Moritz Muehlenhoff pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
aafbfc95 by Moritz Muehlenhoff at 2022-04-21T17:11:40+02:00
various qemu issues fixed in sid
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -8693,19 +8693,20 @@ CVE-2022-26355 (Citrix Federated Authentication Service
(FAS) 7.17 - 10.6 causes
NOT-FOR-US: Citrix
CVE-2022-26354 (A flaw was found in the vhost-vsock device of QEMU. In case of
error, ...)
{DLA-2970-1}
- - qemu <unfixed>
+ - qemu 1:7.0+dfsg-1
[bullseye] - qemu <no-dsa> (Minor issue)
[buster] - qemu <no-dsa> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2063257
NOTE:
https://gitlab.com/qemu-project/qemu/-/commit/8d1b247f3748ac4078524130c6d7ae42b6140aaf
NOTE: vulnerable code in buster in vhost_vsock_send_transport_reset
CVE-2022-26353 (A flaw was found in the virtio-net device of QEMU. This flaw
was inadv ...)
- - qemu <unfixed>
+ - qemu 1:7.0+dfsg-1
[bullseye] - qemu <no-dsa> (Minor issue)
[buster] - qemu <not-affected> (Original upstream fix for CVE-2021-3748
not applied)
[stretch] - qemu <not-affected> (Original upstream fix for
CVE-2021-3748 not applied)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2063197
NOTE:
https://lists.nongnu.org/archive/html/qemu-devel/2022-03/msg02438.html
+ NOTE:
https://gitlab.com/qemu-project/qemu/-/commit/abe300d9d894f7138e1af7c8e9c88c04bfe98b37
NOTE: Introduced by:
https://gitlab.com/qemu-project/qemu/-/commit/bedd7e93d01961fcb16a97ae45d93acf357e11f6
(v6.2.0-rc0)
NOTE: Introduced by the original fix for CVE-2021-3748.
CVE-2022-0835 (AVEVA System Platform 2020 stores sensitive information in
cleartext, ...)
@@ -16010,7 +16011,7 @@ CVE-2022-0359 (Heap-based Buffer Overflow in GitHub
repository vim/vim prior to
NOTE:
https://github.com/vim/vim/commit/85b6747abc15a7a81086db31289cf1b8b17e6cb1
(v8.2.4214)
CVE-2022-0358
RESERVED
- - qemu <unfixed>
+ - qemu 1:7.0+dfsg-1
[buster] - qemu <not-affected> (Vulnerable code not present)
[stretch] - qemu <not-affected> (virtiofsd added in 5.0)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2044863
@@ -18768,6 +18769,7 @@ CVE-2022-0216
- qemu <unfixed>
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2036953
NOTE: https://starlabs.sg/advisories/22-0216
+ NOTE: https://gitlab.com/qemu-project/qemu/-/issues/972
CVE-2022-0215 (The Login/Signup Popup, Waitlist Woocommerce ( Back in stock
notifier ...)
NOT-FOR-US: WordPress plugin
CVE-2022-0214 (The Popup | Custom Popup Builder WordPress plugin before 1.3.1
autoloa ...)
@@ -18793,14 +18795,16 @@ CVE-2021-44760 (Authenticated Reflected Cross-Site
Scripting (XSS) vulnerability
NOT-FOR-US: WordPress plugin
CVE-2021-4207
RESERVED
- - qemu <unfixed>
+ - qemu 1:7.0+dfsg-1
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2036966
NOTE: https://starlabs.sg/advisories/22-4207/
+ NOTE: https://gitlab.com/qemu-project/qemu/-/commit/9569f5cb
CVE-2021-4206
RESERVED
- - qemu <unfixed>
+ - qemu 1:7.0+dfsg-1
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2036998
NOTE: https://starlabs.sg/advisories/22-4206/
+ NOTE: https://gitlab.com/qemu-project/qemu/-/commit/fa892e9a
CVE-2021-4205
RESERVED
CVE-2021-31567 (Authenticated (admin+) Arbitrary File Download vulnerability
discovere ...)
@@ -32045,12 +32049,12 @@ CVE-2021-3930 (An off-by-one error was found in the
SCSI device emulation in QEM
NOTE: Fixed by:
https://gitlab.com/qemu-project/qemu/-/commit/b3af7fdf9cc537f8f0dd3e2423d83f5c99a457e8
(v6.2.0-rc0)
CVE-2021-3929 [nvme: DMA reentrancy issue leads to use-after-free]
RESERVED
- - qemu <unfixed>
+ - qemu 1:7.0+dfsg-1
[stretch] - qemu <not-affected> (Vulnerable code introduced later)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2020298
NOTE: https://gitlab.com/qemu-project/qemu/-/issues/556
NOTE: Proposed patchset:
https://lists.nongnu.org/archive/html/qemu-devel/2021-08/msg03692.html
- NOTE: No upstream patch as of 2022-01-28
+ NOTE: https://gitlab.com/qemu-project/qemu/-/commit/736b01642d85be832385
CVE-2021-43400 (An issue was discovered in gatt-database.c in BlueZ 5.61. A
use-after- ...)
- bluez 5.62-1 (bug #998626)
[bullseye] - bluez <no-dsa> (Minor issue; can be fixed in point release)
@@ -63920,7 +63924,7 @@ CVE-2021-3507 (A heap buffer overflow was found in the
floppy disk emulator of Q
[buster] - qemu <no-dsa> (Minor issue)
[stretch] - qemu <no-dsa> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1951118
- NOTE: No upstream patch as of 2022-01-28
+ NOTE: No upstream patch as of 2022-04-21
CVE-2021-3506 (An out-of-bounds (OOB) memory access flaw was found in
fs/f2fs/node.c ...)
{DLA-2690-1}
- linux 5.10.38-1
@@ -93470,7 +93474,7 @@ CVE-2021-20255 (A stack overflow via an infinite
recursion vulnerability was fou
[buster] - qemu <postponed> (Minor issue)
NOTE:
https://lists.gnu.org/archive/html/qemu-devel/2021-02/msg06098.html
NOTE:
https://ruhr-uni-bochum.sciebo.de/s/NNWP2GfwzYKeKwE?path=%2Feepro100_stackoverflow1
- NOTE: No upstream patch as of 2022-01-28
+ NOTE: No upstream patch as of 2022-04-21
CVE-2021-20254 (A flaw was found in samba. The Samba smbd file server must map
Windows ...)
{DLA-2668-1}
- samba 2:4.13.5+dfsg-2 (bug #987811)
@@ -94274,7 +94278,7 @@ CVE-2020-35503 (A NULL pointer dereference flaw was
found in the megasas-gen2 SC
[buster] - qemu <postponed> (Fix along in future DSA)
[stretch] - qemu <postponed> (Fix along in future DLA)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1910346
- NOTE: No upstream patch as of 2022-01-28
+ NOTE: No upstream patch as of 2022-04-21
CVE-2020-35502 (A flaw was found in Privoxy in versions before 3.0.29. Memory
leaks wh ...)
{DLA-2548-1}
- privoxy 3.0.29-1
@@ -110274,7 +110278,7 @@ CVE-2020-25743 (hw/ide/pci.c in QEMU before 5.1.1 can
trigger a NULL pointer der
[stretch] - qemu <postponed> (Fix along in future DLA)
NOTE:
https://lists.nongnu.org/archive/html/qemu-devel/2020-09/msg01568.html
NOTE:
https://ruhr-uni-bochum.sciebo.de/s/NNWP2GfwzYKeKwE?path=%2Fide_nullptr1
- NOTE: No upstream patch as of 2022-01-28
+ NOTE: No upstream patch as of 2022-04-21
CVE-2020-25742 (pci_change_irq_level in hw/pci/pci.c in QEMU before 5.1.1 has
a NULL p ...)
- qemu <unfixed> (bug #971390)
[bullseye] - qemu <postponed> (Minor issue, revisit when fixed upstream)
@@ -110282,7 +110286,7 @@ CVE-2020-25742 (pci_change_irq_level in hw/pci/pci.c
in QEMU before 5.1.1 has a
[stretch] - qemu <postponed> (Fix along in future DLA)
NOTE:
https://lists.nongnu.org/archive/html/qemu-devel/2020-09/msg05294.html
NOTE:
https://ruhr-uni-bochum.sciebo.de/s/NNWP2GfwzYKeKwE?path=%2Flsi_nullptr1
- NOTE: No upstream patch as of 2022-01-28
+ NOTE: No upstream patch as of 2022-04-21
CVE-2020-25741 (fdctrl_write_data in hw/block/fdc.c in QEMU 5.0.0 has a NULL
pointer d ...)
- qemu <unfixed> (bug #970939)
[bullseye] - qemu <postponed> (Minor issue, revisit when fixed upstream)
@@ -110290,7 +110294,7 @@ CVE-2020-25741 (fdctrl_write_data in hw/block/fdc.c
in QEMU 5.0.0 has a NULL poi
[stretch] - qemu <postponed> (Fix along in future DLA)
NOTE:
https://lists.nongnu.org/archive/html/qemu-devel/2020-09/msg07779.html
NOTE:
https://ruhr-uni-bochum.sciebo.de/s/NNWP2GfwzYKeKwE?path=%2Ffdc_nullptr1
- NOTE: No upstream patch as of 2022-01-28
+ NOTE: No upstream patch as of 2022-04-21
CVE-2020-25740
RESERVED
CVE-2020-25739 (An issue was discovered in the gon gem before gon-6.4.0 for
Ruby. Mult ...)
@@ -136178,7 +136182,7 @@ CVE-2020-14394 [infinite loop in
xhci_ring_chain_length() in hw/usb/hcd-xhci.c]
[stretch] - qemu <postponed> (Minor issue, privileged local DoS, low
CVSS, no patch)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1908004
NOTE: https://gitlab.com/qemu-project/qemu/-/issues/646
- NOTE: No upstream patch as of 2022-01-28
+ NOTE: No upstream patch as of 2022-04-21
CVE-2020-14393 (A buffer overflow was found in perl-DBI < 1.643 in DBI.xs.
A local ...)
{DLA-2386-1}
- libdbi-perl 1.643-1
@@ -197887,7 +197891,7 @@ CVE-2019-12067 (The ahci_commit_buf function in
ide/ahci.c in QEMU allows attack
NOTE: patch not sanctioned as of 20210202
NOTE: patched function introduced in 2014/2.1.50 but affected code
pre-existed
NOTE:
https://github.com/qemu/qemu/commit/659142ecf71a0da240ab0ff7cf929ee25c32b9bc
- NOTE: No upstream patch as of 2022-01-28
+ NOTE: No upstream patch as of 2022-04-21
CVE-2019-12066
RESERVED
CVE-2019-12065
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/aafbfc95a1aabc34dd3dd2b0cbaf3440d89cf8be
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/aafbfc95a1aabc34dd3dd2b0cbaf3440d89cf8be
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
