Описание
Security update for kvm
kvm was updated to fix two security issues.
The following vulnerabilities were fixed:
- CVE-2015-5154: Host code execution via IDE subsystem CD-ROM (bsc#938344).
- CVE-2015-3209: Fix buffer overflow in pcnet emulation (bsc#932770).
Список пакетов
SUSE Linux Enterprise Server 11 SP2-LTSS
kvm-0.15.1-0.32.2
Ссылки
- Link for SUSE-SU-2015:1426-1
- E-Mail link for SUSE-SU-2015:1426-1
- SUSE Security Ratings
- SUSE Bug 932770
- SUSE Bug 938344
- SUSE CVE CVE-2015-3209 page
- SUSE CVE CVE-2015-5154 page
Описание
Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary code by sending a packet with TXSTATUS_STARTPACKET set and then a crafted packet with TXSTATUS_DEVICEOWNS set.
Затронутые продукты
SUSE Linux Enterprise Server 11 SP2-LTSS:kvm-0.15.1-0.32.2
Ссылки
- CVE-2015-3209
- SUSE Bug 932267
- SUSE Bug 932770
- SUSE Bug 932823
Описание
Heap-based buffer overflow in the IDE subsystem in QEMU, as used in Xen 4.5.x and earlier, when the container has a CDROM drive enabled, allows local guest users to execute arbitrary code on the host via unspecified ATAPI commands.
Затронутые продукты
SUSE Linux Enterprise Server 11 SP2-LTSS:kvm-0.15.1-0.32.2
Ссылки
- CVE-2015-5154
- SUSE Bug 938344
- SUSE Bug 950367