| |||||||||||||
Debian-Testing alert DTSA-38-1 (qemu)
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Debian Testing Security Advisory DTSA-38-1 May 26th, 2007 secure-testing-team@lists.alioth.debian.org Stefan Fritsch http://secure-testing-master.debian.net/ - -------------------------------------------------------------------------- Package : qemu Vulnerability : several vulnerabilities Problem-Scope : local Debian-specific: No CVE ID : CVE-2007-1320 CVE-2007-1321 CVE-2007-1322 CVE-2007-1323 CVE-2007-1366 Several vulnerabilities have been discovered in the QEMU processor emulator, which may lead to the execution of arbitrary code or denial of service. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2007-1320 Tavis Ormandy discovered that a memory management routine of the Cirrus video driver performs insufficient bounds checking, which might allow the execution of arbitrary code through a heap overflow. CVE-2007-1321 Tavis Ormandy discovered that the NE2000 network driver and the socket code perform insufficient input validation, which might allow the execution of arbitrary code through a heap overflow. CVE-2007-1322 Tavis Ormandy discovered that the "icebp" instruction can be abused to terminate the emulation, resulting in denial of service. CVE-2007-1323 Tavis Ormandy discovered that the NE2000 network driver and the socket code perform insufficient input validation, which might allow the execution of arbitrary code through a heap overflow. CVE-2007-1366 Tavis Ormandy discovered that the "aam" instruction can be abused to crash qemu through a division by zero, resulting in denial of service. For the testing distribution (lenny) this is fixed in version 0.8.2-5lenny1 The package for the powerpc architecture is still missing. It will be released when it becomes available. For the unstable distribution (sid) this is fixed in version 0.9.0-2 This upgrade is recommended if you use qemu. Upgrade Instructions - -------------------- To use the Debian testing security archive, add the following lines to your /etc/apt/sources.list: deb http://security.debian.org/ testing/updates main contrib non-free deb-src http://security.debian.org/ testing/updates main contrib non-free To install the update, run this command as root: apt-get update && apt-get upgrade For further information about the Debian testing security team, please refer to http://secure-testing-master.debian.net/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (GNU/Linux) iD8DBQFGV+9Vbxelr8HyTqQRAuEyAKCot8Yfgp3Ppwag5ZMduQpavZOligCg37PA ZK/SQ4CFms+3dxW1OE5m6T8= =2WlX -----END PGP SIGNATURE----- _______________________________________________ secure-testing-announce mailing list secure-testing-announce@lists.alioth.debian.org http://lists.alioth.debian.org/mailman/listinfo/secure-te... (Log in to post comments)
|
|||||||||||||