Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2017.2486
qemu security update
4 October 2017
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: qemu
Publisher: Debian
Operating System: Debian GNU/Linux
Impact/Access: Execute Arbitrary Code/Commands -- Existing Account
Denial of Service -- Existing Account
Resolution: Patch/Upgrade
CVE Names: CVE-2017-14167 CVE-2017-13711 CVE-2017-13672
CVE-2017-12809 CVE-2017-9375
Reference: ESB-2017.2322
ESB-2017.2322
ESB-2017.1882
ESB-2017.1827
ESB-2017.1677
Original Bulletin:
http://www.debian.org/security/2017/dsa-3991
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- - -------------------------------------------------------------------------
Debian Security Advisory DSA-3991-1 security@debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
October 03, 2017 https://www.debian.org/security/faq
- - -------------------------------------------------------------------------
Package : qemu
CVE ID : CVE-2017-9375 CVE-2017-12809 CVE-2017-13672 CVE-2017-13711
CVE-2017-14167
Multiple vulnerabilities were found in in qemu, a fast processor emulator:
CVE-2017-9375
Denial of service via memory leak in USB XHCI emulation.
CVE-2017-12809
Denial of service in the CDROM device drive emulation.
CVE-2017-13672
Denial of service in VGA display emulation.
CVE-2017-13711
Denial of service in SLIRP networking support.
CVE-2017-14167
Incorrect validation of multiboot headers could result in the
execution of arbitrary code.
For the stable distribution (stretch), these problems have been fixed in
version 1:2.8+dfsg-6+deb9u3.
We recommend that you upgrade your qemu packages.
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org
- -----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAlnUAVYACgkQEMKTtsN8
TjblkA//R5Mh6Np1NdJzBEO8zPhtvvq01k1h3oooHBF89OCyYjYh27W/NnM4IHOm
CkxJzwm/Mlg+5x4nUadvfwKfhMDpuMt81pVsxzP+XGNsNQfgq5kLJqs4585EFa7C
KibNbAQ2ktkr0eHxeWt6FIWUoFYz41tZEZwiwpdsixvTTbvHCmAqR+jP4lcARqfk
5CMTQCopelswnZFPMF/JTYZ88gAunQuwCVm1jBSBib4Nqep2F4RhYYQubgt1Q2S9
QWhS0ttermVx/r1B2rjQB8iE7V03NVU5NcYvDsbWITxRNZat+5wp7R/zSlP8U+mP
+00UvEk9BfS+QmYYGQVqLAB+apG7iPXfwnnKKf2ZrCRcWOP+Yyo4UDnjtG0iVmvS
m+TWnF2S+dc7TNBP4egUTkDCEyQgXUjIJsa7MP0WvUApz79Nh/xh49N/AaGf+oJc
8ksc1vhjzlWfD5ghTXVpOsW52O6NkiNArbKh3cMuckSFsMksoF6WIAUpdCNrU3gt
3rnapdRZJkxkx6yOr3a5waoYOnT+zpWCEcZNjTu/94SaGxg76KRFWt2ocKGARM6Y
7kk6M0EwBWbBb7bX1H6L8LEpKn37P2+dpL52CvyID6vSBJ8CWS14S1R5YcjVelAu
qfPov5a7diJn3lWWpwUoVgh+g8oZqgv2Q2pLhDgTD13uu9zMO9A=
=pBqx
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBWdQiVox+lLeg9Ub1AQjFJw//XJtT4iBJH9tS1ANs8We7y3szvt5zIc26
PdKHUAmV6/9maP1md1IKnHq3Pp/g+nHjLFclGwQwMI7tIklh09dLzhd9eJnIEQmz
z1E4UKL4FiU35Y9TkUAQzire4OJdeAqkzVxHVIAnCjWrf0D4S5zgYZJEB4aYZ9Vg
rc/yOn+Alflxd7CZ4ULqEYjz1A5vFCGDGchCvLC0WoqF8LX1hb6RjMutqKpt0UGG
ZiYHxYa6y2E4kE26Pn49BPlEjWyBIclTsrnzGSLFyOltmIx4bnav3f7y3XOzOMaE
8FKAE6fIZrO0Gh0GgfnpkUtu4clpbU8X7/38BXYOIKsLqOSLncQKEGknlRfr2bfN
87PCBcw8LJnzuSJ5vC5r6apoJ5CGiWCy7/gG/gyBRFzUC+gwhw7RZbjfxiHfBu8r
Ik7Svz3BsLylJdydlVR/lKFcjxOC1gNYgjkw4n2mEv/2CUGJAk+ZYY9FQieeVH1E
TNrAMklw1KgU5xFJ9Yi8GbNz2qZkN7mFxE/clBKAKvkuRe0lSA4XkYcmEok7vmCl
3O2z9ZxvozflDL4SzznxYnJtialiHxminuq5AfS5cTwIVCU9qDm3VGqfvzxi0JXH
jp5qr62A69v3gL702L7prIdJQjzP1oYY1spEtA6QIcLuXdVnYXppmtx0SlG+8ART
kKkyEASfyrU=
=oe+h
-----END PGP SIGNATURE-----