FreshPorts - VuXML

Secunia reports:

A vulnerability has been reported in QEMU, which can be exploited by malicious, local users to bypass certain security restrictions.

The vulnerability is caused due to the "drive_init()" function in vl.c determining the format of a disk from data contained in the disk's header. This can be exploited by a malicious user in a guest system to e.g. read arbitrary files on the host by writing a fake header to a raw formatted disk image.

lt 0.9.1_6

ge 0.9.1s.20070101* lt 0.9.1s.20080302_6

Secunia reports:

A vulnerability has been reported in QEMU, which can be exploited by malicious, local users to bypass certain security restrictions.

The vulnerability is caused due to the "drive_init()" function in vl.c determining the format of a disk from data contained in the disk's header. This can be exploited by a malicious user in a guest system to e.g. read arbitrary files on the host by writing a fake header to a raw formatted disk image.

lt 0.9.1_6

ge 0.9.1s.20070101* lt 0.9.1s.20080302_6

Aurelien Jarno reports:

CVE-2008-4539: fix a heap overflow in Cirrus emulation

The code in hw/cirrus_vga.c has changed a lot between CVE-2007-1320 has been announced and the patch has been applied. As a consequence it has wrongly applied and QEMU is still vulnerable to this bug if using VNC.

lt 0.9.1_10

ge 0.9.1s.20080101* lt 0.9.1s.20080620_2

Ian Jackson reports on the debian-security mailinglist:

When a block device read or write request is made by the guest, nothing checks that the request is within the range supported by the backend, but the code in the backend typically assumes that the request is sensible.

Depending on the backend, this can allow the guest to read and write arbitrary memory locations in qemu, and possibly gain control over the qemu process, escaping from the emulation/virtualisation.

lt 0.9.1_2

Aurelien Jarno reports:

CVE-2008-4539: fix a heap overflow in Cirrus emulation

The code in hw/cirrus_vga.c has changed a lot between CVE-2007-1320 has been announced and the patch has been applied. As a consequence it has wrongly applied and QEMU is still vulnerable to this bug if using VNC.

lt 0.9.1_10

ge 0.9.1s.20080101* lt 0.9.1s.20080620_2

Ian Jackson reports on the debian-security mailinglist:

When a block device read or write request is made by the guest, nothing checks that the request is within the range supported by the backend, but the code in the backend typically assumes that the request is sensible.

Depending on the backend, this can allow the guest to read and write arbitrary memory locations in qemu, and possibly gain control over the qemu process, escaping from the emulation/virtualisation.

lt 0.9.1_2