Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2020.0371
qemu security update
31 January 2020
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: qemu
Publisher: Debian
Operating System: Debian GNU/Linux 8
Impact/Access: Execute Arbitrary Code/Commands -- Existing Account
Denial of Service -- Existing Account
Resolution: Patch/Upgrade
CVE Names: CVE-2020-7039
Reference: ESB-2020.0281
Original Bulletin:
https://lists.debian.org/debian-lts-announce/2020/01/msg00036.html
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Package : qemu
Version : 1:2.1+dfsg-12+deb8u13
CVE ID : CVE-2020-7039
Debian Bug : 949085
tcp_emu in tcp_subr.c in libslirp 4.1.0, as used in QEMU 4.2.0, mismanages
memory, as demonstrated by IRC DCC commands in EMU_IRC.
This can cause a heap-based buffer overflow or other out-of-bounds access
which can lead to a DoS or potential execute arbitrary code.
For Debian 8 "Jessie", this problem has been fixed in version
1:2.1+dfsg-12+deb8u13.
We recommend that you upgrade your qemu packages.
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
Best,
Utkarsh
- -----BEGIN PGP SIGNATURE-----
iQIzBAEBCAAdFiEEbJ0QSEqa5Mw4X3xxgj6WdgbDS5YFAl4zf3oACgkQgj6WdgbD
S5a+lA//dP1jvG/zMvusgDGZ7kQpFMz8ZOqMRrVso8NfpfgvL2x3YFO3F3i5SrgT
bepEOSQX/v0A/VnbN06M0vmLxTxIyVnuZ+einGSxhdikc6o6KC3pNHTMi6h2GmIu
AXgqFGaOZSLu5mQ6MUzItbQIC8MGXY5WxgSaBbEECe3uX3tu4Wn+PhbDCnmPwj6n
fKFkL6B7JHhQvLHk6PiDzDu6yzYMpOuW+kf4EcwS8KqsgxrMIWTDCvNS+wTEaX88
AuWn/qLl3QhHRdAd5IBoooIVc4aJz2ExE4/8ILtPIDqV1c17b4pTSANu0G5PxirQ
Pt6gLP/c21fYlkVzZ0MNM15GptfCpPStKFlWOudMkgH5hDj6Y6q1wTQTRSgTS7Jk
4uYeCWU5DP9EJnHSzJBYpvBwpo6pLw3w9qIdXD9nuKbIF/JF02iO3Z3mfJ4UV8JQ
nXX1HqWr1vbsvw9oiyMksPLWU9NLe3L2mcE3TqzEm7Qq/c4FY07tJ5DVgwlRRDXb
vyFS0k1BR3liA1/yslUoLaeOy5DMLYUwDsgnjV1rZsw0KuXYNr6y9pMkUv2Vrh9/
BozSbEsZ+hEmx44AYXY+EZdxiLEqlAUv6p8S0Ouz2Edb738D67gPKMnsSVaoO/Ui
0ed98xOlqTem2WAkJ9ONIL61zAsE5fCyE6p1FKwGbu/LEGVfwTk=
=uhdP
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBXjOm3GaOgq3Tt24GAQhkMxAApcQQfYlKYZa/IBnI1WWBmxGj+oiuYWGZ
flA2C1yD9GqazbRx/elnJoTTC1NN2HzpzQ6OzycJ7cDrIjO1C3XqCP26UaDhri7m
sdubzs3TEo+Xb3uwPPHei9L/+hEAhnjZ8ut2rdlm9Uc9xOUk9by/epyFGI1Ztw5T
3oghmX4QsVkgnyErXQHIzvAs6dABDFgPF2FZQtG9KNT7hwEg9olb3Cq6Lz/1K7ke
ptXk90gTGdlaQJTTRsaLKpwf532ZCi7VeyjB8mI4/1dk+RL5z9nDkS0JDObgV+Ak
lxVVr4+GblVhBU1eduJNAYXstqmtVW+hxaOJVD/gQKq9HZ+gpV6MA1MThCDE0+1B
K76Y7IDfH1NY1A2xdJwBs/ppY+XolH6lTtXxdUZwP5quA68xLu7icOX5cKo2Q83x
KF4hGpeyVE+0YMpFgeDKt4Majx5LElcljA33R/VKExgUuLOJ9/u7BzJXA553mS+4
xFccIBMm1D1E2GPYevkEJ30/GpVc2dNEVsEtcABzVF9gxsyCGXMjRaHvphOfGfWx
xKKgS3dLNKBZybPU74S9ccVv7Vkz84oulnPHype8ej4MjHVsYoIqObmI8/paUhdT
GUm3HED2PD7gdymFoc5bTOyyKNmfZp205cFajHSpSqmJbWKhLRcRacndL9d4Ja6l
lM4NSVO9ofg=
=7EEF
-----END PGP SIGNATURE-----