SUSE Security Update: Security update for kvm
______________________________________________________________________________

Announcement ID: SUSE-SU-2014:0623-1
Rating: important
References: #812983 #817593 #842006 #864802 #870439
Cross-References: CVE-2013-2016 CVE-2013-4344 CVE-2013-4541
CVE-2014-0142 CVE-2014-0143 CVE-2014-0144
CVE-2014-0145 CVE-2014-0146 CVE-2014-0147

Affected Products:
SUSE Linux Enterprise Server 11 SP3
SUSE Linux Enterprise Desktop 11 SP3
______________________________________________________________________________

An update that fixes 9 vulnerabilities is now available. It
includes one version update.

Description:

The QEMU embedded within KVM received various security
fixes.

Various issues in the block layer have been fixed:

* A virtio security issue in config io space handling
(CVE-2013-2016).
* A SCSI report LUNs buffer overflow (CVE-2013-4344).
* A buffer overflow in the QEMU USB stack
(CVE-2013-4541).

Security Issue references:

* CVE-2013-2016
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2016
>
* CVE-2013-4344
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4344
>
* CVE-2013-4541
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4541
>
* CVE-2014-0142
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0142
>
* CVE-2014-0143
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0143
>
* CVE-2014-0144
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0144
>
* CVE-2014-0145
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0145
>
* CVE-2014-0146
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0146
>
* CVE-2014-0147
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0147
>

Patch Instructions:

To install this SUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:

– SUSE Linux Enterprise Server 11 SP3:

zypper in -t patch slessp3-kvm-9142

– SUSE Linux Enterprise Desktop 11 SP3:

zypper in -t patch sledsp3-kvm-9142

To bring your system up-to-date, use “zypper patch”.

Package List:

– SUSE Linux Enterprise Server 11 SP3 (i586 s390x x86_64) [New Version: 1.4.2]:

kvm-1.4.2-0.11.1

– SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64) [New Version: 1.4.2]:

kvm-1.4.2-0.11.1

References:

http://support.novell.com/security/cve/CVE-2013-2016.html
http://support.novell.com/security/cve/CVE-2013-4344.html
http://support.novell.com/security/cve/CVE-2013-4541.html
http://support.novell.com/security/cve/CVE-2014-0142.html
http://support.novell.com/security/cve/CVE-2014-0143.html
http://support.novell.com/security/cve/CVE-2014-0144.html
http://support.novell.com/security/cve/CVE-2014-0145.html
http://support.novell.com/security/cve/CVE-2014-0146.html
http://support.novell.com/security/cve/CVE-2014-0147.html
https://bugzilla.novell.com/812983
https://bugzilla.novell.com/817593
https://bugzilla.novell.com/842006
https://bugzilla.novell.com/864802
https://bugzilla.novell.com/870439
http://download.suse.com/patch/finder/?keywords=7b040d1de764d7e94156d09f838af746

—
To unsubscribe, e-mail: opensuse-security-announce+unsubscribe@opensuse.org
For additional commands, e-mail: opensuse-security-announce+help@opensuse.org