CVE-2015-7512
Qemu: net: pcnet: buffer overflow in non-loopback mode
Severidad por fuente
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD. Más baja según Red Hat (alta), Oracle (alta), Ubuntu (media).
Descripción
Buffer overflow in the pcnet_receive function in hw/net/pcnet.c in QEMU, when a guest NIC has a larger MTU, allows remote attackers to cause a denial of service (guest OS crash) or execute arbitrary code via a large packet.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| debian 11 | qemu | 1:2.5+dfsg-1 |
| debian 12 | qemu | 1:2.5+dfsg-1 |
| debian 13 | qemu | 1:2.5+dfsg-1 |
| debian 14 | qemu | 1:2.5+dfsg-1 |
| debian 7 | qemu, qemu-kvm | 1.1.2+dfsg-6a+deb7u12 y 1 más |
| debian 8 | qemu | 1:2.1+dfsg-12+deb8u5a |
| echo | qemu | 1:2.5+dfsg-1 |
| Oracle Linux 6 | qemu-guest-agent, qemu-img, qemu-kvm y 1 más | 2:0.12.1.2-2.479.el6_7.3 |
| ubuntu 12.04 | qemu-kvm | 1.0+noroms-0ubuntu14.26 |
| ubuntu 14.04 | qemu | 2.0.0+dfsg-2ubuntu1.21 |
| ubuntu 14.04-ESM | qemu | 2.0.0+dfsg-2ubuntu1.21 |
| ubuntu 15.04 | qemu | 1:2.2+dfsg-5expubuntu9.7 |
Mostrar las 17 entradas de 13 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| debian 11 | qemu | 1:2.5+dfsg-1 |
| debian 12 | qemu | 1:2.5+dfsg-1 |
| debian 13 | qemu | 1:2.5+dfsg-1 |
| debian 14 | qemu | 1:2.5+dfsg-1 |
| debian 7 | qemu | 1.1.2+dfsg-6a+deb7u12 |
| debian 7 | qemu-kvm | 1.1.2+dfsg-6+deb7u12 |
| debian 8 | qemu | 1:2.1+dfsg-12+deb8u5a |
| echo | qemu | 1:2.5+dfsg-1 |
| Oracle Linux 6 | qemu-guest-agent | 2:0.12.1.2-2.479.el6_7.3 |
| Oracle Linux 6 | qemu-img | 2:0.12.1.2-2.479.el6_7.3 |
| Oracle Linux 6 | qemu-kvm | 2:0.12.1.2-2.479.el6_7.3 |
| Oracle Linux 6 | qemu-kvm-tools | 2:0.12.1.2-2.479.el6_7.3 |
| ubuntu 12.04 | qemu-kvm | 1.0+noroms-0ubuntu14.26 |
| ubuntu 14.04 | qemu | 2.0.0+dfsg-2ubuntu1.21 |
| ubuntu 14.04-ESM | qemu | 2.0.0+dfsg-2ubuntu1.21 |
| ubuntu 15.04 | qemu | 1:2.2+dfsg-5expubuntu9.7 |
| ubuntu 15.10 | qemu | 1:2.3+dfsg-5ubuntu9.1 |
Referencias
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=8b98a2f07175d46c3f7217639bd5e03f
- http://rhn.redhat.com/errata/RHSA-2015-2694.html
- http://rhn.redhat.com/errata/RHSA-2015-2695.html
- http://rhn.redhat.com/errata/RHSA-2015-2696.html
- http://www.debian.org/security/2016/dsa-3469
- http://www.debian.org/security/2016/dsa-3470
- http://www.debian.org/security/2016/dsa-3471
- http://www.openwall.com/lists/oss-security/2015/11/30/3
Las 19 referencias
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.securityfocus.com/bid/78230
- http://www.securitytracker.com/id/1034527
- https://access.redhat.com/security/cve/CVE-2015-7512
- https://linux.oracle.com/cve/CVE-2015-7512.html
- https://linux.oracle.com/errata/ELSA-2015-2694.html
- https://lists.gnu.org/archive/html/qemu-devel/2015-11/msg06341.html
- https://nvd.nist.gov/vuln/detail/CVE-2015-7512
- https://security.gentoo.org/glsa/201602-01
- https://ubuntu.com/security/notices/USN-2828-1
- https://www.cve.org/CVERecord?id=CVE-2015-7512