Re: Request for testing: qemu
On 25/04/2019 03:54, Emilio Pozuelo Monfort wrote: > Hi, > > I prepared an update for qemu, with the following fixes: > > * CVE-2018-20815: information disclosure in tcp_emu(). > * CVE-2019-9824: heap buffer overflow in load_device_tree(). > * CVE-2018-11806: heap-based buffer overflow via incoming fragmented > datagrams (Closes: #901017). > * CVE-2018-18849: out-of-bounds access by triggering an invalid msg_len > value in the lsi53c895a host bus adapter (Closes: #912535). > > I have updated source plus amd64 binaries to: > > https://people.debian.org/~pochu/lts/qemu/ > > I would appreciate some extra testing. I plan to upload it on Monday as the > latest, depending on the received feedback. This took longer than I expected due to some travelling, but is now done. Cheers, Emilio
[SECURITY] [DLA 1781-1] qemu security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Package: qemu Version: 1:2.1+dfsg-12+deb8u11 CVE ID : CVE-2018-11806 CVE-2018-18849 CVE-2018-20815 CVE-2019-9824 Debian Bug : 901017 912535 Several vulnerabilities were found in QEMU, a fast processor emulator: CVE-2018-11806 It was found that the SLiRP networking implementation could use a wrong size when reallocating its buffers, which can be exploited by a priviledged user on a guest to cause denial of service or possibly arbitrary code execution on the host system. CVE-2018-18849 It was found that the LSI53C895A SCSI Host Bus Adapter emulation was susceptible to an out of bounds memory access, which could be leveraged by a malicious guest user to crash the QEMU process. CVE-2018-20815 A heap buffer overflow was found in the load_device_tree function, which could be used by a malicious user to potentially execute arbitrary code with the priviledges of the QEMU process. CVE-2019-9824 William Bowling discovered that the SLiRP networking implementation did not handle some messages properly, which could be triggered to leak memory via crafted messages. For Debian 8 "Jessie", these problems have been fixed in version 1:2.1+dfsg-12+deb8u11. We recommend that you upgrade your qemu packages. Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS -BEGIN PGP SIGNATURE- iQIzBAEBCAAdFiEEcJymx+vmJZxd92Q+nUbEiOQ2gwIFAlzUdIUACgkQnUbEiOQ2 gwKh6A/8CR5876MFmMly2kfPEep9f7arCi5Yr5rGn9c/8+qjjMQRNmrdCea78Gk+ dkGfNQEs//fAyRsYm0+2VwUszvEd0FJvi4pdqCKEQaHFT/6AP+hyZiL9VlhZ3gf6 RHVBAnFSRbaQhH2Us8kmFvSkLp9az6G8scHgaGxe62HZk4rxqiMVn3GxO2OygMqP Scl4V0XEuWHUzpLepYRpatb2peMmwoLg/URvcN3vhZaoyVtbrWuAVTBfUMxhXfVe Gw0wRdzb3ziKqQN3aw3Ao/f+ErOS8SGTyo7ns1wM4F0eIvLnd1McFaZ5Tfs269fb 68wfcMqqz3PZ6bQFXK273jes8krUn8dviHWAmtqf3cSK7iSCrsr/iOqYRtbUX5Bn XpNTfPns3oDiUrp3HMUqRkZCjxdhSCbFwerJYezX90wXZZxMd1R7zqVd3hu/u0Pj uragBJTcQpvFzpOcrI6j8CWc5tj2FFHeSGZqKdypdhPutEYL2VDEkKTQSaePzWzE rFTCbQ7Ymk4Cisi/bsaGpjCKOn8xi8ulXef8a9WR74On9gntYysG/411QUyOeeSe E+YP3eCSS6FMB343i/8avr2+77XB8d/zA2VbCT7+rnStEeXXXB9fL+xNjSzR4yNY FnfkbsMAJKeblf/2fIMVdbI76NGRvgAj6z4ojBS2nXu4MrxDhcE= =NNRo -END PGP SIGNATURE-
Accepted qemu 1:2.1+dfsg-12+deb8u11 (source amd64) into oldstable
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Format: 1.8 Date: Tue, 02 Apr 2019 11:03:28 +0200 Source: qemu Binary: qemu qemu-system qemu-system-common qemu-system-misc qemu-system-arm qemu-system-mips qemu-system-ppc qemu-system-sparc qemu-system-x86 qemu-user qemu-user-static qemu-user-binfmt qemu-utils qemu-guest-agent qemu-kvm Architecture: source amd64 Version: 1:2.1+dfsg-12+deb8u11 Distribution: jessie-security Urgency: medium Maintainer: Debian QEMU Team Changed-By: Emilio Pozuelo Monfort Description: qemu - fast processor emulator qemu-guest-agent - Guest-side qemu-system agent qemu-kvm - QEMU Full virtualization on x86 hardware qemu-system - QEMU full system emulation binaries qemu-system-arm - QEMU full system emulation binaries (arm) qemu-system-common - QEMU full system emulation binaries (common files) qemu-system-mips - QEMU full system emulation binaries (mips) qemu-system-misc - QEMU full system emulation binaries (miscelaneous) qemu-system-ppc - QEMU full system emulation binaries (ppc) qemu-system-sparc - QEMU full system emulation binaries (sparc) qemu-system-x86 - QEMU full system emulation binaries (x86) qemu-user - QEMU user mode emulation binaries qemu-user-binfmt - QEMU user mode binfmt registration for qemu-user qemu-user-static - QEMU user mode emulation binaries (static version) qemu-utils - QEMU utilities Closes: 901017 912535 Changes: qemu (1:2.1+dfsg-12+deb8u11) jessie-security; urgency=medium . * Non-maintainer upload by the LTS Team. * CVE-2018-20815: information disclosure in tcp_emu(). * CVE-2019-9824: heap buffer overflow in load_device_tree(). * CVE-2018-11806: heap-based buffer overflow via incoming fragmented datagrams (Closes: #901017). * CVE-2018-18849: out-of-bounds access by triggering an invalid msg_len value in the lsi53c895a host bus adapter (Closes: #912535). Checksums-Sha1: d1a385e133cdb3757f106b183ddf8df95260d784 5538 qemu_2.1+dfsg-12+deb8u11.dsc d0c0314af2b710cf3dbd91522963cc0eefa51390 5163316 qemu_2.1+dfsg.orig.tar.xz 70dbcf0bd005ccc1c4da6ab2428d684e31ea5b42 217144 qemu_2.1+dfsg-12+deb8u11.debian.tar.xz 0523fdd364bfa1c29698c9bbe8cd8453b49a8d26 126534 qemu_2.1+dfsg-12+deb8u11_amd64.deb c4650a629a6e86029001522e375f51f57c8938dd 55634 qemu-system_2.1+dfsg-12+deb8u11_amd64.deb f6bdd98c1b24c6430c218eaa6ee8ed9ce908b2e6 285970 qemu-system-common_2.1+dfsg-12+deb8u11_amd64.deb e1cce1fda80533c240ea690d9f86e3b998febbde 5130864 qemu-system-misc_2.1+dfsg-12+deb8u11_amd64.deb 6019e5b108177086c375196fc9b7f73873104a45 2238628 qemu-system-arm_2.1+dfsg-12+deb8u11_amd64.deb b1ca4e2727afeb584274aba8aaa8eaa866ed4252 2728106 qemu-system-mips_2.1+dfsg-12+deb8u11_amd64.deb 0bf0a8886ff7969bf46034004c208b3f8d83cba2 2833480 qemu-system-ppc_2.1+dfsg-12+deb8u11_amd64.deb a1211ad1474905d22974fb6eab2cea1ef2ecaf0e 1670612 qemu-system-sparc_2.1+dfsg-12+deb8u11_amd64.deb 8d8ca73a45bfb5c3a44289e11c833b117f8b3cbb 2049468 qemu-system-x86_2.1+dfsg-12+deb8u11_amd64.deb 9cfef2d952cab4a137260551dc456160e6cb9b00 5615622 qemu-user_2.1+dfsg-12+deb8u11_amd64.deb 12111eeac37913e8c522a790cfb8104c748ae353 8231784 qemu-user-static_2.1+dfsg-12+deb8u11_amd64.deb 69b1e37fdda85c7993fc2f6a35ce5b93f5ecfad9 2888 qemu-user-binfmt_2.1+dfsg-12+deb8u11_amd64.deb 66f5b299861e81d52209fac71fa4c69153ca223b 486244 qemu-utils_2.1+dfsg-12+deb8u11_amd64.deb d5e3cde30100da240020fb238d425fb99292522d 140012 qemu-guest-agent_2.1+dfsg-12+deb8u11_amd64.deb 8451b50d03c67f966f465651ed68fda6d602ccea 56264 qemu-kvm_2.1+dfsg-12+deb8u11_amd64.deb Checksums-Sha256: d6111bf971e140020f20d1b526a298919cf1a65476f31885328f102a0a64c72c 5538 qemu_2.1+dfsg-12+deb8u11.dsc 34b610c2538c7617638b8f1bdedf8a96ca2ff8cd8ad97b920a70c4d8d481d97f 5163316 qemu_2.1+dfsg.orig.tar.xz f3711056937ff01cfc70086ef90f6de034dc206b1db3aea564b7eb3c45e0d8da 217144 qemu_2.1+dfsg-12+deb8u11.debian.tar.xz 5eb7f604965679493d68024a4b7f7f580b69df720d955e9ecbf4fd7dbc2a4b3c 126534 qemu_2.1+dfsg-12+deb8u11_amd64.deb daaee6386f471aaf9e58340a151ff7266024ed3c45807a4b070a3533a7bb6183 55634 qemu-system_2.1+dfsg-12+deb8u11_amd64.deb aff76b42948d135d3948c04a885e035a248a2347e75454af7e17d00c51bb3e21 285970 qemu-system-common_2.1+dfsg-12+deb8u11_amd64.deb e8007e297e18419a7b2622fb63bda52661d5d3dbdfa369b06e6251bac8692de8 5130864 qemu-system-misc_2.1+dfsg-12+deb8u11_amd64.deb 7ff8da97f7370bfbed3d40feb1a6169097c00b6c32432d1ebef36aca7416f38c 2238628 qemu-system-arm_2.1+dfsg-12+deb8u11_amd64.deb 54d928d87a4e06cbc9b929b25825a76f43b503bab62dc06a9d987c9a91b0f771 2728106 qemu-system-mips_2.1+dfsg-12+deb8u11_amd64.deb 12acd526e4b79c3dbeb50701013208af36eeafe2904df806df1bde7cd9f48c82 2833480 qemu-system-ppc_2.1+dfsg-12+deb8u11_amd64.deb a9c781a373eb7312d3703a99d05f4caa971eb8a57d6f83f47e1809599a19beb0 1670612 qemu-system-sparc_2.1+dfsg-12+deb8u11_amd64.deb 48ba602c09b7171124ba1ccef65e4f4f6d4f803e2e49fbd04c02c724e942dd70 2049468 qemu-system-x86_2.1+dfsg-12+deb8u11_amd64.deb
Accepted postgresql-9.4 9.4.22-0+deb8u1 (source amd64 all) into oldstable
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Format: 1.8 Date: Thu, 09 May 2019 10:04:31 +0200 Source: postgresql-9.4 Binary: libpq-dev libpq5 libecpg6 libecpg-dev libecpg-compat3 libpgtypes3 postgresql-9.4 postgresql-9.4-dbg postgresql-client-9.4 postgresql-server-dev-9.4 postgresql-doc-9.4 postgresql-contrib-9.4 postgresql-plperl-9.4 postgresql-plpython-9.4 postgresql-plpython3-9.4 postgresql-pltcl-9.4 Architecture: source amd64 all Version: 9.4.22-0+deb8u1 Distribution: jessie-security Urgency: medium Maintainer: Debian PostgreSQL Maintainers Changed-By: Christoph Berg Description: libecpg-compat3 - older version of run-time library for ECPG programs libecpg-dev - development files for ECPG (Embedded PostgreSQL for C) libecpg6 - run-time library for ECPG programs libpgtypes3 - shared library libpgtypes for PostgreSQL 9.4 libpq-dev - header files for libpq5 (PostgreSQL library) libpq5 - PostgreSQL C client library postgresql-9.4 - object-relational SQL database, version 9.4 server postgresql-9.4-dbg - debug symbols for postgresql-9.4 postgresql-client-9.4 - front-end programs for PostgreSQL 9.4 postgresql-contrib-9.4 - additional facilities for PostgreSQL postgresql-doc-9.4 - documentation for the PostgreSQL database management system postgresql-plperl-9.4 - PL/Perl procedural language for PostgreSQL 9.4 postgresql-plpython-9.4 - PL/Python procedural language for PostgreSQL 9.4 postgresql-plpython3-9.4 - PL/Python 3 procedural language for PostgreSQL 9.4 postgresql-pltcl-9.4 - PL/Tcl procedural language for PostgreSQL 9.4 postgresql-server-dev-9.4 - development files for PostgreSQL 9.4 server-side programming Changes: postgresql-9.4 (9.4.22-0+deb8u1) jessie-security; urgency=medium . * New upstream version. Checksums-Sha1: 6b45650a40ecc1429073ad1d8606cdb89b79e45f 3546 postgresql-9.4_9.4.22-0+deb8u1.dsc 68ee53f1781442e429e37808973bddb7ecf1a0f5 16848787 postgresql-9.4_9.4.22.orig.tar.bz2 c9d6d1dab7cd7a49e726d60a3804c06870060958 29196 postgresql-9.4_9.4.22-0+deb8u1.debian.tar.xz bf4ae00e1920cbb186f26cef0bf5a9339fde0dee 167830 libpq-dev_9.4.22-0+deb8u1_amd64.deb 88e7de1eeb2e375de7287ff49dce4732db61964a 128058 libpq5_9.4.22-0+deb8u1_amd64.deb 299c99e30452bc2fcd6963c799b5b47dbbb74eea 83228 libecpg6_9.4.22-0+deb8u1_amd64.deb 0c8055de1b029363d9efbe59c839d4fa281f81b8 221012 libecpg-dev_9.4.22-0+deb8u1_amd64.deb 0081e0dccc4cbdb1776542dce516ebc677e95cf9 18650 libecpg-compat3_9.4.22-0+deb8u1_amd64.deb b742829f94d2c1be69f149c0c98f0d7c8375bdb5 40620 libpgtypes3_9.4.22-0+deb8u1_amd64.deb 17fd9bd05e7987ce9dc94889be27f92798cf1613 3722184 postgresql-9.4_9.4.22-0+deb8u1_amd64.deb 6f17cf78c7926dce4ac5ccd35ccf2d4292e8145d 12285082 postgresql-9.4-dbg_9.4.22-0+deb8u1_amd64.deb 3ff8697a96e447eabc622527c35e16062fd9dac9 1100828 postgresql-client-9.4_9.4.22-0+deb8u1_amd64.deb be89fdae4aaf3c263830200641cd34e95799cbeb 647986 postgresql-server-dev-9.4_9.4.22-0+deb8u1_amd64.deb 4b50e91241bb13ec0b3f10abc370b004e4ac1bf0 1589752 postgresql-doc-9.4_9.4.22-0+deb8u1_all.deb 2595b170556b9fa141d13da04ed132123f7682b3 457788 postgresql-contrib-9.4_9.4.22-0+deb8u1_amd64.deb 46326521e69ebe0954736f44216a4f1208485aeb 56762 postgresql-plperl-9.4_9.4.22-0+deb8u1_amd64.deb 88c95342b71c835ac2b3be592772e5c4eb4115fd 48266 postgresql-plpython-9.4_9.4.22-0+deb8u1_amd64.deb e90f82e9dd706da75e71fe87ed069ddcf443a9d9 47848 postgresql-plpython3-9.4_9.4.22-0+deb8u1_amd64.deb 38929a82a3a7bbe18ba6c86a9024be4e7bee0b58 33526 postgresql-pltcl-9.4_9.4.22-0+deb8u1_amd64.deb Checksums-Sha256: 4001a60a125fedd5d81daeac19557bb09fe62ce3c527d0c59729147397022328 3546 postgresql-9.4_9.4.22-0+deb8u1.dsc d6aa4c2b9204e375545b9845b0e5957b34a1783863a80a194f2b2833c66b 16848787 postgresql-9.4_9.4.22.orig.tar.bz2 e7c3cf279fd0fec0e2830a196cfaf96cf75f35f1946734921de6b1acccfbe67d 29196 postgresql-9.4_9.4.22-0+deb8u1.debian.tar.xz 378b36f13ac7b1451103cebd3834599281d88c615c85122508165aed5eefd96b 167830 libpq-dev_9.4.22-0+deb8u1_amd64.deb 0ccc1058012a25fe43812c0dd9743e76e1f408f9a2ba4f15ab4c571a0233bb56 128058 libpq5_9.4.22-0+deb8u1_amd64.deb 42b2931accc88fce2a75f151569e94c4b02aea6a2c1e1ba4241a67ccc28011f6 83228 libecpg6_9.4.22-0+deb8u1_amd64.deb 75c3547b0887a7d6682754f25c27f1546834a8cfe32324a65c906e81474d8260 221012 libecpg-dev_9.4.22-0+deb8u1_amd64.deb cc22d8251b525678ee7d30ee284cee0ff4106eef31e748cac5f62c18212e3082 18650 libecpg-compat3_9.4.22-0+deb8u1_amd64.deb 19b8fb82941a1acb28405781da0a98e3e48dad43dd71285bce58376c4e26da38 40620 libpgtypes3_9.4.22-0+deb8u1_amd64.deb 08ff145343b05fc31d259dad6f6cde15e0a64ccb174bd0fb70123c6cbb3fd1e3 3722184 postgresql-9.4_9.4.22-0+deb8u1_amd64.deb 1ad1c8cf26a59501ef6f87bf77f34f1de2a74c3a6e0dcd1346f2448a19eaa260 12285082 postgresql-9.4-dbg_9.4.22-0+deb8u1_amd64.deb bfce0a607aa8435e9839ce7e4f0b1e9f8b9d02aa8cfca58308e15401a5dcc4e8 1100828 postgresql-client-9.4_9.4.22-0+deb8u1_amd64.deb aad12761a666d8e3f2b32876d133d6efeb97a90dfecaac3d33c580c9705200f2
