kvm 已更新，修复了 33 个安全问题。

修复了这些安全问题：

- CVE-2016-4439：避免 53C9X 仿真中的 OOB 访问 (bsc#980711)

- CVE-2016-4441：避免 53C9X 仿真中的 OOB 访问 (bsc#980723)

- CVE-2016-3710：修复可能造成客户机逃逸的基于 VGA 仿真的 OOB 访问 (bsc#978158)

- CVE-2016-3712：修复基于 VGa 仿真的 DOS 和 OOB 读取访问利用 (bsc#978160)

- CVE-2016-4037：修复基于 USB ehci 的 DOS (bsc#976109)

- CVE-2016-2538：修复 USB net 设备仿真中潜在的 OOB 访问 (bsc#967969)

- CVE-2016-2841：修复 ne2000 仿真中的 OOB 访问/挂起 (bsc#969350)

- CVE-2016-2858：避免在使用 QEMU 伪随机数发生器时潜在的 DOS (bsc#970036)

- CVE-2016-2857：修复处理 IP 校验和时的 OOB 访问 (bsc#970037)

- CVE-2016-4001：修复 Stellaris enet 仿真 nic 中的 OOB 访问 (bsc#975128)

- CVE-2016-4002：修复 MIPSnet 仿真控制器中的 OOB 访问 (bsc#975136)

- CVE-2016-4020：修复可能将托管数据从 TPR 访问泄漏给客户机的问题 (bsc#975700)

- CVE-2015-3214：修复 i8254 PIC 中的 OOB 读取 (bsc#934069)

- CVE-2014-9718：修复畸形或短 ide PRDT 的处理问题，以避免客户机有任何机会通过滥用该接口来造成 DoS (bsc#928393)

- CVE-2014-3689：修复 rectangle 函数中不充分的参数验证 (bsc#901508)

- CVE-2014-3615：QEMU 中的 VGA 仿真器会允许本地客户机用户通过将显示器设置为高分辨率，来读取主机内存 (bsc#895528)。

- CVE-2015-5239：vnc_client_read() 与 protocol_client_msg() 中的整数溢出 (bsc#944463)。

- CVE-2015-5278：ne2000_receive() 函数中的无限循环 (bsc#945989)。

- CVE-2015-5279：在 QEMU 的 hw/net/ne2000.c 中，ne2000_receive 函数中的基于堆的缓冲区溢出允许客户机操作系统用户通过与接收数据包相关的矢量造成拒绝服务（实例崩溃）或可能执行任意代码 (bsc#945987)。

- CVE-2015-5745：virtio-serial 中的缓冲区溢出 (bsc#940929)。

- CVE-2015-6855：QEMU 中的 hw/ide/core.c 未正确限制 ATAPI 设备接受的命令，这允许客户机用户通过某些 IDE 命令造成拒绝服务或可能造成其他不明影响，这一点已经由发往空驱动器的 WIN_READ_NATIVE_MAX 命令证实，这会触发除以零错误和实例崩溃 (bsc#945404)。

- CVE-2015-7295：QEMU 的虚拟网络设备 (virtio-net) 支持中的 hw/virtio/virtio.c，当大型或可合并的接收缓冲区不受支持时，会允许远程攻击者通过 (1) tuntap 或 (2) macvtap 界面上的大量巨型帧，造成拒绝服务（客户机网络消耗）(bsc#947159)。

- CVE-2015-7549： PCI 空指针取消引用 (bsc#958917)。

- CVE-2015-8504：VNC 浮点异常 (bsc#958491)。

- CVE-2015-8558：ehci_advance_state 中的无限循环导致 DoS (bsc#959005)。

- CVE-2015-8613：megasas 命令处理程序中 memset 的大小错误 (bsc#961358)。

- CVE-2015-8619：长 HMP sendkey 命令参数可能发生 DoS (bsc#960334)。

- CVE-2015-8743：ne2000 ioport r/w 函数中的 OOB 内存访问问题 (bsc#960725)。

- CVE-2016-1568：aio 端口命令中的 AHCI 释放后使用 (bsc#961332)。

- CVE-2016-1714：处理固件配置时可能发生的 OOB 内存访问 (bsc#961691)。

- CVE-2016-1922：处理 hmp i/o 命令时发生空指针取消引用 (bsc#962320)。

- CVE-2016-1981：客户机内恶意的特权用户可能在 e1000 设备仿真中造成 DoS（无限循环）(bsc#963782)。

- CVE-2016-2198：恶意的特权客户机用户可能通过写入只读 EHCI 功能寄存器而造成 DoS (bsc#964413)。

此非安全问题已得到修复：

- 修复 IDE 接口在刷新前需要设置忙碌状态的情况 (bsc#936132)

请注意，Tenable Network Security 已直接从 SUSE 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下尽可能进行了自动整理和排版。

Several vulnerabilities were discovered in qemu, a full virtualization solution on x86 hardware.

  - CVE-2015-7295     Jason Wang of Red Hat Inc. discovered that the Virtual     Network Device support is vulnerable to     denial-of-service (via resource exhaustion), that could     occur when receiving large packets.

  - CVE-2015-7504     Qinghao Tang of Qihoo 360 Inc. and Ling Liu of Qihoo 360     Inc. discovered that the PC-Net II ethernet controller     is vulnerable to a heap-based buffer overflow that could     result in denial-of-service (via application crash) or     arbitrary code execution.

  - CVE-2015-7512     Ling Liu of Qihoo 360 Inc. and Jason Wang of Red Hat     Inc. discovered that the PC-Net II ethernet controller     is vulnerable to a buffer overflow that could result in     denial-of-service (via application crash) or arbitrary     code execution.

  - CVE-2015-8345     Qinghao Tang of Qihoo 360 Inc. discovered that the     eepro100 emulator contains a flaw that could lead to an     infinite loop when processing Command Blocks, eventually     resulting in denial-of-service (via application crash).

  - CVE-2015-8504     Lian Yihan of Qihoo 360 Inc. discovered that the VNC     display driver support is vulnerable to an arithmetic     exception flaw that could lead to denial-of-service (via     application crash).

  - CVE-2015-8558     Qinghao Tang of Qihoo 360 Inc. discovered that the USB     EHCI emulation support contains a flaw that could lead     to an infinite loop during communication between the     host controller and a device driver. This could lead to     denial-of-service (via resource exhaustion).

  - CVE-2015-8743     Ling Liu of Qihoo 360 Inc. discovered that the NE2000     emulator is vulnerable to an out-of-bound read/write     access issue, potentially resulting in information leak     or memory corruption.

  - CVE-2016-1568     Qinghao Tang of Qihoo 360 Inc. discovered that the IDE     AHCI emulation support is vulnerable to a use-after-free     issue, that could lead to denial-of-service (via     application crash) or arbitrary code execution.

  - CVE-2016-1714     Donghai Zhu of Alibaba discovered that the Firmware     Configuration emulation support is vulnerable to an     out-of-bound read/write access issue, that could lead to     denial-of-service (via application crash) or arbitrary     code execution.

  - CVE-2016-1922     Ling Liu of Qihoo 360 Inc. discovered that 32-bit     Windows guests support is vulnerable to a NULL pointer     dereference issue, that could lead to denial-of-service     (via application crash).

Several vulnerabilities were discovered in qemu, a full virtualization solution on x86 hardware.

  - CVE-2015-7295     Jason Wang of Red Hat Inc. discovered that the Virtual     Network Device support is vulnerable to     denial-of-service, that could occur when receiving large     packets.

  - CVE-2015-7504     Qinghao Tang of Qihoo 360 Inc. and Ling Liu of Qihoo 360     Inc. discovered that the PC-Net II ethernet controller     is vulnerable to a heap-based buffer overflow that could     result in denial-of-service (via application crash) or     arbitrary code execution.

  - CVE-2015-7512     Ling Liu of Qihoo 360 Inc. and Jason Wang of Red Hat     Inc. discovered that the PC-Net II ethernet controller     is vulnerable to a buffer overflow that could result in     denial-of-service (via application crash) or arbitrary     code execution.

  - CVE-2015-7549     Qinghao Tang of Qihoo 360 Inc. and Ling Liu of Qihoo 360     Inc. discovered that the PCI MSI-X emulator is     vulnerable to a NULL pointer dereference issue, that     could lead to denial-of-service (via application crash).

  - CVE-2015-8345     Qinghao Tang of Qihoo 360 Inc. discovered that the     eepro100 emulator contains a flaw that could lead to an     infinite loop when processing Command Blocks, eventually     resulting in denial-of-service (via application crash).

  - CVE-2015-8504     Lian Yihan of Qihoo 360 Inc. discovered that the VNC     display driver support is vulnerable to an arithmetic     exception flaw that could lead to denial-of-service (via     application crash).

  - CVE-2015-8550     Felix Wilhelm of ERNW Research discovered that the PV     backend drivers are vulnerable to double fetch     vulnerabilities, possibly resulting in arbitrary code     execution.

  - CVE-2015-8558     Qinghao Tang of Qihoo 360 Inc. discovered that the USB     EHCI emulation support contains a flaw that could lead     to an infinite loop during communication between the     host controller and a device driver. This could lead to     denial-of-service (via resource exhaustion).

  - CVE-2015-8567 CVE-2015-8568     Qinghao Tang of Qihoo 360 Inc. discovered that the     vmxnet3 device emulator could be used to intentionally     leak host memory, thus resulting in denial-of-service.

  - CVE-2015-8613     Qinghao Tang of Qihoo 360 Inc. discovered that the SCSI     MegaRAID SAS HBA emulation support is vulnerable to a     stack-based buffer overflow issue, that could lead to     denial-of-service (via application crash).

  - CVE-2015-8619     Ling Liu of Qihoo 360 Inc. discovered that the Human     Monitor Interface support is vulnerable to an     out-of-bound write access issue that could result in     denial-of-service (via application crash).

  - CVE-2015-8743     Ling Liu of Qihoo 360 Inc. discovered that the NE2000     emulator is vulnerable to an out-of-bound read/write     access issue, potentially resulting in information leak     or memory corruption.

  - CVE-2015-8744     The vmxnet3 driver incorrectly processes small packets,     which could result in denial-of-service (via application     crash).

  - CVE-2015-8745     The vmxnet3 driver incorrectly processes Interrupt Mask     Registers, which could result in denial-of-service (via     application crash).

  - CVE-2016-1568     Qinghao Tang of Qihoo 360 Inc. discovered that the IDE     AHCI emulation support is vulnerable to a use-after-free     issue, that could lead to denial-of-service (via     application crash) or arbitrary code execution.

  - CVE-2016-1714     Donghai Zhu of Alibaba discovered that the Firmware     Configuration emulation support is vulnerable to an     out-of-bound read/write access issue, that could lead to     denial-of-service (via application crash) or arbitrary     code execution.

  - CVE-2016-1922     Ling Liu of Qihoo 360 Inc. discovered that 32-bit     Windows guests support is vulnerable to a NULL pointer     dereference issue, that could lead to denial-of-service     (via application crash).

  - CVE-2016-1981     The e1000 driver is vulnerable to an infinite loop issue     that could lead to denial-of-service (via application     crash).

Qemu: net: virtio-net possible remote DoS [CVE-2015-7295]

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the qemu-kvm packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In libslirp 4.1.0, as used in QEMU 4.2.0, tcp_subr.c     misuses snprintf return values, leading to a buffer     overflow in later code.(CVE-2020-8608)

  - This vulnerability has been modified since it was last     analyzed by the NVD. It is awaiting reanalysis which     may result in further changes to the information     provided.(CVE-2019-11135)

  - tcp_emu in tcp_subr.c in libslirp 4.1.0, as used in     QEMU 4.2.0, mismanages memory, as demonstrated by IRC     DCC commands in EMU_IRC. This can cause a heap-based     buffer overflow or other out-of-bounds access which can     lead to a DoS or potential execute arbitrary     code.(CVE-2020-7039)

  - ip_reass in ip_input.c in libslirp 4.0.0 has a     heap-based buffer overflow via a large packet because     it mishandles a case involving the first     fragment.(CVE-2019-14378)

  - Integer overflow in the VNC display driver in QEMU     before 2.1.0 allows attachers to cause a denial of     service (process crash) via a CLIENT_CUT_TEXT message,     which triggers an infinite loop.(CVE-2015-5239)

  - Buffer overflow in the send_control_msg function in     hw/char/virtio-serial-bus.c in QEMU before 2.4.0 allows     guest users to cause a denial of service (QEMU process     crash) via a crafted virtio control     message.(CVE-2015-5745)

  - The ne2000_receive function in hw/net/ne2000.c in QEMU     before 2.4.0.1 allows attackers to cause a denial of     service (infinite loop and instance crash) or possibly     execute arbitrary code via vectors related to receiving     packets.(CVE-2015-5278)

  - The process_tx_desc function in hw/net/e1000.c in QEMU     before 2.4.0.1 does not properly process transmit     descriptor data when sending a network packet, which     allows attackers to cause a denial of service (infinite     loop and guest crash) via unspecified     vectors.(CVE-2015-6815)

  - Heap-based buffer overflow in the ne2000_receive     function in hw/net/ne2000.c in QEMU before 2.4.0.1     allows guest OS users to cause a denial of service     (instance crash) or possibly execute arbitrary code via     vectors related to receiving packets.(CVE-2015-5279)

  - Heap-based buffer overflow in the .receive callback of     xlnx.xps-ethernetlite in QEMU (aka Quick Emulator)     allows attackers to execute arbitrary code on the QEMU     host via a large ethlite packet.(CVE-2016-7161)

  - hw/net/vmxnet3.c in QEMU 2.0.0-rc0, 1.7.1, and earlier     allows local guest users to cause a denial of service     or possibly execute arbitrary code via vectors related     to (1) RX or (2) TX queue numbers or (3) interrupt     indices. NOTE: some of these details are obtained from     third party information.(CVE-2013-4544)

  - The slirp_smb function in net/slirp.c in QEMU 2.3.0 and     earlier creates temporary files with predictable names,     which allows local users to cause a denial of service     (instantiation failure) by creating /tmp/qemu-smb.*-*     files before the program.(CVE-2015-4037)

  - hw/ide/core.c in QEMU does not properly restrict the     commands accepted by an ATAPI device, which allows     guest users to cause a denial of service or possibly     have unspecified other impact via certain IDE commands,     as demonstrated by a WIN_READ_NATIVE_MAX command to an     empty drive, which triggers a divide-by-zero error and     instance crash.(CVE-2015-6855)

  - hw/virtio/virtio.c in the Virtual Network Device     (virtio-net) support in QEMU, when big or mergeable     receive buffers are not supported, allows remote     attackers to cause a denial of service (guest network     consumption) via a flood of jumbo frames on the (1)     tuntap or (2) macvtap interface.(CVE-2015-7295)

  - The MSI-X MMIO support in hw/pci/msix.c in QEMU (aka     Quick Emulator) allows local guest OS privileged users     to cause a denial of service (NULL pointer dereference     and QEMU process crash) by leveraging failure to define     the .write method.(CVE-2015-7549)

  - The eepro100 emulator in QEMU qemu-kvm blank allows     local guest users to cause a denial of service     (application crash and infinite loop) via vectors     involving the command block list.(CVE-2015-8345)

  - Qemu, when built with VNC display driver support,     allows remote attackers to cause a denial of service     (arithmetic exception and application crash) via     crafted SetPixelFormat messages from a     client.(CVE-2015-8504)

  - The ehci_process_itd function in hw/usb/hcd-ehci.c in     QEMU allows local guest OS administrators to cause a     denial of service (infinite loop and CPU consumption)     via a circular isochronous transfer descriptor (iTD)     list.(CVE-2015-8558)

  - Memory leak in net/vmxnet3.c in QEMU allows remote     attackers to cause a denial of service (memory     consumption).(CVE-2015-8567)

  - Memory leak in QEMU, when built with a VMWARE VMXNET3     paravirtual NIC emulator support, allows local guest     users to cause a denial of service (host memory     consumption) by trying to activate the vmxnet3 device     repeatedly.(CVE-2015-8568)

  - Stack-based buffer overflow in the     megasas_ctrl_get_info function in QEMU, when built with     SCSI MegaRAID SAS HBA emulation support, allows local     guest users to cause a denial of service (QEMU instance     crash) via a crafted SCSI controller CTRL_GET_INFO     command.(CVE-2015-8613)

  - Use-after-free vulnerability in hw/ide/ahci.c in QEMU,     when built with IDE AHCI Emulation support, allows     guest OS users to cause a denial of service (instance     crash) or possibly execute arbitrary code via an     invalid AHCI Native Command Queuing (NCQ) AIO     command.(CVE-2016-1568)

  - QEMU (aka Quick Emulator) built with the USB EHCI     emulation support is vulnerable to a null pointer     dereference flaw. It could occur when an application     attempts to write to EHCI capabilities registers. A     privileged user inside quest could use this flaw to     crash the QEMU process instance resulting in     DoS.(CVE-2016-2198)

  - The ohci_bus_start function in the USB OHCI emulation     support (hw/usb/hcd-ohci.c) in QEMU allows local guest     OS administrators to cause a denial of service (NULL     pointer dereference and QEMU process crash) via vectors     related to multiple eof_timers.(CVE-2016-2391)

  - The is_rndis function in the USB Net device emulator     (hw/usb/dev-network.c) in QEMU before 2.5.1 does not     properly validate USB configuration descriptor objects,     which allows local guest OS administrators to cause a     denial of service (NULL pointer dereference and QEMU     process crash) via vectors involving a remote NDIS     control message packet.(CVE-2016-2392)

  - Multiple integer overflows in the USB Net device     emulator (hw/usb/dev-network.c) in QEMU before 2.5.1     allow local guest OS administrators to cause a denial     of service (QEMU process crash) or obtain sensitive     host memory information via a remote NDIS control     message packet that is mishandled in the (1)     rndis_query_response, (2) rndis_set_response, or (3)     usb_net_handle_dataout function.(CVE-2016-2538)

  - The ne2000_receive function in the NE2000 NIC emulation     support (hw/net/ne2000.c) in QEMU before 2.5.1 allows     local guest OS administrators to cause a denial of     service (infinite loop and QEMU process crash) via     crafted values for the PSTART and PSTOP registers,     involving ring buffer control.(CVE-2016-2841)

  - QEMU, when built with the Pseudo Random Number     Generator (PRNG) back-end support, allows local guest     OS users to cause a denial of service (process crash)     via an entropy request, which triggers arbitrary stack     based allocation and memory corruption.(CVE-2016-2858)

  - Buffer overflow in the stellaris_enet_receive function     in hw/net/stellaris_enet.c in QEMU, when the Stellaris     ethernet controller is configured to accept large     packets, allows remote attackers to cause a denial of     service (QEMU crash) via a large packet.(CVE-2016-4001)

  - Buffer overflow in the mipsnet_receive function in     hw/net/mipsnet.c in QEMU, when the guest NIC is     configured to accept large packets, allows remote     attackers to cause a denial of service (memory     corruption and QEMU crash) or possibly execute     arbitrary code via a packet larger than 1514     bytes.(CVE-2016-4002)

  - The ehci_advance_state function in hw/usb/hcd-ehci.c in     QEMU allows local guest OS administrators to cause a     denial of service (infinite loop and CPU consumption)     via a circular split isochronous transfer descriptor     (siTD) list, a related issue to     CVE-2015-8558.(CVE-2016-4037)

  - The vmsvga_fifo_run function in hw/display/vmware_vga.c     in QEMU allows local guest OS administrators to cause a     denial of service (infinite loop and QEMU process     crash) via a VGA command.(CVE-2016-4453)

  - The vmsvga_fifo_read_raw function in     hw/display/vmware_vga.c in QEMU allows local guest OS     administrators to obtain sensitive host memory     information or cause a denial of service (QEMU process     crash) by changing FIFO registers and issuing a VGA     command, which triggers an out-of-bounds     read.(CVE-2016-4454)

  - The net_tx_pkt_do_sw_fragmentation function in     hw/net/net_tx_pkt.c in QEMU (aka Quick Emulator) allows     local guest OS administrators to cause a denial of     service (infinite loop and QEMU process crash) via a     zero length for the current fragment     length.(CVE-2016-6834)

  - The vmxnet_tx_pkt_parse_headers function in     hw/net/vmxnet_tx_pkt.c in QEMU (aka Quick Emulator)     allows local guest OS administrators to cause a denial     of service (buffer over-read) by leveraging failure to     check IP header length.(CVE-2016-6835)

  - The vmxnet3_complete_packet function in     hw/net/vmxnet3.c in QEMU (aka Quick Emulator) allows     local guest OS administrators to obtain sensitive host     memory information by leveraging failure to initialize     the txcq_descr object.(CVE-2016-6836)

  - Integer overflow in the net_tx_pkt_init function in     hw/net/net_tx_pkt.c in QEMU (aka Quick Emulator) allows     local guest OS administrators to cause a denial of     service (QEMU process crash) via the maximum     fragmentation count, which triggers an unchecked     multiplication and NULL pointer     dereference.(CVE-2016-6888)

  - Directory traversal vulnerability in hw/9pfs/9p.c in     QEMU (aka Quick Emulator) allows local guest OS     administrators to access host files outside the export     path via a .. (dot dot) in an unspecified     string.(CVE-2016-7116)

  - The pvscsi_ring_pop_req_descr function in     hw/scsi/vmw_pvscsi.c in QEMU (aka Quick Emulator)     allows local guest OS administrators to cause a denial     of service (infinite loop and QEMU process crash) by     leveraging failure to limit process IO loop to the ring     size.(CVE-2016-7421)

  - The mcf_fec_do_tx function in hw/net/mcf_fec.c in QEMU     (aka Quick Emulator) does not properly limit the buffer     descriptor count when transmitting packets, which     allows local guest OS administrators to cause a denial     of service (infinite loop and QEMU process crash) via     vectors involving a buffer descriptor with a length of     0 and crafted values in bd.flags.(CVE-2016-7908)

  - The pcnet_rdra_addr function in hw/net/pcnet.c in QEMU     (aka Quick Emulator) allows local guest OS     administrators to cause a denial of service (infinite     loop and QEMU process crash) by setting the (1) receive     or (2) transmit descriptor ring length to     0.(CVE-2016-7909)

  - The xhci_ring_fetch function in hw/usb/hcd-xhci.c in     QEMU (aka Quick Emulator) allows local guest OS     administrators to cause a denial of service (infinite     loop and QEMU process crash) by leveraging failure to     limit the number of link Transfer Request Blocks (TRB)     to process.(CVE-2016-8576)

  - The serial_update_parameters function in     hw/char/serial.c in QEMU (aka Quick Emulator) allows     local guest OS administrators to cause a denial of     service (divide-by-zero error and QEMU process crash)     via vectors involving a value of divider greater than     baud base.(CVE-2016-8669)

  - The intel_hda_xfer function in hw/audio/intel-hda.c in     QEMU (aka Quick Emulator) allows local guest OS     administrators to cause a denial of service (infinite     loop and CPU consumption) via an entry with the same     value for buffer length and pointer     position.(CVE-2016-8909)

  - The rtl8139_cplus_transmit function in hw/net/rtl8139.c     in QEMU (aka Quick Emulator) allows local guest OS     administrators to cause a denial of service (infinite     loop and CPU consumption) by leveraging failure to     limit the ring descriptor count.(CVE-2016-8910)

  - Memory leak in the v9fs_xattrcreate function in     hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local     guest OS administrators to cause a denial of service     (memory consumption and QEMU process crash) via a large     number of Txattrcreate messages with the same fid     number.(CVE-2016-9102)

  - The v9fs_xattrcreate function in hw/9pfs/9p.c in QEMU     (aka Quick Emulator) allows local guest OS     administrators to obtain sensitive host heap memory     information by reading xattribute values before writing     to them.(CVE-2016-9103)

  - Multiple integer overflows in the (1) v9fs_xattr_read     and (2) v9fs_xattr_write functions in hw/9pfs/9p.c in     QEMU (aka Quick Emulator) allow local guest OS     administrators to cause a denial of service (QEMU     process crash) via a crafted offset, which triggers an     out-of-bounds access.(CVE-2016-9104)

  - Memory leak in the v9fs_link function in hw/9pfs/9p.c     in QEMU (aka Quick Emulator) allows local guest OS     administrators to cause a denial of service (memory     consumption) via vectors involving a reference to the     source fid object.(CVE-2016-9105)

  - Memory leak in the v9fs_write function in hw/9pfs/9p.c     in QEMU (aka Quick Emulator) allows local guest OS     administrators to cause a denial of service (memory     consumption) by leveraging failure to free an IO     vector.(CVE-2016-9106)

  - Race condition in QEMU in Xen allows local x86 HVM     guest OS administrators to gain privileges by changing     certain data on shared rings, aka a 'double fetch'     vulnerability.(CVE-2016-9381)

  - Quick Emulator (Qemu) built with the USB redirector     usb-guest support is vulnerable to a memory leakage     flaw. It could occur while destroying the USB     redirector in 'usbredir_handle_destroy'. A guest     user/process could use this issue to leak host memory,     resulting in DoS for a host.(CVE-2016-9907)

  - Quick Emulator (Qemu) built with the USB EHCI Emulation     support is vulnerable to a memory leakage issue. It     could occur while processing packet data in     'ehci_init_transfer'. A guest user/process could use     this issue to leak host memory, resulting in DoS for a     host.(CVE-2016-9911)

  - Stack-based buffer overflow in hw/usb/redirect.c in     QEMU (aka Quick Emulator) allows local guest OS users     to cause a denial of service (QEMU process crash) via     vectors related to logging debug     messages.(CVE-2017-10806)

  - The dhcp_decode function in slirp/bootp.c in QEMU (aka     Quick Emulator) allows local guest OS users to cause a     denial of service (out-of-bounds read and QEMU process     crash) via a crafted DHCP options     string.(CVE-2017-11434)

  - Integer overflow in the macro ROUND_UP (n, d) in Quick     Emulator (Qemu) allows a user to cause a denial of     service (Qemu process crash).(CVE-2017-18043)

  - Memory leak in the serial_exit_core function in     hw/char/serial.c in QEMU (aka Quick Emulator) allows     local guest OS privileged users to cause a denial of     service (host memory consumption and QEMU process     crash) via a large number of device unplug     operations.(CVE-2017-5579)

  - The xhci_kick_epctx function in hw/usb/hcd-xhci.c in     QEMU (aka Quick Emulator) allows local guest OS     privileged users to cause a denial of service (infinite     loop and QEMU process crash) via vectors related to     control transfer descriptor sequence.(CVE-2017-5973)

  - Memory leak in the audio/audio.c in QEMU (aka Quick     Emulator) allows remote attackers to cause a denial of     service (memory consumption) by repeatedly starting and     stopping audio capture.(CVE-2017-8309)

  - Memory leak in QEMU (aka Quick Emulator), when built     with IDE AHCI Emulation support, allows local guest OS     privileged users to cause a denial of service (memory     consumption) by repeatedly hot-unplugging the AHCI     device.(CVE-2017-9373)

  - Memory leak in QEMU (aka Quick Emulator), when built     with USB EHCI Emulation support, allows local guest OS     privileged users to cause a denial of service (memory     consumption) by repeatedly hot-unplugging the     device.(CVE-2017-9374)

  - Qemu emulator <= 3.0.0 built with the NE2000 NIC     emulation support is vulnerable to an integer overflow,     which could lead to buffer overflow issue. It could     occur when receiving packets over the network. A user     inside guest could use this flaw to crash the Qemu     process resulting in DoS.(CVE-2018-10839)

  - qemu-seccomp.c in QEMU might allow local OS guest users     to cause a denial of service (guest crash) by     leveraging mishandling of the seccomp policy for     threads other than the main thread.(CVE-2018-15746)

  - Qemu has a Buffer Overflow in rtl8139_do_receive in     hw/net/rtl8139.c because an incorrect integer data type     is used.(CVE-2018-17958)

  - qemu_deliver_packet_iov in net/net.c in Qemu accepts     packet sizes greater than INT_MAX, which allows     attackers to cause a denial of service or possibly have     unspecified other impact.(CVE-2018-17963)

  - In QEMU 3.0.0, tcp_emu in slirp/tcp_subr.c has a     heap-based buffer overflow.(CVE-2019-6778)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

kvm was updated to fix 33 security issues.

These security issues were fixed :

  - CVE-2016-4439: Avoid OOB access in 53C9X emulation     (bsc#980711)

  - CVE-2016-4441: Avoid OOB access in 53C9X emulation     (bsc#980723)

  - CVE-2016-3710: Fixed VGA emulation based OOB access with     potential for guest escape (bsc#978158)

  - CVE-2016-3712: Fixed VGa emulation based DOS and OOB     read access exploit (bsc#978160)

  - CVE-2016-4037: Fixed USB ehci based DOS (bsc#976109)

  - CVE-2016-2538: Fixed potential OOB access in USB net     device emulation (bsc#967969)

  - CVE-2016-2841: Fixed OOB access / hang in ne2000     emulation (bsc#969350)

  - CVE-2016-2858: Avoid potential DOS when using QEMU     pseudo random number generator (bsc#970036)

  - CVE-2016-2857: Fixed OOB access when processing IP     checksums (bsc#970037)

  - CVE-2016-4001: Fixed OOB access in Stellaris enet     emulated nic (bsc#975128)

  - CVE-2016-4002: Fixed OOB access in MIPSnet emulated     controller (bsc#975136)

  - CVE-2016-4020: Fixed possible host data leakage to guest     from TPR access (bsc#975700)

  - CVE-2015-3214: Fixed OOB read in i8254 PIC (bsc#934069)

  - CVE-2014-9718: Fixed the handling of malformed or short     ide PRDTs to avoid any opportunity for guest to cause     DoS by abusing that interface (bsc#928393)

  - CVE-2014-3689: Fixed insufficient parameter validation     in rectangle functions (bsc#901508)

  - CVE-2014-3615: The VGA emulator in QEMU allowed local     guest users to read host memory by setting the display     to a high resolution (bsc#895528).

  - CVE-2015-5239: Integer overflow in vnc_client_read() and     protocol_client_msg() (bsc#944463).

  - CVE-2015-5278: Infinite loop in ne2000_receive()     function (bsc#945989).

  - CVE-2015-5279: Heap-based buffer overflow in the     ne2000_receive function in hw/net/ne2000.c in QEMU     allowed guest OS users to cause a denial of service     (instance crash) or possibly execute arbitrary code via     vectors related to receiving packets (bsc#945987).

  - CVE-2015-5745: Buffer overflow in virtio-serial     (bsc#940929).

  - CVE-2015-6855: hw/ide/core.c in QEMU did not properly     restrict the commands accepted by an ATAPI device, which     allowed guest users to cause a denial of service or     possibly have unspecified other impact via certain IDE     commands, as demonstrated by a WIN_READ_NATIVE_MAX     command to an empty drive, which triggers a     divide-by-zero error and instance crash (bsc#945404).

  - CVE-2015-7295: hw/virtio/virtio.c in the Virtual Network     Device (virtio-net) support in QEMU, when big or     mergeable receive buffers are not supported, allowed     remote attackers to cause a denial of service (guest     network consumption) via a flood of jumbo frames on the     (1) tuntap or (2) macvtap interface (bsc#947159).

  - CVE-2015-7549: PCI NULL pointer dereferences     (bsc#958917).

  - CVE-2015-8504: VNC floating point exception     (bsc#958491).

  - CVE-2015-8558: Infinite loop in ehci_advance_state     resulting in DoS (bsc#959005).

  - CVE-2015-8613: Wrong sized memset in megasas command     handler (bsc#961358).

  - CVE-2015-8619: Potential DoS for long HMP sendkey     command argument (bsc#960334).

  - CVE-2015-8743: OOB memory access in ne2000 ioport r/w     functions (bsc#960725).

  - CVE-2016-1568: AHCI use-after-free in aio port commands     (bsc#961332).

  - CVE-2016-1714: Potential OOB memory access in processing     firmware configuration (bsc#961691).

  - CVE-2016-1922: NULL pointer dereference when processing     hmp i/o command (bsc#962320).

  - CVE-2016-1981: Potential DoS (infinite loop) in e1000     device emulation by malicious privileged user within     guest (bsc#963782).

  - CVE-2016-2198: Malicious privileged guest user were able     to cause DoS by writing to read-only EHCI capabilities     registers (bsc#964413).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- CVE-2015-7295：virtio-net 可能的遠端 DoS (bz #1264393) * drive-mirror：修正協程重新進入 (bz #1266936) * 修正 udp 通訊端「localaddr」(bz #1268708)

請注意，Tenable Network Security 已直接從 Fedora 安全性公告擷取前置描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

遠端主機受到 GLSA-201602-01 中所述的弱點影響 (QEMU：多個弱點)

在 QEMU 中發現多個弱點。如需詳細資訊，請檢閱以下提及的 CVE 識別碼。
 影響：

遠端攻擊者可能造成拒絕服務或取得來賓虛擬機器上提升的權限。
 因應措施：

目前尚無已知的因應措施。

遠端 Ubuntu 14.04 LTS 主機上安裝的套件受到 USN-2828-1 公告中所提及的多個弱點影響。

    Jason Wang 發現 QEMU 未正確處理 virtio-net 裝置。遠端攻擊者可利用此問題造成來賓網路消耗，進而導致拒絕服務。(CVE-2015-7295)

    Qinghao Tang 和 Ling Liu 發現，在回送模式中使用時，QEMU 會不正確地處理 pcnet 驅動程式。惡意來賓可利用此問題導致拒絕服務，或可能以執行 QEMU 處理程序的使用者身分在主機上執行任意程式碼。在預設安裝中，搭配 libvirt 使用 QEMU 時，libvirt AppArmor 設定檔會隔離攻擊者。(CVE-2015-7504)

    Ling Liu 和 Jason Wang 發現 QEMU 會不正確地處理 pcnet 驅動程式。遠端攻擊者可利用此問題造成拒絕服務，或可能以執行 QEMU 處理程序的使用者身分，在主機上執行任意程式碼。在預設安裝中，搭配 libvirt 使用 QEMU 時，libvirt AppArmor 設定檔會隔離攻擊者。(CVE-2015-7512)

    Qinghao Tang 發現 QEMU 未正確處理 eepro100 驅動程式。惡意來賓可利用此問題造成無限迴圈，進而導致拒絕服務。(CVE-2015-8345)

Tenable 已直接從 Ubuntu 安全公告擷取前置描述區塊。

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

qemu 已更新，修正了 37 個安全性問題。

已修正這些安全性問題：

- CVE-2016-4439：避免 53C9X 模擬中的 OOB 存取 (bsc#980711)

- CVE-2016-4441：避免 53C9X 模擬中的 OOB 存取 (bsc#980723)

- CVE-2016-4952：避免 Vmware PV SCSI 模擬中的 OOB 存取 (bsc#981266)

- CVE-2015-8817：避免 PCI DMA I/O 中的 OOB 存取 (bsc#969121)

- CVE-2015-8818：避免 PCI DMA I/O 中的 OOB 存取 (bsc#969122)

- CVE-2016-3710：已修正可能造成來賓逸出的 VGA 模擬型 OOB 存取問題 (bsc#978158)

- CVE-2016-3712：已修正 VGa 模擬型 DOS 和 OOB 讀取存取惡意利用問題 (bsc#978160)

- CVE-2016-4037：已修正 USB ehci 型 DOS (bsc#976109)

- CVE-2016-2538：已修正 USB net 裝置模擬中可能發生的 OOB 存取問題 (bsc#967969)

- CVE-2016-2841：已修正 ne2000 模擬中的 OOB 存取/懸置問題 (bsc#969350)

- CVE-2016-2858：避免在使用 QEMU pseudo 亂數產生器時可能發生的 DOS (bsc#970036)

- CVE-2016-2857：已修正處理 IP 總和檢查碼時的 OOB 存取問題 (bsc#970037)

- CVE-2016-4001：已修正 Stellaris enet 模擬 nic 中的 OOB 存取問題 (bsc#975128)

- CVE-2016-4002：已修正 MIPSnet 模擬控制器中的 OOB 存取問題 (bsc#975136)

- CVE-2016-4020：已修正可能從 TPR 存取洩漏主機資料給來賓的問題 (bsc#975700)

- CVE-2015-3214：已修正 i8254 PIC 中的 OOB 讀取問題 (bsc#934069)

- CVE-2014-9718：已修正格式錯誤或短 ide PRDT 的處理問題，以避免來賓有任何機會透過濫用該介面來造成 DoS (bsc#928393)

- CVE-2014-3689：已修正 rectangle 函式中參數驗證不充分的問題 (bsc#901508)

- CVE-2014-3615：QEMU 中的 VGA 模擬器會允許本機來賓使用者透過設定為高解析度顯示，進而讀取主機記憶體 (bsc#895528)。

- CVE-2015-5239：vnc_client_read() 和 protocol_client_msg() 中存在整數溢位 (bsc#944463)。

- CVE-2015-5745：virtio-serial 中的緩衝區溢位問題 (bsc#940929)。

- CVE-2015-7295：當大型或可合併的接收緩衝區不受支援時，QEMU 的虛擬網路裝置 (virtio-net) 支援中的 hw/virtio/virtio.c，會允許遠端攻擊者透過 (1) tuntap 或 (2) macvtap 介面上的 jumbo 框架流動，造成拒絕服務 (來賓網路消耗) (bsc#947159)。

- CVE-2015-7549： PCI NULL 指標解除參照 (bsc#958917)。

- CVE-2015-8504：VNC 浮點例外狀況 (bsc#958491)。

- CVE-2015-8558：ehci_advance_state 中的無限迴圈導致 DoS (bsc#959005)。

- CVE-2015-8567：來賓重複啟動 vmxnet3 裝置可洩漏主機記憶體 (bsc#959386)。

- CVE-2015-8568：來賓重複啟動 vmxnet3 裝置可洩漏主機記憶體 (bsc#959386)。

- CVE-2015-8613：megasas 命令處置程式中 memset 的大小錯誤 (bsc#961358)。

- CVE-2015-8619：長 HMP sendkey 命令引數可能發生 DoS (bsc#960334)。

- CVE-2015-8743：ne2000 ioport 讀取/寫入函式中的 OOB 記憶體存取問題 (bsc#960725)。

- CVE-2015-8744：透過 assert(2) 呼叫錯誤執行的 l2 標頭驗證可導致當機 (bsc#960835)。

- CVE-2015-8745：透過 assert(2) 呼叫讀取 IMR 暫存器可導致當機 (bsc#960708)。

- CVE-2016-1568：aio 連接埠命令中的 AHCI 釋放後使用問題 (bsc#961332)。

- CVE-2016-1714：處理韌體組態時可能發生的 OOB 記憶體存取問題 (bsc#961691)。

- CVE-2016-1922：處理 hmp i/o 命令時發生 NULL 指標解除參照問題 (bsc#962320)。

- CVE-2016-1981：來賓內惡意的有權限使用者可能在 e1000 裝置模擬中造成 DoS (無限迴圈) (bsc#963782).

- CVE-2016-2198：惡意的有權限來賓使用者能透過寫入唯讀 EHCI 功能暫存器而造成 DoS (bsc#964413)。

已修正此非安全性問題

- bsc#886378：qemu 會截斷 virt-rescue 中的 vhd 影像

請注意，Tenable Network Security 已直接從 SUSE 安全性公告擷取前置描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

Qemu：net：virtio-net 可能的遠端 DoS [CVE-2015-7295]

請注意，Tenable Network Security 已直接從 Fedora 安全性公告擷取前置描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

在 x86 硬體上的完全虛擬化解決方案 qemu 中發現數個弱點。

- CVE-2015-7295 Red Hat Inc. 的 Jason Wang 發現，虛擬網路裝置支援容易受到拒絕服務影響 (透過資源耗盡)，接收大型封包時可能會發生此情形。

- CVE-2015-7504 Qihoo 360 Inc. 的 Qinghao Tang 和 Qihoo 360 Inc. 的 Ling Liu 發現，PC-Net II 乙太網路控制器容易受到堆積型緩衝區溢位影響，其可導致拒絕服務 (透過應用程式損毀) 或任意程式碼執行。

- CVE-2015-7512 Qihoo 360 Inc. 的 Ling Liu 和 Red Hat Inc. 的 Jason Wang 發現，PC-Net II 乙太網路控制器容易受到緩衝區溢位影響，其可導致拒絕服務 (透過應用程式損毀) 或任意程式碼執行。

- CVE-2015-8345 Qihoo 360 Inc. 的 Qinghao Tang 發現，eepro100 模擬器有一個瑕疵，處理命令區塊時可導致無限迴圈，最終導致拒絕服務 (透過應用程式損毀)。

- CVE-2015-8504 Qihoo 360 Inc. 的 Lian Yihan 發現，VNC 顯示器驅動程式支援容易受到算術例外狀況瑕疵的影響，其可導致拒絕服務 (透過應用程式損毀)。

- CVE-2015-8558 Qihoo 360 Inc. 的 Qinghao Tang 發現，USB EHCI 模擬支援有一個瑕疵，其可導致主機控制器和裝置驅動程式通訊期間發生無限迴圈。這可能導致拒絕服務 (透過資源耗盡)。

- CVE-2015-8743 Qihoo 360 Inc. 的 Ling Liu 發現，NE2000 模擬器容易受到超出邊界讀取/寫入存取問題的影響，可能導致資訊洩漏或記憶體損毀。

- CVE-2016-1568 Qihoo 360 Inc. 的 Qinghao Tang 發現，IDE AHCI 模擬支援容易受到釋放後使用問題影響，其可導致拒絕服務 (透過應用程式損毀) 或任意程式碼執行。

- CVE-2016-1714 Alibaba 的 Donghai Zhu 發現，韌體組態模擬支援容易受到超出邊界讀取/寫入存取問題影響，其可導致拒絕服務 (透過應用程式損毀) 或任意程式碼執行。

- CVE-2016-1922 Qihoo 360 Inc. 的 Ling Liu 發現，32 位元 Windows 來賓支援容易受到 NULL 指標解除參照問題影響，其可導致拒絕服務 (透過應用程式損毀)。

在 x86 硬體上的完全虛擬化解決方案 qemu 中發現數個弱點。

- CVE-2015-7295 Red Hat Inc. 的 Jason Wang 發現，虛擬網路裝置支援容易受到拒絕服務影響，接收大型封包時可能會發生此情形。

- CVE-2015-7504 Qihoo 360 Inc. 的 Qinghao Tang 和 Qihoo 360 Inc. 的 Ling Liu 發現，PC-Net II 乙太網路控制器容易受到堆積型緩衝區溢位影響，其可導致拒絕服務 (透過應用程式損毀) 或任意程式碼執行。

- CVE-2015-7512 Qihoo 360 Inc. 的 Ling Liu 和 Red Hat Inc. 的 Jason Wang 發現，PC-Net II 乙太網路控制器容易受到緩衝區溢位影響，其可導致拒絕服務 (透過應用程式損毀) 或任意程式碼執行。

- CVE-2015-7549 Qihoo 360 Inc. 的 Qinghao Tang 和 Qihoo 360 Inc. 的 Ling Liu 發現，PCI MSI-X 模擬器容易受到一個 NULL 指標解除參照問題影響，其可導致拒絕服務 (透過應用程式損毀)。

- CVE-2015-8345 Qihoo 360 Inc. 的 Qinghao Tang 發現，eepro100 模擬器有一個瑕疵，處理命令區塊時可導致無限迴圈，最終導致拒絕服務 (透過應用程式損毀)。

- CVE-2015-8504 Qihoo 360 Inc. 的 Lian Yihan 發現，VNC 顯示器驅動程式支援容易受到算術例外狀況瑕疵的影響，其可導致拒絕服務 (透過應用程式損毀)。

- CVE-2015-8550 ERNW Research 的 Felix Wilhelm 發現，PV 後端驅動程式容易受到雙重擷取弱點影響，這可能導致任意程式碼執行。

- CVE-2015-8558 Qihoo 360 Inc. 的 Qinghao Tang 發現，USB EHCI 模擬支援有一個瑕疵，其可導致主機控制器和裝置驅動程式通訊期間發生無限迴圈。這可能導致拒絕服務 (透過資源耗盡)。

- CVE-2015-8567 CVE-2015-8568 Qihoo 360 Inc. 的 Qinghao Tang 發現，攻擊者可利用 vmxnet3 裝置模擬器刻意洩漏主機記憶體，進而導致拒絕服務。

- CVE-2015-8613 Qihoo 360 Inc. 的 Qinghao Tang 發現，SCSI MegaRAID SAS HBA 模擬支援容易受到一個堆疊型緩衝區溢位問題影響，其可導致拒絕服務 (透過應用程式損毀)。

- CVE-2015-8619 Qihoo 360 Inc. 的 Ling Liu 發現，Human Monitor Interface 支援容易受到一個超出邊界寫入存取問題影響，其可導致拒絕服務 (透過應用程式損毀)。

- CVE-2015-8743 Qihoo 360 Inc. 的 Ling Liu 發現，NE2000 模擬器容易受到超出邊界讀取/寫入存取問題的影響，可能導致資訊洩漏或記憶體損毀。

- CVE-2015-8744 vmxnet3 驅動程式未正確處理小封包，其可導致拒絕服務 (透過應用程式損毀)。

- CVE-2015-8745 vmxnet3 驅動程式未正確處理中斷遮罩暫存器，其可導致拒絕服務 (透過應用程式損毀)。

- CVE-2016-1568 Qihoo 360 Inc. 的 Qinghao Tang 發現，IDE AHCI 模擬支援容易受到釋放後使用問題影響，其可導致拒絕服務 (透過應用程式損毀) 或任意程式碼執行。

- CVE-2016-1714 Alibaba 的 Donghai Zhu 發現，韌體組態模擬支援容易受到超出邊界讀取/寫入存取問題影響，其可導致拒絕服務 (透過應用程式損毀) 或任意程式碼執行。

- CVE-2016-1922 Qihoo 360 Inc. 的 Ling Liu 發現，32 位元 Windows 來賓支援容易受到 NULL 指標解除參照問題影響，其可導致拒絕服務 (透過應用程式損毀)。

- CVE-2016-1981 e1000 驅動程容易受到一個無限迴圈問題影響，其可導致拒絕服務 (透過應用程式損毀)。

kvm 已更新，修正了 33 個安全性問題。

已修正這些安全性問題：

- CVE-2016-4439：避免 53C9X 模擬中的 OOB 存取 (bsc#980711)

- CVE-2016-4441：避免 53C9X 模擬中的 OOB 存取 (bsc#980723)

- CVE-2016-3710：已修正可能造成來賓逸出的 VGA 模擬型 OOB 存取問題 (bsc#978158)

- CVE-2016-3712：已修正 VGa 模擬型 DOS 和 OOB 讀取存取惡意利用問題 (bsc#978160)

- CVE-2016-4037：已修正 USB ehci 型 DOS (bsc#976109)

- CVE-2016-2538：已修正 USB net 裝置模擬中可能發生的 OOB 存取問題 (bsc#967969)

- CVE-2016-2841：已修正 ne2000 模擬中的 OOB 存取/懸置問題 (bsc#969350)

- CVE-2016-2858：避免在使用 QEMU pseudo 亂數產生器時可能發生的 DOS (bsc#970036)

- CVE-2016-2857：已修正處理 IP 總和檢查碼時的 OOB 存取問題 (bsc#970037)

- CVE-2016-4001：已修正 Stellaris enet 模擬 nic 中的 OOB 存取問題 (bsc#975128)

- CVE-2016-4002：已修正 MIPSnet 模擬控制器中的 OOB 存取問題 (bsc#975136)

- CVE-2016-4020：已修正可能從 TPR 存取洩漏主機資料給來賓的問題 (bsc#975700)

- CVE-2015-3214：已修正 i8254 PIC 中的 OOB 讀取問題 (bsc#934069)

- CVE-2014-9718：已修正格式錯誤或短 ide PRDT 的處理問題，以避免來賓有任何機會透過濫用該介面來造成 DoS (bsc#928393)

- CVE-2014-3689：已修正 rectangle 函式中參數驗證不充分的問題 (bsc#901508)

- CVE-2014-3615：QEMU 中的 VGA 模擬器會允許本機來賓使用者透過設定為高解析度顯示，進而讀取主機記憶體 (bsc#895528)。

- CVE-2015-5239：vnc_client_read() 和 protocol_client_msg() 中存在整數溢位 (bsc#944463)。

- CVE-2015-5278：ne2000_receive() 函式中的無限迴圈問題 (bsc#945989)。

- CVE-2015-5279：在 QEMU 的 hw/net/ne2000.c 中，ne2000_receive 函式中的堆積型緩衝區溢位允許來賓 OS 使用者透過與接收封包有關的向量造成拒絕服務 (執行個體當機)，或可能執行任意程式碼 (bsc#945987)。

- CVE-2015-5745：virtio-serial 中的緩衝區溢位問題 (bsc#940929)。

- CVE-2015-6855：QEMU 中的 hw/ide/core.c 未正確限制 ATAPI 裝置接受的命令，進而允許來賓使用者透過特定 IDE 命令造成拒絕服務，或可能造成其他不明影響；空白磁碟機的 WIN_READ_NATIVE_MAX 命令觸發除以零錯誤和執行個體損毀即為一例 (bsc#945404)。

- CVE-2015-7295：當大型或可合併的接收緩衝區不受支援時，QEMU 的虛擬網路裝置 (virtio-net) 支援中的 hw/virtio/virtio.c，會允許遠端攻擊者透過 (1) tuntap 或 (2) macvtap 介面上的 jumbo 框架流動，造成拒絕服務 (來賓網路消耗) (bsc#947159)。

- CVE-2015-7549： PCI NULL 指標解除參照 (bsc#958917)。

- CVE-2015-8504：VNC 浮點例外狀況 (bsc#958491)。

- CVE-2015-8558：ehci_advance_state 中的無限迴圈導致 DoS (bsc#959005)。

- CVE-2015-8613：megasas 命令處置程式中 memset 的大小錯誤 (bsc#961358)。

- CVE-2015-8619：長 HMP sendkey 命令引數可能發生 DoS (bsc#960334)。

- CVE-2015-8743：ne2000 ioport 讀取/寫入函式中的 OOB 記憶體存取問題 (bsc#960725)。

- CVE-2016-1568：aio 連接埠命令中的 AHCI 釋放後使用問題 (bsc#961332)。

- CVE-2016-1714：處理韌體組態時可能發生的 OOB 記憶體存取問題 (bsc#961691)。

- CVE-2016-1922：處理 hmp i/o 命令時發生 NULL 指標解除參照問題 (bsc#962320)。

- CVE-2016-1981：來賓內惡意的有權限使用者可能在 e1000 裝置模擬中造成 DoS (無限迴圈) (bsc#963782).

- CVE-2016-2198：惡意的有權限來賓使用者能透過寫入唯讀 EHCI 功能暫存器而造成 DoS (bsc#964413)。

已修正此非安全性問題：

- 修正 IDE 介面在排清前需要設定忙碌狀態的情形 (bsc#936132)

請注意，Tenable Network Security 已直接從 SUSE 安全性公告擷取前置描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

ID	名稱	產品	系列	已發布	已更新	嚴重性
93169	SUSE SLES11 安全更新：kvm (SUSE-SU-2016:1698-1)	Nessus	SuSE Local Security Checks	2016/8/29	2021/1/19	critical
88628	Debian DSA-3469-1 : qemu - security update	Nessus	Debian Local Security Checks	2016/2/9	2021/1/11	critical
88630	Debian DSA-3471-1 : qemu - security update	Nessus	Debian Local Security Checks	2016/2/9	2021/1/11	critical
89231	Fedora 23 : xen-4.5.1-13.fc23 (2015-46b18ccdc3)	Nessus	Fedora Local Security Checks	2016/3/4	2021/1/11	medium
135559	EulerOS 2.0 SP3 : qemu-kvm (EulerOS-SA-2020-1430)	Nessus	Huawei Local Security Checks	2020/4/15	2024/3/18	critical
93169	SUSE SLES11 Security Update : kvm (SUSE-SU-2016:1698-1)	Nessus	SuSE Local Security Checks	2016/8/29	2021/1/19	critical
89423	Fedora 22：qemu-2.3.1-7.fc22 (2015-d5c1048b47)	Nessus	Fedora Local Security Checks	2016/3/4	2021/1/11	medium
88587	GLSA-201602-01：QEMU：多個弱點 (Venom)	Nessus	Gentoo Local Security Checks	2016/2/5	2021/1/11	critical
87205	Ubuntu 14.04 LTS：QEMU 弱點 (USN-2828-1)	Nessus	Ubuntu Local Security Checks	2015/12/4	2024/8/27	critical
91660	SUSE SLED12 / SLES12 安全性更新：qemu (SUSE-SU-2016:1560-1)	Nessus	SuSE Local Security Checks	2016/6/17	2021/1/6	critical
89231	Fedora 23：xen-4.5.1-13.fc23 (2015-46b18ccdc3)	Nessus	Fedora Local Security Checks	2016/3/4	2021/1/11	medium
88628	Debian DSA-3469-1：qemu - 安全性更新	Nessus	Debian Local Security Checks	2016/2/9	2021/1/11	critical
88630	Debian DSA-3471-1：qemu - 安全性更新	Nessus	Debian Local Security Checks	2016/2/9	2021/1/11	critical
93169	SUSE SLES11 安全性更新：kvm (SUSE-SU-2016:1698-1)	Nessus	SuSE Local Security Checks	2016/8/29	2021/1/19	critical

偵測

搜尋 Plugin

critical

critical

critical

medium

critical

critical

medium

critical

critical

critical

medium

critical

critical

critical