Home
Reading
Searching
Subscribe
Sponsors
Statistics
Posting
Contact
Spam
Lists
Links
About
Hosting
Filtering
Features Download
Marketing
Archives
FAQ
Blog
 
Gmane
From: <updates <at> fedoraproject.org>
Subject: [SECURITY] Fedora 15 Update: qemu-0.14.0-9.fc15
Newsgroups: gmane.linux.redhat.fedora.package.announce
Date: Thursday 7th June 2012 23:07:08 UTC (over 4 years ago)
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2012-8604
2012-05-29 21:36:42
--------------------------------------------------------------------------------

Name        : qemu
Product     : Fedora 15
Version     : 0.14.0
Release     : 9.fc15
URL         : http://www.qemu.org/
Summary     : QEMU is a FAST! processor emulator
Description :
QEMU is a generic and open source processor emulator which achieves a good
emulation speed by using dynamic translation. QEMU has two operating modes:

 * Full system emulation. In this mode, QEMU emulates a full system (for
   example a PC), including a processor and various peripherials. It can be
   used to launch different Operating Systems without rebooting the PC or
   to debug system code.
 * User mode emulation. In this mode, QEMU can launch Linux processes
compiled
   for one CPU on another CPU.

As QEMU requires no host kernel patches to run, it is safe and easy to use.

--------------------------------------------------------------------------------
Update Information:

* CVE-2011-1750 virtio-blk: heap buffer overflow (bz 698906, bz 698911)
* CVE-2011-2527 set groups properly for -runas (bz 720773, bz 720784)
* CVE-2012-0029 e1000 buffer overflow (bz 783984, bz 772075)
* virtio-blk: refuse SG_IO requests with scsi=off (bz 770135)
--------------------------------------------------------------------------------
ChangeLog:

* Tue May 29 2012 Cole Robinson  - 0.14.0-9
- CVE-2011-1750 virtio-blk: heap buffer overflow (bz 698906, bz 698911)
- CVE-2011-2527 set groups properly for -runas (bz 720773, bz 720784)
- CVE-2012-0029 e1000 buffer overflow (bz 783984, bz 772075)
- virtio-blk: refuse SG_IO requests with scsi=off (bz 770135)
* Wed Jun 22 2011 Richard W.M. Jones  - 2:0.14.0-8
- Add BR libattr-devel.  This caused the -fstype option to be disabled.
  https://www.redhat.com/archives/libvir-list/2011-June/thread.html#01017
--------------------------------------------------------------------------------
References:

  [ 1 ] Bug #698906 - CVE-2011-1750 virtio-blk: heap buffer overflow caused
by unaligned requests
        https://bugzilla.redhat.com/show_bug.cgi?id=698906
  [ 2 ] Bug #720773 - CVE-2011-2527 qemu: when started as root, extra
groups are not dropped correctly
        https://bugzilla.redhat.com/show_bug.cgi?id=720773
  [ 3 ] Bug #772075 - CVE-2012-0029 qemu: e1000: process_tx_desc legacy
mode packets heap overflow
        https://bugzilla.redhat.com/show_bug.cgi?id=772075
--------------------------------------------------------------------------------

This update can be installed with the "yum" update program.  Use 
su -c 'yum update qemu' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.

All packages are signed with the Fedora Project GPG key.  More details on
the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
_______________________________________________
package-announce mailing list
[email protected]
https://admin.fedoraproject.org/mailman/listinfo/package-announce
 
CD: 2ms