Sigurnosni nedostaci programskog paketa qemu-kvm

—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256

=====================================================================
Red Hat Security Advisory

Synopsis: Important: qemu-kvm-ma security update
Advisory ID: RHSA-2020:4047-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2020:4047
Issue date: 2020-09-29
CVE Names: CVE-2020-14364
=====================================================================

1. Summary:

An update for qemu-kvm-ma is now available for Red Hat Enterprise Linux 7.7
Extended Update Support.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Server EUS (v. 7.7) – ppc64, ppc64le, s390x
Red Hat Enterprise Linux Server Optional EUS (v. 7.7) – ppc64

3. Description:

Kernel-based Virtual Machine (KVM) is a full virtualization solution for
Linux on a variety of architectures. The qemu-kvm-ma packages provide the
user-space component for running virtual machines that use KVM on the IBM z
Systems, IBM Power, and 64-bit ARM architectures.

Security Fix(es):

* QEMU: usb: out-of-bounds r/w access issue while processing usb packets
(CVE-2020-14364)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, shut down all running virtual machines. Once
all virtual machines have shut down, start them again for this update to
take effect.

5. Bugs fixed (https://bugzilla.redhat.com/):

1869201 – CVE-2020-14364 QEMU: usb: out-of-bounds r/w access issue while processing usb packets

6. Package List:

Red Hat Enterprise Linux Server EUS (v. 7.7):

Source:
qemu-kvm-ma-2.12.0-33.el7_7.4.src.rpm

ppc64:
qemu-img-ma-2.12.0-33.el7_7.4.ppc64.rpm
qemu-kvm-ma-debuginfo-2.12.0-33.el7_7.4.ppc64.rpm

ppc64le:
qemu-img-ma-2.12.0-33.el7_7.4.ppc64le.rpm
qemu-kvm-common-ma-2.12.0-33.el7_7.4.ppc64le.rpm
qemu-kvm-ma-2.12.0-33.el7_7.4.ppc64le.rpm
qemu-kvm-ma-debuginfo-2.12.0-33.el7_7.4.ppc64le.rpm
qemu-kvm-tools-ma-2.12.0-33.el7_7.4.ppc64le.rpm

s390x:
qemu-img-ma-2.12.0-33.el7_7.4.s390x.rpm
qemu-kvm-common-ma-2.12.0-33.el7_7.4.s390x.rpm
qemu-kvm-ma-2.12.0-33.el7_7.4.s390x.rpm
qemu-kvm-ma-debuginfo-2.12.0-33.el7_7.4.s390x.rpm
qemu-kvm-tools-ma-2.12.0-33.el7_7.4.s390x.rpm

Red Hat Enterprise Linux Server Optional EUS (v. 7.7):

ppc64:
qemu-kvm-common-ma-2.12.0-33.el7_7.4.ppc64.rpm
qemu-kvm-ma-2.12.0-33.el7_7.4.ppc64.rpm
qemu-kvm-ma-debuginfo-2.12.0-33.el7_7.4.ppc64.rpm
qemu-kvm-tools-ma-2.12.0-33.el7_7.4.ppc64.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2020-14364
https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=1869705

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

iQIVAwUBX3L0W9zjgjWX9erEAQhVfg//bxgzPFA7Md+N9wS96YhkNRWEMoDjHP0h
fYpPG5Ypr0rL4oJ4lRnugoP18nDx87I7r3EoB6i5b3YR43Eqg8p2Vz03k5OPzuyz
WVyi8xwZ51mNxCVkSTSLcPMppjO04EZFx33LHfgI/sjXDLVZExB6fPudpX22Xn35
P6GvxJmEFNuXANHGpRA1t7OUgCaGBIZIMKdzgnvfuNAdkUK7eMYlp/XjesqAwL/l
5S9JtEXGCixOl/RuFl7hlWW/eIXpWbZalvEo1zpo3xYxI+jgHUQDbhsELFpN+4lS
MjLF/WzyLVT4AYvjPDN1j7/W9E2YNTVx7mRztpk6NNTQ25o5rX4iEQTuUepTKE8t
UrTwvjv8kkd4ltVBUzKyMghkwYs8U3EemzwUsH3xq/iyJkMd18ZSkZdCDpI6RwrT
GtBLJ6i01Pq3eh4S83x8OHykXlDYhjns4cki1D3oQee7/iKz8/1sMBESURCcyzh0
U8E636u1D8AuA5qALpgBD3hpNZLNNXE9owx7yc8/s49q4H5Y5cX8yJZSLUzCw/s6
kXOX31Y38pabJoXBWfcRgYMugpkThuoO7El9SB62+lhU4adxYS1x7nv1M0Z9D94s
JAI8mBwDC1lZ91Pj2g9RDxoDHhC84SCSBkR2nk+FEbeaVXghKrruzkukaG2bowuP
T1pzOvlAxrI=
=c4Os
—–END PGP SIGNATURE—–

—
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce

—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256

=====================================================================
Red Hat Security Advisory

Synopsis: Important: qemu-kvm security update
Advisory ID: RHSA-2020:4051-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2020:4051
Issue date: 2020-09-29
CVE Names: CVE-2020-14364
=====================================================================

1. Summary:

An update for qemu-kvm is now available for Red Hat Enterprise Linux 7.4
Advanced Update Support, Red Hat Enterprise Linux 7.4 Telco Extended Update
Support, and Red Hat Enterprise Linux 7.4 Update Services for SAP
Solutions.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Server AUS (v. 7.4) – x86_64
Red Hat Enterprise Linux Server E4S (v. 7.4) – ppc64le, x86_64
Red Hat Enterprise Linux Server TUS (v. 7.4) – x86_64

3. Description:

Kernel-based Virtual Machine (KVM) is a full virtualization solution for
Linux on a variety of architectures. The qemu-kvm packages provide the
user-space component for running virtual machines that use KVM.

Security Fix(es):

* QEMU: usb: out-of-bounds r/w access issue while processing usb packets
(CVE-2020-14364)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, shut down all running virtual machines. Once
all virtual machines have shut down, start them again for this update to
take effect.

5. Bugs fixed (https://bugzilla.redhat.com/):

1869201 – CVE-2020-14364 QEMU: usb: out-of-bounds r/w access issue while processing usb packets

6. Package List:

Red Hat Enterprise Linux Server AUS (v. 7.4):

Source:
qemu-kvm-1.5.3-141.el7_4.11.src.rpm

x86_64:
qemu-img-1.5.3-141.el7_4.11.x86_64.rpm
qemu-kvm-1.5.3-141.el7_4.11.x86_64.rpm
qemu-kvm-common-1.5.3-141.el7_4.11.x86_64.rpm
qemu-kvm-debuginfo-1.5.3-141.el7_4.11.x86_64.rpm
qemu-kvm-tools-1.5.3-141.el7_4.11.x86_64.rpm

Red Hat Enterprise Linux Server E4S (v. 7.4):

Source:
qemu-kvm-1.5.3-141.el7_4.11.src.rpm

ppc64le:
qemu-img-1.5.3-141.el7_4.11.ppc64le.rpm
qemu-kvm-debuginfo-1.5.3-141.el7_4.11.ppc64le.rpm

Red Hat Enterprise Linux Server TUS (v. 7.4):

Source:
qemu-kvm-1.5.3-141.el7_4.11.src.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2020-14364
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

iQIVAwUBX3L0H9zjgjWX9erEAQii3g/8Duqw0GvoFshzbPRUCeoR7lE9hgKnskXL
EpM49d9SkJonxLYXgQJqlzeETsbonCFKe5RqxiFJWLWn/PguYL4TPxlLzEh93vaU
SyM68LaST1dceUTtYpyiYpLfznSMTORgNNmwQ0OK6rNaL7gSBBidSn3Njd3dFdOZ
ckgpXxFg4lP3uaxp+DspxKgDK/2Nhtnky9T7VJokriqC/6FJ5DPXMG0U0wyHe1Pn
5OGKYirbr0p4YGSTjn/pB1SiDfPWF3cslMkjbjELTwFSVUe1xEtB65GeOvUhexag
1sTclW+eyKb0yuGT6l12o00xt+lu/osmmOOUZsqbro29zXc4JxS4fujcv1658MqI
L4CGA/k7EYdSocHw4K+YjnWqFs1fEyMA94XGFvVyg4aXaXZaUjrYMJaUnrhaOToT
QqPokWT8El4K48n9BvWOvcli09P3asOgAttxH4tFy5dY6sk4LaZJ7/WC8ujqMhxP
2clYn/CA21BIw0nxE7MHH2zOSmWQrxvGbuH4Jc0nHhW8iAuyDOzay+EUhCxlEzb+
2ZriDS+1kdHOglIGh+8WNgTDKHVCr+Pg5U96KXciohHPiMp0axcRy9jIL1qIBa9j
62yw7qRfhyGJxQenlwOa1i0/XpIDhuhc8C/2liZr0ROIfeqj3DGaR6D6F5fOySNx
KAU17fSSnEE=
=cgUg
—–END PGP SIGNATURE—–

—
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce

—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256

=====================================================================
Red Hat Security Advisory

Synopsis: Important: qemu-kvm security update
Advisory ID: RHSA-2020:4050-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2020:4050
Issue date: 2020-09-29
CVE Names: CVE-2020-14364
=====================================================================

1. Summary:

An update for qemu-kvm is now available for Red Hat Enterprise Linux 7.3
Advanced Update Support, Red Hat Enterprise Linux 7.3 Telco Extended Update
Support, and Red Hat Enterprise Linux 7.3 Update Services for SAP
Solutions.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Server AUS (v. 7.3) – x86_64
Red Hat Enterprise Linux Server E4S (v. 7.3) – ppc64le, x86_64
Red Hat Enterprise Linux Server TUS (v. 7.3) – x86_64

3. Description:

Security Fix(es):

* QEMU: usb: out-of-bounds r/w access issue while processing usb packets
(CVE-2020-14364)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, shut down all running virtual machines. Once
all virtual machines have shut down, start them again for this update to
take effect.

5. Bugs fixed (https://bugzilla.redhat.com/):

1869201 – CVE-2020-14364 QEMU: usb: out-of-bounds r/w access issue while processing usb packets

6. Package List:

Red Hat Enterprise Linux Server AUS (v. 7.3):

Source:
qemu-kvm-1.5.3-126.el7_3.18.src.rpm

x86_64:
qemu-img-1.5.3-126.el7_3.18.x86_64.rpm
qemu-kvm-1.5.3-126.el7_3.18.x86_64.rpm
qemu-kvm-common-1.5.3-126.el7_3.18.x86_64.rpm
qemu-kvm-debuginfo-1.5.3-126.el7_3.18.x86_64.rpm
qemu-kvm-tools-1.5.3-126.el7_3.18.x86_64.rpm

Red Hat Enterprise Linux Server E4S (v. 7.3):

Source:
qemu-kvm-1.5.3-126.el7_3.18.src.rpm

ppc64le:
qemu-img-1.5.3-126.el7_3.18.ppc64le.rpm
qemu-kvm-debuginfo-1.5.3-126.el7_3.18.ppc64le.rpm

Red Hat Enterprise Linux Server TUS (v. 7.3):

Source:
qemu-kvm-1.5.3-126.el7_3.18.src.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2020-14364
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

iQIVAwUBX3Lz4tzjgjWX9erEAQiB9g/+LKFFACk/H/QjeLlGl7O5PvGVXUOMUIWr
+ygKqPvvrQWebUUnw2lKZlmqotSDoYZGANltEGCpn9/2FZPl+Iiva9ZZCJPY0xit
R1xghoCE/x+iUhK6aGSdcUjom3nRgzlL7lWUckgVJGLB7hvbTkkh38rSctuivnJv
t7ujt5wo7W4DRl5ixX2UFFiFT0FCOmXzFTEWcWg+6f5xkd8dtn/fXjJzS0T42/eG
qhFK8Z74OQK/P+ochQ3wmF8Lqbf8jCVNl+ImIl9Ya0RvisNwH22DyvHiV4T6iY/Q
fjtXql3AuGJ8/xQ8pRdAtbFStWB5NeF7ost6nk/VEulFn58lynr4auxKdcW9xGJZ
hWZZkKeaWpprBr7HOZFNYJ74oDDsQf+l6cnTOxCO/9MXebQUc85g/A9/L1dHtP2h
CioR2NU+rMej2X7uQxDCtEdcm5zHb2rRC/GXGnQOhP4tSfs5OJWth1Clio2sjTLQ
hGGO5LBA5Z5nM+C2fJ6aZIctA8t+vckLp0tAfO/r9HDv3EL3UtLco5qI87K4eEa6
HAr3MwhQe6Sl7sVmSP9j2TCvSpAUe+AskgVxSvZXXjgA8KiThVycEn+8E72iNz6Q
s6SbX/K2FdhTtw4finnZNSYzRjuNWLQQ6LK67HhOGPMi3k9QJMYP3TMYIZ6BbzQv
vZ4QbVk89PM=
=wdu3
—–END PGP SIGNATURE—–

—
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce

—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256

=====================================================================
Red Hat Security Advisory

Synopsis: Important: qemu-kvm security update
Advisory ID: RHSA-2020:4055-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2020:4055
Issue date: 2020-09-29
CVE Names: CVE-2020-14364
=====================================================================

1. Summary:

An update for qemu-kvm is now available for Red Hat Enterprise Linux 6.6
Advanced Update Support.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Server AUS (v. 6.6) – x86_64

3. Description:

Security Fix(es):

* QEMU: usb: out-of-bounds r/w access issue while processing usb packets
(CVE-2020-14364)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, shut down all running virtual machines. Once
all virtual machines have shut down, start them again for this update to
take effect.

5. Bugs fixed (https://bugzilla.redhat.com/):

1869201 – CVE-2020-14364 QEMU: usb: out-of-bounds r/w access issue while processing usb packets

6. Package List:

Red Hat Enterprise Linux Server AUS (v. 6.6):

Source:
qemu-kvm-0.12.1.2-2.448.el6_6.9.src.rpm

x86_64:
qemu-guest-agent-0.12.1.2-2.448.el6_6.9.x86_64.rpm
qemu-img-0.12.1.2-2.448.el6_6.9.x86_64.rpm
qemu-kvm-0.12.1.2-2.448.el6_6.9.x86_64.rpm
qemu-kvm-debuginfo-0.12.1.2-2.448.el6_6.9.x86_64.rpm
qemu-kvm-tools-0.12.1.2-2.448.el6_6.9.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2020-14364
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

iQIVAwUBX3LwHtzjgjWX9erEAQhVOw//V/e+d+KcgfT1OL0YV9WEEF9lPckL1AJZ
pBa46SokohaZykjy4VcIUEwgo1kTZgcbqsndsz4taT5MtknGolssfCyw0gx8a08r
6cwnFV8aKMyVDQx0WJDrgLXz1x36LrhDj+RY//CDKApFd4RYBzS4TMPbmWfYf+hH
m/VZaOm8c8imyWkKIDLXHjVTLNCc6qG0KbyOjbngeGMPgELQ4QQ0wFZVZAz5hRhr
KjW3GYuadPfGBWPamjyUzfNKITZ5QOiRm8vAJivN5KOnJLFWRNjyneht7uSX+PA1
ZFZfjInGsf28dlvQWsUCLcOC3wrjcOYtDDlOn2yO4IOLxiVQi0AbDMnMgNQy+009
cq959yfzHR1VRjJqytTbQDMYS7c/y1jtfu50Qgo6V9YeejREMgiMCRVW2aw+0ihF
nnZToCJRUtRMDSHVIW12V39zpYUqzSmepf+Kh9Wbkl84zmsoXJzUwTyXTdMB+C3I
PUIKZOpdHsGYpnQY4YjgNwuJpi71jxGGubZQzheIK90A/p+OR3ztg7GrBL8PTarV
RWNpBldsS+x7rJ0rNEtsVuvfS+S3dxIGKrUOnOf34Hu12EAjEBGHFPBWKOFP2VcN
XTXVse+OjV8HA26oUQMcpTcFMx8bC4OwaXxaTfbkfIAM7TY+XcP0NrCBbdDYfAJb
Z57ISWcjRlo=
=sHqz
—–END PGP SIGNATURE—–

—
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce

—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256

=====================================================================
Red Hat Security Advisory

Synopsis: Important: qemu-kvm security update
Advisory ID: RHSA-2020:4048-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2020:4048
Issue date: 2020-09-29
CVE Names: CVE-2020-14364
=====================================================================

1. Summary:

An update for qemu-kvm is now available for Red Hat Enterprise Linux 7.2
Advanced Update Support.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Server AUS (v. 7.2) – x86_64
Red Hat Enterprise Linux Server Optional AUS (v. 7.2) – x86_64

3. Description:

Security Fix(es):

* QEMU: usb: out-of-bounds r/w access issue while processing usb packets
(CVE-2020-14364)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, shut down all running virtual machines. Once
all virtual machines have shut down, start them again for this update to
take effect.

5. Bugs fixed (https://bugzilla.redhat.com/):

1869201 – CVE-2020-14364 QEMU: usb: out-of-bounds r/w access issue while processing usb packets

6. Package List:

Red Hat Enterprise Linux Server AUS (v. 7.2):

Source:
qemu-kvm-1.5.3-105.el7_2.20.src.rpm

x86_64:
libcacard-1.5.3-105.el7_2.20.i686.rpm
libcacard-1.5.3-105.el7_2.20.x86_64.rpm
qemu-img-1.5.3-105.el7_2.20.x86_64.rpm
qemu-kvm-1.5.3-105.el7_2.20.x86_64.rpm
qemu-kvm-common-1.5.3-105.el7_2.20.x86_64.rpm
qemu-kvm-debuginfo-1.5.3-105.el7_2.20.i686.rpm
qemu-kvm-debuginfo-1.5.3-105.el7_2.20.x86_64.rpm
qemu-kvm-tools-1.5.3-105.el7_2.20.x86_64.rpm

Red Hat Enterprise Linux Server Optional AUS (v. 7.2):

x86_64:
libcacard-devel-1.5.3-105.el7_2.20.i686.rpm
libcacard-devel-1.5.3-105.el7_2.20.x86_64.rpm
libcacard-tools-1.5.3-105.el7_2.20.x86_64.rpm
qemu-kvm-debuginfo-1.5.3-105.el7_2.20.i686.rpm
qemu-kvm-debuginfo-1.5.3-105.el7_2.20.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2020-14364
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

iQIVAwUBX3LwONzjgjWX9erEAQj5nw//bynalGVu9Q6YyEO1apXvldBrm9WEzHKH
Eecz72gCiPX2M1oFjpJjZgxhLmkSRk86B8SQEYxeAHFwBUgil5sys/EI/nKti91K
sNJm9oxNahN4m3GqRvtA0KbeeNfGnZxW2XYr7QzrgbE+eTP2UXzJyjJ7u2zGVij4
Lt/tpBQ1VUVMONeZhKSTiXGcxd8mquSURjt1a3q4yZRcSheyvO5JFJSlzbcpNKo2
nGc00UDPycnM1+4ptPDc3A5/IyT0Pm6de/rK0dbTitdkS1TT6ff360OmaRqc58j+
ThHdW7cKxkLrmFKkaEDPfO4GMCJ3Ya7B84H280iZbGXuQdXh5rIrBgBxJYkU7qH/
4JYWhdYnYW8Bh7I0awkhhQ2qWtW82B75rCZYQ0K+pVG/5/ULG/i4VtR129AjTN3S
uz4FYYdami0eRYF2NhSe83LuwuOQFosrREKCxfUBAc84zdzi5YrdtVDIbLYAMeEE
puQHLMVmlc/cLrixOkPvl/ibI3t9KogKb+GwC3+R81Hi2zSLRI1UlC2wBEB29Q9/
1LhGddh+YsmpN8/O2fPvlNqlPS7xR4B64ZGdzA3m0FMuvsrOJ40e1QLAmwsuKJHx
PppU4sX0Gum58mQDtqFMw5rgeotHyyiIxqNLDmGqh6xIY6uqvwJeiRxelMF5e3to
zBGEiuqiZPY=
=zRqI
—–END PGP SIGNATURE—–

—
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce

—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256

=====================================================================
Red Hat Security Advisory

Synopsis: Important: qemu-kvm security update
Advisory ID: RHSA-2020:4054-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2020:4054
Issue date: 2020-09-29
CVE Names: CVE-2020-14364
=====================================================================

1. Summary:

An update for qemu-kvm is now available for Red Hat Enterprise Linux 6.5
Advanced Update Support.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Server AUS (v. 6.5) – x86_64

3. Description:

Security Fix(es):

* QEMU: usb: out-of-bounds r/w access issue while processing usb packets
(CVE-2020-14364)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, shut down all running virtual machines. Once
all virtual machines have shut down, start them again for this update to
take effect.

5. Bugs fixed (https://bugzilla.redhat.com/):

1869201 – CVE-2020-14364 QEMU: usb: out-of-bounds r/w access issue while processing usb packets

6. Package List:

Red Hat Enterprise Linux Server AUS (v. 6.5):

Source:
qemu-kvm-0.12.1.2-2.415.el6_5.21.src.rpm

x86_64:
qemu-guest-agent-0.12.1.2-2.415.el6_5.21.x86_64.rpm
qemu-img-0.12.1.2-2.415.el6_5.21.x86_64.rpm
qemu-kvm-0.12.1.2-2.415.el6_5.21.x86_64.rpm
qemu-kvm-debuginfo-0.12.1.2-2.415.el6_5.21.x86_64.rpm
qemu-kvm-tools-0.12.1.2-2.415.el6_5.21.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2020-14364
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

iQIVAwUBX3Lv5tzjgjWX9erEAQiYwhAApngzGEkX6Nc/ULx2fIWNJ7e0RQbEZsop
b3kfQ7owBbSl+QRN/zR4Z/ztBi5UygrauxcHtHEeVVuCZ2ILIVu7TePF3ypvRMKa
Wf/U/cizbUtbsUOybzdJKU+HAYuKTwmQ/4ywP0ER6jLOr0uxTp6tkQtPIW4H46hp
jKfyDtJEI55JAII3g4YUuoanwSNA4L9iwLmZx2jfsJ1FGPmeXDRmkLyGtvndcsyk
iEgvAqQQPe5w88Ptx3pohIi6Df7fWsfIhIP1LQE31dAjNc+mbl0RQ0cFpHlcE/5F
qGcGr2BMBdeHQVNOEG6Img19qckFklym21YHPNp68z2WOkHqV5tfzX/9uGHgIC1D
z86SlPt7PDwJ5cl6vQ2i4cI8wk3ojpkt/sAkTltGymSMtNC+3q/3J0Jwj6yqoBXT
g++SXnO3AeAZQlr2XxRfkvsGu066g2XnWV7lXWnZM3/KdfOZzt34bd1OOxMTtpqo
91QpqW2QOwJBwkreCyqZ/SnvcESCknhBoctFQzI367tx+/nm2LjRArn0xFZsFP1+
P7zM5yzGMHcMwYq0OT4tGBKsqecLCZnxGUnouPDz4sEFUSQPGYrag/Y5vKJx3Xcg
b4jJXtZ/Yebl+PBCqheK2fm6hW4FxcPeqEOsJcJyhxWHuQN2BVjzlQY0MjSilD54
nAFaGLRrvQM=
=S1gF
—–END PGP SIGNATURE—–

—
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce

—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256

=====================================================================
Red Hat Security Advisory

Synopsis: Important: qemu-kvm security update
Advisory ID: RHSA-2020:4079-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2020:4079
Issue date: 2020-09-29
CVE Names: CVE-2020-1983 CVE-2020-14364
=====================================================================

1. Summary:

An update for qemu-kvm is now available for Red Hat Enterprise Linux 7.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Client (v. 7) – x86_64
Red Hat Enterprise Linux ComputeNode Optional (v. 7) – x86_64
Red Hat Enterprise Linux Server (v. 7) – x86_64
Red Hat Enterprise Linux Workstation (v. 7) – x86_64

3. Description:

Security Fix(es):

* QEMU: usb: out-of-bounds r/w access issue while processing usb packets
(CVE-2020-14364)

* QEMU: slirp: use-after-free in ip_reass() function in ip_input.c
(CVE-2020-1983)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, shut down all running virtual machines. Once
all virtual machines have shut down, start them again for this update to
take effect.

5. Bugs fixed (https://bugzilla.redhat.com/):

1829825 – CVE-2020-1983 QEMU: slirp: use-after-free in ip_reass() function in ip_input.c
1869201 – CVE-2020-14364 QEMU: usb: out-of-bounds r/w access issue while processing usb packets

6. Package List:

Red Hat Enterprise Linux Client (v. 7):

Source:
qemu-kvm-1.5.3-175.el7_9.1.src.rpm

x86_64:
qemu-img-1.5.3-175.el7_9.1.x86_64.rpm
qemu-kvm-1.5.3-175.el7_9.1.x86_64.rpm
qemu-kvm-common-1.5.3-175.el7_9.1.x86_64.rpm
qemu-kvm-debuginfo-1.5.3-175.el7_9.1.x86_64.rpm
qemu-kvm-tools-1.5.3-175.el7_9.1.x86_64.rpm

Red Hat Enterprise Linux ComputeNode Optional (v. 7):

Source:
qemu-kvm-1.5.3-175.el7_9.1.src.rpm

Red Hat Enterprise Linux Server (v. 7):

Source:
qemu-kvm-1.5.3-175.el7_9.1.src.rpm

Red Hat Enterprise Linux Workstation (v. 7):

Source:
qemu-kvm-1.5.3-175.el7_9.1.src.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2020-1983
https://access.redhat.com/security/cve/CVE-2020-14364
https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=1869693
https://bugzilla.redhat.com/show_bug.cgi?id=1837565

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

iQIVAwUBX3QdodzjgjWX9erEAQjLIQ//TesMNk471ZMIWu8ozZsMuKfwiGxsPtXk
MDTSiIAxddiURMrDpOVrBK1iFUKGEhncmRgl5Z74exWPwyEvt3vaDFHABg/kwx9s
4sRkGV4bLcxKMPylzkY1ujCAhDwRtT+i6OVqaDXrudAtM+2tYrdTepOQ9OUeX5Zq
oMaYD71cPFnifZnXo/bh7pNZGIvL2w4r8YCXv6km+gVin++ggaz8/ZxdAeVVAFdP
xUXLtdNp+sjlChvOQCTA0vbQk+r/aA7gwqshwUjPvb8j3KCmfnke4zxOz7hZxN7G
TD6dOpdRSiZye/eXDQsXLIa2bpO1/SsUCBveKUsC/hEjNzNhJD5A+T6T/gMXaemR
H2jJqsfVXxmJGsQMq/RGSJv3QYeWuOPeyPv40kXMA6kM+qE4ZxzGyMRKkJz7N6c+
CHLcok+DGfvzBMEf0dHEWFL0hdL6zKHpnCRg9mflHR5wcGEINq9pkY+f+dNcF2Ze
GYKvim4sXPVEO4v6lLTq0Wp6RaWCzWfY/HxVZEgTnzlZecZ6a1EhUePJbcZUEBS7
JswVGMOudquAOvwnMCe668/EaYZtYeKViMj84BLQsUD43Q5H91Q4XpbQ8EdjP0M3
Ksu/2FaQU7os67/OArDhSLYWfRTgSr7BDcRNQmgQObSl6gbh3DQ4HXt80j8cVi03
N5Q/ROPxkM0=
=uzk5
—–END PGP SIGNATURE—–

—
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce

—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256

=====================================================================
Red Hat Security Advisory

Synopsis: Low: qemu-kvm security, bug fix, and enhancement update
Advisory ID: RHSA-2020:3906-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2020:3906
Issue date: 2020-09-29
CVE Names: CVE-2018-15746 CVE-2019-20382
=====================================================================

1. Summary:

An update for qemu-kvm is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact
of Low. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Relevant releases/architectures:

3. Description:

Security Fix(es):

* QEMU: seccomp: blacklist is not applied to all threads (CVE-2018-15746)

* QEMU: vnc: memory leakage upon disconnect (CVE-2019-20382)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat
Enterprise Linux 7.9 Release Notes linked from the References section.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, shut down all running virtual machines. Once
all virtual machines have shut down, start them again for this update to
take effect.

5. Bugs fixed (https://bugzilla.redhat.com/):

1615637 – CVE-2018-15746 QEMU: seccomp: blacklist is not applied to all threads
1791679 – QEMU: Slirp: disable emulation of tcp programs like ftp IRC etc. [rhel-7]
1802215 – Add support for newer glusterfs
1810390 – CVE-2019-20382 QEMU: vnc: memory leakage upon disconnect

6. Package List:

Red Hat Enterprise Linux Client (v. 7):

Source:
qemu-kvm-1.5.3-175.el7.src.rpm

x86_64:
qemu-img-1.5.3-175.el7.x86_64.rpm
qemu-kvm-1.5.3-175.el7.x86_64.rpm
qemu-kvm-common-1.5.3-175.el7.x86_64.rpm
qemu-kvm-debuginfo-1.5.3-175.el7.x86_64.rpm
qemu-kvm-tools-1.5.3-175.el7.x86_64.rpm

Red Hat Enterprise Linux ComputeNode Optional (v. 7):

Source:
qemu-kvm-1.5.3-175.el7.src.rpm

Red Hat Enterprise Linux Server (v. 7):

Source:
qemu-kvm-1.5.3-175.el7.src.rpm

Red Hat Enterprise Linux Workstation (v. 7):

Source:
qemu-kvm-1.5.3-175.el7.src.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2018-15746
https://access.redhat.com/security/cve/CVE-2019-20382
https://access.redhat.com/security/updates/classification/#low
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.9_release_notes/index

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

iQIVAwUBX3OkNNzjgjWX9erEAQjoCA/+PxA00M4tO/CUyHmhT7Hpe/2YOQU8sI5c
22vBkMEc5B+VONuohoKzRZG4Pxdhlhz7mJuVrw38R9t4RP/c0H+EP5XO01/Cicp9
9H0d6kfgZ8bHXbfGJNPDNWmQd2D9B6QYnJwEDv+S+gwNsH2qxc4SXsBeHN3YvB6l
eFS016tlpYThzqEc9fgHHHRf63pYrIZTVOJ0AJwxU58CXfnk2SgrKrDkuZVArkt3
FCJdPoG71k4AL3xqhpc4pLtYo+Ex9Snmh4M7Dqt8HDK8gAoWokrEhf6TPZWRILQS
etPAXuNamheugn2LYGZdaxWFyeT5pPl/soXtkR5QxrlbG/DTaDzRAJmmu6J8GyDk
xRiJqdIg75lVAOJB0/F3ANTcaIQgCnMCdQrkjzs00qwWc3snaSQ94YYBrd27LH9s
9rj3ooAjDiDZ5X9JwNy5sQd61hvW9O7DyKjsEmXbVbM9M1fTUgk1+LccC8x4wsuF
DLRRx+rLDC3XJo2+kcY4GHyF8KA7V5acIfbTN3hVcvGnM879xXW4QJomRaD5kLZB
IoURwN/LwPl4mHl1BqrxYaFidcXa/TC4w9hGd5841ne5SP5UX/M8di7hxwuF2jBY
1HNHUN00d1XTkZAWgUVKfKPmE104xnY+GwJ6Jsgl83LLCsI0+nvnsEXTF8Lr31tA
VR3SbYaUoig=
=+94/
—–END PGP SIGNATURE—–

—
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce

Sigurnosni nedostaci programskog paketa qemu-kvm

Archives

More in Preporuke

Sigurnosni nedostatak programskih paketa conmon, fuse-overlayfs, podman i programske biblioteke libcontainers-common