This update for xen to version 4.7.2 fixes the following issues: These security issues were fixed :

  - CVE-2017-7228: Broken check in memory_exchange()     permited PV guest breakout (bsc#1030442).

  - XSA-206: Unprivileged guests issuing writes to xenstore     were able to stall progress of the control domain or     driver domain, possibly leading to a Denial of Service     (DoS) of the entire host (bsc#1030144).

  - CVE-2017-6505: The ohci_service_ed_list function in     hw/usb/hcd-ohci.c allowed local guest OS users to cause     a denial of service (infinite loop) via vectors     involving the number of link endpoint list descriptors     (bsc#1028235).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities were discovered in qemu-kvm, a full virtualization solution for Linux hosts on x86 hardware with x86 guests based on the Quick Emulator(Qemu).

CVE-2017-6505

Denial of service via infinite loop in the USB OHCI emulation

CVE-2017-8309

Denial of service via VNC audio capture

CVE-2017-10664

Denial of service in qemu-nbd server, qemu-io and qemu-img.

CVE-2017-11434

Denial of service via a crafted DHCP options string

For Debian 7 'Wheezy', these problems have been fixed in version 1.1.2+dfsg-6+deb7u23.

We recommend that you upgrade your qemu-kvm packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for qemu fixes several issues. These security issues were fixed :

  - CVE-2017-10911: The make_response function in the Linux     kernel allowed guest OS users to obtain sensitive     information from host OS (or other guest OS) kernel     memory by leveraging the copying of uninitialized     padding fields in Xen block-interface response     structures (bsc#1057378).

  - CVE-2017-12809: The IDE disk and CD/DVD-ROM Emulator     support allowed local guest OS privileged users to cause     a denial of service (NULL pointer dereference and QEMU     process crash) by flushing an empty CDROM device drive     (bsc#1054724).

  - CVE-2017-15289: The mode4and5 write functions allowed     local OS guest privileged users to cause a denial of     service (out-of-bounds write access and Qemu process     crash) via vectors related to dst calculation     (bsc#1063122)

  - CVE-2017-15038: Race condition in the v9fs_xattrwalk     function local guest OS users to obtain sensitive     information from host heap memory via vectors related to     reading extended attributes (bsc#1062069)

  - CVE-2017-14167: Integer overflow in the load_multiboot     function allowed local guest OS users to execute     arbitrary code on the host via crafted multiboot header     address values, which trigger an out-of-bounds write     (bsc#1057585)

  - CVE-2017-11434: The dhcp_decode function in     slirp/bootp.c allowed local guest OS users to cause a     denial of service (out-of-bounds read) via a crafted     DHCP options string (bsc#1049381)

  - CVE-2017-11334: The address_space_write_continue     function allowed local guest OS privileged users to     cause a denial of service (out-of-bounds access and     guest instance crash) by leveraging use of     qemu_map_ram_ptr to access guest ram block area     (bsc#1048902)

  - CVE-2017-13672: The VGA display emulator support allowed     local guest OS privileged users to cause a denial of     service (out-of-bounds read and QEMU process crash) via     vectors involving display update (bsc#1056334)

  - CVE-2017-5973: A infinite loop while doing control     transfer in xhci_kick_epctx allowed privileged user     inside the guest to crash the host process resulting in     DoS (bsc#1025109)

  - CVE-2017-5987: The sdhci_sdma_transfer_multi_blocks     function in hw/sd/sdhci.c allowed local OS guest     privileged users to cause a denial of service (infinite     loop and QEMU process crash) via vectors involving the     transfer mode register during multi block transfer     (bsc#1025311)

  - CVE-2017-6505: The ohci_service_ed_list function allowed     local guest OS users to cause a denial of service     (infinite loop) via vectors involving the number of link     endpoint list descriptors (bsc#1028184)

  - CVE-2016-9603: A privileged user within the guest VM     could have caused a heap overflow in the device model     process, potentially escalating their privileges to that     of the device model process (bsc#1028656)

  - CVE-2017-7718: hw/display/cirrus_vga_rop.h allowed local     guest OS privileged users to cause a denial of service     (out-of-bounds read and QEMU process crash) via vectors     related to copying VGA data via the     cirrus_bitblt_rop_fwd_transp_ and cirrus_bitblt_rop_fwd_     functions (bsc#1034908)

  - CVE-2017-7980: An out-of-bounds r/w access issues in the     Cirrus CLGD 54xx VGA Emulator support allowed privileged     user inside guest to use this flaw to crash the Qemu     process resulting in DoS or potentially execute     arbitrary code on a host with privileges of Qemu process     on the host (bsc#1035406)

  - CVE-2017-8112: hw/scsi/vmw_pvscsi.c allowed local guest     OS privileged users to cause a denial of service     (infinite loop and CPU consumption) via the message ring     page count (bsc#1036211)

  - CVE-2017-9375: The USB xHCI controller emulator support     was vulnerable to an infinite recursive call loop issue,     which allowed a privileged user inside guest to crash     the Qemu process resulting in DoS (bsc#1042800)

  - CVE-2017-9374: Missing free of 's->ipacket', causes a     host memory leak, allowing for DoS (bsc#1043073)

  - CVE-2017-9373: The IDE AHCI Emulation support was     vulnerable to a host memory leakage issue, which allowed     a privileged user inside guest to leak host memory     resulting in DoS (bsc#1042801)

  - CVE-2017-9330: USB OHCI Emulation in qemu allowed local     guest OS users to cause a denial of service (infinite     loop) by leveraging an incorrect return value     (bsc#1042159)

  - CVE-2017-8379: Memory leak in the keyboard input event     handlers support allowed local guest OS privileged users     to cause a denial of service (host memory consumption)     by rapidly generating large keyboard events     (bsc#1037334)

  - CVE-2017-8309: Memory leak in the audio/audio.c allowed     remote attackers to cause a denial of service (memory     consumption) by repeatedly starting and stopping audio     capture (bsc#1037242)

  - CVE-2017-8380: The MegaRAID SAS 8708EM2 Host Bus Adapter     emulation support was vulnerable to an out-of-bounds     read access issue which allowed a privileged user inside     guest to read host memory resulting in DoS (bsc#1037336)

  - CVE-2017-7493: The VirtFS, host directory sharing via     Plan 9 File System(9pfs) support, was vulnerable to an     improper access control issue. It could occur while     accessing virtfs metadata files in mapped-file security     mode. A guest user could have used this flaw to escalate     their privileges inside guest (bsc#1039495)

  - CVE-2016-9602: The VirtFS host directory sharing via     Plan 9 File System(9pfs) support was vulnerable to an     improper link following issue which allowed a privileged     user inside guest to access host file system beyond the     shared folder and potentially escalating their     privileges on a host (bsc#1020427)

  - CVE-2017-5579: The 16550A UART serial device emulation     support was vulnerable to a memory leakage issue     allowing a privileged user to cause a DoS and/or     potentially crash the Qemu process on the host     (bsc#1021741)

  - CVE-2017-9503: The MegaRAID SAS 8708EM2 Host Bus Adapter     emulation support was vulnerable to a NULL pointer     dereference issue which allowed a privileged user inside     guest to crash the Qemu process on the host resulting in     DoS (bsc#1043296)

  - CVE-2017-10664: qemu-nbd did not ignore SIGPIPE, which     allowed remote attackers to cause a denial of service     (daemon crash) by disconnecting during a     server-to-client reply attempt (bsc#1046636)

  - CVE-2017-10806: Stack-based buffer overflow allowed     local guest OS users to cause a denial of service (QEMU     process crash) via vectors related to logging debug     messages (bsc#1047674)

  - CVE-2016-9602: The VirtFS host directory sharing via     Plan 9 File System(9pfs) support was vulnerable to an     improper link following issue which allowed a privileged     user inside guest to access host file system beyond the     shared folder and potentially escalating their     privileges on a host (bsc#1020427)

  - CVE-2017-7377: The v9fs_create and v9fs_lcreate     functions in hw/9pfs/9p.c allowed local guest OS     privileged users to cause a denial of service (file     descriptor or memory consumption) via vectors related to     an already in-use fid (bsc#1032075)

  - CVE-2017-8086: A memory leak in the v9fs_list_xattr     function in hw/9pfs/9p-xattr.c allowed local guest OS     privileged users to cause a denial of service (memory     consumption) via vectors involving the orig_value     variable (bsc#1035950)

  - CVE-2017-7471: The VirtFS host directory sharing via     Plan 9 File System(9pfs) support was vulnerable to an     improper access control issue which allowed a privileged     user inside guest to access host file system beyond the     shared folder and potentially escalating their     privileges on a host (bsc#1034866)

  - CVE-2016-6835: Buffer overflow in the VMWARE VMXNET3 NIC     device support, causing an OOB read access (bsc#994605)

  - CVE-2016-6834: A infinite loop during packet     fragmentation in the VMWARE VMXNET3 NIC device support     allowed privileged user inside guest to crash the Qemu     instance resulting in DoS (bsc#994418)

  - Fix privilege escalation in TCG mode (bsc#1030624)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the qemu-kvm packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - qemu-kvm is an open source virtualizer that provides     hardware emulation for the KVM hypervisor. qemu-kvm     acts as a virtual machine monitor together with the KVM     kernel modules, and emulates the hardware for a full     system such as a PC and its assocated peripherals. As     qemu-kvm requires no host kernel patches to run, it is     safe and easy to use. Security Fix(es):The     ohci_service_ed_list function in hw/usb/hcd-ohci.c in     QEMU (aka Quick Emulator) before 2.9.0 allows local     guest OS users to cause a denial of service (infinite     loop) via vectors involving the number of link endpoint     list descriptors, a different vulnerability than     CVE-2017-9330.(CVE-2017-6505)** DISPUTED ** QEMU 3.0.0     has an Integer Overflow because the qga/commands*.c     files do not check the length of the argument list or     the number of environment variables. NOTE: This has     been disputed as not exploitable.(CVE-2019-12247)**     DISPUTED ** An issue was discovered in ide_dma_cb() in     hw/ide/core.c in QEMU 2.4.0 through 4.2.0. The guest     system can crash the QEMU process in the host system     via a special SCSI_IOCTL_SEND_COMMAND. It hits an     assertion that implies that the size of successful DMA     transfers there must be a multiple of 512 (the size of     a sector). NOTE: a member of the QEMU security team     disputes the significance of this issue because a     'privileged guest user has many ways to cause similar     DoS effect, without triggering this     assert.'(CVE-2019-20175)Race condition in the     v9fs_xattrwalk function in hw/9pfs/9p.c in QEMU (aka     Quick Emulator) allows local guest OS users to obtain     sensitive information from host heap memory via vectors     related to reading extended     attributes.(cve-2017-15038)Memory leak in the     megasas_handle_dcmd function in hw/scsi/megasas.c in     QEMU (aka Quick Emulator) allows local guest OS     privileged users to cause a denial of service (host     memory consumption) via MegaRAID Firmware Interface     (MFI) commands with the sglist size set to a value over     2 Gb.(cve-2017-5856)QEMU (aka Quick Emulator), when     built with the e1000e NIC emulation support, allows     local guest OS privileged users to cause a denial of     service (infinite loop) via vectors related to setting     the initial receive / transmit descriptor head     (TDH/RDH) outside the allocated descriptor     buffer.(cve-2017-9310)QEMU (aka Quick Emulator), when     built with MegaRAID SAS 8708EM2 Host Bus Adapter     emulation support, allows local guest OS privileged     users to cause a denial of service (NULL pointer     dereference and QEMU process crash) via vectors     involving megasas command processing.(cve-2017-9503)The     dhcp_decode function in slirp/bootp.c in QEMU (aka     Quick Emulator) allows local guest OS users to cause a     denial of service (out-of-bounds read and QEMU process     crash) via a crafted DHCP options     string.(CVE-2017-11434)Memory leak in the     v9fs_list_xattr function in hw/9pfs/9p-xattr.c in QEMU     (aka Quick Emulator) allows local guest OS privileged     users to cause a denial of service (memory consumption)     via vectors involving the orig_value     variable.(CVE-2017-8086)m_cat in slirp/mbuf.c in Qemu     has a heap-based buffer overflow via incoming     fragmented datagrams.(CVE-2018-11806)In QEMU 3.1.0,     load_device_tree in device_tree.c calls the deprecated     load_image function, which has a buffer overflow     risk.(CVE-2018-20815)The pnv_lpc_do_eccb function in     hw/ppc/pnv_lpc.c in Qemu before 3.1 allows     out-of-bounds write or read access to PowerNV     memory.(cve-2018-18954)qemu_deliver_packet_iov in     net/net.c in Qemu accepts packet sizes greater than     INT_MAX, which allows attackers to cause a denial of     service or possibly have unspecified other     impact.(CVE-2018-17963)Qemu has a Buffer Overflow in     pcnet_receive in hw/net/pcnet.c because an incorrect     integer data type is used.(CVE-2018-17962)Qemu has a     Buffer Overflow in rtl8139_do_receive in     hw/net/rtl8139.c because an incorrect integer data type     is used.(CVE-2018-17958)qemu-seccomp.c in QEMU might     allow local OS guest users to cause a denial of service     (guest crash) by leveraging mishandling of the seccomp     policy for threads other than the main     thread.(CVE-2018-15746)In QEMU 1:4.1-1,     1:2.1+dfsg-12+deb8u6, 1:2.8+dfsg-6+deb9u8,     1:3.1+dfsg-8~deb10u1, 1:3.1+dfsg-8+deb10u2, and     1:2.1+dfsg-12+deb8u12 (fixed), when executing script in     lsi_execute_script(), the LSI scsi adapter emulator     advances 's->dsp' index to read next opcode. This can     lead to an infinite loop if the next opcode is empty.
    Move the existing loop exit after 10k iterations so     that it covers no-op opcodes as     well.(CVE-2019-12068)qemu-bridge-helper.c in QEMU 4.0.0     does not ensure that a network interface name (obtained     from bridge.conf or a --br=bridge option) is limited to     the IFNAMSIZ size, which can lead to an ACL     bypass.(CVE-2019-13164)tcp_emu in slirp/tcp_subr.c (aka     slirp/src/tcp_subr.c) in QEMU 3.0.0 uses uninitialized     data in an snprintf call, leading to Information     disclosure.(CVE-2019-9824)interface_release_resource in     hw/display/qxl.c in QEMU 4.0.0 has a NULL pointer     dereference.(CVE-2019-12155)The Virtio Vring     implementation in QEMU allows local OS guest users to     cause a denial of service (divide-by-zero error and     QEMU process crash) by unsetting vring alignment while     updating Virtio     rings.(CVE-2017-17381)hw/display/cirrus_vga_rop.h in     QEMU (aka Quick Emulator) allows local guest OS     privileged users to cause a denial of service     (out-of-bounds read and QEMU process crash) via vectors     related to copying VGA data via the     cirrus_bitblt_rop_fwd_transp_ and     cirrus_bitblt_rop_fwd_ functions.(CVE-2017-7718)Memory     leak in the serial_exit_core function in     hw/char/serial.c in QEMU (aka Quick Emulator) allows     local guest OS privileged users to cause a denial of     service (host memory consumption and QEMU process     crash) via a large number of device unplug     operations.(CVE-2017-5579)Quick Emulator (aka QEMU),     when built with the Cirrus CLGD 54xx VGA Emulator     support, allows local guest OS privileged users to     cause a denial of service (out-of-bounds access and     QEMU process crash) by leveraging incorrect region     calculation when updating VGA     display.(CVE-2018-7858)qemu-nbd in QEMU (aka Quick     Emulator) does not ignore SIGPIPE, which allows remote     attackers to cause a denial of service (daemon crash)     by disconnecting during a server-to-client reply     attempt.(CVE-2017-10664)QEMU (aka Quick Emulator), when     built with the VGA display emulator support, allows     local guest OS privileged users to cause a denial of     service (out-of-bounds read and QEMU process crash) via     vectors involving display update.(CVE-2017-13672)QEMU     (aka Quick Emulator), when built with the IDE disk and     CD/DVD-ROM Emulator support, allows local guest OS     privileged users to cause a denial of service (NULL     pointer dereference and QEMU process crash) by flushing     an empty CDROM device drive.(CVE-2017-12809)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- CVE-2016-7907: net: imx: infinite loop (bz #1381182)

  - CVE-2017-5525: audio: memory leakage in ac97 (bz     #1414110)

  - CVE-2017-5526: audio: memory leakage in es1370 (bz     #1414210)

  - CVE-2016-10155 watchdog: memory leakage in i6300esb (bz     #1415200)

  - CVE-2017-5552: virtio-gpu-3d: memory leakage (bz     #1415283)

  - CVE-2017-5578: virtio-gpu: memory leakage (bz #1415797)

  - CVE-2017-5667: sd: sdhci OOB access during multi block     transfer (bz #1417560)

  - CVE-2017-5856: scsi: megasas: memory leakage (bz     #1418344)

  - CVE-2017-5857: virtio-gpu-3d: host memory leakage in     virgl_cmd_resource_unref (bz #1418383)

  - CVE-2017-5898: usb: integer overflow in     emulated_apdu_from_guest (bz #1419700)

  - CVE-2017-5987: sd: infinite loop issue in multi block     transfers (bz #1422001)

  - CVE-2017-6058: vmxnet3: OOB access when doing vlan     stripping (bz #1423359)

  - CVE-2017-6505: usb: an infinite loop issue in     ohci_service_ed_list (bz #1429434)

  - CVE-2017-2615: cirrus: oob access while doing bitblt     copy backward (bz #1418206)

  - CVE-2017-2620: cirrus: potential arbitrary code     execution (bz #1425419)

  - Fix spice GL with new mesa/libglvnd (bz #1431905)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- CVE-2017-5525: audio: memory leakage in ac97 (bz     #1414110)

  - CVE-2017-5526: audio: memory leakage in es1370 (bz     #1414210)

  - CVE-2016-10155 watchdog: memory leakage in i6300esb (bz     #1415200)

  - CVE-2017-5552: virtio-gpu-3d: memory leakage (bz     #1415283)

  - CVE-2017-5667: sd: sdhci OOB access during multi block     transfer (bz #1417560)

  - CVE-2017-5857: virtio-gpu-3d: host memory leakage in     virgl_cmd_resource_unref (bz #1418383)

  - CVE-2017-5856: scsi: megasas: memory leakage (bz     #1418344)

  - CVE-2017-5898: usb: integer overflow in     emulated_apdu_from_guest (bz #1419700)

  - CVE-2017-5987: sd: infinite loop issue in multi block     transfers (bz #1422001)

  - CVE-2017-6505: usb: an infinite loop issue in     ohci_service_ed_list (bz #1429434)

  - CVE-2017-2615: cirrus: oob access while doing bitblt     copy backward (bz #1418206)

  - CVE-2017-2620: cirrus: potential arbitrary code     execution (bz #1425419)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for xen fixes the following security issues :

  - CVE-2017-7228: Broken check in memory_exchange()     permited PV guest breakout (bsc#1030442).

  - CVE-2017-6414: Memory leak in the vcard_apdu_new     function in card_7816.c in libcacard allowed local guest     OS users to cause a denial of service (host memory     consumption) via vectors related to allocating a new     APDU object (bsc#1027570).

  - CVE-2017-6505: The ohci_service_ed_list function in     hw/usb/hcd-ohci.c allowed local guest OS users to cause     a denial of service (infinite loop) via vectors     involving the number of link endpoint list descriptors     (bsc#1028235).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for xen fixes the following issues: These security issues were fixed :

  - CVE-2017-7228: Broken check in memory_exchange()     permited PV guest breakout (bsc#1030442).

  - XSA-206: Unprivileged guests issuing writes to xenstore     were able to stall progress of the control domain or     driver domain, possibly leading to a Denial of Service     (DoS) of the entire host (bsc#1030144).

  - CVE-2017-6505: The ohci_service_ed_list function in     hw/usb/hcd-ohci.c allowed local guest OS users to cause     a denial of service (infinite loop) via vectors     involving the number of link endpoint list descriptors     (bsc#1028235).

  - CVE-2017-6414: Memory leak in the vcard_apdu_new     function in card_7816.c in libcacard allowed local guest     OS users to cause a denial of service (host memory     consumption) via vectors related to allocating a new     APDU object (bsc#1027570).

  - CVE-2017-2633: The VNC display driver support was     vulnerable to an out-of-bounds memory access issue. A     user/process inside guest could use this flaw to cause     DoS (bsc#1026636).

  - CVE-2016-9603: A privileged user within the guest VM can     cause a heap overflow in the device model process,     potentially escalating their privileges to that of the     device model process (bsc#1028655).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Zhenhao Hong discovered that QEMU incorrectly handled the Virtio GPU device. An attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2016-10028)

It was discovered that QEMU incorrectly handled the JAZZ RC4030 device. A privileged attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2016-8667)

Jann Horn discovered that QEMU incorrectly handled VirtFS directory sharing. A privileged attacker inside the guest could use this issue to access files on the host file system outside of the shared directory and possibly escalate their privileges. In the default installation, when QEMU is used with libvirt, attackers would be isolated by the libvirt AppArmor profile. (CVE-2016-9602)

Gerd Hoffmann discovered that QEMU incorrectly handled the Cirrus VGA device when being used with a VNC connection. A privileged attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code on the host. In the default installation, when QEMU is used with libvirt, attackers would be isolated by the libvirt AppArmor profile.
(CVE-2016-9603)

Li Qiang discovered that QEMU incorrectly handled the Virtio GPU device. An attacker inside the guest could use this issue to cause QEMU to leak contents of host memory. (CVE-2016-9908)

Li Qiang discovered that QEMU incorrectly handled the Virtio GPU device. An attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2016-9912, CVE-2017-5552, CVE-2017-5578)

Li Qiang discovered that QEMU incorrectly handled VirtFS directory sharing. A privileged attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service.
(CVE-2016-9914)

Jiang Xin and Wjjzhang discovered that QEMU incorrectly handled SDHCI device emulation. A privileged attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service.
(CVE-2017-5987)

Li Qiang discovered that QEMU incorrectly handled USB OHCI controller emulation. A privileged attacker inside the guest could use this issue to cause QEMU to hang, resulting in a denial of service.
(CVE-2017-6505).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for xen fixes several issues. These security issues were fixed :

  - A malicious 64-bit PV guest may be able to access all of     system memory, allowing for all of privilege escalation,     host crashes, and information leaks by placing a IRET     hypercall in the middle of a multicall batch (XSA-213,     bsc#1034843)

  - A malicious pair of guests may be able to access all of     system memory, allowing for all of privilege escalation,     host crashes, and information leaks because of a missing     check when transfering pages via GNTTABOP_transfer     (XSA-214, bsc#1034844).

  - CVE-2017-7718: hw/display/cirrus_vga_rop.h allowed local     guest OS privileged users to cause a denial of service     (out-of-bounds read and QEMU process crash) via vectors     related to copying VGA data via the     cirrus_bitblt_rop_fwd_transp_ and cirrus_bitblt_rop_fwd_     functions (bsc#1034994).

  - CVE-2016-9603: A privileged user within the guest VM     could have caused a heap overflow in the device model     process, potentially escalating their privileges to that     of the device model process (bsc#1028655)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
99302	SUSE SLED12 / SLES12 Security Update : xen (SUSE-SU-2017:0983-1)	Nessus	SuSE Local Security Checks	2017/4/12	2025/12/26	high
102805	Debian DLA-1071-1 : qemu-kvm security update	Nessus	Debian Local Security Checks	2017/8/29	2025/11/25	high
104471	SUSE SLES12 Security Update : qemu (SUSE-SU-2017:2946-1)	Nessus	SuSE Local Security Checks	2017/11/9	2025/11/14	critical
136276	EulerOS Virtualization for ARM 64 3.0.2.0 : qemu-kvm (EulerOS-SA-2020-1573)	Nessus	Huawei Local Security Checks	2020/5/1	2024/3/13	critical
97804	Fedora 25 : 2:qemu (2017-31b976672b)	Nessus	Fedora Local Security Checks	2017/3/20	2025/12/29	critical
97865	Fedora 24 : 2:qemu (2017-62ac1230f7)	Nessus	Fedora Local Security Checks	2017/3/22	2025/12/29	critical
99507	SUSE SLES11 Security Update : xen (SUSE-SU-2017:1058-1)	Nessus	SuSE Local Security Checks	2017/4/20	2025/12/25	high
99579	SUSE SLES12 Security Update : xen (SUSE-SU-2017:1080-1)	Nessus	SuSE Local Security Checks	2017/4/21	2025/12/23	critical
99686	Ubuntu 17.04 : qemu vulnerabilities (USN-3268-1)	Nessus	Ubuntu Local Security Checks	2017/4/26	2025/12/23	critical
99962	SUSE SLED12 / SLES12 Security Update : xen (SUSE-SU-2017:1147-1)	Nessus	SuSE Local Security Checks	2017/5/3	2025/12/22	critical

检测

插件搜索

high

high

critical

critical

critical

critical

high

critical

critical

critical