This update for qemu fixes the following issues :

Security issues fixed :

CVE-2020-1711: Fixed a potential OOB access in the iSCSI client code (bsc#1166240).

CVE-2019-12068: Fixed a potential DoS in the LSI SCSI controller emulation (bsc#1146873).

CVE-2020-1983: Fixed a use-after-free in the ip_reass function of slirp (bsc#1170940).

CVE-2020-8608: Fixed a potential OOB access in slirp (bsc#1163018).

CVE-2020-7039: Fixed a potential OOB access in slirp (bsc#1161066).

CVE-2019-15890: Fixed a use-after-free during packet reassembly in slirp (bsc#1149811).

Fixed multiple potential DoS issues in SLIRP, similar to CVE-2019-6778 (bsc#1123156).

Non-security issue fixed :

Make sure that required memory is mapped properly during an incoming migration of a Xen HVM domU (bsc#1160024).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote SUSE Linux SLES11 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2019:14199-1 advisory.

  - The ahci_commit_buf function in ide/ahci.c in QEMU allows attackers to cause a denial of service (NULL     dereference) when the command header 'ad->cur_cmd' is null. (CVE-2019-12067)

  - In QEMU 1:4.1-1, 1:2.1+dfsg-12+deb8u6, 1:2.8+dfsg-6+deb9u8, 1:3.1+dfsg-8~deb10u1, 1:3.1+dfsg-8+deb10u2,     and 1:2.1+dfsg-12+deb8u12 (fixed), when executing script in lsi_execute_script(), the LSI scsi adapter     emulator advances 's->dsp' index to read next opcode. This can lead to an infinite loop if the next opcode     is empty. Move the existing loop exit after 10k iterations so that it covers no-op opcodes as well.
    (CVE-2019-12068)

  - interface_release_resource in hw/display/qxl.c in QEMU 3.1.x through 4.0.0 has a NULL pointer dereference.
    (CVE-2019-12155)

  - ip_reass in ip_input.c in libslirp 4.0.0 has a heap-based buffer overflow via a large packet because it     mishandles a case involving the first fragment. (CVE-2019-14378)

  - libslirp 4.0.0, as used in QEMU 4.1.0, has a use-after-free in ip_reass in ip_input.c. (CVE-2019-15890)

  - An issue was discovered in Xen through 4.11.x allowing x86 guest OS users to cause a denial of service or     gain privileges because grant-table transfer requests are mishandled. (CVE-2019-17340)

  - An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service     or gain privileges by leveraging a page-writability race condition during addition of a passed-through PCI     device. (CVE-2019-17341)

  - An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service     or gain privileges by leveraging a race condition that arose when XENMEM_exchange was introduced.
    (CVE-2019-17342)

  - An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service     or gain privileges by leveraging incorrect use of the HVM physmap concept for PV domains. (CVE-2019-17343)

  - An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service     by leveraging a long-running operation that exists to support restartability of PTE updates.
    (CVE-2019-17344)

  - An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service     or gain privileges because of an incompatibility between Process Context Identifiers (PCID) and TLB     flushes. (CVE-2019-17346)

  - An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service     or gain privileges because a guest can manipulate its virtualised %cr4 in a way that is incompatible with     Linux (and possibly other guest kernels). (CVE-2019-17347)

  - An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service     because of an incompatibility between Process Context Identifiers (PCID) and shadow-pagetable switching.
    (CVE-2019-17348)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
137586	SUSE SLES12 Security Update : qemu (SUSE-SU-2020:1538-1)	Nessus	SuSE Local Security Checks	2020/6/18	2024/3/6	high
150593	SUSE SLES11 Security Update : xen (SUSE-SU-2019:14199-1)	Nessus	SuSE Local Security Checks	2021/6/10	2022/1/21	high

检测

插件搜索

high

high