"category": "product_version",
"name": "qemu-tools-2.0.2-48.9.1.s390x",
"product": {
"name": "qemu-tools-2.0.2-48.9.1.s390x",
"product_id": "qemu-tools-2.0.2-48.9.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-2.0.2-48.9.1.x86_64",
"product": {
"name": "qemu-2.0.2-48.9.1.x86_64",
"product_id": "qemu-2.0.2-48.9.1.x86_64"
}
},
{
"category": "product_version",
"name": "qemu-block-curl-2.0.2-48.9.1.x86_64",
"product": {
"name": "qemu-block-curl-2.0.2-48.9.1.x86_64",
"product_id": "qemu-block-curl-2.0.2-48.9.1.x86_64"
}
},
{
"category": "product_version",
"name": "qemu-kvm-2.0.2-48.9.1.x86_64",
"product": {
"name": "qemu-kvm-2.0.2-48.9.1.x86_64",
"product_id": "qemu-kvm-2.0.2-48.9.1.x86_64"
}
},
{
"category": "product_version",
"name": "qemu-tools-2.0.2-48.9.1.x86_64",
"product": {
"name": "qemu-tools-2.0.2-48.9.1.x86_64",
"product_id": "qemu-tools-2.0.2-48.9.1.x86_64"
}
},
{
"category": "product_version",
"name": "qemu-x86-2.0.2-48.9.1.x86_64",
"product": {
"name": "qemu-x86-2.0.2-48.9.1.x86_64",
"product_id": "qemu-x86-2.0.2-48.9.1.x86_64"
}
},
{
"category": "product_version",
"name": "qemu-block-rbd-2.0.2-48.9.1.x86_64",
"product": {
"name": "qemu-block-rbd-2.0.2-48.9.1.x86_64",
"product_id": "qemu-block-rbd-2.0.2-48.9.1.x86_64"
}
},
{
"category": "product_version",
"name": "qemu-guest-agent-2.0.2-48.9.1.x86_64",
"product": {
"name": "qemu-guest-agent-2.0.2-48.9.1.x86_64",
"product_id": "qemu-guest-agent-2.0.2-48.9.1.x86_64"
}
},
{
"category": "product_version",
"name": "qemu-lang-2.0.2-48.9.1.x86_64",
"product": {
"name": "qemu-lang-2.0.2-48.9.1.x86_64",
"product_id": "qemu-lang-2.0.2-48.9.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Desktop 12",
"product": {
"name": "SUSE Linux Enterprise Desktop 12",
"product_id": "SUSE Linux Enterprise Desktop 12",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sled:12"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 12",
"product": {
"name": "SUSE Linux Enterprise Server 12",
"product_id": "SUSE Linux Enterprise Server 12",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:12"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP Applications 12",
"product": {
"name": "SUSE Linux Enterprise Server for SAP Applications 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles_sap:12"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-2.0.2-48.9.1.x86_64 as component of SUSE Linux Enterprise Desktop 12",
"product_id": "SUSE Linux Enterprise Desktop 12:qemu-2.0.2-48.9.1.x86_64"
},
"product_reference": "qemu-2.0.2-48.9.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Desktop 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-block-curl-2.0.2-48.9.1.x86_64 as component of SUSE Linux Enterprise Desktop 12",
"product_id": "SUSE Linux Enterprise Desktop 12:qemu-block-curl-2.0.2-48.9.1.x86_64"
},
"product_reference": "qemu-block-curl-2.0.2-48.9.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Desktop 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-ipxe-1.0.0-48.9.1.noarch as component of SUSE Linux Enterprise Desktop 12",
"product_id": "SUSE Linux Enterprise Desktop 12:qemu-ipxe-1.0.0-48.9.1.noarch"
},
"product_reference": "qemu-ipxe-1.0.0-48.9.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Desktop 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-2.0.2-48.9.1.x86_64 as component of SUSE Linux Enterprise Desktop 12",
"product_id": "SUSE Linux Enterprise Desktop 12:qemu-kvm-2.0.2-48.9.1.x86_64"
},
"product_reference": "qemu-kvm-2.0.2-48.9.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Desktop 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-seabios-1.7.4-48.9.1.noarch as component of SUSE Linux Enterprise Desktop 12",
"product_id": "SUSE Linux Enterprise Desktop 12:qemu-seabios-1.7.4-48.9.1.noarch"
},
"product_reference": "qemu-seabios-1.7.4-48.9.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Desktop 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-sgabios-8-48.9.1.noarch as component of SUSE Linux Enterprise Desktop 12",
"product_id": "SUSE Linux Enterprise Desktop 12:qemu-sgabios-8-48.9.1.noarch"
},
"product_reference": "qemu-sgabios-8-48.9.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Desktop 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-tools-2.0.2-48.9.1.x86_64 as component of SUSE Linux Enterprise Desktop 12",
"product_id": "SUSE Linux Enterprise Desktop 12:qemu-tools-2.0.2-48.9.1.x86_64"
},
"product_reference": "qemu-tools-2.0.2-48.9.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Desktop 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-vgabios-1.7.4-48.9.1.noarch as component of SUSE Linux Enterprise Desktop 12",
"product_id": "SUSE Linux Enterprise Desktop 12:qemu-vgabios-1.7.4-48.9.1.noarch"
},
"product_reference": "qemu-vgabios-1.7.4-48.9.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Desktop 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-x86-2.0.2-48.9.1.x86_64 as component of SUSE Linux Enterprise Desktop 12",
"product_id": "SUSE Linux Enterprise Desktop 12:qemu-x86-2.0.2-48.9.1.x86_64"
},
"product_reference": "qemu-x86-2.0.2-48.9.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Desktop 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-2.0.2-48.9.1.ppc64le as component of SUSE Linux Enterprise Server 12",
"product_id": "SUSE Linux Enterprise Server 12:qemu-2.0.2-48.9.1.ppc64le"
},
"product_reference": "qemu-2.0.2-48.9.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-2.0.2-48.9.1.s390x as component of SUSE Linux Enterprise Server 12",
"product_id": "SUSE Linux Enterprise Server 12:qemu-2.0.2-48.9.1.s390x"
},
"product_reference": "qemu-2.0.2-48.9.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-2.0.2-48.9.1.x86_64 as component of SUSE Linux Enterprise Server 12",
"product_id": "SUSE Linux Enterprise Server 12:qemu-2.0.2-48.9.1.x86_64"
},
"product_reference": "qemu-2.0.2-48.9.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-block-curl-2.0.2-48.9.1.ppc64le as component of SUSE Linux Enterprise Server 12",
"product_id": "SUSE Linux Enterprise Server 12:qemu-block-curl-2.0.2-48.9.1.ppc64le"
},
"product_reference": "qemu-block-curl-2.0.2-48.9.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-block-curl-2.0.2-48.9.1.s390x as component of SUSE Linux Enterprise Server 12",
"product_id": "SUSE Linux Enterprise Server 12:qemu-block-curl-2.0.2-48.9.1.s390x"
},
"product_reference": "qemu-block-curl-2.0.2-48.9.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-block-curl-2.0.2-48.9.1.x86_64 as component of SUSE Linux Enterprise Server 12",
"product_id": "SUSE Linux Enterprise Server 12:qemu-block-curl-2.0.2-48.9.1.x86_64"
},
"product_reference": "qemu-block-curl-2.0.2-48.9.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-block-rbd-2.0.2-48.9.1.x86_64 as component of SUSE Linux Enterprise Server 12",
"product_id": "SUSE Linux Enterprise Server 12:qemu-block-rbd-2.0.2-48.9.1.x86_64"
},
"product_reference": "qemu-block-rbd-2.0.2-48.9.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-guest-agent-2.0.2-48.9.1.ppc64le as component of SUSE Linux Enterprise Server 12",
"product_id": "SUSE Linux Enterprise Server 12:qemu-guest-agent-2.0.2-48.9.1.ppc64le"
},
"product_reference": "qemu-guest-agent-2.0.2-48.9.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-guest-agent-2.0.2-48.9.1.s390x as component of SUSE Linux Enterprise Server 12",
"product_id": "SUSE Linux Enterprise Server 12:qemu-guest-agent-2.0.2-48.9.1.s390x"
},
"product_reference": "qemu-guest-agent-2.0.2-48.9.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-guest-agent-2.0.2-48.9.1.x86_64 as component of SUSE Linux Enterprise Server 12",
"product_id": "SUSE Linux Enterprise Server 12:qemu-guest-agent-2.0.2-48.9.1.x86_64"
},
"product_reference": "qemu-guest-agent-2.0.2-48.9.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-ipxe-1.0.0-48.9.1.noarch as component of SUSE Linux Enterprise Server 12",
"product_id": "SUSE Linux Enterprise Server 12:qemu-ipxe-1.0.0-48.9.1.noarch"
},
"product_reference": "qemu-ipxe-1.0.0-48.9.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-2.0.2-48.9.1.s390x as component of SUSE Linux Enterprise Server 12",
"product_id": "SUSE Linux Enterprise Server 12:qemu-kvm-2.0.2-48.9.1.s390x"
},
"product_reference": "qemu-kvm-2.0.2-48.9.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-2.0.2-48.9.1.x86_64 as component of SUSE Linux Enterprise Server 12",
"product_id": "SUSE Linux Enterprise Server 12:qemu-kvm-2.0.2-48.9.1.x86_64"
},
"product_reference": "qemu-kvm-2.0.2-48.9.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-lang-2.0.2-48.9.1.ppc64le as component of SUSE Linux Enterprise Server 12",
"product_id": "SUSE Linux Enterprise Server 12:qemu-lang-2.0.2-48.9.1.ppc64le"
},
"product_reference": "qemu-lang-2.0.2-48.9.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-lang-2.0.2-48.9.1.s390x as component of SUSE Linux Enterprise Server 12",
"product_id": "SUSE Linux Enterprise Server 12:qemu-lang-2.0.2-48.9.1.s390x"
},
"product_reference": "qemu-lang-2.0.2-48.9.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-lang-2.0.2-48.9.1.x86_64 as component of SUSE Linux Enterprise Server 12",
"product_id": "SUSE Linux Enterprise Server 12:qemu-lang-2.0.2-48.9.1.x86_64"
},
"product_reference": "qemu-lang-2.0.2-48.9.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-ppc-2.0.2-48.9.1.ppc64le as component of SUSE Linux Enterprise Server 12",
"product_id": "SUSE Linux Enterprise Server 12:qemu-ppc-2.0.2-48.9.1.ppc64le"
},
"product_reference": "qemu-ppc-2.0.2-48.9.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-s390-2.0.2-48.9.1.s390x as component of SUSE Linux Enterprise Server 12",
"product_id": "SUSE Linux Enterprise Server 12:qemu-s390-2.0.2-48.9.1.s390x"
},
"product_reference": "qemu-s390-2.0.2-48.9.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-seabios-1.7.4-48.9.1.noarch as component of SUSE Linux Enterprise Server 12",
"product_id": "SUSE Linux Enterprise Server 12:qemu-seabios-1.7.4-48.9.1.noarch"
},
"product_reference": "qemu-seabios-1.7.4-48.9.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-sgabios-8-48.9.1.noarch as component of SUSE Linux Enterprise Server 12",
"product_id": "SUSE Linux Enterprise Server 12:qemu-sgabios-8-48.9.1.noarch"
},
"product_reference": "qemu-sgabios-8-48.9.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-tools-2.0.2-48.9.1.ppc64le as component of SUSE Linux Enterprise Server 12",
"product_id": "SUSE Linux Enterprise Server 12:qemu-tools-2.0.2-48.9.1.ppc64le"
},
"product_reference": "qemu-tools-2.0.2-48.9.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-tools-2.0.2-48.9.1.s390x as component of SUSE Linux Enterprise Server 12",
"product_id": "SUSE Linux Enterprise Server 12:qemu-tools-2.0.2-48.9.1.s390x"
},
"product_reference": "qemu-tools-2.0.2-48.9.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-tools-2.0.2-48.9.1.x86_64 as component of SUSE Linux Enterprise Server 12",
"product_id": "SUSE Linux Enterprise Server 12:qemu-tools-2.0.2-48.9.1.x86_64"
},
"product_reference": "qemu-tools-2.0.2-48.9.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-vgabios-1.7.4-48.9.1.noarch as component of SUSE Linux Enterprise Server 12",
"product_id": "SUSE Linux Enterprise Server 12:qemu-vgabios-1.7.4-48.9.1.noarch"
},
"product_reference": "qemu-vgabios-1.7.4-48.9.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-x86-2.0.2-48.9.1.x86_64 as component of SUSE Linux Enterprise Server 12",
"product_id": "SUSE Linux Enterprise Server 12:qemu-x86-2.0.2-48.9.1.x86_64"
},
"product_reference": "qemu-x86-2.0.2-48.9.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-2.0.2-48.9.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12:qemu-2.0.2-48.9.1.ppc64le"
},
"product_reference": "qemu-2.0.2-48.9.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-2.0.2-48.9.1.s390x as component of SUSE Linux Enterprise Server for SAP Applications 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12:qemu-2.0.2-48.9.1.s390x"
},
"product_reference": "qemu-2.0.2-48.9.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-2.0.2-48.9.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12:qemu-2.0.2-48.9.1.x86_64"
},
"product_reference": "qemu-2.0.2-48.9.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-block-curl-2.0.2-48.9.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-curl-2.0.2-48.9.1.ppc64le"
},
"product_reference": "qemu-block-curl-2.0.2-48.9.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-block-curl-2.0.2-48.9.1.s390x as component of SUSE Linux Enterprise Server for SAP Applications 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-curl-2.0.2-48.9.1.s390x"
},
"product_reference": "qemu-block-curl-2.0.2-48.9.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-block-curl-2.0.2-48.9.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-curl-2.0.2-48.9.1.x86_64"
},
"product_reference": "qemu-block-curl-2.0.2-48.9.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-block-rbd-2.0.2-48.9.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-rbd-2.0.2-48.9.1.x86_64"
},
"product_reference": "qemu-block-rbd-2.0.2-48.9.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-guest-agent-2.0.2-48.9.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12:qemu-guest-agent-2.0.2-48.9.1.ppc64le"
},
"product_reference": "qemu-guest-agent-2.0.2-48.9.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-guest-agent-2.0.2-48.9.1.s390x as component of SUSE Linux Enterprise Server for SAP Applications 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12:qemu-guest-agent-2.0.2-48.9.1.s390x"
},
"product_reference": "qemu-guest-agent-2.0.2-48.9.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-guest-agent-2.0.2-48.9.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12:qemu-guest-agent-2.0.2-48.9.1.x86_64"
},
"product_reference": "qemu-guest-agent-2.0.2-48.9.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-ipxe-1.0.0-48.9.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12:qemu-ipxe-1.0.0-48.9.1.noarch"
},
"product_reference": "qemu-ipxe-1.0.0-48.9.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-2.0.2-48.9.1.s390x as component of SUSE Linux Enterprise Server for SAP Applications 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12:qemu-kvm-2.0.2-48.9.1.s390x"
},
"product_reference": "qemu-kvm-2.0.2-48.9.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-2.0.2-48.9.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12:qemu-kvm-2.0.2-48.9.1.x86_64"
},
"product_reference": "qemu-kvm-2.0.2-48.9.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-lang-2.0.2-48.9.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12:qemu-lang-2.0.2-48.9.1.ppc64le"
},
"product_reference": "qemu-lang-2.0.2-48.9.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-lang-2.0.2-48.9.1.s390x as component of SUSE Linux Enterprise Server for SAP Applications 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12:qemu-lang-2.0.2-48.9.1.s390x"
},
"product_reference": "qemu-lang-2.0.2-48.9.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-lang-2.0.2-48.9.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12:qemu-lang-2.0.2-48.9.1.x86_64"
},
"product_reference": "qemu-lang-2.0.2-48.9.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-ppc-2.0.2-48.9.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12:qemu-ppc-2.0.2-48.9.1.ppc64le"
},
"product_reference": "qemu-ppc-2.0.2-48.9.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-s390-2.0.2-48.9.1.s390x as component of SUSE Linux Enterprise Server for SAP Applications 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12:qemu-s390-2.0.2-48.9.1.s390x"
},
"product_reference": "qemu-s390-2.0.2-48.9.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-seabios-1.7.4-48.9.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12:qemu-seabios-1.7.4-48.9.1.noarch"
},
"product_reference": "qemu-seabios-1.7.4-48.9.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-sgabios-8-48.9.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12:qemu-sgabios-8-48.9.1.noarch"
},
"product_reference": "qemu-sgabios-8-48.9.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-tools-2.0.2-48.9.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12:qemu-tools-2.0.2-48.9.1.ppc64le"
},
"product_reference": "qemu-tools-2.0.2-48.9.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-tools-2.0.2-48.9.1.s390x as component of SUSE Linux Enterprise Server for SAP Applications 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12:qemu-tools-2.0.2-48.9.1.s390x"
},
"product_reference": "qemu-tools-2.0.2-48.9.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-tools-2.0.2-48.9.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12:qemu-tools-2.0.2-48.9.1.x86_64"
},
"product_reference": "qemu-tools-2.0.2-48.9.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-vgabios-1.7.4-48.9.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12:qemu-vgabios-1.7.4-48.9.1.noarch"
},
"product_reference": "qemu-vgabios-1.7.4-48.9.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-x86-2.0.2-48.9.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12:qemu-x86-2.0.2-48.9.1.x86_64"
},
"product_reference": "qemu-x86-2.0.2-48.9.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2014-7815",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2014-7815"
}
],
"notes": [
{
"category": "general",
"text": "The set_pixel_format function in ui/vnc.c in QEMU allows remote attackers to cause a denial of service (crash) via a small bytes_per_pixel value.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Desktop 12:qemu-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Desktop 12:qemu-block-curl-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Desktop 12:qemu-ipxe-1.0.0-48.9.1.noarch",
"SUSE Linux Enterprise Desktop 12:qemu-kvm-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Desktop 12:qemu-seabios-1.7.4-48.9.1.noarch",
"SUSE Linux Enterprise Desktop 12:qemu-sgabios-8-48.9.1.noarch",
"SUSE Linux Enterprise Desktop 12:qemu-tools-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Desktop 12:qemu-vgabios-1.7.4-48.9.1.noarch",
"SUSE Linux Enterprise Desktop 12:qemu-x86-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-block-curl-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-block-curl-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-block-curl-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-block-rbd-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-guest-agent-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-guest-agent-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-guest-agent-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-ipxe-1.0.0-48.9.1.noarch",
"SUSE Linux Enterprise Server 12:qemu-kvm-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-kvm-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-lang-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-lang-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-lang-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-ppc-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-s390-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-seabios-1.7.4-48.9.1.noarch",
"SUSE Linux Enterprise Server 12:qemu-sgabios-8-48.9.1.noarch",
"SUSE Linux Enterprise Server 12:qemu-tools-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-tools-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-tools-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-vgabios-1.7.4-48.9.1.noarch",
"SUSE Linux Enterprise Server 12:qemu-x86-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-curl-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-curl-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-curl-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-rbd-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-guest-agent-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-guest-agent-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-guest-agent-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-ipxe-1.0.0-48.9.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-kvm-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-kvm-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-lang-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-lang-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-lang-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-ppc-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-s390-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-seabios-1.7.4-48.9.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-sgabios-8-48.9.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-tools-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-tools-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-tools-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-vgabios-1.7.4-48.9.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-x86-2.0.2-48.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2014-7815",
"url": "https://www.suse.com/security/cve/CVE-2014-7815"
},
{
"category": "external",
"summary": "SUSE Bug 902737 for CVE-2014-7815",
"url": "https://bugzilla.suse.com/902737"
},
{
"category": "external",
"summary": "SUSE Bug 962627 for CVE-2014-7815",
"url": "https://bugzilla.suse.com/962627"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Desktop 12:qemu-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Desktop 12:qemu-block-curl-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Desktop 12:qemu-ipxe-1.0.0-48.9.1.noarch",
"SUSE Linux Enterprise Desktop 12:qemu-kvm-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Desktop 12:qemu-seabios-1.7.4-48.9.1.noarch",
"SUSE Linux Enterprise Desktop 12:qemu-sgabios-8-48.9.1.noarch",
"SUSE Linux Enterprise Desktop 12:qemu-tools-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Desktop 12:qemu-vgabios-1.7.4-48.9.1.noarch",
"SUSE Linux Enterprise Desktop 12:qemu-x86-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-block-curl-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-block-curl-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-block-curl-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-block-rbd-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-guest-agent-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-guest-agent-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-guest-agent-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-ipxe-1.0.0-48.9.1.noarch",
"SUSE Linux Enterprise Server 12:qemu-kvm-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-kvm-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-lang-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-lang-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-lang-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-ppc-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-s390-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-seabios-1.7.4-48.9.1.noarch",
"SUSE Linux Enterprise Server 12:qemu-sgabios-8-48.9.1.noarch",
"SUSE Linux Enterprise Server 12:qemu-tools-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-tools-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-tools-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-vgabios-1.7.4-48.9.1.noarch",
"SUSE Linux Enterprise Server 12:qemu-x86-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-curl-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-curl-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-curl-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-rbd-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-guest-agent-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-guest-agent-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-guest-agent-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-ipxe-1.0.0-48.9.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-kvm-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-kvm-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-lang-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-lang-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-lang-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-ppc-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-s390-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-seabios-1.7.4-48.9.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-sgabios-8-48.9.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-tools-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-tools-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-tools-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-vgabios-1.7.4-48.9.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-x86-2.0.2-48.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2015-09-28T09:38:55Z",
"details": "moderate"
}
],
"title": "CVE-2014-7815"
},
{
"cve": "CVE-2015-5154",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-5154"
}
],
"notes": [
{
"category": "general",
"text": "Heap-based buffer overflow in the IDE subsystem in QEMU, as used in Xen 4.5.x and earlier, when the container has a CDROM drive enabled, allows local guest users to execute arbitrary code on the host via unspecified ATAPI commands.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Desktop 12:qemu-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Desktop 12:qemu-block-curl-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Desktop 12:qemu-ipxe-1.0.0-48.9.1.noarch",
"SUSE Linux Enterprise Desktop 12:qemu-kvm-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Desktop 12:qemu-seabios-1.7.4-48.9.1.noarch",
"SUSE Linux Enterprise Desktop 12:qemu-sgabios-8-48.9.1.noarch",
"SUSE Linux Enterprise Desktop 12:qemu-tools-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Desktop 12:qemu-vgabios-1.7.4-48.9.1.noarch",
"SUSE Linux Enterprise Desktop 12:qemu-x86-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-block-curl-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-block-curl-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-block-curl-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-block-rbd-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-guest-agent-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-guest-agent-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-guest-agent-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-ipxe-1.0.0-48.9.1.noarch",
"SUSE Linux Enterprise Server 12:qemu-kvm-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-kvm-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-lang-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-lang-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-lang-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-ppc-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-s390-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-seabios-1.7.4-48.9.1.noarch",
"SUSE Linux Enterprise Server 12:qemu-sgabios-8-48.9.1.noarch",
"SUSE Linux Enterprise Server 12:qemu-tools-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-tools-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-tools-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-vgabios-1.7.4-48.9.1.noarch",
"SUSE Linux Enterprise Server 12:qemu-x86-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-curl-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-curl-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-curl-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-rbd-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-guest-agent-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-guest-agent-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-guest-agent-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-ipxe-1.0.0-48.9.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-kvm-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-kvm-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-lang-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-lang-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-lang-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-ppc-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-s390-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-seabios-1.7.4-48.9.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-sgabios-8-48.9.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-tools-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-tools-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-tools-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-vgabios-1.7.4-48.9.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-x86-2.0.2-48.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-5154",
"url": "https://www.suse.com/security/cve/CVE-2015-5154"
},
{
"category": "external",
"summary": "SUSE Bug 938344 for CVE-2015-5154",
"url": "https://bugzilla.suse.com/938344"
},
{
"category": "external",
"summary": "SUSE Bug 950367 for CVE-2015-5154",
"url": "https://bugzilla.suse.com/950367"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Desktop 12:qemu-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Desktop 12:qemu-block-curl-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Desktop 12:qemu-ipxe-1.0.0-48.9.1.noarch",
"SUSE Linux Enterprise Desktop 12:qemu-kvm-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Desktop 12:qemu-seabios-1.7.4-48.9.1.noarch",
"SUSE Linux Enterprise Desktop 12:qemu-sgabios-8-48.9.1.noarch",
"SUSE Linux Enterprise Desktop 12:qemu-tools-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Desktop 12:qemu-vgabios-1.7.4-48.9.1.noarch",
"SUSE Linux Enterprise Desktop 12:qemu-x86-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-block-curl-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-block-curl-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-block-curl-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-block-rbd-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-guest-agent-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-guest-agent-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-guest-agent-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-ipxe-1.0.0-48.9.1.noarch",
"SUSE Linux Enterprise Server 12:qemu-kvm-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-kvm-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-lang-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-lang-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-lang-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-ppc-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-s390-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-seabios-1.7.4-48.9.1.noarch",
"SUSE Linux Enterprise Server 12:qemu-sgabios-8-48.9.1.noarch",
"SUSE Linux Enterprise Server 12:qemu-tools-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-tools-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-tools-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-vgabios-1.7.4-48.9.1.noarch",
"SUSE Linux Enterprise Server 12:qemu-x86-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-curl-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-curl-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-curl-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-rbd-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-guest-agent-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-guest-agent-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-guest-agent-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-ipxe-1.0.0-48.9.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-kvm-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-kvm-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-lang-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-lang-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-lang-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-ppc-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-s390-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-seabios-1.7.4-48.9.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-sgabios-8-48.9.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-tools-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-tools-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-tools-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-vgabios-1.7.4-48.9.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-x86-2.0.2-48.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2015-09-28T09:38:55Z",
"details": "important"
}
],
"title": "CVE-2015-5154"
},
{
"cve": "CVE-2015-5278",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-5278"
}
],
"notes": [
{
"category": "general",
"text": "The ne2000_receive function in hw/net/ne2000.c in QEMU before 2.4.0.1 allows attackers to cause a denial of service (infinite loop and instance crash) or possibly execute arbitrary code via vectors related to receiving packets.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Desktop 12:qemu-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Desktop 12:qemu-block-curl-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Desktop 12:qemu-ipxe-1.0.0-48.9.1.noarch",
"SUSE Linux Enterprise Desktop 12:qemu-kvm-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Desktop 12:qemu-seabios-1.7.4-48.9.1.noarch",
"SUSE Linux Enterprise Desktop 12:qemu-sgabios-8-48.9.1.noarch",
"SUSE Linux Enterprise Desktop 12:qemu-tools-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Desktop 12:qemu-vgabios-1.7.4-48.9.1.noarch",
"SUSE Linux Enterprise Desktop 12:qemu-x86-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-block-curl-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-block-curl-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-block-curl-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-block-rbd-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-guest-agent-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-guest-agent-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-guest-agent-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-ipxe-1.0.0-48.9.1.noarch",
"SUSE Linux Enterprise Server 12:qemu-kvm-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-kvm-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-lang-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-lang-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-lang-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-ppc-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-s390-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-seabios-1.7.4-48.9.1.noarch",
"SUSE Linux Enterprise Server 12:qemu-sgabios-8-48.9.1.noarch",
"SUSE Linux Enterprise Server 12:qemu-tools-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-tools-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-tools-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-vgabios-1.7.4-48.9.1.noarch",
"SUSE Linux Enterprise Server 12:qemu-x86-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-curl-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-curl-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-curl-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-rbd-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-guest-agent-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-guest-agent-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-guest-agent-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-ipxe-1.0.0-48.9.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-kvm-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-kvm-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-lang-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-lang-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-lang-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-ppc-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-s390-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-seabios-1.7.4-48.9.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-sgabios-8-48.9.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-tools-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-tools-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-tools-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-vgabios-1.7.4-48.9.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-x86-2.0.2-48.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-5278",
"url": "https://www.suse.com/security/cve/CVE-2015-5278"
},
{
"category": "external",
"summary": "SUSE Bug 945989 for CVE-2015-5278",
"url": "https://bugzilla.suse.com/945989"
},
{
"category": "external",
"summary": "SUSE Bug 964947 for CVE-2015-5278",
"url": "https://bugzilla.suse.com/964947"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Desktop 12:qemu-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Desktop 12:qemu-block-curl-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Desktop 12:qemu-ipxe-1.0.0-48.9.1.noarch",
"SUSE Linux Enterprise Desktop 12:qemu-kvm-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Desktop 12:qemu-seabios-1.7.4-48.9.1.noarch",
"SUSE Linux Enterprise Desktop 12:qemu-sgabios-8-48.9.1.noarch",
"SUSE Linux Enterprise Desktop 12:qemu-tools-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Desktop 12:qemu-vgabios-1.7.4-48.9.1.noarch",
"SUSE Linux Enterprise Desktop 12:qemu-x86-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-block-curl-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-block-curl-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-block-curl-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-block-rbd-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-guest-agent-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-guest-agent-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-guest-agent-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-ipxe-1.0.0-48.9.1.noarch",
"SUSE Linux Enterprise Server 12:qemu-kvm-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-kvm-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-lang-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-lang-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-lang-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-ppc-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-s390-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-seabios-1.7.4-48.9.1.noarch",
"SUSE Linux Enterprise Server 12:qemu-sgabios-8-48.9.1.noarch",
"SUSE Linux Enterprise Server 12:qemu-tools-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-tools-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-tools-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-vgabios-1.7.4-48.9.1.noarch",
"SUSE Linux Enterprise Server 12:qemu-x86-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-curl-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-curl-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-curl-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-rbd-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-guest-agent-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-guest-agent-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-guest-agent-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-ipxe-1.0.0-48.9.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-kvm-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-kvm-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-lang-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-lang-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-lang-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-ppc-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-s390-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-seabios-1.7.4-48.9.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-sgabios-8-48.9.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-tools-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-tools-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-tools-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-vgabios-1.7.4-48.9.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-x86-2.0.2-48.9.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Desktop 12:qemu-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Desktop 12:qemu-block-curl-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Desktop 12:qemu-ipxe-1.0.0-48.9.1.noarch",
"SUSE Linux Enterprise Desktop 12:qemu-kvm-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Desktop 12:qemu-seabios-1.7.4-48.9.1.noarch",
"SUSE Linux Enterprise Desktop 12:qemu-sgabios-8-48.9.1.noarch",
"SUSE Linux Enterprise Desktop 12:qemu-tools-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Desktop 12:qemu-vgabios-1.7.4-48.9.1.noarch",
"SUSE Linux Enterprise Desktop 12:qemu-x86-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-block-curl-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-block-curl-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-block-curl-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-block-rbd-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-guest-agent-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-guest-agent-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-guest-agent-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-ipxe-1.0.0-48.9.1.noarch",
"SUSE Linux Enterprise Server 12:qemu-kvm-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-kvm-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-lang-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-lang-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-lang-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-ppc-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-s390-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-seabios-1.7.4-48.9.1.noarch",
"SUSE Linux Enterprise Server 12:qemu-sgabios-8-48.9.1.noarch",
"SUSE Linux Enterprise Server 12:qemu-tools-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-tools-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-tools-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-vgabios-1.7.4-48.9.1.noarch",
"SUSE Linux Enterprise Server 12:qemu-x86-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-curl-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-curl-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-curl-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-rbd-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-guest-agent-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-guest-agent-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-guest-agent-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-ipxe-1.0.0-48.9.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-kvm-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-kvm-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-lang-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-lang-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-lang-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-ppc-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-s390-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-seabios-1.7.4-48.9.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-sgabios-8-48.9.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-tools-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-tools-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-tools-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-vgabios-1.7.4-48.9.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-x86-2.0.2-48.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2015-09-28T09:38:55Z",
"details": "moderate"
}
],
"title": "CVE-2015-5278"
},
{
"cve": "CVE-2015-5279",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-5279"
}
],
"notes": [
{
"category": "general",
"text": "Heap-based buffer overflow in the ne2000_receive function in hw/net/ne2000.c in QEMU before 2.4.0.1 allows guest OS users to cause a denial of service (instance crash) or possibly execute arbitrary code via vectors related to receiving packets.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Desktop 12:qemu-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Desktop 12:qemu-block-curl-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Desktop 12:qemu-ipxe-1.0.0-48.9.1.noarch",
"SUSE Linux Enterprise Desktop 12:qemu-kvm-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Desktop 12:qemu-seabios-1.7.4-48.9.1.noarch",
"SUSE Linux Enterprise Desktop 12:qemu-sgabios-8-48.9.1.noarch",
"SUSE Linux Enterprise Desktop 12:qemu-tools-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Desktop 12:qemu-vgabios-1.7.4-48.9.1.noarch",
"SUSE Linux Enterprise Desktop 12:qemu-x86-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-block-curl-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-block-curl-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-block-curl-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-block-rbd-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-guest-agent-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-guest-agent-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-guest-agent-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-ipxe-1.0.0-48.9.1.noarch",
"SUSE Linux Enterprise Server 12:qemu-kvm-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-kvm-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-lang-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-lang-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-lang-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-ppc-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-s390-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-seabios-1.7.4-48.9.1.noarch",
"SUSE Linux Enterprise Server 12:qemu-sgabios-8-48.9.1.noarch",
"SUSE Linux Enterprise Server 12:qemu-tools-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-tools-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-tools-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-vgabios-1.7.4-48.9.1.noarch",
"SUSE Linux Enterprise Server 12:qemu-x86-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-curl-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-curl-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-curl-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-rbd-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-guest-agent-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-guest-agent-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-guest-agent-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-ipxe-1.0.0-48.9.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-kvm-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-kvm-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-lang-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-lang-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-lang-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-ppc-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-s390-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-seabios-1.7.4-48.9.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-sgabios-8-48.9.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-tools-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-tools-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-tools-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-vgabios-1.7.4-48.9.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-x86-2.0.2-48.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-5279",
"url": "https://www.suse.com/security/cve/CVE-2015-5279"
},
{
"category": "external",
"summary": "SUSE Bug 945987 for CVE-2015-5279",
"url": "https://bugzilla.suse.com/945987"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Desktop 12:qemu-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Desktop 12:qemu-block-curl-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Desktop 12:qemu-ipxe-1.0.0-48.9.1.noarch",
"SUSE Linux Enterprise Desktop 12:qemu-kvm-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Desktop 12:qemu-seabios-1.7.4-48.9.1.noarch",
"SUSE Linux Enterprise Desktop 12:qemu-sgabios-8-48.9.1.noarch",
"SUSE Linux Enterprise Desktop 12:qemu-tools-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Desktop 12:qemu-vgabios-1.7.4-48.9.1.noarch",
"SUSE Linux Enterprise Desktop 12:qemu-x86-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-block-curl-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-block-curl-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-block-curl-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-block-rbd-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-guest-agent-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-guest-agent-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-guest-agent-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-ipxe-1.0.0-48.9.1.noarch",
"SUSE Linux Enterprise Server 12:qemu-kvm-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-kvm-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-lang-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-lang-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-lang-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-ppc-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-s390-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-seabios-1.7.4-48.9.1.noarch",
"SUSE Linux Enterprise Server 12:qemu-sgabios-8-48.9.1.noarch",
"SUSE Linux Enterprise Server 12:qemu-tools-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-tools-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-tools-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-vgabios-1.7.4-48.9.1.noarch",
"SUSE Linux Enterprise Server 12:qemu-x86-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-curl-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-curl-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-curl-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-rbd-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-guest-agent-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-guest-agent-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-guest-agent-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-ipxe-1.0.0-48.9.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-kvm-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-kvm-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-lang-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-lang-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-lang-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-ppc-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-s390-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-seabios-1.7.4-48.9.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-sgabios-8-48.9.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-tools-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-tools-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-tools-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-vgabios-1.7.4-48.9.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-x86-2.0.2-48.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2015-09-28T09:38:55Z",
"details": "important"
}
],
"title": "CVE-2015-5279"
},
{
"cve": "CVE-2015-6855",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-6855"
}
],
"notes": [
{
"category": "general",
"text": "hw/ide/core.c in QEMU does not properly restrict the commands accepted by an ATAPI device, which allows guest users to cause a denial of service or possibly have unspecified other impact via certain IDE commands, as demonstrated by a WIN_READ_NATIVE_MAX command to an empty drive, which triggers a divide-by-zero error and instance crash.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Desktop 12:qemu-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Desktop 12:qemu-block-curl-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Desktop 12:qemu-ipxe-1.0.0-48.9.1.noarch",
"SUSE Linux Enterprise Desktop 12:qemu-kvm-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Desktop 12:qemu-seabios-1.7.4-48.9.1.noarch",
"SUSE Linux Enterprise Desktop 12:qemu-sgabios-8-48.9.1.noarch",
"SUSE Linux Enterprise Desktop 12:qemu-tools-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Desktop 12:qemu-vgabios-1.7.4-48.9.1.noarch",
"SUSE Linux Enterprise Desktop 12:qemu-x86-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-block-curl-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-block-curl-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-block-curl-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-block-rbd-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-guest-agent-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-guest-agent-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-guest-agent-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-ipxe-1.0.0-48.9.1.noarch",
"SUSE Linux Enterprise Server 12:qemu-kvm-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-kvm-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-lang-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-lang-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-lang-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-ppc-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-s390-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-seabios-1.7.4-48.9.1.noarch",
"SUSE Linux Enterprise Server 12:qemu-sgabios-8-48.9.1.noarch",
"SUSE Linux Enterprise Server 12:qemu-tools-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-tools-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-tools-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-vgabios-1.7.4-48.9.1.noarch",
"SUSE Linux Enterprise Server 12:qemu-x86-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-curl-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-curl-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-curl-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-rbd-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-guest-agent-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-guest-agent-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-guest-agent-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-ipxe-1.0.0-48.9.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-kvm-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-kvm-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-lang-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-lang-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-lang-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-ppc-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-s390-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-seabios-1.7.4-48.9.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-sgabios-8-48.9.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-tools-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-tools-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-tools-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-vgabios-1.7.4-48.9.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-x86-2.0.2-48.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-6855",
"url": "https://www.suse.com/security/cve/CVE-2015-6855"
},
{
"category": "external",
"summary": "SUSE Bug 945404 for CVE-2015-6855",
"url": "https://bugzilla.suse.com/945404"
},
{
"category": "external",
"summary": "SUSE Bug 965156 for CVE-2015-6855",
"url": "https://bugzilla.suse.com/965156"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Desktop 12:qemu-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Desktop 12:qemu-block-curl-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Desktop 12:qemu-ipxe-1.0.0-48.9.1.noarch",
"SUSE Linux Enterprise Desktop 12:qemu-kvm-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Desktop 12:qemu-seabios-1.7.4-48.9.1.noarch",
"SUSE Linux Enterprise Desktop 12:qemu-sgabios-8-48.9.1.noarch",
"SUSE Linux Enterprise Desktop 12:qemu-tools-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Desktop 12:qemu-vgabios-1.7.4-48.9.1.noarch",
"SUSE Linux Enterprise Desktop 12:qemu-x86-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-block-curl-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-block-curl-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-block-curl-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-block-rbd-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-guest-agent-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-guest-agent-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-guest-agent-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-ipxe-1.0.0-48.9.1.noarch",
"SUSE Linux Enterprise Server 12:qemu-kvm-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-kvm-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-lang-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-lang-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-lang-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-ppc-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-s390-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-seabios-1.7.4-48.9.1.noarch",
"SUSE Linux Enterprise Server 12:qemu-sgabios-8-48.9.1.noarch",
"SUSE Linux Enterprise Server 12:qemu-tools-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-tools-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-tools-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-vgabios-1.7.4-48.9.1.noarch",
"SUSE Linux Enterprise Server 12:qemu-x86-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-curl-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-curl-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-curl-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-rbd-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-guest-agent-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-guest-agent-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-guest-agent-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-ipxe-1.0.0-48.9.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-kvm-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-kvm-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-lang-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-lang-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-lang-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-ppc-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-s390-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-seabios-1.7.4-48.9.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-sgabios-8-48.9.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-tools-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-tools-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-tools-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-vgabios-1.7.4-48.9.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-x86-2.0.2-48.9.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Desktop 12:qemu-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Desktop 12:qemu-block-curl-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Desktop 12:qemu-ipxe-1.0.0-48.9.1.noarch",
"SUSE Linux Enterprise Desktop 12:qemu-kvm-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Desktop 12:qemu-seabios-1.7.4-48.9.1.noarch",
"SUSE Linux Enterprise Desktop 12:qemu-sgabios-8-48.9.1.noarch",
"SUSE Linux Enterprise Desktop 12:qemu-tools-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Desktop 12:qemu-vgabios-1.7.4-48.9.1.noarch",
"SUSE Linux Enterprise Desktop 12:qemu-x86-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-block-curl-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-block-curl-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-block-curl-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-block-rbd-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-guest-agent-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-guest-agent-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-guest-agent-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-ipxe-1.0.0-48.9.1.noarch",
"SUSE Linux Enterprise Server 12:qemu-kvm-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-kvm-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-lang-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-lang-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-lang-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-ppc-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-s390-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-seabios-1.7.4-48.9.1.noarch",
"SUSE Linux Enterprise Server 12:qemu-sgabios-8-48.9.1.noarch",
"SUSE Linux Enterprise Server 12:qemu-tools-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server 12:qemu-tools-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server 12:qemu-tools-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server 12:qemu-vgabios-1.7.4-48.9.1.noarch",
"SUSE Linux Enterprise Server 12:qemu-x86-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-curl-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-curl-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-curl-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-block-rbd-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-guest-agent-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-guest-agent-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-guest-agent-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-ipxe-1.0.0-48.9.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-kvm-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-kvm-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-lang-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-lang-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-lang-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-ppc-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-s390-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-seabios-1.7.4-48.9.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-sgabios-8-48.9.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-tools-2.0.2-48.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-tools-2.0.2-48.9.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-tools-2.0.2-48.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-vgabios-1.7.4-48.9.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12:qemu-x86-2.0.2-48.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2015-09-28T09:38:55Z",
"details": "important"
}
],
"title": "CVE-2015-6855"
}
]
}
rhsa-2015:1924
Vulnerability from csaf_redhat
Published
2015-10-22 16:41
Modified
2024-11-22 09:31
Summary
Red Hat Security Advisory: qemu-kvm security update
Notes
Topic
Updated qemu-kvm packages that fix one security issue are now available for
Red Hat Enterprise Linux 6.
Red Hat Product Security has rated this update as having Important security
impact. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available from the CVE link in the
References section.
Details
KVM (Kernel-based Virtual Machine) is a full virtualization solution for
Linux on AMD64 and Intel 64 systems. The qemu-kvm package provides the
user-space component for running virtual machines using KVM.
A heap buffer overflow flaw was found in the way QEMU's NE2000 NIC
emulation implementation handled certain packets received over the network.
A privileged user inside a guest could use this flaw to crash the QEMU
instance (denial of service) or potentially execute arbitrary code on
the host. (CVE-2015-5279)
Red Hat would like to thank Qinghao Tang of QIHU 360 Inc. for reporting
this issue.
All qemu-kvm users are advised to upgrade to these updated packages, which
contain a backported patch to correct this issue. After installing this
update, shut down all running virtual machines. Once all virtual machines
have shut down, start them again for this update to take effect.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated qemu-kvm packages that fix one security issue are now available for\nRed Hat Enterprise Linux 6.\n\nRed Hat Product Security has rated this update as having Important security\nimpact. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available from the CVE link in the\nReferences section.",
"title": "Topic"
},
{
"category": "general",
"text": "KVM (Kernel-based Virtual Machine) is a full virtualization solution for\nLinux on AMD64 and Intel 64 systems. The qemu-kvm package provides the\nuser-space component for running virtual machines using KVM.\n\nA heap buffer overflow flaw was found in the way QEMU\u0027s NE2000 NIC\nemulation implementation handled certain packets received over the network.\nA privileged user inside a guest could use this flaw to crash the QEMU\ninstance (denial of service) or potentially execute arbitrary code on\nthe host. (CVE-2015-5279)\n\nRed Hat would like to thank Qinghao Tang of QIHU 360 Inc. for reporting\nthis issue.\n\nAll qemu-kvm users are advised to upgrade to these updated packages, which\ncontain a backported patch to correct this issue. After installing this\nupdate, shut down all running virtual machines. Once all virtual machines\nhave shut down, start them again for this update to take effect.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2015:1924",
"url": "https://access.redhat.com/errata/RHSA-2015:1924"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "1256672",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1256672"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1924.json"
}
],
"title": "Red Hat Security Advisory: qemu-kvm security update",
"tracking": {
"current_release_date": "2024-11-22T09:31:33+00:00",
"generator": {
"date": "2024-11-22T09:31:33+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2015:1924",
"initial_release_date": "2015-10-22T16:41:35+00:00",
"revision_history": [
{
"date": "2015-10-22T16:41:35+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2015-10-22T16:41:35+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-22T09:31:33+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Desktop (v. 6)",
"product": {
"name": "Red Hat Enterprise Linux Desktop (v. 6)",
"product_id": "6Client-6.7.z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:6::client"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux HPC Node (v. 6)",
"product": {
"name": "Red Hat Enterprise Linux HPC Node (v. 6)",
"product_id": "6ComputeNode-6.7.z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:6::computenode"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Server (v. 6)",
"product": {
"name": "Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-6.7.z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:6::server"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Workstation (v. 6)",
"product": {
"name": "Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-6.7.z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:6::workstation"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-kvm-2:0.12.1.2-2.479.el6_7.2.src",
"product": {
"name": "qemu-kvm-2:0.12.1.2-2.479.el6_7.2.src",
"product_id": "qemu-kvm-2:0.12.1.2-2.479.el6_7.2.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm@0.12.1.2-2.479.el6_7.2?arch=src\u0026epoch=2"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-kvm-tools-2:0.12.1.2-2.479.el6_7.2.x86_64",
"product": {
"name": "qemu-kvm-tools-2:0.12.1.2-2.479.el6_7.2.x86_64",
"product_id": "qemu-kvm-tools-2:0.12.1.2-2.479.el6_7.2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-tools@0.12.1.2-2.479.el6_7.2?arch=x86_64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-2:0.12.1.2-2.479.el6_7.2.x86_64",
"product": {
"name": "qemu-kvm-2:0.12.1.2-2.479.el6_7.2.x86_64",
"product_id": "qemu-kvm-2:0.12.1.2-2.479.el6_7.2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm@0.12.1.2-2.479.el6_7.2?arch=x86_64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "qemu-img-2:0.12.1.2-2.479.el6_7.2.x86_64",
"product": {
"name": "qemu-img-2:0.12.1.2-2.479.el6_7.2.x86_64",
"product_id": "qemu-img-2:0.12.1.2-2.479.el6_7.2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-img@0.12.1.2-2.479.el6_7.2?arch=x86_64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "qemu-guest-agent-2:0.12.1.2-2.479.el6_7.2.x86_64",
"product": {
"name": "qemu-guest-agent-2:0.12.1.2-2.479.el6_7.2.x86_64",
"product_id": "qemu-guest-agent-2:0.12.1.2-2.479.el6_7.2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-guest-agent@0.12.1.2-2.479.el6_7.2?arch=x86_64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-debuginfo-2:0.12.1.2-2.479.el6_7.2.x86_64",
"product": {
"name": "qemu-kvm-debuginfo-2:0.12.1.2-2.479.el6_7.2.x86_64",
"product_id": "qemu-kvm-debuginfo-2:0.12.1.2-2.479.el6_7.2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-debuginfo@0.12.1.2-2.479.el6_7.2?arch=x86_64\u0026epoch=2"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-guest-agent-2:0.12.1.2-2.479.el6_7.2.i686",
"product": {
"name": "qemu-guest-agent-2:0.12.1.2-2.479.el6_7.2.i686",
"product_id": "qemu-guest-agent-2:0.12.1.2-2.479.el6_7.2.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-guest-agent@0.12.1.2-2.479.el6_7.2?arch=i686\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-debuginfo-2:0.12.1.2-2.479.el6_7.2.i686",
"product": {
"name": "qemu-kvm-debuginfo-2:0.12.1.2-2.479.el6_7.2.i686",
"product_id": "qemu-kvm-debuginfo-2:0.12.1.2-2.479.el6_7.2.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-debuginfo@0.12.1.2-2.479.el6_7.2?arch=i686\u0026epoch=2"
}
}
}
],
"category": "architecture",
"name": "i686"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-kvm-debuginfo-2:0.12.1.2-2.479.el6_7.2.ppc64",
"product": {
"name": "qemu-kvm-debuginfo-2:0.12.1.2-2.479.el6_7.2.ppc64",
"product_id": "qemu-kvm-debuginfo-2:0.12.1.2-2.479.el6_7.2.ppc64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-debuginfo@0.12.1.2-2.479.el6_7.2?arch=ppc64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "qemu-guest-agent-2:0.12.1.2-2.479.el6_7.2.ppc64",
"product": {
"name": "qemu-guest-agent-2:0.12.1.2-2.479.el6_7.2.ppc64",
"product_id": "qemu-guest-agent-2:0.12.1.2-2.479.el6_7.2.ppc64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-guest-agent@0.12.1.2-2.479.el6_7.2?arch=ppc64\u0026epoch=2"
}
}
}
],
"category": "architecture",
"name": "ppc64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-guest-agent-2:0.12.1.2-2.479.el6_7.2.i686 as a component of Red Hat Enterprise Linux Desktop (v. 6)",
"product_id": "6Client-6.7.z:qemu-guest-agent-2:0.12.1.2-2.479.el6_7.2.i686"
},
"product_reference": "qemu-guest-agent-2:0.12.1.2-2.479.el6_7.2.i686",
"relates_to_product_reference": "6Client-6.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-guest-agent-2:0.12.1.2-2.479.el6_7.2.ppc64 as a component of Red Hat Enterprise Linux Desktop (v. 6)",
"product_id": "6Client-6.7.z:qemu-guest-agent-2:0.12.1.2-2.479.el6_7.2.ppc64"
},
"product_reference": "qemu-guest-agent-2:0.12.1.2-2.479.el6_7.2.ppc64",
"relates_to_product_reference": "6Client-6.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-guest-agent-2:0.12.1.2-2.479.el6_7.2.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 6)",
"product_id": "6Client-6.7.z:qemu-guest-agent-2:0.12.1.2-2.479.el6_7.2.x86_64"
},
"product_reference": "qemu-guest-agent-2:0.12.1.2-2.479.el6_7.2.x86_64",
"relates_to_product_reference": "6Client-6.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-2:0.12.1.2-2.479.el6_7.2.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 6)",
"product_id": "6Client-6.7.z:qemu-img-2:0.12.1.2-2.479.el6_7.2.x86_64"
},
"product_reference": "qemu-img-2:0.12.1.2-2.479.el6_7.2.x86_64",
"relates_to_product_reference": "6Client-6.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-2:0.12.1.2-2.479.el6_7.2.src as a component of Red Hat Enterprise Linux Desktop (v. 6)",
"product_id": "6Client-6.7.z:qemu-kvm-2:0.12.1.2-2.479.el6_7.2.src"
},
"product_reference": "qemu-kvm-2:0.12.1.2-2.479.el6_7.2.src",
"relates_to_product_reference": "6Client-6.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-2:0.12.1.2-2.479.el6_7.2.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 6)",
"product_id": "6Client-6.7.z:qemu-kvm-2:0.12.1.2-2.479.el6_7.2.x86_64"
},
"product_reference": "qemu-kvm-2:0.12.1.2-2.479.el6_7.2.x86_64",
"relates_to_product_reference": "6Client-6.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-2:0.12.1.2-2.479.el6_7.2.i686 as a component of Red Hat Enterprise Linux Desktop (v. 6)",
"product_id": "6Client-6.7.z:qemu-kvm-debuginfo-2:0.12.1.2-2.479.el6_7.2.i686"
},
"product_reference": "qemu-kvm-debuginfo-2:0.12.1.2-2.479.el6_7.2.i686",
"relates_to_product_reference": "6Client-6.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-2:0.12.1.2-2.479.el6_7.2.ppc64 as a component of Red Hat Enterprise Linux Desktop (v. 6)",
"product_id": "6Client-6.7.z:qemu-kvm-debuginfo-2:0.12.1.2-2.479.el6_7.2.ppc64"
},
"product_reference": "qemu-kvm-debuginfo-2:0.12.1.2-2.479.el6_7.2.ppc64",
"relates_to_product_reference": "6Client-6.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-2:0.12.1.2-2.479.el6_7.2.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 6)",
"product_id": "6Client-6.7.z:qemu-kvm-debuginfo-2:0.12.1.2-2.479.el6_7.2.x86_64"
},
"product_reference": "qemu-kvm-debuginfo-2:0.12.1.2-2.479.el6_7.2.x86_64",
"relates_to_product_reference": "6Client-6.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-tools-2:0.12.1.2-2.479.el6_7.2.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 6)",
"product_id": "6Client-6.7.z:qemu-kvm-tools-2:0.12.1.2-2.479.el6_7.2.x86_64"
},
"product_reference": "qemu-kvm-tools-2:0.12.1.2-2.479.el6_7.2.x86_64",
"relates_to_product_reference": "6Client-6.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-guest-agent-2:0.12.1.2-2.479.el6_7.2.i686 as a component of Red Hat Enterprise Linux HPC Node (v. 6)",
"product_id": "6ComputeNode-6.7.z:qemu-guest-agent-2:0.12.1.2-2.479.el6_7.2.i686"
},
"product_reference": "qemu-guest-agent-2:0.12.1.2-2.479.el6_7.2.i686",
"relates_to_product_reference": "6ComputeNode-6.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-guest-agent-2:0.12.1.2-2.479.el6_7.2.ppc64 as a component of Red Hat Enterprise Linux HPC Node (v. 6)",
"product_id": "6ComputeNode-6.7.z:qemu-guest-agent-2:0.12.1.2-2.479.el6_7.2.ppc64"
},
"product_reference": "qemu-guest-agent-2:0.12.1.2-2.479.el6_7.2.ppc64",
"relates_to_product_reference": "6ComputeNode-6.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-guest-agent-2:0.12.1.2-2.479.el6_7.2.x86_64 as a component of Red Hat Enterprise Linux HPC Node (v. 6)",
"product_id": "6ComputeNode-6.7.z:qemu-guest-agent-2:0.12.1.2-2.479.el6_7.2.x86_64"
},
"product_reference": "qemu-guest-agent-2:0.12.1.2-2.479.el6_7.2.x86_64",
"relates_to_product_reference": "6ComputeNode-6.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-2:0.12.1.2-2.479.el6_7.2.x86_64 as a component of Red Hat Enterprise Linux HPC Node (v. 6)",
"product_id": "6ComputeNode-6.7.z:qemu-img-2:0.12.1.2-2.479.el6_7.2.x86_64"
},
"product_reference": "qemu-img-2:0.12.1.2-2.479.el6_7.2.x86_64",
"relates_to_product_reference": "6ComputeNode-6.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-2:0.12.1.2-2.479.el6_7.2.src as a component of Red Hat Enterprise Linux HPC Node (v. 6)",
"product_id": "6ComputeNode-6.7.z:qemu-kvm-2:0.12.1.2-2.479.el6_7.2.src"
},
"product_reference": "qemu-kvm-2:0.12.1.2-2.479.el6_7.2.src",
"relates_to_product_reference": "6ComputeNode-6.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-2:0.12.1.2-2.479.el6_7.2.x86_64 as a component of Red Hat Enterprise Linux HPC Node (v. 6)",
"product_id": "6ComputeNode-6.7.z:qemu-kvm-2:0.12.1.2-2.479.el6_7.2.x86_64"
},
"product_reference": "qemu-kvm-2:0.12.1.2-2.479.el6_7.2.x86_64",
"relates_to_product_reference": "6ComputeNode-6.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-2:0.12.1.2-2.479.el6_7.2.i686 as a component of Red Hat Enterprise Linux HPC Node (v. 6)",
"product_id": "6ComputeNode-6.7.z:qemu-kvm-debuginfo-2:0.12.1.2-2.479.el6_7.2.i686"
},
"product_reference": "qemu-kvm-debuginfo-2:0.12.1.2-2.479.el6_7.2.i686",
"relates_to_product_reference": "6ComputeNode-6.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-2:0.12.1.2-2.479.el6_7.2.ppc64 as a component of Red Hat Enterprise Linux HPC Node (v. 6)",
"product_id": "6ComputeNode-6.7.z:qemu-kvm-debuginfo-2:0.12.1.2-2.479.el6_7.2.ppc64"
},
"product_reference": "qemu-kvm-debuginfo-2:0.12.1.2-2.479.el6_7.2.ppc64",
"relates_to_product_reference": "6ComputeNode-6.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-2:0.12.1.2-2.479.el6_7.2.x86_64 as a component of Red Hat Enterprise Linux HPC Node (v. 6)",
"product_id": "6ComputeNode-6.7.z:qemu-kvm-debuginfo-2:0.12.1.2-2.479.el6_7.2.x86_64"
},
"product_reference": "qemu-kvm-debuginfo-2:0.12.1.2-2.479.el6_7.2.x86_64",
"relates_to_product_reference": "6ComputeNode-6.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-tools-2:0.12.1.2-2.479.el6_7.2.x86_64 as a component of Red Hat Enterprise Linux HPC Node (v. 6)",
"product_id": "6ComputeNode-6.7.z:qemu-kvm-tools-2:0.12.1.2-2.479.el6_7.2.x86_64"
},
"product_reference": "qemu-kvm-tools-2:0.12.1.2-2.479.el6_7.2.x86_64",
"relates_to_product_reference": "6ComputeNode-6.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-guest-agent-2:0.12.1.2-2.479.el6_7.2.i686 as a component of Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-6.7.z:qemu-guest-agent-2:0.12.1.2-2.479.el6_7.2.i686"
},
"product_reference": "qemu-guest-agent-2:0.12.1.2-2.479.el6_7.2.i686",
"relates_to_product_reference": "6Server-6.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-guest-agent-2:0.12.1.2-2.479.el6_7.2.ppc64 as a component of Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-6.7.z:qemu-guest-agent-2:0.12.1.2-2.479.el6_7.2.ppc64"
},
"product_reference": "qemu-guest-agent-2:0.12.1.2-2.479.el6_7.2.ppc64",
"relates_to_product_reference": "6Server-6.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-guest-agent-2:0.12.1.2-2.479.el6_7.2.x86_64 as a component of Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-6.7.z:qemu-guest-agent-2:0.12.1.2-2.479.el6_7.2.x86_64"
},
"product_reference": "qemu-guest-agent-2:0.12.1.2-2.479.el6_7.2.x86_64",
"relates_to_product_reference": "6Server-6.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-2:0.12.1.2-2.479.el6_7.2.x86_64 as a component of Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-6.7.z:qemu-img-2:0.12.1.2-2.479.el6_7.2.x86_64"
},
"product_reference": "qemu-img-2:0.12.1.2-2.479.el6_7.2.x86_64",
"relates_to_product_reference": "6Server-6.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-2:0.12.1.2-2.479.el6_7.2.src as a component of Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-6.7.z:qemu-kvm-2:0.12.1.2-2.479.el6_7.2.src"
},
"product_reference": "qemu-kvm-2:0.12.1.2-2.479.el6_7.2.src",
"relates_to_product_reference": "6Server-6.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-2:0.12.1.2-2.479.el6_7.2.x86_64 as a component of Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-6.7.z:qemu-kvm-2:0.12.1.2-2.479.el6_7.2.x86_64"
},
"product_reference": "qemu-kvm-2:0.12.1.2-2.479.el6_7.2.x86_64",
"relates_to_product_reference": "6Server-6.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-2:0.12.1.2-2.479.el6_7.2.i686 as a component of Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-6.7.z:qemu-kvm-debuginfo-2:0.12.1.2-2.479.el6_7.2.i686"
},
"product_reference": "qemu-kvm-debuginfo-2:0.12.1.2-2.479.el6_7.2.i686",
"relates_to_product_reference": "6Server-6.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-2:0.12.1.2-2.479.el6_7.2.ppc64 as a component of Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-6.7.z:qemu-kvm-debuginfo-2:0.12.1.2-2.479.el6_7.2.ppc64"
},
"product_reference": "qemu-kvm-debuginfo-2:0.12.1.2-2.479.el6_7.2.ppc64",
"relates_to_product_reference": "6Server-6.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-2:0.12.1.2-2.479.el6_7.2.x86_64 as a component of Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-6.7.z:qemu-kvm-debuginfo-2:0.12.1.2-2.479.el6_7.2.x86_64"
},
"product_reference": "qemu-kvm-debuginfo-2:0.12.1.2-2.479.el6_7.2.x86_64",
"relates_to_product_reference": "6Server-6.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-tools-2:0.12.1.2-2.479.el6_7.2.x86_64 as a component of Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-6.7.z:qemu-kvm-tools-2:0.12.1.2-2.479.el6_7.2.x86_64"
},
"product_reference": "qemu-kvm-tools-2:0.12.1.2-2.479.el6_7.2.x86_64",
"relates_to_product_reference": "6Server-6.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-guest-agent-2:0.12.1.2-2.479.el6_7.2.i686 as a component of Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-6.7.z:qemu-guest-agent-2:0.12.1.2-2.479.el6_7.2.i686"
},
"product_reference": "qemu-guest-agent-2:0.12.1.2-2.479.el6_7.2.i686",
"relates_to_product_reference": "6Workstation-6.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-guest-agent-2:0.12.1.2-2.479.el6_7.2.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-6.7.z:qemu-guest-agent-2:0.12.1.2-2.479.el6_7.2.ppc64"
},
"product_reference": "qemu-guest-agent-2:0.12.1.2-2.479.el6_7.2.ppc64",
"relates_to_product_reference": "6Workstation-6.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-guest-agent-2:0.12.1.2-2.479.el6_7.2.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-6.7.z:qemu-guest-agent-2:0.12.1.2-2.479.el6_7.2.x86_64"
},
"product_reference": "qemu-guest-agent-2:0.12.1.2-2.479.el6_7.2.x86_64",
"relates_to_product_reference": "6Workstation-6.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-2:0.12.1.2-2.479.el6_7.2.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-6.7.z:qemu-img-2:0.12.1.2-2.479.el6_7.2.x86_64"
},
"product_reference": "qemu-img-2:0.12.1.2-2.479.el6_7.2.x86_64",
"relates_to_product_reference": "6Workstation-6.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-2:0.12.1.2-2.479.el6_7.2.src as a component of Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-6.7.z:qemu-kvm-2:0.12.1.2-2.479.el6_7.2.src"
},
"product_reference": "qemu-kvm-2:0.12.1.2-2.479.el6_7.2.src",
"relates_to_product_reference": "6Workstation-6.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-2:0.12.1.2-2.479.el6_7.2.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-6.7.z:qemu-kvm-2:0.12.1.2-2.479.el6_7.2.x86_64"
},
"product_reference": "qemu-kvm-2:0.12.1.2-2.479.el6_7.2.x86_64",
"relates_to_product_reference": "6Workstation-6.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-2:0.12.1.2-2.479.el6_7.2.i686 as a component of Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-6.7.z:qemu-kvm-debuginfo-2:0.12.1.2-2.479.el6_7.2.i686"
},
"product_reference": "qemu-kvm-debuginfo-2:0.12.1.2-2.479.el6_7.2.i686",
"relates_to_product_reference": "6Workstation-6.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-2:0.12.1.2-2.479.el6_7.2.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-6.7.z:qemu-kvm-debuginfo-2:0.12.1.2-2.479.el6_7.2.ppc64"
},
"product_reference": "qemu-kvm-debuginfo-2:0.12.1.2-2.479.el6_7.2.ppc64",
"relates_to_product_reference": "6Workstation-6.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-2:0.12.1.2-2.479.el6_7.2.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-6.7.z:qemu-kvm-debuginfo-2:0.12.1.2-2.479.el6_7.2.x86_64"
},
"product_reference": "qemu-kvm-debuginfo-2:0.12.1.2-2.479.el6_7.2.x86_64",
"relates_to_product_reference": "6Workstation-6.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-tools-2:0.12.1.2-2.479.el6_7.2.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-6.7.z:qemu-kvm-tools-2:0.12.1.2-2.479.el6_7.2.x86_64"
},
"product_reference": "qemu-kvm-tools-2:0.12.1.2-2.479.el6_7.2.x86_64",
"relates_to_product_reference": "6Workstation-6.7.z"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Qinghao Tang"
],
"organization": "QIHU 360 Inc."
}
],
"cve": "CVE-2015-5279",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2015-08-24T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1256672"
}
],
"notes": [
{
"category": "description",
"text": "A heap buffer overflow flaw was found in the way QEMU\u0027s NE2000 NIC emulation implementation handled certain packets received over the network. A privileged user inside a guest could use this flaw to crash the QEMU instance (denial of service) or potentially execute arbitrary code on the host.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "qemu: Heap overflow vulnerability in ne2000_receive() function",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue affects the versions of kvm and xen packages as shipped with Red Hat Enterprise Linux 5.\n\nThis issue affects the versions of the qemu-kvm packages as shipped with Red Hat Enterprise Linux 6.\n\nThis issue affects the Red Hat Enterprise Linux 6 based versions of qemu-kvm-rhev packages as shipped with Red Hat Enterprise Virtualization 3.\n\nThis issue does not affect the versions of the qemu-kvm packages as shipped with Red Hat Enterprise Linux 7.\n\nThis issue does not affect the Red Hat Enterprise Linux 7 based versions of the qemu-kvm-rhev packages as shipped with Red Hat Enterprise Virtualization 3.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Client-6.7.z:qemu-guest-agent-2:0.12.1.2-2.479.el6_7.2.i686",
"6Client-6.7.z:qemu-guest-agent-2:0.12.1.2-2.479.el6_7.2.ppc64",
"6Client-6.7.z:qemu-guest-agent-2:0.12.1.2-2.479.el6_7.2.x86_64",
"6Client-6.7.z:qemu-img-2:0.12.1.2-2.479.el6_7.2.x86_64",
"6Client-6.7.z:qemu-kvm-2:0.12.1.2-2.479.el6_7.2.src",
"6Client-6.7.z:qemu-kvm-2:0.12.1.2-2.479.el6_7.2.x86_64",
"6Client-6.7.z:qemu-kvm-debuginfo-2:0.12.1.2-2.479.el6_7.2.i686",
"6Client-6.7.z:qemu-kvm-debuginfo-2:0.12.1.2-2.479.el6_7.2.ppc64",
"6Client-6.7.z:qemu-kvm-debuginfo-2:0.12.1.2-2.479.el6_7.2.x86_64",
"6Client-6.7.z:qemu-kvm-tools-2:0.12.1.2-2.479.el6_7.2.x86_64",
"6ComputeNode-6.7.z:qemu-guest-agent-2:0.12.1.2-2.479.el6_7.2.i686",
"6ComputeNode-6.7.z:qemu-guest-agent-2:0.12.1.2-2.479.el6_7.2.ppc64",
"6ComputeNode-6.7.z:qemu-guest-agent-2:0.12.1.2-2.479.el6_7.2.x86_64",
"6ComputeNode-6.7.z:qemu-img-2:0.12.1.2-2.479.el6_7.2.x86_64",
"6ComputeNode-6.7.z:qemu-kvm-2:0.12.1.2-2.479.el6_7.2.src",
"6ComputeNode-6.7.z:qemu-kvm-2:0.12.1.2-2.479.el6_7.2.x86_64",
"6ComputeNode-6.7.z:qemu-kvm-debuginfo-2:0.12.1.2-2.479.el6_7.2.i686",
"6ComputeNode-6.7.z:qemu-kvm-debuginfo-2:0.12.1.2-2.479.el6_7.2.ppc64",
"6ComputeNode-6.7.z:qemu-kvm-debuginfo-2:0.12.1.2-2.479.el6_7.2.x86_64",
"6ComputeNode-6.7.z:qemu-kvm-tools-2:0.12.1.2-2.479.el6_7.2.x86_64",
"6Server-6.7.z:qemu-guest-agent-2:0.12.1.2-2.479.el6_7.2.i686",
"6Server-6.7.z:qemu-guest-agent-2:0.12.1.2-2.479.el6_7.2.ppc64",
"6Server-6.7.z:qemu-guest-agent-2:0.12.1.2-2.479.el6_7.2.x86_64",
"6Server-6.7.z:qemu-img-2:0.12.1.2-2.479.el6_7.2.x86_64",
"6Server-6.7.z:qemu-kvm-2:0.12.1.2-2.479.el6_7.2.src",
"6Server-6.7.z:qemu-kvm-2:0.12.1.2-2.479.el6_7.2.x86_64",
"6Server-6.7.z:qemu-kvm-debuginfo-2:0.12.1.2-2.479.el6_7.2.i686",
"6Server-6.7.z:qemu-kvm-debuginfo-2:0.12.1.2-2.479.el6_7.2.ppc64",
"6Server-6.7.z:qemu-kvm-debuginfo-2:0.12.1.2-2.479.el6_7.2.x86_64",
"6Server-6.7.z:qemu-kvm-tools-2:0.12.1.2-2.479.el6_7.2.x86_64",
"6Workstation-6.7.z:qemu-guest-agent-2:0.12.1.2-2.479.el6_7.2.i686",
"6Workstation-6.7.z:qemu-guest-agent-2:0.12.1.2-2.479.el6_7.2.ppc64",
"6Workstation-6.7.z:qemu-guest-agent-2:0.12.1.2-2.479.el6_7.2.x86_64",
"6Workstation-6.7.z:qemu-img-2:0.12.1.2-2.479.el6_7.2.x86_64",
"6Workstation-6.7.z:qemu-kvm-2:0.12.1.2-2.479.el6_7.2.src",
"6Workstation-6.7.z:qemu-kvm-2:0.12.1.2-2.479.el6_7.2.x86_64",
"6Workstation-6.7.z:qemu-kvm-debuginfo-2:0.12.1.2-2.479.el6_7.2.i686",
"6Workstation-6.7.z:qemu-kvm-debuginfo-2:0.12.1.2-2.479.el6_7.2.ppc64",
"6Workstation-6.7.z:qemu-kvm-debuginfo-2:0.12.1.2-2.479.el6_7.2.x86_64",
"6Workstation-6.7.z:qemu-kvm-tools-2:0.12.1.2-2.479.el6_7.2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-5279"
},
{
"category": "external",
"summary": "RHBZ#1256672",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1256672"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-5279",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-5279"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-5279",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5279"
}
],
"release_date": "2015-09-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-10-22T16:41:35+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"6Client-6.7.z:qemu-guest-agent-2:0.12.1.2-2.479.el6_7.2.i686",
"6Client-6.7.z:qemu-guest-agent-2:0.12.1.2-2.479.el6_7.2.ppc64",
"6Client-6.7.z:qemu-guest-agent-2:0.12.1.2-2.479.el6_7.2.x86_64",
"6Client-6.7.z:qemu-img-2:0.12.1.2-2.479.el6_7.2.x86_64",
"6Client-6.7.z:qemu-kvm-2:0.12.1.2-2.479.el6_7.2.src",
"6Client-6.7.z:qemu-kvm-2:0.12.1.2-2.479.el6_7.2.x86_64",
"6Client-6.7.z:qemu-kvm-debuginfo-2:0.12.1.2-2.479.el6_7.2.i686",
"6Client-6.7.z:qemu-kvm-debuginfo-2:0.12.1.2-2.479.el6_7.2.ppc64",
"6Client-6.7.z:qemu-kvm-debuginfo-2:0.12.1.2-2.479.el6_7.2.x86_64",
"6Client-6.7.z:qemu-kvm-tools-2:0.12.1.2-2.479.el6_7.2.x86_64",
"6ComputeNode-6.7.z:qemu-guest-agent-2:0.12.1.2-2.479.el6_7.2.i686",
"6ComputeNode-6.7.z:qemu-guest-agent-2:0.12.1.2-2.479.el6_7.2.ppc64",
"6ComputeNode-6.7.z:qemu-guest-agent-2:0.12.1.2-2.479.el6_7.2.x86_64",
"6ComputeNode-6.7.z:qemu-img-2:0.12.1.2-2.479.el6_7.2.x86_64",
"6ComputeNode-6.7.z:qemu-kvm-2:0.12.1.2-2.479.el6_7.2.src",
"6ComputeNode-6.7.z:qemu-kvm-2:0.12.1.2-2.479.el6_7.2.x86_64",
"6ComputeNode-6.7.z:qemu-kvm-debuginfo-2:0.12.1.2-2.479.el6_7.2.i686",
"6ComputeNode-6.7.z:qemu-kvm-debuginfo-2:0.12.1.2-2.479.el6_7.2.ppc64",
"6ComputeNode-6.7.z:qemu-kvm-debuginfo-2:0.12.1.2-2.479.el6_7.2.x86_64",
"6ComputeNode-6.7.z:qemu-kvm-tools-2:0.12.1.2-2.479.el6_7.2.x86_64",
"6Server-6.7.z:qemu-guest-agent-2:0.12.1.2-2.479.el6_7.2.i686",
"6Server-6.7.z:qemu-guest-agent-2:0.12.1.2-2.479.el6_7.2.ppc64",
"6Server-6.7.z:qemu-guest-agent-2:0.12.1.2-2.479.el6_7.2.x86_64",
"6Server-6.7.z:qemu-img-2:0.12.1.2-2.479.el6_7.2.x86_64",
"6Server-6.7.z:qemu-kvm-2:0.12.1.2-2.479.el6_7.2.src",
"6Server-6.7.z:qemu-kvm-2:0.12.1.2-2.479.el6_7.2.x86_64",
"6Server-6.7.z:qemu-kvm-debuginfo-2:0.12.1.2-2.479.el6_7.2.i686",
"6Server-6.7.z:qemu-kvm-debuginfo-2:0.12.1.2-2.479.el6_7.2.ppc64",
"6Server-6.7.z:qemu-kvm-debuginfo-2:0.12.1.2-2.479.el6_7.2.x86_64",
"6Server-6.7.z:qemu-kvm-tools-2:0.12.1.2-2.479.el6_7.2.x86_64",
"6Workstation-6.7.z:qemu-guest-agent-2:0.12.1.2-2.479.el6_7.2.i686",
"6Workstation-6.7.z:qemu-guest-agent-2:0.12.1.2-2.479.el6_7.2.ppc64",
"6Workstation-6.7.z:qemu-guest-agent-2:0.12.1.2-2.479.el6_7.2.x86_64",
"6Workstation-6.7.z:qemu-img-2:0.12.1.2-2.479.el6_7.2.x86_64",
"6Workstation-6.7.z:qemu-kvm-2:0.12.1.2-2.479.el6_7.2.src",
"6Workstation-6.7.z:qemu-kvm-2:0.12.1.2-2.479.el6_7.2.x86_64",
"6Workstation-6.7.z:qemu-kvm-debuginfo-2:0.12.1.2-2.479.el6_7.2.i686",
"6Workstation-6.7.z:qemu-kvm-debuginfo-2:0.12.1.2-2.479.el6_7.2.ppc64",
"6Workstation-6.7.z:qemu-kvm-debuginfo-2:0.12.1.2-2.479.el6_7.2.x86_64",
"6Workstation-6.7.z:qemu-kvm-tools-2:0.12.1.2-2.479.el6_7.2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:1924"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "COMPLETE",
"baseScore": 6.5,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:A/AC:H/Au:S/C:C/I:C/A:C",
"version": "2.0"
},
"products": [
"6Client-6.7.z:qemu-guest-agent-2:0.12.1.2-2.479.el6_7.2.i686",
"6Client-6.7.z:qemu-guest-agent-2:0.12.1.2-2.479.el6_7.2.ppc64",
"6Client-6.7.z:qemu-guest-agent-2:0.12.1.2-2.479.el6_7.2.x86_64",
"6Client-6.7.z:qemu-img-2:0.12.1.2-2.479.el6_7.2.x86_64",
"6Client-6.7.z:qemu-kvm-2:0.12.1.2-2.479.el6_7.2.src",
"6Client-6.7.z:qemu-kvm-2:0.12.1.2-2.479.el6_7.2.x86_64",
"6Client-6.7.z:qemu-kvm-debuginfo-2:0.12.1.2-2.479.el6_7.2.i686",
"6Client-6.7.z:qemu-kvm-debuginfo-2:0.12.1.2-2.479.el6_7.2.ppc64",
"6Client-6.7.z:qemu-kvm-debuginfo-2:0.12.1.2-2.479.el6_7.2.x86_64",
"6Client-6.7.z:qemu-kvm-tools-2:0.12.1.2-2.479.el6_7.2.x86_64",
"6ComputeNode-6.7.z:qemu-guest-agent-2:0.12.1.2-2.479.el6_7.2.i686",
"6ComputeNode-6.7.z:qemu-guest-agent-2:0.12.1.2-2.479.el6_7.2.ppc64",
"6ComputeNode-6.7.z:qemu-guest-agent-2:0.12.1.2-2.479.el6_7.2.x86_64",
"6ComputeNode-6.7.z:qemu-img-2:0.12.1.2-2.479.el6_7.2.x86_64",
"6ComputeNode-6.7.z:qemu-kvm-2:0.12.1.2-2.479.el6_7.2.src",
"6ComputeNode-6.7.z:qemu-kvm-2:0.12.1.2-2.479.el6_7.2.x86_64",
"6ComputeNode-6.7.z:qemu-kvm-debuginfo-2:0.12.1.2-2.479.el6_7.2.i686",
"6ComputeNode-6.7.z:qemu-kvm-debuginfo-2:0.12.1.2-2.479.el6_7.2.ppc64",
"6ComputeNode-6.7.z:qemu-kvm-debuginfo-2:0.12.1.2-2.479.el6_7.2.x86_64",
"6ComputeNode-6.7.z:qemu-kvm-tools-2:0.12.1.2-2.479.el6_7.2.x86_64",
"6Server-6.7.z:qemu-guest-agent-2:0.12.1.2-2.479.el6_7.2.i686",
"6Server-6.7.z:qemu-guest-agent-2:0.12.1.2-2.479.el6_7.2.ppc64",
"6Server-6.7.z:qemu-guest-agent-2:0.12.1.2-2.479.el6_7.2.x86_64",
"6Server-6.7.z:qemu-img-2:0.12.1.2-2.479.el6_7.2.x86_64",
"6Server-6.7.z:qemu-kvm-2:0.12.1.2-2.479.el6_7.2.src",
"6Server-6.7.z:qemu-kvm-2:0.12.1.2-2.479.el6_7.2.x86_64",
"6Server-6.7.z:qemu-kvm-debuginfo-2:0.12.1.2-2.479.el6_7.2.i686",
"6Server-6.7.z:qemu-kvm-debuginfo-2:0.12.1.2-2.479.el6_7.2.ppc64",
"6Server-6.7.z:qemu-kvm-debuginfo-2:0.12.1.2-2.479.el6_7.2.x86_64",
"6Server-6.7.z:qemu-kvm-tools-2:0.12.1.2-2.479.el6_7.2.x86_64",
"6Workstation-6.7.z:qemu-guest-agent-2:0.12.1.2-2.479.el6_7.2.i686",
"6Workstation-6.7.z:qemu-guest-agent-2:0.12.1.2-2.479.el6_7.2.ppc64",
"6Workstation-6.7.z:qemu-guest-agent-2:0.12.1.2-2.479.el6_7.2.x86_64",
"6Workstation-6.7.z:qemu-img-2:0.12.1.2-2.479.el6_7.2.x86_64",
"6Workstation-6.7.z:qemu-kvm-2:0.12.1.2-2.479.el6_7.2.src",
"6Workstation-6.7.z:qemu-kvm-2:0.12.1.2-2.479.el6_7.2.x86_64",
"6Workstation-6.7.z:qemu-kvm-debuginfo-2:0.12.1.2-2.479.el6_7.2.i686",
"6Workstation-6.7.z:qemu-kvm-debuginfo-2:0.12.1.2-2.479.el6_7.2.ppc64",
"6Workstation-6.7.z:qemu-kvm-debuginfo-2:0.12.1.2-2.479.el6_7.2.x86_64",
"6Workstation-6.7.z:qemu-kvm-tools-2:0.12.1.2-2.479.el6_7.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "qemu: Heap overflow vulnerability in ne2000_receive() function"
}
]
}
rhsa-2015:1896
Vulnerability from csaf_redhat
Published
2015-10-15 12:17
Modified
2024-11-22 09:31
Summary
Red Hat Security Advisory: qemu-kvm-rhev security update
Notes
Topic
Updated qemu-kvm-rhev packages that fix one security issue are now
available for Red Hat Enterprise Linux OpenStack Platform 5.0 for Red Hat
Enterprise Linux 6.
Red Hat Product Security has rated this update as having Important security
impact. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available from the CVE link in the
References section.
Details
KVM (Kernel-based Virtual Machine) is a full virtualization solution for
Linux on AMD64 and Intel 64 systems. The qemu-kvm-rhev package provides the
user-space component for running virtual machines using KVM.
A heap buffer overflow flaw was found in the way QEMU's NE2000 NIC
emulation implementation handled certain packets received over the
network. A privileged user inside a guest could use this flaw to crash the
QEMU instance (denial of service) or potentially execute arbitrary code on
the host. (CVE-2015-5279)
Red Hat would like to thank Qinghao Tang of QIHU 360 Inc. for reporting
this issue.
All users of qemu-kvm-rhev are advised to upgrade to these updated
packages, which contain a backported patch to correct this issue. After
installing this update, shut down and restart all running virtual machines
for this update to take effect.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated qemu-kvm-rhev packages that fix one security issue are now\navailable for Red Hat Enterprise Linux OpenStack Platform 5.0 for Red Hat\nEnterprise Linux 6.\n\nRed Hat Product Security has rated this update as having Important security\nimpact. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available from the CVE link in the\nReferences section.",
"title": "Topic"
},
{
"category": "general",
"text": "KVM (Kernel-based Virtual Machine) is a full virtualization solution for\nLinux on AMD64 and Intel 64 systems. The qemu-kvm-rhev package provides the\nuser-space component for running virtual machines using KVM.\n\nA heap buffer overflow flaw was found in the way QEMU\u0027s NE2000 NIC\nemulation implementation handled certain packets received over the\nnetwork. A privileged user inside a guest could use this flaw to crash the\nQEMU instance (denial of service) or potentially execute arbitrary code on\nthe host. (CVE-2015-5279)\n\nRed Hat would like to thank Qinghao Tang of QIHU 360 Inc. for reporting\nthis issue.\n\nAll users of qemu-kvm-rhev are advised to upgrade to these updated\npackages, which contain a backported patch to correct this issue. After\ninstalling this update, shut down and restart all running virtual machines\nfor this update to take effect.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2015:1896",
"url": "https://access.redhat.com/errata/RHSA-2015:1896"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "1256672",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1256672"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1896.json"
}
],
"title": "Red Hat Security Advisory: qemu-kvm-rhev security update",
"tracking": {
"current_release_date": "2024-11-22T09:31:43+00:00",
"generator": {
"date": "2024-11-22T09:31:43+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2015:1896",
"initial_release_date": "2015-10-15T12:17:40+00:00",
"revision_history": [
{
"date": "2015-10-15T12:17:40+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2015-10-15T12:17:40+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-22T09:31:43+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6",
"product": {
"name": "Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6",
"product_id": "6Server-RH6-RHOS-5.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openstack:5::el6"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenStack Platform"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-img-rhev-2:0.12.1.2-2.479.el6_7.2.x86_64",
"product": {
"name": "qemu-img-rhev-2:0.12.1.2-2.479.el6_7.2.x86_64",
"product_id": "qemu-img-rhev-2:0.12.1.2-2.479.el6_7.2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-img-rhev@0.12.1.2-2.479.el6_7.2?arch=x86_64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.479.el6_7.2.x86_64",
"product": {
"name": "qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.479.el6_7.2.x86_64",
"product_id": "qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.479.el6_7.2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev-debuginfo@0.12.1.2-2.479.el6_7.2?arch=x86_64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-rhev-2:0.12.1.2-2.479.el6_7.2.x86_64",
"product": {
"name": "qemu-kvm-rhev-2:0.12.1.2-2.479.el6_7.2.x86_64",
"product_id": "qemu-kvm-rhev-2:0.12.1.2-2.479.el6_7.2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev@0.12.1.2-2.479.el6_7.2?arch=x86_64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-rhev-tools-2:0.12.1.2-2.479.el6_7.2.x86_64",
"product": {
"name": "qemu-kvm-rhev-tools-2:0.12.1.2-2.479.el6_7.2.x86_64",
"product_id": "qemu-kvm-rhev-tools-2:0.12.1.2-2.479.el6_7.2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev-tools@0.12.1.2-2.479.el6_7.2?arch=x86_64\u0026epoch=2"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-kvm-rhev-2:0.12.1.2-2.479.el6_7.2.src",
"product": {
"name": "qemu-kvm-rhev-2:0.12.1.2-2.479.el6_7.2.src",
"product_id": "qemu-kvm-rhev-2:0.12.1.2-2.479.el6_7.2.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev@0.12.1.2-2.479.el6_7.2?arch=src\u0026epoch=2"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-rhev-2:0.12.1.2-2.479.el6_7.2.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6",
"product_id": "6Server-RH6-RHOS-5.0:qemu-img-rhev-2:0.12.1.2-2.479.el6_7.2.x86_64"
},
"product_reference": "qemu-img-rhev-2:0.12.1.2-2.479.el6_7.2.x86_64",
"relates_to_product_reference": "6Server-RH6-RHOS-5.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-2:0.12.1.2-2.479.el6_7.2.src as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6",
"product_id": "6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.479.el6_7.2.src"
},
"product_reference": "qemu-kvm-rhev-2:0.12.1.2-2.479.el6_7.2.src",
"relates_to_product_reference": "6Server-RH6-RHOS-5.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-2:0.12.1.2-2.479.el6_7.2.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6",
"product_id": "6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.479.el6_7.2.x86_64"
},
"product_reference": "qemu-kvm-rhev-2:0.12.1.2-2.479.el6_7.2.x86_64",
"relates_to_product_reference": "6Server-RH6-RHOS-5.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.479.el6_7.2.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6",
"product_id": "6Server-RH6-RHOS-5.0:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.479.el6_7.2.x86_64"
},
"product_reference": "qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.479.el6_7.2.x86_64",
"relates_to_product_reference": "6Server-RH6-RHOS-5.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-tools-2:0.12.1.2-2.479.el6_7.2.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6",
"product_id": "6Server-RH6-RHOS-5.0:qemu-kvm-rhev-tools-2:0.12.1.2-2.479.el6_7.2.x86_64"
},
"product_reference": "qemu-kvm-rhev-tools-2:0.12.1.2-2.479.el6_7.2.x86_64",
"relates_to_product_reference": "6Server-RH6-RHOS-5.0"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Qinghao Tang"
],
"organization": "QIHU 360 Inc."
}
],
"cve": "CVE-2015-5279",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2015-08-24T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1256672"
}
],
"notes": [
{
"category": "description",
"text": "A heap buffer overflow flaw was found in the way QEMU\u0027s NE2000 NIC emulation implementation handled certain packets received over the network. A privileged user inside a guest could use this flaw to crash the QEMU instance (denial of service) or potentially execute arbitrary code on the host.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "qemu: Heap overflow vulnerability in ne2000_receive() function",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue affects the versions of kvm and xen packages as shipped with Red Hat Enterprise Linux 5.\n\nThis issue affects the versions of the qemu-kvm packages as shipped with Red Hat Enterprise Linux 6.\n\nThis issue affects the Red Hat Enterprise Linux 6 based versions of qemu-kvm-rhev packages as shipped with Red Hat Enterprise Virtualization 3.\n\nThis issue does not affect the versions of the qemu-kvm packages as shipped with Red Hat Enterprise Linux 7.\n\nThis issue does not affect the Red Hat Enterprise Linux 7 based versions of the qemu-kvm-rhev packages as shipped with Red Hat Enterprise Virtualization 3.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RH6-RHOS-5.0:qemu-img-rhev-2:0.12.1.2-2.479.el6_7.2.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.479.el6_7.2.src",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.479.el6_7.2.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.479.el6_7.2.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-tools-2:0.12.1.2-2.479.el6_7.2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-5279"
},
{
"category": "external",
"summary": "RHBZ#1256672",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1256672"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-5279",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-5279"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-5279",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5279"
}
],
"release_date": "2015-09-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-10-15T12:17:40+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"6Server-RH6-RHOS-5.0:qemu-img-rhev-2:0.12.1.2-2.479.el6_7.2.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.479.el6_7.2.src",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.479.el6_7.2.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.479.el6_7.2.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-tools-2:0.12.1.2-2.479.el6_7.2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:1896"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "COMPLETE",
"baseScore": 6.5,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:A/AC:H/Au:S/C:C/I:C/A:C",
"version": "2.0"
},
"products": [
"6Server-RH6-RHOS-5.0:qemu-img-rhev-2:0.12.1.2-2.479.el6_7.2.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.479.el6_7.2.src",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.479.el6_7.2.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.479.el6_7.2.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-tools-2:0.12.1.2-2.479.el6_7.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "qemu: Heap overflow vulnerability in ne2000_receive() function"
}
]
}
rhsa-2015:2065
Vulnerability from csaf_redhat
Published
2015-11-16 18:57
Modified
2024-11-22 09:31
Summary
Red Hat Security Advisory: xen security update
Notes
Topic
Updated xen packages that fix one security issue are now available for Red
Hat Enterprise Linux 5.
Red Hat Product Security has rated this update as having Important security
impact. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available from the CVE link in the
References section.
Details
The xen packages contain administration tools and the xend service for
managing the kernel-xen kernel for virtualization on Red Hat Enterprise
Linux.
A heap buffer overflow flaw was found in the way QEMU's NE2000 NIC
emulation implementation handled certain packets received over the network.
A privileged user inside a guest could use this flaw to crash the QEMU
instance (denial of service) or potentially execute arbitrary code on the
host. (CVE-2015-5279)
Red Hat would like to thank Qinghao Tang of QIHU 360 Inc. for reporting
this issue.
All xen users are advised to upgrade to these updated packages, which
contain a backported patch to correct this issue. After installing the
updated packages, all running fully-virtualized guests must be restarted
for this update to take effect.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated xen packages that fix one security issue are now available for Red\nHat Enterprise Linux 5.\n\nRed Hat Product Security has rated this update as having Important security\nimpact. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available from the CVE link in the\nReferences section.",
"title": "Topic"
},
{
"category": "general",
"text": "The xen packages contain administration tools and the xend service for\nmanaging the kernel-xen kernel for virtualization on Red Hat Enterprise\nLinux.\n\nA heap buffer overflow flaw was found in the way QEMU\u0027s NE2000 NIC\nemulation implementation handled certain packets received over the network.\nA privileged user inside a guest could use this flaw to crash the QEMU\ninstance (denial of service) or potentially execute arbitrary code on the\nhost. (CVE-2015-5279)\n\nRed Hat would like to thank Qinghao Tang of QIHU 360 Inc. for reporting\nthis issue.\n\nAll xen users are advised to upgrade to these updated packages, which\ncontain a backported patch to correct this issue. After installing the\nupdated packages, all running fully-virtualized guests must be restarted\nfor this update to take effect.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2015:2065",
"url": "https://access.redhat.com/errata/RHSA-2015:2065"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "1256672",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1256672"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_2065.json"
}
],
"title": "Red Hat Security Advisory: xen security update",
"tracking": {
"current_release_date": "2024-11-22T09:31:49+00:00",
"generator": {
"date": "2024-11-22T09:31:49+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2015:2065",
"initial_release_date": "2015-11-16T18:57:46+00:00",
"revision_history": [
{
"date": "2015-11-16T18:57:46+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2015-11-16T18:57:46+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-22T09:31:49+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Desktop Multi OS (v. 5 client)",
"product": {
"name": "Red Hat Enterprise Linux Desktop Multi OS (v. 5 client)",
"product_id": "5Client-VT-5.11.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_virtualization:5::client"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Virtualization (v. 5 server)",
"product": {
"name": "Red Hat Enterprise Linux Virtualization (v. 5 server)",
"product_id": "5Server-VT-5.11.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_virtualization:5::server"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Desktop (v. 5 client)",
"product": {
"name": "Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client-5.11.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:5::client"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux (v. 5 server)",
"product": {
"name": "Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server-5.11.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:5::server"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "xen-libs-0:3.0.3-147.el5_11.i386",
"product": {
"name": "xen-libs-0:3.0.3-147.el5_11.i386",
"product_id": "xen-libs-0:3.0.3-147.el5_11.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/xen-libs@3.0.3-147.el5_11?arch=i386"
}
}
},
{
"category": "product_version",
"name": "xen-debuginfo-0:3.0.3-147.el5_11.i386",
"product": {
"name": "xen-debuginfo-0:3.0.3-147.el5_11.i386",
"product_id": "xen-debuginfo-0:3.0.3-147.el5_11.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/xen-debuginfo@3.0.3-147.el5_11?arch=i386"
}
}
},
{
"category": "product_version",
"name": "xen-0:3.0.3-147.el5_11.i386",
"product": {
"name": "xen-0:3.0.3-147.el5_11.i386",
"product_id": "xen-0:3.0.3-147.el5_11.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/xen@3.0.3-147.el5_11?arch=i386"
}
}
},
{
"category": "product_version",
"name": "xen-devel-0:3.0.3-147.el5_11.i386",
"product": {
"name": "xen-devel-0:3.0.3-147.el5_11.i386",
"product_id": "xen-devel-0:3.0.3-147.el5_11.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/xen-devel@3.0.3-147.el5_11?arch=i386"
}
}
}
],
"category": "architecture",
"name": "i386"
},
{
"branches": [
{
"category": "product_version",
"name": "xen-debuginfo-0:3.0.3-147.el5_11.x86_64",
"product": {
"name": "xen-debuginfo-0:3.0.3-147.el5_11.x86_64",
"product_id": "xen-debuginfo-0:3.0.3-147.el5_11.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/xen-debuginfo@3.0.3-147.el5_11?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "xen-libs-0:3.0.3-147.el5_11.x86_64",
"product": {
"name": "xen-libs-0:3.0.3-147.el5_11.x86_64",
"product_id": "xen-libs-0:3.0.3-147.el5_11.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/xen-libs@3.0.3-147.el5_11?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "xen-devel-0:3.0.3-147.el5_11.x86_64",
"product": {
"name": "xen-devel-0:3.0.3-147.el5_11.x86_64",
"product_id": "xen-devel-0:3.0.3-147.el5_11.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/xen-devel@3.0.3-147.el5_11?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "xen-0:3.0.3-147.el5_11.x86_64",
"product": {
"name": "xen-0:3.0.3-147.el5_11.x86_64",
"product_id": "xen-0:3.0.3-147.el5_11.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/xen@3.0.3-147.el5_11?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "xen-0:3.0.3-147.el5_11.src",
"product": {
"name": "xen-0:3.0.3-147.el5_11.src",
"product_id": "xen-0:3.0.3-147.el5_11.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/xen@3.0.3-147.el5_11?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "xen-libs-0:3.0.3-147.el5_11.ia64",
"product": {
"name": "xen-libs-0:3.0.3-147.el5_11.ia64",
"product_id": "xen-libs-0:3.0.3-147.el5_11.ia64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/xen-libs@3.0.3-147.el5_11?arch=ia64"
}
}
},
{
"category": "product_version",
"name": "xen-debuginfo-0:3.0.3-147.el5_11.ia64",
"product": {
"name": "xen-debuginfo-0:3.0.3-147.el5_11.ia64",
"product_id": "xen-debuginfo-0:3.0.3-147.el5_11.ia64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/xen-debuginfo@3.0.3-147.el5_11?arch=ia64"
}
}
},
{
"category": "product_version",
"name": "xen-devel-0:3.0.3-147.el5_11.ia64",
"product": {
"name": "xen-devel-0:3.0.3-147.el5_11.ia64",
"product_id": "xen-devel-0:3.0.3-147.el5_11.ia64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/xen-devel@3.0.3-147.el5_11?arch=ia64"
}
}
},
{
"category": "product_version",
"name": "xen-0:3.0.3-147.el5_11.ia64",
"product": {
"name": "xen-0:3.0.3-147.el5_11.ia64",
"product_id": "xen-0:3.0.3-147.el5_11.ia64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/xen@3.0.3-147.el5_11?arch=ia64"
}
}
}
],
"category": "architecture",
"name": "ia64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-0:3.0.3-147.el5_11.i386 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client-5.11.Z:xen-0:3.0.3-147.el5_11.i386"
},
"product_reference": "xen-0:3.0.3-147.el5_11.i386",
"relates_to_product_reference": "5Client-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-0:3.0.3-147.el5_11.ia64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client-5.11.Z:xen-0:3.0.3-147.el5_11.ia64"
},
"product_reference": "xen-0:3.0.3-147.el5_11.ia64",
"relates_to_product_reference": "5Client-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-0:3.0.3-147.el5_11.src as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client-5.11.Z:xen-0:3.0.3-147.el5_11.src"
},
"product_reference": "xen-0:3.0.3-147.el5_11.src",
"relates_to_product_reference": "5Client-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-0:3.0.3-147.el5_11.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client-5.11.Z:xen-0:3.0.3-147.el5_11.x86_64"
},
"product_reference": "xen-0:3.0.3-147.el5_11.x86_64",
"relates_to_product_reference": "5Client-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-debuginfo-0:3.0.3-147.el5_11.i386 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client-5.11.Z:xen-debuginfo-0:3.0.3-147.el5_11.i386"
},
"product_reference": "xen-debuginfo-0:3.0.3-147.el5_11.i386",
"relates_to_product_reference": "5Client-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-debuginfo-0:3.0.3-147.el5_11.ia64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client-5.11.Z:xen-debuginfo-0:3.0.3-147.el5_11.ia64"
},
"product_reference": "xen-debuginfo-0:3.0.3-147.el5_11.ia64",
"relates_to_product_reference": "5Client-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-debuginfo-0:3.0.3-147.el5_11.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client-5.11.Z:xen-debuginfo-0:3.0.3-147.el5_11.x86_64"
},
"product_reference": "xen-debuginfo-0:3.0.3-147.el5_11.x86_64",
"relates_to_product_reference": "5Client-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-devel-0:3.0.3-147.el5_11.i386 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client-5.11.Z:xen-devel-0:3.0.3-147.el5_11.i386"
},
"product_reference": "xen-devel-0:3.0.3-147.el5_11.i386",
"relates_to_product_reference": "5Client-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-devel-0:3.0.3-147.el5_11.ia64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client-5.11.Z:xen-devel-0:3.0.3-147.el5_11.ia64"
},
"product_reference": "xen-devel-0:3.0.3-147.el5_11.ia64",
"relates_to_product_reference": "5Client-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-devel-0:3.0.3-147.el5_11.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client-5.11.Z:xen-devel-0:3.0.3-147.el5_11.x86_64"
},
"product_reference": "xen-devel-0:3.0.3-147.el5_11.x86_64",
"relates_to_product_reference": "5Client-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-libs-0:3.0.3-147.el5_11.i386 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client-5.11.Z:xen-libs-0:3.0.3-147.el5_11.i386"
},
"product_reference": "xen-libs-0:3.0.3-147.el5_11.i386",
"relates_to_product_reference": "5Client-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-libs-0:3.0.3-147.el5_11.ia64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client-5.11.Z:xen-libs-0:3.0.3-147.el5_11.ia64"
},
"product_reference": "xen-libs-0:3.0.3-147.el5_11.ia64",
"relates_to_product_reference": "5Client-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-libs-0:3.0.3-147.el5_11.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client-5.11.Z:xen-libs-0:3.0.3-147.el5_11.x86_64"
},
"product_reference": "xen-libs-0:3.0.3-147.el5_11.x86_64",
"relates_to_product_reference": "5Client-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-0:3.0.3-147.el5_11.i386 as a component of Red Hat Enterprise Linux Desktop Multi OS (v. 5 client)",
"product_id": "5Client-VT-5.11.Z:xen-0:3.0.3-147.el5_11.i386"
},
"product_reference": "xen-0:3.0.3-147.el5_11.i386",
"relates_to_product_reference": "5Client-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-0:3.0.3-147.el5_11.ia64 as a component of Red Hat Enterprise Linux Desktop Multi OS (v. 5 client)",
"product_id": "5Client-VT-5.11.Z:xen-0:3.0.3-147.el5_11.ia64"
},
"product_reference": "xen-0:3.0.3-147.el5_11.ia64",
"relates_to_product_reference": "5Client-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-0:3.0.3-147.el5_11.src as a component of Red Hat Enterprise Linux Desktop Multi OS (v. 5 client)",
"product_id": "5Client-VT-5.11.Z:xen-0:3.0.3-147.el5_11.src"
},
"product_reference": "xen-0:3.0.3-147.el5_11.src",
"relates_to_product_reference": "5Client-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-0:3.0.3-147.el5_11.x86_64 as a component of Red Hat Enterprise Linux Desktop Multi OS (v. 5 client)",
"product_id": "5Client-VT-5.11.Z:xen-0:3.0.3-147.el5_11.x86_64"
},
"product_reference": "xen-0:3.0.3-147.el5_11.x86_64",
"relates_to_product_reference": "5Client-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-debuginfo-0:3.0.3-147.el5_11.i386 as a component of Red Hat Enterprise Linux Desktop Multi OS (v. 5 client)",
"product_id": "5Client-VT-5.11.Z:xen-debuginfo-0:3.0.3-147.el5_11.i386"
},
"product_reference": "xen-debuginfo-0:3.0.3-147.el5_11.i386",
"relates_to_product_reference": "5Client-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-debuginfo-0:3.0.3-147.el5_11.ia64 as a component of Red Hat Enterprise Linux Desktop Multi OS (v. 5 client)",
"product_id": "5Client-VT-5.11.Z:xen-debuginfo-0:3.0.3-147.el5_11.ia64"
},
"product_reference": "xen-debuginfo-0:3.0.3-147.el5_11.ia64",
"relates_to_product_reference": "5Client-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-debuginfo-0:3.0.3-147.el5_11.x86_64 as a component of Red Hat Enterprise Linux Desktop Multi OS (v. 5 client)",
"product_id": "5Client-VT-5.11.Z:xen-debuginfo-0:3.0.3-147.el5_11.x86_64"
},
"product_reference": "xen-debuginfo-0:3.0.3-147.el5_11.x86_64",
"relates_to_product_reference": "5Client-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-devel-0:3.0.3-147.el5_11.i386 as a component of Red Hat Enterprise Linux Desktop Multi OS (v. 5 client)",
"product_id": "5Client-VT-5.11.Z:xen-devel-0:3.0.3-147.el5_11.i386"
},
"product_reference": "xen-devel-0:3.0.3-147.el5_11.i386",
"relates_to_product_reference": "5Client-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-devel-0:3.0.3-147.el5_11.ia64 as a component of Red Hat Enterprise Linux Desktop Multi OS (v. 5 client)",
"product_id": "5Client-VT-5.11.Z:xen-devel-0:3.0.3-147.el5_11.ia64"
},
"product_reference": "xen-devel-0:3.0.3-147.el5_11.ia64",
"relates_to_product_reference": "5Client-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-devel-0:3.0.3-147.el5_11.x86_64 as a component of Red Hat Enterprise Linux Desktop Multi OS (v. 5 client)",
"product_id": "5Client-VT-5.11.Z:xen-devel-0:3.0.3-147.el5_11.x86_64"
},
"product_reference": "xen-devel-0:3.0.3-147.el5_11.x86_64",
"relates_to_product_reference": "5Client-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-libs-0:3.0.3-147.el5_11.i386 as a component of Red Hat Enterprise Linux Desktop Multi OS (v. 5 client)",
"product_id": "5Client-VT-5.11.Z:xen-libs-0:3.0.3-147.el5_11.i386"
},
"product_reference": "xen-libs-0:3.0.3-147.el5_11.i386",
"relates_to_product_reference": "5Client-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-libs-0:3.0.3-147.el5_11.ia64 as a component of Red Hat Enterprise Linux Desktop Multi OS (v. 5 client)",
"product_id": "5Client-VT-5.11.Z:xen-libs-0:3.0.3-147.el5_11.ia64"
},
"product_reference": "xen-libs-0:3.0.3-147.el5_11.ia64",
"relates_to_product_reference": "5Client-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-libs-0:3.0.3-147.el5_11.x86_64 as a component of Red Hat Enterprise Linux Desktop Multi OS (v. 5 client)",
"product_id": "5Client-VT-5.11.Z:xen-libs-0:3.0.3-147.el5_11.x86_64"
},
"product_reference": "xen-libs-0:3.0.3-147.el5_11.x86_64",
"relates_to_product_reference": "5Client-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-0:3.0.3-147.el5_11.i386 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server-5.11.Z:xen-0:3.0.3-147.el5_11.i386"
},
"product_reference": "xen-0:3.0.3-147.el5_11.i386",
"relates_to_product_reference": "5Server-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-0:3.0.3-147.el5_11.ia64 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server-5.11.Z:xen-0:3.0.3-147.el5_11.ia64"
},
"product_reference": "xen-0:3.0.3-147.el5_11.ia64",
"relates_to_product_reference": "5Server-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-0:3.0.3-147.el5_11.src as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server-5.11.Z:xen-0:3.0.3-147.el5_11.src"
},
"product_reference": "xen-0:3.0.3-147.el5_11.src",
"relates_to_product_reference": "5Server-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-0:3.0.3-147.el5_11.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server-5.11.Z:xen-0:3.0.3-147.el5_11.x86_64"
},
"product_reference": "xen-0:3.0.3-147.el5_11.x86_64",
"relates_to_product_reference": "5Server-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-debuginfo-0:3.0.3-147.el5_11.i386 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server-5.11.Z:xen-debuginfo-0:3.0.3-147.el5_11.i386"
},
"product_reference": "xen-debuginfo-0:3.0.3-147.el5_11.i386",
"relates_to_product_reference": "5Server-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-debuginfo-0:3.0.3-147.el5_11.ia64 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server-5.11.Z:xen-debuginfo-0:3.0.3-147.el5_11.ia64"
},
"product_reference": "xen-debuginfo-0:3.0.3-147.el5_11.ia64",
"relates_to_product_reference": "5Server-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-debuginfo-0:3.0.3-147.el5_11.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server-5.11.Z:xen-debuginfo-0:3.0.3-147.el5_11.x86_64"
},
"product_reference": "xen-debuginfo-0:3.0.3-147.el5_11.x86_64",
"relates_to_product_reference": "5Server-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-devel-0:3.0.3-147.el5_11.i386 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server-5.11.Z:xen-devel-0:3.0.3-147.el5_11.i386"
},
"product_reference": "xen-devel-0:3.0.3-147.el5_11.i386",
"relates_to_product_reference": "5Server-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-devel-0:3.0.3-147.el5_11.ia64 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server-5.11.Z:xen-devel-0:3.0.3-147.el5_11.ia64"
},
"product_reference": "xen-devel-0:3.0.3-147.el5_11.ia64",
"relates_to_product_reference": "5Server-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-devel-0:3.0.3-147.el5_11.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server-5.11.Z:xen-devel-0:3.0.3-147.el5_11.x86_64"
},
"product_reference": "xen-devel-0:3.0.3-147.el5_11.x86_64",
"relates_to_product_reference": "5Server-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-libs-0:3.0.3-147.el5_11.i386 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server-5.11.Z:xen-libs-0:3.0.3-147.el5_11.i386"
},
"product_reference": "xen-libs-0:3.0.3-147.el5_11.i386",
"relates_to_product_reference": "5Server-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-libs-0:3.0.3-147.el5_11.ia64 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server-5.11.Z:xen-libs-0:3.0.3-147.el5_11.ia64"
},
"product_reference": "xen-libs-0:3.0.3-147.el5_11.ia64",
"relates_to_product_reference": "5Server-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-libs-0:3.0.3-147.el5_11.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server-5.11.Z:xen-libs-0:3.0.3-147.el5_11.x86_64"
},
"product_reference": "xen-libs-0:3.0.3-147.el5_11.x86_64",
"relates_to_product_reference": "5Server-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-0:3.0.3-147.el5_11.i386 as a component of Red Hat Enterprise Linux Virtualization (v. 5 server)",
"product_id": "5Server-VT-5.11.Z:xen-0:3.0.3-147.el5_11.i386"
},
"product_reference": "xen-0:3.0.3-147.el5_11.i386",
"relates_to_product_reference": "5Server-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-0:3.0.3-147.el5_11.ia64 as a component of Red Hat Enterprise Linux Virtualization (v. 5 server)",
"product_id": "5Server-VT-5.11.Z:xen-0:3.0.3-147.el5_11.ia64"
},
"product_reference": "xen-0:3.0.3-147.el5_11.ia64",
"relates_to_product_reference": "5Server-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-0:3.0.3-147.el5_11.src as a component of Red Hat Enterprise Linux Virtualization (v. 5 server)",
"product_id": "5Server-VT-5.11.Z:xen-0:3.0.3-147.el5_11.src"
},
"product_reference": "xen-0:3.0.3-147.el5_11.src",
"relates_to_product_reference": "5Server-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-0:3.0.3-147.el5_11.x86_64 as a component of Red Hat Enterprise Linux Virtualization (v. 5 server)",
"product_id": "5Server-VT-5.11.Z:xen-0:3.0.3-147.el5_11.x86_64"
},
"product_reference": "xen-0:3.0.3-147.el5_11.x86_64",
"relates_to_product_reference": "5Server-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-debuginfo-0:3.0.3-147.el5_11.i386 as a component of Red Hat Enterprise Linux Virtualization (v. 5 server)",
"product_id": "5Server-VT-5.11.Z:xen-debuginfo-0:3.0.3-147.el5_11.i386"
},
"product_reference": "xen-debuginfo-0:3.0.3-147.el5_11.i386",
"relates_to_product_reference": "5Server-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-debuginfo-0:3.0.3-147.el5_11.ia64 as a component of Red Hat Enterprise Linux Virtualization (v. 5 server)",
"product_id": "5Server-VT-5.11.Z:xen-debuginfo-0:3.0.3-147.el5_11.ia64"
},
"product_reference": "xen-debuginfo-0:3.0.3-147.el5_11.ia64",
"relates_to_product_reference": "5Server-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-debuginfo-0:3.0.3-147.el5_11.x86_64 as a component of Red Hat Enterprise Linux Virtualization (v. 5 server)",
"product_id": "5Server-VT-5.11.Z:xen-debuginfo-0:3.0.3-147.el5_11.x86_64"
},
"product_reference": "xen-debuginfo-0:3.0.3-147.el5_11.x86_64",
"relates_to_product_reference": "5Server-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-devel-0:3.0.3-147.el5_11.i386 as a component of Red Hat Enterprise Linux Virtualization (v. 5 server)",
"product_id": "5Server-VT-5.11.Z:xen-devel-0:3.0.3-147.el5_11.i386"
},
"product_reference": "xen-devel-0:3.0.3-147.el5_11.i386",
"relates_to_product_reference": "5Server-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-devel-0:3.0.3-147.el5_11.ia64 as a component of Red Hat Enterprise Linux Virtualization (v. 5 server)",
"product_id": "5Server-VT-5.11.Z:xen-devel-0:3.0.3-147.el5_11.ia64"
},
"product_reference": "xen-devel-0:3.0.3-147.el5_11.ia64",
"relates_to_product_reference": "5Server-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-devel-0:3.0.3-147.el5_11.x86_64 as a component of Red Hat Enterprise Linux Virtualization (v. 5 server)",
"product_id": "5Server-VT-5.11.Z:xen-devel-0:3.0.3-147.el5_11.x86_64"
},
"product_reference": "xen-devel-0:3.0.3-147.el5_11.x86_64",
"relates_to_product_reference": "5Server-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-libs-0:3.0.3-147.el5_11.i386 as a component of Red Hat Enterprise Linux Virtualization (v. 5 server)",
"product_id": "5Server-VT-5.11.Z:xen-libs-0:3.0.3-147.el5_11.i386"
},
"product_reference": "xen-libs-0:3.0.3-147.el5_11.i386",
"relates_to_product_reference": "5Server-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-libs-0:3.0.3-147.el5_11.ia64 as a component of Red Hat Enterprise Linux Virtualization (v. 5 server)",
"product_id": "5Server-VT-5.11.Z:xen-libs-0:3.0.3-147.el5_11.ia64"
},
"product_reference": "xen-libs-0:3.0.3-147.el5_11.ia64",
"relates_to_product_reference": "5Server-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xen-libs-0:3.0.3-147.el5_11.x86_64 as a component of Red Hat Enterprise Linux Virtualization (v. 5 server)",
"product_id": "5Server-VT-5.11.Z:xen-libs-0:3.0.3-147.el5_11.x86_64"
},
"product_reference": "xen-libs-0:3.0.3-147.el5_11.x86_64",
"relates_to_product_reference": "5Server-VT-5.11.Z"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Qinghao Tang"
],
"organization": "QIHU 360 Inc."
}
],
"cve": "CVE-2015-5279",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2015-08-24T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1256672"
}
],
"notes": [
{
"category": "description",
"text": "A heap buffer overflow flaw was found in the way QEMU\u0027s NE2000 NIC emulation implementation handled certain packets received over the network. A privileged user inside a guest could use this flaw to crash the QEMU instance (denial of service) or potentially execute arbitrary code on the host.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "qemu: Heap overflow vulnerability in ne2000_receive() function",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue affects the versions of kvm and xen packages as shipped with Red Hat Enterprise Linux 5.\n\nThis issue affects the versions of the qemu-kvm packages as shipped with Red Hat Enterprise Linux 6.\n\nThis issue affects the Red Hat Enterprise Linux 6 based versions of qemu-kvm-rhev packages as shipped with Red Hat Enterprise Virtualization 3.\n\nThis issue does not affect the versions of the qemu-kvm packages as shipped with Red Hat Enterprise Linux 7.\n\nThis issue does not affect the Red Hat Enterprise Linux 7 based versions of the qemu-kvm-rhev packages as shipped with Red Hat Enterprise Virtualization 3.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Client-5.11.Z:xen-0:3.0.3-147.el5_11.i386",
"5Client-5.11.Z:xen-0:3.0.3-147.el5_11.ia64",
"5Client-5.11.Z:xen-0:3.0.3-147.el5_11.src",
"5Client-5.11.Z:xen-0:3.0.3-147.el5_11.x86_64",
"5Client-5.11.Z:xen-debuginfo-0:3.0.3-147.el5_11.i386",
"5Client-5.11.Z:xen-debuginfo-0:3.0.3-147.el5_11.ia64",
"5Client-5.11.Z:xen-debuginfo-0:3.0.3-147.el5_11.x86_64",
"5Client-5.11.Z:xen-devel-0:3.0.3-147.el5_11.i386",
"5Client-5.11.Z:xen-devel-0:3.0.3-147.el5_11.ia64",
"5Client-5.11.Z:xen-devel-0:3.0.3-147.el5_11.x86_64",
"5Client-5.11.Z:xen-libs-0:3.0.3-147.el5_11.i386",
"5Client-5.11.Z:xen-libs-0:3.0.3-147.el5_11.ia64",
"5Client-5.11.Z:xen-libs-0:3.0.3-147.el5_11.x86_64",
"5Client-VT-5.11.Z:xen-0:3.0.3-147.el5_11.i386",
"5Client-VT-5.11.Z:xen-0:3.0.3-147.el5_11.ia64",
"5Client-VT-5.11.Z:xen-0:3.0.3-147.el5_11.src",
"5Client-VT-5.11.Z:xen-0:3.0.3-147.el5_11.x86_64",
"5Client-VT-5.11.Z:xen-debuginfo-0:3.0.3-147.el5_11.i386",
"5Client-VT-5.11.Z:xen-debuginfo-0:3.0.3-147.el5_11.ia64",
"5Client-VT-5.11.Z:xen-debuginfo-0:3.0.3-147.el5_11.x86_64",
"5Client-VT-5.11.Z:xen-devel-0:3.0.3-147.el5_11.i386",
"5Client-VT-5.11.Z:xen-devel-0:3.0.3-147.el5_11.ia64",
"5Client-VT-5.11.Z:xen-devel-0:3.0.3-147.el5_11.x86_64",
"5Client-VT-5.11.Z:xen-libs-0:3.0.3-147.el5_11.i386",
"5Client-VT-5.11.Z:xen-libs-0:3.0.3-147.el5_11.ia64",
"5Client-VT-5.11.Z:xen-libs-0:3.0.3-147.el5_11.x86_64",
"5Server-5.11.Z:xen-0:3.0.3-147.el5_11.i386",
"5Server-5.11.Z:xen-0:3.0.3-147.el5_11.ia64",
"5Server-5.11.Z:xen-0:3.0.3-147.el5_11.src",
"5Server-5.11.Z:xen-0:3.0.3-147.el5_11.x86_64",
"5Server-5.11.Z:xen-debuginfo-0:3.0.3-147.el5_11.i386",
"5Server-5.11.Z:xen-debuginfo-0:3.0.3-147.el5_11.ia64",
"5Server-5.11.Z:xen-debuginfo-0:3.0.3-147.el5_11.x86_64",
"5Server-5.11.Z:xen-devel-0:3.0.3-147.el5_11.i386",
"5Server-5.11.Z:xen-devel-0:3.0.3-147.el5_11.ia64",
"5Server-5.11.Z:xen-devel-0:3.0.3-147.el5_11.x86_64",
"5Server-5.11.Z:xen-libs-0:3.0.3-147.el5_11.i386",
"5Server-5.11.Z:xen-libs-0:3.0.3-147.el5_11.ia64",
"5Server-5.11.Z:xen-libs-0:3.0.3-147.el5_11.x86_64",
"5Server-VT-5.11.Z:xen-0:3.0.3-147.el5_11.i386",
"5Server-VT-5.11.Z:xen-0:3.0.3-147.el5_11.ia64",
"5Server-VT-5.11.Z:xen-0:3.0.3-147.el5_11.src",
"5Server-VT-5.11.Z:xen-0:3.0.3-147.el5_11.x86_64",
"5Server-VT-5.11.Z:xen-debuginfo-0:3.0.3-147.el5_11.i386",
"5Server-VT-5.11.Z:xen-debuginfo-0:3.0.3-147.el5_11.ia64",
"5Server-VT-5.11.Z:xen-debuginfo-0:3.0.3-147.el5_11.x86_64",
"5Server-VT-5.11.Z:xen-devel-0:3.0.3-147.el5_11.i386",
"5Server-VT-5.11.Z:xen-devel-0:3.0.3-147.el5_11.ia64",
"5Server-VT-5.11.Z:xen-devel-0:3.0.3-147.el5_11.x86_64",
"5Server-VT-5.11.Z:xen-libs-0:3.0.3-147.el5_11.i386",
"5Server-VT-5.11.Z:xen-libs-0:3.0.3-147.el5_11.ia64",
"5Server-VT-5.11.Z:xen-libs-0:3.0.3-147.el5_11.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-5279"
},
{
"category": "external",
"summary": "RHBZ#1256672",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1256672"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-5279",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-5279"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-5279",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5279"
}
],
"release_date": "2015-09-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-11-16T18:57:46+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"5Client-5.11.Z:xen-0:3.0.3-147.el5_11.i386",
"5Client-5.11.Z:xen-0:3.0.3-147.el5_11.ia64",
"5Client-5.11.Z:xen-0:3.0.3-147.el5_11.src",
"5Client-5.11.Z:xen-0:3.0.3-147.el5_11.x86_64",
"5Client-5.11.Z:xen-debuginfo-0:3.0.3-147.el5_11.i386",
"5Client-5.11.Z:xen-debuginfo-0:3.0.3-147.el5_11.ia64",
"5Client-5.11.Z:xen-debuginfo-0:3.0.3-147.el5_11.x86_64",
"5Client-5.11.Z:xen-devel-0:3.0.3-147.el5_11.i386",
"5Client-5.11.Z:xen-devel-0:3.0.3-147.el5_11.ia64",
"5Client-5.11.Z:xen-devel-0:3.0.3-147.el5_11.x86_64",
"5Client-5.11.Z:xen-libs-0:3.0.3-147.el5_11.i386",
"5Client-5.11.Z:xen-libs-0:3.0.3-147.el5_11.ia64",
"5Client-5.11.Z:xen-libs-0:3.0.3-147.el5_11.x86_64",
"5Client-VT-5.11.Z:xen-0:3.0.3-147.el5_11.i386",
"5Client-VT-5.11.Z:xen-0:3.0.3-147.el5_11.ia64",
"5Client-VT-5.11.Z:xen-0:3.0.3-147.el5_11.src",
"5Client-VT-5.11.Z:xen-0:3.0.3-147.el5_11.x86_64",
"5Client-VT-5.11.Z:xen-debuginfo-0:3.0.3-147.el5_11.i386",
"5Client-VT-5.11.Z:xen-debuginfo-0:3.0.3-147.el5_11.ia64",
"5Client-VT-5.11.Z:xen-debuginfo-0:3.0.3-147.el5_11.x86_64",
"5Client-VT-5.11.Z:xen-devel-0:3.0.3-147.el5_11.i386",
"5Client-VT-5.11.Z:xen-devel-0:3.0.3-147.el5_11.ia64",
"5Client-VT-5.11.Z:xen-devel-0:3.0.3-147.el5_11.x86_64",
"5Client-VT-5.11.Z:xen-libs-0:3.0.3-147.el5_11.i386",
"5Client-VT-5.11.Z:xen-libs-0:3.0.3-147.el5_11.ia64",
"5Client-VT-5.11.Z:xen-libs-0:3.0.3-147.el5_11.x86_64",
"5Server-5.11.Z:xen-0:3.0.3-147.el5_11.i386",
"5Server-5.11.Z:xen-0:3.0.3-147.el5_11.ia64",
"5Server-5.11.Z:xen-0:3.0.3-147.el5_11.src",
"5Server-5.11.Z:xen-0:3.0.3-147.el5_11.x86_64",
"5Server-5.11.Z:xen-debuginfo-0:3.0.3-147.el5_11.i386",
"5Server-5.11.Z:xen-debuginfo-0:3.0.3-147.el5_11.ia64",
"5Server-5.11.Z:xen-debuginfo-0:3.0.3-147.el5_11.x86_64",
"5Server-5.11.Z:xen-devel-0:3.0.3-147.el5_11.i386",
"5Server-5.11.Z:xen-devel-0:3.0.3-147.el5_11.ia64",
"5Server-5.11.Z:xen-devel-0:3.0.3-147.el5_11.x86_64",
"5Server-5.11.Z:xen-libs-0:3.0.3-147.el5_11.i386",
"5Server-5.11.Z:xen-libs-0:3.0.3-147.el5_11.ia64",
"5Server-5.11.Z:xen-libs-0:3.0.3-147.el5_11.x86_64",
"5Server-VT-5.11.Z:xen-0:3.0.3-147.el5_11.i386",
"5Server-VT-5.11.Z:xen-0:3.0.3-147.el5_11.ia64",
"5Server-VT-5.11.Z:xen-0:3.0.3-147.el5_11.src",
"5Server-VT-5.11.Z:xen-0:3.0.3-147.el5_11.x86_64",
"5Server-VT-5.11.Z:xen-debuginfo-0:3.0.3-147.el5_11.i386",
"5Server-VT-5.11.Z:xen-debuginfo-0:3.0.3-147.el5_11.ia64",
"5Server-VT-5.11.Z:xen-debuginfo-0:3.0.3-147.el5_11.x86_64",
"5Server-VT-5.11.Z:xen-devel-0:3.0.3-147.el5_11.i386",
"5Server-VT-5.11.Z:xen-devel-0:3.0.3-147.el5_11.ia64",
"5Server-VT-5.11.Z:xen-devel-0:3.0.3-147.el5_11.x86_64",
"5Server-VT-5.11.Z:xen-libs-0:3.0.3-147.el5_11.i386",
"5Server-VT-5.11.Z:xen-libs-0:3.0.3-147.el5_11.ia64",
"5Server-VT-5.11.Z:xen-libs-0:3.0.3-147.el5_11.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:2065"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "COMPLETE",
"baseScore": 6.5,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:A/AC:H/Au:S/C:C/I:C/A:C",
"version": "2.0"
},
"products": [
"5Client-5.11.Z:xen-0:3.0.3-147.el5_11.i386",
"5Client-5.11.Z:xen-0:3.0.3-147.el5_11.ia64",
"5Client-5.11.Z:xen-0:3.0.3-147.el5_11.src",
"5Client-5.11.Z:xen-0:3.0.3-147.el5_11.x86_64",
"5Client-5.11.Z:xen-debuginfo-0:3.0.3-147.el5_11.i386",
"5Client-5.11.Z:xen-debuginfo-0:3.0.3-147.el5_11.ia64",
"5Client-5.11.Z:xen-debuginfo-0:3.0.3-147.el5_11.x86_64",
"5Client-5.11.Z:xen-devel-0:3.0.3-147.el5_11.i386",
"5Client-5.11.Z:xen-devel-0:3.0.3-147.el5_11.ia64",
"5Client-5.11.Z:xen-devel-0:3.0.3-147.el5_11.x86_64",
"5Client-5.11.Z:xen-libs-0:3.0.3-147.el5_11.i386",
"5Client-5.11.Z:xen-libs-0:3.0.3-147.el5_11.ia64",
"5Client-5.11.Z:xen-libs-0:3.0.3-147.el5_11.x86_64",
"5Client-VT-5.11.Z:xen-0:3.0.3-147.el5_11.i386",
"5Client-VT-5.11.Z:xen-0:3.0.3-147.el5_11.ia64",
"5Client-VT-5.11.Z:xen-0:3.0.3-147.el5_11.src",
"5Client-VT-5.11.Z:xen-0:3.0.3-147.el5_11.x86_64",
"5Client-VT-5.11.Z:xen-debuginfo-0:3.0.3-147.el5_11.i386",
"5Client-VT-5.11.Z:xen-debuginfo-0:3.0.3-147.el5_11.ia64",
"5Client-VT-5.11.Z:xen-debuginfo-0:3.0.3-147.el5_11.x86_64",
"5Client-VT-5.11.Z:xen-devel-0:3.0.3-147.el5_11.i386",
"5Client-VT-5.11.Z:xen-devel-0:3.0.3-147.el5_11.ia64",
"5Client-VT-5.11.Z:xen-devel-0:3.0.3-147.el5_11.x86_64",
"5Client-VT-5.11.Z:xen-libs-0:3.0.3-147.el5_11.i386",
"5Client-VT-5.11.Z:xen-libs-0:3.0.3-147.el5_11.ia64",
"5Client-VT-5.11.Z:xen-libs-0:3.0.3-147.el5_11.x86_64",
"5Server-5.11.Z:xen-0:3.0.3-147.el5_11.i386",
"5Server-5.11.Z:xen-0:3.0.3-147.el5_11.ia64",
"5Server-5.11.Z:xen-0:3.0.3-147.el5_11.src",
"5Server-5.11.Z:xen-0:3.0.3-147.el5_11.x86_64",
"5Server-5.11.Z:xen-debuginfo-0:3.0.3-147.el5_11.i386",
"5Server-5.11.Z:xen-debuginfo-0:3.0.3-147.el5_11.ia64",
"5Server-5.11.Z:xen-debuginfo-0:3.0.3-147.el5_11.x86_64",
"5Server-5.11.Z:xen-devel-0:3.0.3-147.el5_11.i386",
"5Server-5.11.Z:xen-devel-0:3.0.3-147.el5_11.ia64",
"5Server-5.11.Z:xen-devel-0:3.0.3-147.el5_11.x86_64",
"5Server-5.11.Z:xen-libs-0:3.0.3-147.el5_11.i386",
"5Server-5.11.Z:xen-libs-0:3.0.3-147.el5_11.ia64",
"5Server-5.11.Z:xen-libs-0:3.0.3-147.el5_11.x86_64",
"5Server-VT-5.11.Z:xen-0:3.0.3-147.el5_11.i386",
"5Server-VT-5.11.Z:xen-0:3.0.3-147.el5_11.ia64",
"5Server-VT-5.11.Z:xen-0:3.0.3-147.el5_11.src",
"5Server-VT-5.11.Z:xen-0:3.0.3-147.el5_11.x86_64",
"5Server-VT-5.11.Z:xen-debuginfo-0:3.0.3-147.el5_11.i386",
"5Server-VT-5.11.Z:xen-debuginfo-0:3.0.3-147.el5_11.ia64",
"5Server-VT-5.11.Z:xen-debuginfo-0:3.0.3-147.el5_11.x86_64",
"5Server-VT-5.11.Z:xen-devel-0:3.0.3-147.el5_11.i386",
"5Server-VT-5.11.Z:xen-devel-0:3.0.3-147.el5_11.ia64",
"5Server-VT-5.11.Z:xen-devel-0:3.0.3-147.el5_11.x86_64",
"5Server-VT-5.11.Z:xen-libs-0:3.0.3-147.el5_11.i386",
"5Server-VT-5.11.Z:xen-libs-0:3.0.3-147.el5_11.ia64",
"5Server-VT-5.11.Z:xen-libs-0:3.0.3-147.el5_11.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "qemu: Heap overflow vulnerability in ne2000_receive() function"
}
]
}
rhsa-2015:1923
Vulnerability from csaf_redhat
Published
2015-10-22 16:44
Modified
2024-11-22 09:31
Summary
Red Hat Security Advisory: qemu-kvm-rhev security update
Notes
Topic
Updated qemu-kvm-rhev packages that fix one security issue are now
available for Red Hat Enterprise Virtualization.
Red Hat Product Security has rated this update as having Important security
impact. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available from the CVE link in the
References section.
Details
KVM (Kernel-based Virtual Machine) is a full virtualization solution for
Linux on AMD64 and Intel 64 systems. The qemu-kvm-rhev package provides the
user-space component for running virtual machines using KVM.
A heap buffer overflow flaw was found in the way QEMU's NE2000 NIC
emulation implementation handled certain packets received over the network.
A privileged user inside a guest could use this flaw to crash the QEMU
instance (denial of service) or potentially execute arbitrary code on the
host. (CVE-2015-5279)
Red Hat would like to thank Qinghao Tang of QIHU 360 Inc. for reporting
this issue.
All qemu-kvm-rhev users are advised to upgrade to these updated packages,
which contain a backported patch to correct this issue. After installing
this update, shut down all running virtual machines. Once all virtual
machines have shut down, start them again for this update to take effect.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated qemu-kvm-rhev packages that fix one security issue are now\navailable for Red Hat Enterprise Virtualization.\n\nRed Hat Product Security has rated this update as having Important security\nimpact. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available from the CVE link in the\nReferences section.",
"title": "Topic"
},
{
"category": "general",
"text": "KVM (Kernel-based Virtual Machine) is a full virtualization solution for\nLinux on AMD64 and Intel 64 systems. The qemu-kvm-rhev package provides the\nuser-space component for running virtual machines using KVM.\n\nA heap buffer overflow flaw was found in the way QEMU\u0027s NE2000 NIC\nemulation implementation handled certain packets received over the network.\nA privileged user inside a guest could use this flaw to crash the QEMU\ninstance (denial of service) or potentially execute arbitrary code on the\nhost. (CVE-2015-5279)\n\nRed Hat would like to thank Qinghao Tang of QIHU 360 Inc. for reporting\nthis issue.\n\nAll qemu-kvm-rhev users are advised to upgrade to these updated packages,\nwhich contain a backported patch to correct this issue. After installing\nthis update, shut down all running virtual machines. Once all virtual\nmachines have shut down, start them again for this update to take effect.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2015:1923",
"url": "https://access.redhat.com/errata/RHSA-2015:1923"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "1256672",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1256672"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1923.json"
}
],
"title": "Red Hat Security Advisory: qemu-kvm-rhev security update",
"tracking": {
"current_release_date": "2024-11-22T09:31:28+00:00",
"generator": {
"date": "2024-11-22T09:31:28+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2015:1923",
"initial_release_date": "2015-10-22T16:44:02+00:00",
"revision_history": [
{
"date": "2015-10-22T16:44:02+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2015-10-22T16:44:02+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-22T09:31:28+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "RHEV Agents (vdsm)",
"product": {
"name": "RHEV Agents (vdsm)",
"product_id": "6Server-RHEV-Agents",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:enterprise_linux:6::hypervisor"
}
}
}
],
"category": "product_family",
"name": "Red Hat Virtualization"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-img-rhev-2:0.12.1.2-2.479.el6_7.2.x86_64",
"product": {
"name": "qemu-img-rhev-2:0.12.1.2-2.479.el6_7.2.x86_64",
"product_id": "qemu-img-rhev-2:0.12.1.2-2.479.el6_7.2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-img-rhev@0.12.1.2-2.479.el6_7.2?arch=x86_64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.479.el6_7.2.x86_64",
"product": {
"name": "qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.479.el6_7.2.x86_64",
"product_id": "qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.479.el6_7.2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev-debuginfo@0.12.1.2-2.479.el6_7.2?arch=x86_64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-rhev-2:0.12.1.2-2.479.el6_7.2.x86_64",
"product": {
"name": "qemu-kvm-rhev-2:0.12.1.2-2.479.el6_7.2.x86_64",
"product_id": "qemu-kvm-rhev-2:0.12.1.2-2.479.el6_7.2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev@0.12.1.2-2.479.el6_7.2?arch=x86_64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-rhev-tools-2:0.12.1.2-2.479.el6_7.2.x86_64",
"product": {
"name": "qemu-kvm-rhev-tools-2:0.12.1.2-2.479.el6_7.2.x86_64",
"product_id": "qemu-kvm-rhev-tools-2:0.12.1.2-2.479.el6_7.2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev-tools@0.12.1.2-2.479.el6_7.2?arch=x86_64\u0026epoch=2"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-kvm-rhev-2:0.12.1.2-2.479.el6_7.2.src",
"product": {
"name": "qemu-kvm-rhev-2:0.12.1.2-2.479.el6_7.2.src",
"product_id": "qemu-kvm-rhev-2:0.12.1.2-2.479.el6_7.2.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev@0.12.1.2-2.479.el6_7.2?arch=src\u0026epoch=2"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-rhev-2:0.12.1.2-2.479.el6_7.2.x86_64 as a component of RHEV Agents (vdsm)",
"product_id": "6Server-RHEV-Agents:qemu-img-rhev-2:0.12.1.2-2.479.el6_7.2.x86_64"
},
"product_reference": "qemu-img-rhev-2:0.12.1.2-2.479.el6_7.2.x86_64",
"relates_to_product_reference": "6Server-RHEV-Agents"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-2:0.12.1.2-2.479.el6_7.2.src as a component of RHEV Agents (vdsm)",
"product_id": "6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.479.el6_7.2.src"
},
"product_reference": "qemu-kvm-rhev-2:0.12.1.2-2.479.el6_7.2.src",
"relates_to_product_reference": "6Server-RHEV-Agents"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-2:0.12.1.2-2.479.el6_7.2.x86_64 as a component of RHEV Agents (vdsm)",
"product_id": "6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.479.el6_7.2.x86_64"
},
"product_reference": "qemu-kvm-rhev-2:0.12.1.2-2.479.el6_7.2.x86_64",
"relates_to_product_reference": "6Server-RHEV-Agents"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.479.el6_7.2.x86_64 as a component of RHEV Agents (vdsm)",
"product_id": "6Server-RHEV-Agents:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.479.el6_7.2.x86_64"
},
"product_reference": "qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.479.el6_7.2.x86_64",
"relates_to_product_reference": "6Server-RHEV-Agents"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-tools-2:0.12.1.2-2.479.el6_7.2.x86_64 as a component of RHEV Agents (vdsm)",
"product_id": "6Server-RHEV-Agents:qemu-kvm-rhev-tools-2:0.12.1.2-2.479.el6_7.2.x86_64"
},
"product_reference": "qemu-kvm-rhev-tools-2:0.12.1.2-2.479.el6_7.2.x86_64",
"relates_to_product_reference": "6Server-RHEV-Agents"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Qinghao Tang"
],
"organization": "QIHU 360 Inc."
}
],
"cve": "CVE-2015-5279",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2015-08-24T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1256672"
}
],
"notes": [
{
"category": "description",
"text": "A heap buffer overflow flaw was found in the way QEMU\u0027s NE2000 NIC emulation implementation handled certain packets received over the network. A privileged user inside a guest could use this flaw to crash the QEMU instance (denial of service) or potentially execute arbitrary code on the host.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "qemu: Heap overflow vulnerability in ne2000_receive() function",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue affects the versions of kvm and xen packages as shipped with Red Hat Enterprise Linux 5.\n\nThis issue affects the versions of the qemu-kvm packages as shipped with Red Hat Enterprise Linux 6.\n\nThis issue affects the Red Hat Enterprise Linux 6 based versions of qemu-kvm-rhev packages as shipped with Red Hat Enterprise Virtualization 3.\n\nThis issue does not affect the versions of the qemu-kvm packages as shipped with Red Hat Enterprise Linux 7.\n\nThis issue does not affect the Red Hat Enterprise Linux 7 based versions of the qemu-kvm-rhev packages as shipped with Red Hat Enterprise Virtualization 3.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RHEV-Agents:qemu-img-rhev-2:0.12.1.2-2.479.el6_7.2.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.479.el6_7.2.src",
"6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.479.el6_7.2.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.479.el6_7.2.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-tools-2:0.12.1.2-2.479.el6_7.2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-5279"
},
{
"category": "external",
"summary": "RHBZ#1256672",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1256672"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-5279",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-5279"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-5279",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5279"
}
],
"release_date": "2015-09-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-10-22T16:44:02+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"6Server-RHEV-Agents:qemu-img-rhev-2:0.12.1.2-2.479.el6_7.2.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.479.el6_7.2.src",
"6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.479.el6_7.2.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.479.el6_7.2.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-tools-2:0.12.1.2-2.479.el6_7.2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:1923"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "COMPLETE",
"baseScore": 6.5,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:A/AC:H/Au:S/C:C/I:C/A:C",
"version": "2.0"
},
"products": [
"6Server-RHEV-Agents:qemu-img-rhev-2:0.12.1.2-2.479.el6_7.2.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.479.el6_7.2.src",
"6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.479.el6_7.2.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.479.el6_7.2.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-tools-2:0.12.1.2-2.479.el6_7.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "qemu: Heap overflow vulnerability in ne2000_receive() function"
}
]
}
rhsa-2015:1925
Vulnerability from csaf_redhat
Published
2015-10-22 16:41
Modified
2024-11-22 09:31
Summary
Red Hat Security Advisory: kvm security update
Notes
Topic
Updated kvm packages that fix one security issue are now available for Red
Hat Enterprise Linux 5.
Red Hat Product Security has rated this update as having Important security
impact. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available from the CVE link in the
References section.
Details
KVM (Kernel-based Virtual Machine) is a full virtualization solution for
Linux on AMD64 and Intel 64 systems.
A heap buffer overflow flaw was found in the way QEMU's NE2000 NIC
emulation implementation handled certain packets received over the network.
A privileged user inside a guest could use this flaw to crash the QEMU
instance (denial of service) or potentially execute arbitrary code on
the host. (CVE-2015-5279)
Red Hat would like to thank Qinghao Tang of QIHU 360 Inc. for reporting
this issue.
All kvm users are advised to upgrade to these updated packages, which
contain a backported patch to correct this issue. Note: The procedure in
the Solution section must be performed before this update will take effect.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated kvm packages that fix one security issue are now available for Red\nHat Enterprise Linux 5.\n\nRed Hat Product Security has rated this update as having Important security\nimpact. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available from the CVE link in the\nReferences section.",
"title": "Topic"
},
{
"category": "general",
"text": "KVM (Kernel-based Virtual Machine) is a full virtualization solution for\nLinux on AMD64 and Intel 64 systems.\n\nA heap buffer overflow flaw was found in the way QEMU\u0027s NE2000 NIC\nemulation implementation handled certain packets received over the network.\nA privileged user inside a guest could use this flaw to crash the QEMU\ninstance (denial of service) or potentially execute arbitrary code on\nthe host. (CVE-2015-5279)\n\nRed Hat would like to thank Qinghao Tang of QIHU 360 Inc. for reporting\nthis issue.\n\nAll kvm users are advised to upgrade to these updated packages, which\ncontain a backported patch to correct this issue. Note: The procedure in\nthe Solution section must be performed before this update will take effect.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2015:1925",
"url": "https://access.redhat.com/errata/RHSA-2015:1925"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "1256672",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1256672"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1925.json"
}
],
"title": "Red Hat Security Advisory: kvm security update",
"tracking": {
"current_release_date": "2024-11-22T09:31:38+00:00",
"generator": {
"date": "2024-11-22T09:31:38+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2015:1925",
"initial_release_date": "2015-10-22T16:41:34+00:00",
"revision_history": [
{
"date": "2015-10-22T16:41:34+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2015-10-22T16:41:34+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-22T09:31:38+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Desktop Multi OS (v. 5 client)",
"product": {
"name": "Red Hat Enterprise Linux Desktop Multi OS (v. 5 client)",
"product_id": "5Client-VT-5.11.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_virtualization:5::client"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Virtualization (v. 5 server)",
"product": {
"name": "Red Hat Enterprise Linux Virtualization (v. 5 server)",
"product_id": "5Server-VT-5.11.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_virtualization:5::server"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "kvm-tools-0:83-274.el5_11.x86_64",
"product": {
"name": "kvm-tools-0:83-274.el5_11.x86_64",
"product_id": "kvm-tools-0:83-274.el5_11.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/kvm-tools@83-274.el5_11?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "kmod-kvm-0:83-274.el5_11.x86_64",
"product": {
"name": "kmod-kvm-0:83-274.el5_11.x86_64",
"product_id": "kmod-kvm-0:83-274.el5_11.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/kmod-kvm@83-274.el5_11?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "kvm-debuginfo-0:83-274.el5_11.x86_64",
"product": {
"name": "kvm-debuginfo-0:83-274.el5_11.x86_64",
"product_id": "kvm-debuginfo-0:83-274.el5_11.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/kvm-debuginfo@83-274.el5_11?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "kvm-qemu-img-0:83-274.el5_11.x86_64",
"product": {
"name": "kvm-qemu-img-0:83-274.el5_11.x86_64",
"product_id": "kvm-qemu-img-0:83-274.el5_11.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/kvm-qemu-img@83-274.el5_11?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "kmod-kvm-debug-0:83-274.el5_11.x86_64",
"product": {
"name": "kmod-kvm-debug-0:83-274.el5_11.x86_64",
"product_id": "kmod-kvm-debug-0:83-274.el5_11.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/kmod-kvm-debug@83-274.el5_11?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "kvm-0:83-274.el5_11.x86_64",
"product": {
"name": "kvm-0:83-274.el5_11.x86_64",
"product_id": "kvm-0:83-274.el5_11.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/kvm@83-274.el5_11?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "kvm-0:83-274.el5_11.src",
"product": {
"name": "kvm-0:83-274.el5_11.src",
"product_id": "kvm-0:83-274.el5_11.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/kvm@83-274.el5_11?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "kmod-kvm-0:83-274.el5_11.x86_64 as a component of Red Hat Enterprise Linux Desktop Multi OS (v. 5 client)",
"product_id": "5Client-VT-5.11.Z:kmod-kvm-0:83-274.el5_11.x86_64"
},
"product_reference": "kmod-kvm-0:83-274.el5_11.x86_64",
"relates_to_product_reference": "5Client-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kmod-kvm-debug-0:83-274.el5_11.x86_64 as a component of Red Hat Enterprise Linux Desktop Multi OS (v. 5 client)",
"product_id": "5Client-VT-5.11.Z:kmod-kvm-debug-0:83-274.el5_11.x86_64"
},
"product_reference": "kmod-kvm-debug-0:83-274.el5_11.x86_64",
"relates_to_product_reference": "5Client-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kvm-0:83-274.el5_11.src as a component of Red Hat Enterprise Linux Desktop Multi OS (v. 5 client)",
"product_id": "5Client-VT-5.11.Z:kvm-0:83-274.el5_11.src"
},
"product_reference": "kvm-0:83-274.el5_11.src",
"relates_to_product_reference": "5Client-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kvm-0:83-274.el5_11.x86_64 as a component of Red Hat Enterprise Linux Desktop Multi OS (v. 5 client)",
"product_id": "5Client-VT-5.11.Z:kvm-0:83-274.el5_11.x86_64"
},
"product_reference": "kvm-0:83-274.el5_11.x86_64",
"relates_to_product_reference": "5Client-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kvm-debuginfo-0:83-274.el5_11.x86_64 as a component of Red Hat Enterprise Linux Desktop Multi OS (v. 5 client)",
"product_id": "5Client-VT-5.11.Z:kvm-debuginfo-0:83-274.el5_11.x86_64"
},
"product_reference": "kvm-debuginfo-0:83-274.el5_11.x86_64",
"relates_to_product_reference": "5Client-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kvm-qemu-img-0:83-274.el5_11.x86_64 as a component of Red Hat Enterprise Linux Desktop Multi OS (v. 5 client)",
"product_id": "5Client-VT-5.11.Z:kvm-qemu-img-0:83-274.el5_11.x86_64"
},
"product_reference": "kvm-qemu-img-0:83-274.el5_11.x86_64",
"relates_to_product_reference": "5Client-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kvm-tools-0:83-274.el5_11.x86_64 as a component of Red Hat Enterprise Linux Desktop Multi OS (v. 5 client)",
"product_id": "5Client-VT-5.11.Z:kvm-tools-0:83-274.el5_11.x86_64"
},
"product_reference": "kvm-tools-0:83-274.el5_11.x86_64",
"relates_to_product_reference": "5Client-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kmod-kvm-0:83-274.el5_11.x86_64 as a component of Red Hat Enterprise Linux Virtualization (v. 5 server)",
"product_id": "5Server-VT-5.11.Z:kmod-kvm-0:83-274.el5_11.x86_64"
},
"product_reference": "kmod-kvm-0:83-274.el5_11.x86_64",
"relates_to_product_reference": "5Server-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kmod-kvm-debug-0:83-274.el5_11.x86_64 as a component of Red Hat Enterprise Linux Virtualization (v. 5 server)",
"product_id": "5Server-VT-5.11.Z:kmod-kvm-debug-0:83-274.el5_11.x86_64"
},
"product_reference": "kmod-kvm-debug-0:83-274.el5_11.x86_64",
"relates_to_product_reference": "5Server-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kvm-0:83-274.el5_11.src as a component of Red Hat Enterprise Linux Virtualization (v. 5 server)",
"product_id": "5Server-VT-5.11.Z:kvm-0:83-274.el5_11.src"
},
"product_reference": "kvm-0:83-274.el5_11.src",
"relates_to_product_reference": "5Server-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kvm-0:83-274.el5_11.x86_64 as a component of Red Hat Enterprise Linux Virtualization (v. 5 server)",
"product_id": "5Server-VT-5.11.Z:kvm-0:83-274.el5_11.x86_64"
},
"product_reference": "kvm-0:83-274.el5_11.x86_64",
"relates_to_product_reference": "5Server-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kvm-debuginfo-0:83-274.el5_11.x86_64 as a component of Red Hat Enterprise Linux Virtualization (v. 5 server)",
"product_id": "5Server-VT-5.11.Z:kvm-debuginfo-0:83-274.el5_11.x86_64"
},
"product_reference": "kvm-debuginfo-0:83-274.el5_11.x86_64",
"relates_to_product_reference": "5Server-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kvm-qemu-img-0:83-274.el5_11.x86_64 as a component of Red Hat Enterprise Linux Virtualization (v. 5 server)",
"product_id": "5Server-VT-5.11.Z:kvm-qemu-img-0:83-274.el5_11.x86_64"
},
"product_reference": "kvm-qemu-img-0:83-274.el5_11.x86_64",
"relates_to_product_reference": "5Server-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kvm-tools-0:83-274.el5_11.x86_64 as a component of Red Hat Enterprise Linux Virtualization (v. 5 server)",
"product_id": "5Server-VT-5.11.Z:kvm-tools-0:83-274.el5_11.x86_64"
},
"product_reference": "kvm-tools-0:83-274.el5_11.x86_64",
"relates_to_product_reference": "5Server-VT-5.11.Z"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Qinghao Tang"
],
"organization": "QIHU 360 Inc."
}
],
"cve": "CVE-2015-5279",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2015-08-24T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1256672"
}
],
"notes": [
{
"category": "description",
"text": "A heap buffer overflow flaw was found in the way QEMU\u0027s NE2000 NIC emulation implementation handled certain packets received over the network. A privileged user inside a guest could use this flaw to crash the QEMU instance (denial of service) or potentially execute arbitrary code on the host.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "qemu: Heap overflow vulnerability in ne2000_receive() function",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue affects the versions of kvm and xen packages as shipped with Red Hat Enterprise Linux 5.\n\nThis issue affects the versions of the qemu-kvm packages as shipped with Red Hat Enterprise Linux 6.\n\nThis issue affects the Red Hat Enterprise Linux 6 based versions of qemu-kvm-rhev packages as shipped with Red Hat Enterprise Virtualization 3.\n\nThis issue does not affect the versions of the qemu-kvm packages as shipped with Red Hat Enterprise Linux 7.\n\nThis issue does not affect the Red Hat Enterprise Linux 7 based versions of the qemu-kvm-rhev packages as shipped with Red Hat Enterprise Virtualization 3.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Client-VT-5.11.Z:kmod-kvm-0:83-274.el5_11.x86_64",
"5Client-VT-5.11.Z:kmod-kvm-debug-0:83-274.el5_11.x86_64",
"5Client-VT-5.11.Z:kvm-0:83-274.el5_11.src",
"5Client-VT-5.11.Z:kvm-0:83-274.el5_11.x86_64",
"5Client-VT-5.11.Z:kvm-debuginfo-0:83-274.el5_11.x86_64",
"5Client-VT-5.11.Z:kvm-qemu-img-0:83-274.el5_11.x86_64",
"5Client-VT-5.11.Z:kvm-tools-0:83-274.el5_11.x86_64",
"5Server-VT-5.11.Z:kmod-kvm-0:83-274.el5_11.x86_64",
"5Server-VT-5.11.Z:kmod-kvm-debug-0:83-274.el5_11.x86_64",
"5Server-VT-5.11.Z:kvm-0:83-274.el5_11.src",
"5Server-VT-5.11.Z:kvm-0:83-274.el5_11.x86_64",
"5Server-VT-5.11.Z:kvm-debuginfo-0:83-274.el5_11.x86_64",
"5Server-VT-5.11.Z:kvm-qemu-img-0:83-274.el5_11.x86_64",
"5Server-VT-5.11.Z:kvm-tools-0:83-274.el5_11.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-5279"
},
{
"category": "external",
"summary": "RHBZ#1256672",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1256672"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-5279",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-5279"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-5279",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5279"
}
],
"release_date": "2015-09-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-10-22T16:41:34+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nThe following procedure must be performed before this update will take\neffect:\n\n1) Stop all KVM guest virtual machines.\n\n2) Either reboot the hypervisor machine or, as the root user, remove (using\n\"modprobe -r [module]\") and reload (using \"modprobe [module]\") all of the\nfollowing modules which are currently running (determined using \"lsmod\"):\nkvm, ksm, kvm-intel or kvm-amd.\n\n3) Restart the KVM guest virtual machines.",
"product_ids": [
"5Client-VT-5.11.Z:kmod-kvm-0:83-274.el5_11.x86_64",
"5Client-VT-5.11.Z:kmod-kvm-debug-0:83-274.el5_11.x86_64",
"5Client-VT-5.11.Z:kvm-0:83-274.el5_11.src",
"5Client-VT-5.11.Z:kvm-0:83-274.el5_11.x86_64",
"5Client-VT-5.11.Z:kvm-debuginfo-0:83-274.el5_11.x86_64",
"5Client-VT-5.11.Z:kvm-qemu-img-0:83-274.el5_11.x86_64",
"5Client-VT-5.11.Z:kvm-tools-0:83-274.el5_11.x86_64",
"5Server-VT-5.11.Z:kmod-kvm-0:83-274.el5_11.x86_64",
"5Server-VT-5.11.Z:kmod-kvm-debug-0:83-274.el5_11.x86_64",
"5Server-VT-5.11.Z:kvm-0:83-274.el5_11.src",
"5Server-VT-5.11.Z:kvm-0:83-274.el5_11.x86_64",
"5Server-VT-5.11.Z:kvm-debuginfo-0:83-274.el5_11.x86_64",
"5Server-VT-5.11.Z:kvm-qemu-img-0:83-274.el5_11.x86_64",
"5Server-VT-5.11.Z:kvm-tools-0:83-274.el5_11.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:1925"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "COMPLETE",
"baseScore": 6.5,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:A/AC:H/Au:S/C:C/I:C/A:C",
"version": "2.0"
},
"products": [
"5Client-VT-5.11.Z:kmod-kvm-0:83-274.el5_11.x86_64",
"5Client-VT-5.11.Z:kmod-kvm-debug-0:83-274.el5_11.x86_64",
"5Client-VT-5.11.Z:kvm-0:83-274.el5_11.src",
"5Client-VT-5.11.Z:kvm-0:83-274.el5_11.x86_64",
"5Client-VT-5.11.Z:kvm-debuginfo-0:83-274.el5_11.x86_64",
"5Client-VT-5.11.Z:kvm-qemu-img-0:83-274.el5_11.x86_64",
"5Client-VT-5.11.Z:kvm-tools-0:83-274.el5_11.x86_64",
"5Server-VT-5.11.Z:kmod-kvm-0:83-274.el5_11.x86_64",
"5Server-VT-5.11.Z:kmod-kvm-debug-0:83-274.el5_11.x86_64",
"5Server-VT-5.11.Z:kvm-0:83-274.el5_11.src",
"5Server-VT-5.11.Z:kvm-0:83-274.el5_11.x86_64",
"5Server-VT-5.11.Z:kvm-debuginfo-0:83-274.el5_11.x86_64",
"5Server-VT-5.11.Z:kvm-qemu-img-0:83-274.el5_11.x86_64",
"5Server-VT-5.11.Z:kvm-tools-0:83-274.el5_11.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "qemu: Heap overflow vulnerability in ne2000_receive() function"
}
]
}
ghsa-cppw-7q6r-phh2
Vulnerability from github
Published
2022-05-13 01:05
Modified
2022-05-13 01:05
VLAI Severity ?
Details
Heap-based buffer overflow in the ne2000_receive function in hw/net/ne2000.c in QEMU before 2.4.0.1 allows guest OS users to cause a denial of service (instance crash) or possibly execute arbitrary code via vectors related to receiving packets.
{
"affected": [],
"aliases": [
"CVE-2015-5279"
],
"database_specific": {
"cwe_ids": [
"CWE-119"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2015-09-28T16:59:00Z",
"severity": "HIGH"
},
"details": "Heap-based buffer overflow in the ne2000_receive function in hw/net/ne2000.c in QEMU before 2.4.0.1 allows guest OS users to cause a denial of service (instance crash) or possibly execute arbitrary code via vectors related to receiving packets.",
"id": "GHSA-cppw-7q6r-phh2",
"modified": "2022-05-13T01:05:10Z",
"published": "2022-05-13T01:05:10Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5279"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2015:1896"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2015:1923"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2015:1924"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2015:1925"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2015:2065"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2015-5279"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1256672"
},
{
"type": "WEB",
"url": "https://lists.gnu.org/archive/html/qemu-devel/2015-09/msg03984.html"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/201602-01"
},
{
"type": "WEB",
"url": "https://www.arista.com/en/support/advisories-notices/security-advisories/1188-security-advisory-14"
},
{
"type": "WEB",
"url": "http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=7aa2bcad0ca837dd6d4bf4fa38a80314b4a6b755"
},
{
"type": "WEB",
"url": "http://git.qemu.org/?p=qemu.git;a=commit;h=7aa2bcad0ca837dd6d4bf4fa38a80314b4a6b755"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169036.html"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169039.html"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-September/167369.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00019.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2015-1896.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2015-1923.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2015-1924.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2015-1925.html"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2015/dsa-3361"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2015/dsa-3362"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2015/09/15/3"
},
{
"type": "WEB",
"url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/76746"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1033569"
}
],
"schema_version": "1.4.0",
"severity": []
}
fkie_cve-2015-5279
Vulnerability from fkie_nvd
Published
2015-09-28 16:59
Modified
2025-04-12 10:46
Severity ?
Summary
Heap-based buffer overflow in the ne2000_receive function in hw/net/ne2000.c in QEMU before 2.4.0.1 allows guest OS users to cause a denial of service (instance crash) or possibly execute arbitrary code via vectors related to receiving packets.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| secalert@redhat.com | http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=7aa2bcad0ca837dd6d4bf4fa38a80314b4a6b755 | ||
| secalert@redhat.com | http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169036.html | ||
| secalert@redhat.com | http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169039.html | ||
| secalert@redhat.com | http://lists.fedoraproject.org/pipermail/package-announce/2015-September/167369.html | ||
| secalert@redhat.com | http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00019.html | ||
| secalert@redhat.com | http://rhn.redhat.com/errata/RHSA-2015-1896.html | ||
| secalert@redhat.com | http://rhn.redhat.com/errata/RHSA-2015-1923.html | ||
| secalert@redhat.com | http://rhn.redhat.com/errata/RHSA-2015-1924.html | ||
| secalert@redhat.com | http://rhn.redhat.com/errata/RHSA-2015-1925.html | ||
| secalert@redhat.com | http://www.debian.org/security/2015/dsa-3361 | ||
| secalert@redhat.com | http://www.debian.org/security/2015/dsa-3362 | ||
| secalert@redhat.com | http://www.openwall.com/lists/oss-security/2015/09/15/3 | ||
| secalert@redhat.com | http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html | ||
| secalert@redhat.com | http://www.securityfocus.com/bid/76746 | ||
| secalert@redhat.com | http://www.securitytracker.com/id/1033569 | ||
| secalert@redhat.com | https://lists.gnu.org/archive/html/qemu-devel/2015-09/msg03984.html | ||
| secalert@redhat.com | https://security.gentoo.org/glsa/201602-01 | ||
| secalert@redhat.com | https://www.arista.com/en/support/advisories-notices/security-advisories/1188-security-advisory-14 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=7aa2bcad0ca837dd6d4bf4fa38a80314b4a6b755 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169036.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169039.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.fedoraproject.org/pipermail/package-announce/2015-September/167369.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00019.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://rhn.redhat.com/errata/RHSA-2015-1896.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://rhn.redhat.com/errata/RHSA-2015-1923.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://rhn.redhat.com/errata/RHSA-2015-1924.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://rhn.redhat.com/errata/RHSA-2015-1925.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.debian.org/security/2015/dsa-3361 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.debian.org/security/2015/dsa-3362 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.openwall.com/lists/oss-security/2015/09/15/3 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/76746 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securitytracker.com/id/1033569 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://lists.gnu.org/archive/html/qemu-devel/2015-09/msg03984.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://security.gentoo.org/glsa/201602-01 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://www.arista.com/en/support/advisories-notices/security-advisories/1188-security-advisory-14 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:*",
"matchCriteriaId": "AD6602DD-7B3E-4AD9-940C-D960B77C41C2",
"versionEndIncluding": "2.4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Heap-based buffer overflow in the ne2000_receive function in hw/net/ne2000.c in QEMU before 2.4.0.1 allows guest OS users to cause a denial of service (instance crash) or possibly execute arbitrary code via vectors related to receiving packets."
},
{
"lang": "es",
"value": "Desbordamiento de buffer basado en memoria din\u00e1mica en la funci\u00f3n ne2000_receive en hw/net/ne2000.c en QEMU en versiones anteriores a 2.4.0.1, permite a usuarios invitados del SO provocar una denegaci\u00f3n de servicio (ca\u00edda de la instancia) o posiblemente ejecutar c\u00f3digo arbitrario a trav\u00e9s de vectores relacionados con la recepci\u00f3n de paquetes."
}
],
"id": "CVE-2015-5279",
"lastModified": "2025-04-12T10:46:40.837",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 7.2,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2015-09-28T16:59:02.270",
"references": [
{
"source": "secalert@redhat.com",
"url": "http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=7aa2bcad0ca837dd6d4bf4fa38a80314b4a6b755"
},
{
"source": "secalert@redhat.com",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169036.html"
},
{
"source": "secalert@redhat.com",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169039.html"
},
{
"source": "secalert@redhat.com",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-September/167369.html"
},
{
"source": "secalert@redhat.com",
"url": "http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00019.html"
},
{
"source": "secalert@redhat.com",
"url": "http://rhn.redhat.com/errata/RHSA-2015-1896.html"
},
{
"source": "secalert@redhat.com",
"url": "http://rhn.redhat.com/errata/RHSA-2015-1923.html"
},
{
"source": "secalert@redhat.com",
"url": "http://rhn.redhat.com/errata/RHSA-2015-1924.html"
},
{
"source": "secalert@redhat.com",
"url": "http://rhn.redhat.com/errata/RHSA-2015-1925.html"
},
{
"source": "secalert@redhat.com",
"url": "http://www.debian.org/security/2015/dsa-3361"
},
{
"source": "secalert@redhat.com",
"url": "http://www.debian.org/security/2015/dsa-3362"
},
{
"source": "secalert@redhat.com",
"url": "http://www.openwall.com/lists/oss-security/2015/09/15/3"
},
{
"source": "secalert@redhat.com",
"url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html"
},
{
"source": "secalert@redhat.com",
"url": "http://www.securityfocus.com/bid/76746"
},
{
"source": "secalert@redhat.com",
"url": "http://www.securitytracker.com/id/1033569"
},
{
"source": "secalert@redhat.com",
"url": "https://lists.gnu.org/archive/html/qemu-devel/2015-09/msg03984.html"
},
{
"source": "secalert@redhat.com",
"url": "https://security.gentoo.org/glsa/201602-01"
},
{
"source": "secalert@redhat.com",
"url": "https://www.arista.com/en/support/advisories-notices/security-advisories/1188-security-advisory-14"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=7aa2bcad0ca837dd6d4bf4fa38a80314b4a6b755"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169036.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169039.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-September/167369.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00019.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://rhn.redhat.com/errata/RHSA-2015-1896.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://rhn.redhat.com/errata/RHSA-2015-1923.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://rhn.redhat.com/errata/RHSA-2015-1924.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://rhn.redhat.com/errata/RHSA-2015-1925.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2015/dsa-3361"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2015/dsa-3362"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2015/09/15/3"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/76746"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securitytracker.com/id/1033569"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.gnu.org/archive/html/qemu-devel/2015-09/msg03984.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/201602-01"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.arista.com/en/support/advisories-notices/security-advisories/1188-security-advisory-14"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-119"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…