Security update for qemu SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2017:0194-1 Final 1 1 2017-01-18T07:28:52Z current 2017-01-18T07:28:52Z 2017-01-18T07:28:52Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for qemu qemu was updated to fix several issues. These security issues were fixed: - CVE-2016-9102: Memory leak in the v9fs_xattrcreate function in hw/9pfs/9p.c in allowed local guest OS administrators to cause a denial of service (memory consumption and QEMU process crash) via a large number of Txattrcreate messages with the same fid number (bsc#1014256). - CVE-2016-9103: The v9fs_xattrcreate function in hw/9pfs/9p.c in allowed local guest OS administrators to obtain sensitive host heap memory information by reading xattribute values writing to them (bsc#1007454). - CVE-2016-9381: Improper processing of shared rings allowing guest administrators take over the qemu process, elevating their privilege to that of the qemu process (bsc#1009109) - CVE-2016-9776: The ColdFire Fast Ethernet Controller emulator support was vulnerable to an infinite loop issue while receiving packets in 'mcf_fec_receive'. A privileged user/process inside guest could have used this issue to crash the Qemu process on the host leading to DoS (bsc#1013285). - CVE-2016-9845: The Virtio GPU Device emulator support as vulnerable to an information leakage issue while processing the 'VIRTIO_GPU_CMD_GET_CAPSET_INFO' command. A guest user/process could have used this flaw to leak contents of the host memory (bsc#1013767). - CVE-2016-9846: The Virtio GPU Device emulator support was vulnerable to a memory leakage issue while updating the cursor data in update_cursor_data_virgl. A guest user/process could have used this flaw to leak host memory bytes, resulting in DoS for the host (bsc#1013764). - CVE-2016-9907: The USB redirector usb-guest support was vulnerable to a memory leakage flaw when destroying the USB redirector in 'usbredir_handle_destroy'. A guest user/process could have used this issue to leak host memory, resulting in DoS for a host (bsc#1014109). - CVE-2016-9908: The Virtio GPU Device emulator support was vulnerable to an information leakage issue while processing the 'VIRTIO_GPU_CMD_GET_CAPSET' command. A guest user/process could have used this flaw to leak contents of the host memory (bsc#1014514). - CVE-2016-9911: The USB EHCI Emulation support was vulnerable to a memory leakage issue while processing packet data in 'ehci_init_transfer'. A guest user/process could have used this issue to leak host memory, resulting in DoS for the host (bsc#1014111). - CVE-2016-9912: The Virtio GPU Device emulator support was vulnerable to a memory leakage issue while destroying gpu resource object in 'virtio_gpu_resource_destroy'. A guest user/process could have used this flaw to leak host memory bytes, resulting in DoS for the host (bsc#1014112). - CVE-2016-9913: VirtFS was vulnerable to memory leakage issue via its '9p-handle' or '9p-proxy' backend drivers. A privileged user inside guest could have used this flaw to leak host memory, thus affecting other services on the host and/or potentially crash the Qemu process on the host (bsc#1014110). These non-security issues were fixed: - Fixed uint64 property parsing and add regression tests (bsc#937125) - Added a man page for kvm_stat - Fix crash in vte (bsc#1008519) - Various upstream commits targeted towards stable releases (bsc#1013341) This update was imported from the SUSE:SLE-12-SP2:Update update project. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/opensuse-security-announce/2017-01/msg00032.html E-Mail link for openSUSE-SU-2017:0194-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings openSUSE Leap 42.2 qemu-2.6.2-26.1 qemu-arm-2.6.2-26.1 qemu-block-curl-2.6.2-26.1 qemu-block-dmg-2.6.2-26.1 qemu-block-iscsi-2.6.2-26.1 qemu-block-rbd-2.6.2-26.1 qemu-block-ssh-2.6.2-26.1 qemu-extra-2.6.2-26.1 qemu-guest-agent-2.6.2-26.1 qemu-ipxe-1.0.0-26.1 qemu-kvm-2.6.2-26.1 qemu-lang-2.6.2-26.1 qemu-linux-user-2.6.2-26.1 qemu-ppc-2.6.2-26.1 qemu-s390-2.6.2-26.1 qemu-seabios-1.9.1-26.1 qemu-sgabios-8-26.1 qemu-testsuite-2.6.2-26.1 qemu-tools-2.6.2-26.1 qemu-vgabios-1.9.1-26.1 qemu-x86-2.6.2-26.1 qemu-2.6.2-26.1 as a component of openSUSE Leap 42.2 qemu-arm-2.6.2-26.1 as a component of openSUSE Leap 42.2 qemu-block-curl-2.6.2-26.1 as a component of openSUSE Leap 42.2 qemu-block-dmg-2.6.2-26.1 as a component of openSUSE Leap 42.2 qemu-block-iscsi-2.6.2-26.1 as a component of openSUSE Leap 42.2 qemu-block-rbd-2.6.2-26.1 as a component of openSUSE Leap 42.2 qemu-block-ssh-2.6.2-26.1 as a component of openSUSE Leap 42.2 qemu-extra-2.6.2-26.1 as a component of openSUSE Leap 42.2 qemu-guest-agent-2.6.2-26.1 as a component of openSUSE Leap 42.2 qemu-ipxe-1.0.0-26.1 as a component of openSUSE Leap 42.2 qemu-kvm-2.6.2-26.1 as a component of openSUSE Leap 42.2 qemu-lang-2.6.2-26.1 as a component of openSUSE Leap 42.2 qemu-linux-user-2.6.2-26.1 as a component of openSUSE Leap 42.2 qemu-ppc-2.6.2-26.1 as a component of openSUSE Leap 42.2 qemu-s390-2.6.2-26.1 as a component of openSUSE Leap 42.2 qemu-seabios-1.9.1-26.1 as a component of openSUSE Leap 42.2 qemu-sgabios-8-26.1 as a component of openSUSE Leap 42.2 qemu-testsuite-2.6.2-26.1 as a component of openSUSE Leap 42.2 qemu-tools-2.6.2-26.1 as a component of openSUSE Leap 42.2 qemu-vgabios-1.9.1-26.1 as a component of openSUSE Leap 42.2 qemu-x86-2.6.2-26.1 as a component of openSUSE Leap 42.2 Memory leak in the v9fs_xattrcreate function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory consumption and QEMU process crash) via a large number of Txattrcreate messages with the same fid number. CVE-2016-9102 openSUSE Leap 42.2:qemu-2.6.2-26.1 openSUSE Leap 42.2:qemu-arm-2.6.2-26.1 openSUSE Leap 42.2:qemu-block-curl-2.6.2-26.1 openSUSE Leap 42.2:qemu-block-dmg-2.6.2-26.1 openSUSE Leap 42.2:qemu-block-iscsi-2.6.2-26.1 openSUSE Leap 42.2:qemu-block-rbd-2.6.2-26.1 openSUSE Leap 42.2:qemu-block-ssh-2.6.2-26.1 openSUSE Leap 42.2:qemu-extra-2.6.2-26.1 openSUSE Leap 42.2:qemu-guest-agent-2.6.2-26.1 openSUSE Leap 42.2:qemu-ipxe-1.0.0-26.1 openSUSE Leap 42.2:qemu-kvm-2.6.2-26.1 openSUSE Leap 42.2:qemu-lang-2.6.2-26.1 openSUSE Leap 42.2:qemu-linux-user-2.6.2-26.1 openSUSE Leap 42.2:qemu-ppc-2.6.2-26.1 openSUSE Leap 42.2:qemu-s390-2.6.2-26.1 openSUSE Leap 42.2:qemu-seabios-1.9.1-26.1 openSUSE Leap 42.2:qemu-sgabios-8-26.1 openSUSE Leap 42.2:qemu-testsuite-2.6.2-26.1 openSUSE Leap 42.2:qemu-tools-2.6.2-26.1 openSUSE Leap 42.2:qemu-vgabios-1.9.1-26.1 openSUSE Leap 42.2:qemu-x86-2.6.2-26.1 moderate 1.5 AV:L/AC:M/Au:S/C:N/I:N/A:P Please Install the update. https://lists.opensuse.org/opensuse-security-announce/2017-01/msg00032.html https://www.suse.com/security/cve/CVE-2016-9102.html CVE-2016-9102 https://bugzilla.suse.com/1007450 SUSE Bug 1007450 https://bugzilla.suse.com/1014256 SUSE Bug 1014256 The v9fs_xattrcreate function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to obtain sensitive host heap memory information by reading xattribute values before writing to them. CVE-2016-9103 openSUSE Leap 42.2:qemu-2.6.2-26.1 openSUSE Leap 42.2:qemu-arm-2.6.2-26.1 openSUSE Leap 42.2:qemu-block-curl-2.6.2-26.1 openSUSE Leap 42.2:qemu-block-dmg-2.6.2-26.1 openSUSE Leap 42.2:qemu-block-iscsi-2.6.2-26.1 openSUSE Leap 42.2:qemu-block-rbd-2.6.2-26.1 openSUSE Leap 42.2:qemu-block-ssh-2.6.2-26.1 openSUSE Leap 42.2:qemu-extra-2.6.2-26.1 openSUSE Leap 42.2:qemu-guest-agent-2.6.2-26.1 openSUSE Leap 42.2:qemu-ipxe-1.0.0-26.1 openSUSE Leap 42.2:qemu-kvm-2.6.2-26.1 openSUSE Leap 42.2:qemu-lang-2.6.2-26.1 openSUSE Leap 42.2:qemu-linux-user-2.6.2-26.1 openSUSE Leap 42.2:qemu-ppc-2.6.2-26.1 openSUSE Leap 42.2:qemu-s390-2.6.2-26.1 openSUSE Leap 42.2:qemu-seabios-1.9.1-26.1 openSUSE Leap 42.2:qemu-sgabios-8-26.1 openSUSE Leap 42.2:qemu-testsuite-2.6.2-26.1 openSUSE Leap 42.2:qemu-tools-2.6.2-26.1 openSUSE Leap 42.2:qemu-vgabios-1.9.1-26.1 openSUSE Leap 42.2:qemu-x86-2.6.2-26.1 moderate 1.5 AV:L/AC:M/Au:S/C:P/I:N/A:N Please Install the update. https://lists.opensuse.org/opensuse-security-announce/2017-01/msg00032.html https://www.suse.com/security/cve/CVE-2016-9103.html CVE-2016-9103 https://bugzilla.suse.com/1007454 SUSE Bug 1007454 https://bugzilla.suse.com/1014259 SUSE Bug 1014259 Race condition in QEMU in Xen allows local x86 HVM guest OS administrators to gain privileges by changing certain data on shared rings, aka a "double fetch" vulnerability. CVE-2016-9381 openSUSE Leap 42.2:qemu-2.6.2-26.1 openSUSE Leap 42.2:qemu-arm-2.6.2-26.1 openSUSE Leap 42.2:qemu-block-curl-2.6.2-26.1 openSUSE Leap 42.2:qemu-block-dmg-2.6.2-26.1 openSUSE Leap 42.2:qemu-block-iscsi-2.6.2-26.1 openSUSE Leap 42.2:qemu-block-rbd-2.6.2-26.1 openSUSE Leap 42.2:qemu-block-ssh-2.6.2-26.1 openSUSE Leap 42.2:qemu-extra-2.6.2-26.1 openSUSE Leap 42.2:qemu-guest-agent-2.6.2-26.1 openSUSE Leap 42.2:qemu-ipxe-1.0.0-26.1 openSUSE Leap 42.2:qemu-kvm-2.6.2-26.1 openSUSE Leap 42.2:qemu-lang-2.6.2-26.1 openSUSE Leap 42.2:qemu-linux-user-2.6.2-26.1 openSUSE Leap 42.2:qemu-ppc-2.6.2-26.1 openSUSE Leap 42.2:qemu-s390-2.6.2-26.1 openSUSE Leap 42.2:qemu-seabios-1.9.1-26.1 openSUSE Leap 42.2:qemu-sgabios-8-26.1 openSUSE Leap 42.2:qemu-testsuite-2.6.2-26.1 openSUSE Leap 42.2:qemu-tools-2.6.2-26.1 openSUSE Leap 42.2:qemu-vgabios-1.9.1-26.1 openSUSE Leap 42.2:qemu-x86-2.6.2-26.1 moderate 6 AV:L/AC:H/Au:S/C:C/I:C/A:C Please Install the update. https://lists.opensuse.org/opensuse-security-announce/2017-01/msg00032.html https://www.suse.com/security/cve/CVE-2016-9381.html CVE-2016-9381 https://bugzilla.suse.com/1009109 SUSE Bug 1009109 QEMU (aka Quick Emulator) built with the ColdFire Fast Ethernet Controller emulator support is vulnerable to an infinite loop issue. It could occur while receiving packets in 'mcf_fec_receive'. A privileged user/process inside guest could use this issue to crash the QEMU process on the host leading to DoS. CVE-2016-9776 openSUSE Leap 42.2:qemu-2.6.2-26.1 openSUSE Leap 42.2:qemu-arm-2.6.2-26.1 openSUSE Leap 42.2:qemu-block-curl-2.6.2-26.1 openSUSE Leap 42.2:qemu-block-dmg-2.6.2-26.1 openSUSE Leap 42.2:qemu-block-iscsi-2.6.2-26.1 openSUSE Leap 42.2:qemu-block-rbd-2.6.2-26.1 openSUSE Leap 42.2:qemu-block-ssh-2.6.2-26.1 openSUSE Leap 42.2:qemu-extra-2.6.2-26.1 openSUSE Leap 42.2:qemu-guest-agent-2.6.2-26.1 openSUSE Leap 42.2:qemu-ipxe-1.0.0-26.1 openSUSE Leap 42.2:qemu-kvm-2.6.2-26.1 openSUSE Leap 42.2:qemu-lang-2.6.2-26.1 openSUSE Leap 42.2:qemu-linux-user-2.6.2-26.1 openSUSE Leap 42.2:qemu-ppc-2.6.2-26.1 openSUSE Leap 42.2:qemu-s390-2.6.2-26.1 openSUSE Leap 42.2:qemu-seabios-1.9.1-26.1 openSUSE Leap 42.2:qemu-sgabios-8-26.1 openSUSE Leap 42.2:qemu-testsuite-2.6.2-26.1 openSUSE Leap 42.2:qemu-tools-2.6.2-26.1 openSUSE Leap 42.2:qemu-vgabios-1.9.1-26.1 openSUSE Leap 42.2:qemu-x86-2.6.2-26.1 moderate 1.5 AV:L/AC:M/Au:S/C:N/I:N/A:P Please Install the update. https://lists.opensuse.org/opensuse-security-announce/2017-01/msg00032.html https://www.suse.com/security/cve/CVE-2016-9776.html CVE-2016-9776 https://bugzilla.suse.com/1013285 SUSE Bug 1013285 https://bugzilla.suse.com/1013657 SUSE Bug 1013657 https://bugzilla.suse.com/1024182 SUSE Bug 1024182 https://bugzilla.suse.com/1178658 SUSE Bug 1178658 QEMU (aka Quick Emulator) built with the Virtio GPU Device emulator support is vulnerable to an information leakage issue. It could occur while processing 'VIRTIO_GPU_CMD_GET_CAPSET_INFO' command. A guest user/process could use this flaw to leak contents of the host memory bytes. CVE-2016-9845 openSUSE Leap 42.2:qemu-2.6.2-26.1 openSUSE Leap 42.2:qemu-arm-2.6.2-26.1 openSUSE Leap 42.2:qemu-block-curl-2.6.2-26.1 openSUSE Leap 42.2:qemu-block-dmg-2.6.2-26.1 openSUSE Leap 42.2:qemu-block-iscsi-2.6.2-26.1 openSUSE Leap 42.2:qemu-block-rbd-2.6.2-26.1 openSUSE Leap 42.2:qemu-block-ssh-2.6.2-26.1 openSUSE Leap 42.2:qemu-extra-2.6.2-26.1 openSUSE Leap 42.2:qemu-guest-agent-2.6.2-26.1 openSUSE Leap 42.2:qemu-ipxe-1.0.0-26.1 openSUSE Leap 42.2:qemu-kvm-2.6.2-26.1 openSUSE Leap 42.2:qemu-lang-2.6.2-26.1 openSUSE Leap 42.2:qemu-linux-user-2.6.2-26.1 openSUSE Leap 42.2:qemu-ppc-2.6.2-26.1 openSUSE Leap 42.2:qemu-s390-2.6.2-26.1 openSUSE Leap 42.2:qemu-seabios-1.9.1-26.1 openSUSE Leap 42.2:qemu-sgabios-8-26.1 openSUSE Leap 42.2:qemu-testsuite-2.6.2-26.1 openSUSE Leap 42.2:qemu-tools-2.6.2-26.1 openSUSE Leap 42.2:qemu-vgabios-1.9.1-26.1 openSUSE Leap 42.2:qemu-x86-2.6.2-26.1 moderate 1 AV:L/AC:H/Au:S/C:P/I:N/A:N Please Install the update. https://lists.opensuse.org/opensuse-security-announce/2017-01/msg00032.html https://www.suse.com/security/cve/CVE-2016-9845.html CVE-2016-9845 https://bugzilla.suse.com/1013767 SUSE Bug 1013767 QEMU (aka Quick Emulator) built with the Virtio GPU Device emulator support is vulnerable to a memory leakage issue. It could occur while updating the cursor data in update_cursor_data_virgl. A guest user/process could use this flaw to leak host memory bytes, resulting in DoS for a host. CVE-2016-9846 openSUSE Leap 42.2:qemu-2.6.2-26.1 openSUSE Leap 42.2:qemu-arm-2.6.2-26.1 openSUSE Leap 42.2:qemu-block-curl-2.6.2-26.1 openSUSE Leap 42.2:qemu-block-dmg-2.6.2-26.1 openSUSE Leap 42.2:qemu-block-iscsi-2.6.2-26.1 openSUSE Leap 42.2:qemu-block-rbd-2.6.2-26.1 openSUSE Leap 42.2:qemu-block-ssh-2.6.2-26.1 openSUSE Leap 42.2:qemu-extra-2.6.2-26.1 openSUSE Leap 42.2:qemu-guest-agent-2.6.2-26.1 openSUSE Leap 42.2:qemu-ipxe-1.0.0-26.1 openSUSE Leap 42.2:qemu-kvm-2.6.2-26.1 openSUSE Leap 42.2:qemu-lang-2.6.2-26.1 openSUSE Leap 42.2:qemu-linux-user-2.6.2-26.1 openSUSE Leap 42.2:qemu-ppc-2.6.2-26.1 openSUSE Leap 42.2:qemu-s390-2.6.2-26.1 openSUSE Leap 42.2:qemu-seabios-1.9.1-26.1 openSUSE Leap 42.2:qemu-sgabios-8-26.1 openSUSE Leap 42.2:qemu-testsuite-2.6.2-26.1 openSUSE Leap 42.2:qemu-tools-2.6.2-26.1 openSUSE Leap 42.2:qemu-vgabios-1.9.1-26.1 openSUSE Leap 42.2:qemu-x86-2.6.2-26.1 moderate 1.5 AV:L/AC:M/Au:S/C:P/I:N/A:N Please Install the update. https://lists.opensuse.org/opensuse-security-announce/2017-01/msg00032.html https://www.suse.com/security/cve/CVE-2016-9846.html CVE-2016-9846 https://bugzilla.suse.com/1013764 SUSE Bug 1013764 Quick Emulator (Qemu) built with the USB redirector usb-guest support is vulnerable to a memory leakage flaw. It could occur while destroying the USB redirector in 'usbredir_handle_destroy'. A guest user/process could use this issue to leak host memory, resulting in DoS for a host. CVE-2016-9907 openSUSE Leap 42.2:qemu-2.6.2-26.1 openSUSE Leap 42.2:qemu-arm-2.6.2-26.1 openSUSE Leap 42.2:qemu-block-curl-2.6.2-26.1 openSUSE Leap 42.2:qemu-block-dmg-2.6.2-26.1 openSUSE Leap 42.2:qemu-block-iscsi-2.6.2-26.1 openSUSE Leap 42.2:qemu-block-rbd-2.6.2-26.1 openSUSE Leap 42.2:qemu-block-ssh-2.6.2-26.1 openSUSE Leap 42.2:qemu-extra-2.6.2-26.1 openSUSE Leap 42.2:qemu-guest-agent-2.6.2-26.1 openSUSE Leap 42.2:qemu-ipxe-1.0.0-26.1 openSUSE Leap 42.2:qemu-kvm-2.6.2-26.1 openSUSE Leap 42.2:qemu-lang-2.6.2-26.1 openSUSE Leap 42.2:qemu-linux-user-2.6.2-26.1 openSUSE Leap 42.2:qemu-ppc-2.6.2-26.1 openSUSE Leap 42.2:qemu-s390-2.6.2-26.1 openSUSE Leap 42.2:qemu-seabios-1.9.1-26.1 openSUSE Leap 42.2:qemu-sgabios-8-26.1 openSUSE Leap 42.2:qemu-testsuite-2.6.2-26.1 openSUSE Leap 42.2:qemu-tools-2.6.2-26.1 openSUSE Leap 42.2:qemu-vgabios-1.9.1-26.1 openSUSE Leap 42.2:qemu-x86-2.6.2-26.1 moderate 1.5 AV:L/AC:M/Au:S/C:N/I:N/A:P Please Install the update. https://lists.opensuse.org/opensuse-security-announce/2017-01/msg00032.html https://www.suse.com/security/cve/CVE-2016-9907.html CVE-2016-9907 https://bugzilla.suse.com/1014109 SUSE Bug 1014109 https://bugzilla.suse.com/1014490 SUSE Bug 1014490 Quick Emulator (Qemu) built with the Virtio GPU Device emulator support is vulnerable to an information leakage issue. It could occur while processing 'VIRTIO_GPU_CMD_GET_CAPSET' command. A guest user/process could use this flaw to leak contents of the host memory bytes. CVE-2016-9908 openSUSE Leap 42.2:qemu-2.6.2-26.1 openSUSE Leap 42.2:qemu-arm-2.6.2-26.1 openSUSE Leap 42.2:qemu-block-curl-2.6.2-26.1 openSUSE Leap 42.2:qemu-block-dmg-2.6.2-26.1 openSUSE Leap 42.2:qemu-block-iscsi-2.6.2-26.1 openSUSE Leap 42.2:qemu-block-rbd-2.6.2-26.1 openSUSE Leap 42.2:qemu-block-ssh-2.6.2-26.1 openSUSE Leap 42.2:qemu-extra-2.6.2-26.1 openSUSE Leap 42.2:qemu-guest-agent-2.6.2-26.1 openSUSE Leap 42.2:qemu-ipxe-1.0.0-26.1 openSUSE Leap 42.2:qemu-kvm-2.6.2-26.1 openSUSE Leap 42.2:qemu-lang-2.6.2-26.1 openSUSE Leap 42.2:qemu-linux-user-2.6.2-26.1 openSUSE Leap 42.2:qemu-ppc-2.6.2-26.1 openSUSE Leap 42.2:qemu-s390-2.6.2-26.1 openSUSE Leap 42.2:qemu-seabios-1.9.1-26.1 openSUSE Leap 42.2:qemu-sgabios-8-26.1 openSUSE Leap 42.2:qemu-testsuite-2.6.2-26.1 openSUSE Leap 42.2:qemu-tools-2.6.2-26.1 openSUSE Leap 42.2:qemu-vgabios-1.9.1-26.1 openSUSE Leap 42.2:qemu-x86-2.6.2-26.1 low 1.5 AV:L/AC:M/Au:S/C:P/I:N/A:N Please Install the update. https://lists.opensuse.org/opensuse-security-announce/2017-01/msg00032.html https://www.suse.com/security/cve/CVE-2016-9908.html CVE-2016-9908 https://bugzilla.suse.com/1014514 SUSE Bug 1014514 Quick Emulator (Qemu) built with the USB EHCI Emulation support is vulnerable to a memory leakage issue. It could occur while processing packet data in 'ehci_init_transfer'. A guest user/process could use this issue to leak host memory, resulting in DoS for a host. CVE-2016-9911 openSUSE Leap 42.2:qemu-2.6.2-26.1 openSUSE Leap 42.2:qemu-arm-2.6.2-26.1 openSUSE Leap 42.2:qemu-block-curl-2.6.2-26.1 openSUSE Leap 42.2:qemu-block-dmg-2.6.2-26.1 openSUSE Leap 42.2:qemu-block-iscsi-2.6.2-26.1 openSUSE Leap 42.2:qemu-block-rbd-2.6.2-26.1 openSUSE Leap 42.2:qemu-block-ssh-2.6.2-26.1 openSUSE Leap 42.2:qemu-extra-2.6.2-26.1 openSUSE Leap 42.2:qemu-guest-agent-2.6.2-26.1 openSUSE Leap 42.2:qemu-ipxe-1.0.0-26.1 openSUSE Leap 42.2:qemu-kvm-2.6.2-26.1 openSUSE Leap 42.2:qemu-lang-2.6.2-26.1 openSUSE Leap 42.2:qemu-linux-user-2.6.2-26.1 openSUSE Leap 42.2:qemu-ppc-2.6.2-26.1 openSUSE Leap 42.2:qemu-s390-2.6.2-26.1 openSUSE Leap 42.2:qemu-seabios-1.9.1-26.1 openSUSE Leap 42.2:qemu-sgabios-8-26.1 openSUSE Leap 42.2:qemu-testsuite-2.6.2-26.1 openSUSE Leap 42.2:qemu-tools-2.6.2-26.1 openSUSE Leap 42.2:qemu-vgabios-1.9.1-26.1 openSUSE Leap 42.2:qemu-x86-2.6.2-26.1 moderate 1.5 AV:L/AC:M/Au:S/C:N/I:N/A:P Please Install the update. https://lists.opensuse.org/opensuse-security-announce/2017-01/msg00032.html https://www.suse.com/security/cve/CVE-2016-9911.html CVE-2016-9911 https://bugzilla.suse.com/1014111 SUSE Bug 1014111 https://bugzilla.suse.com/1014507 SUSE Bug 1014507 Quick Emulator (Qemu) built with the Virtio GPU Device emulator support is vulnerable to a memory leakage issue. It could occur while destroying gpu resource object in 'virtio_gpu_resource_destroy'. A guest user/process could use this flaw to leak host memory bytes, resulting in DoS for a host. CVE-2016-9912 openSUSE Leap 42.2:qemu-2.6.2-26.1 openSUSE Leap 42.2:qemu-arm-2.6.2-26.1 openSUSE Leap 42.2:qemu-block-curl-2.6.2-26.1 openSUSE Leap 42.2:qemu-block-dmg-2.6.2-26.1 openSUSE Leap 42.2:qemu-block-iscsi-2.6.2-26.1 openSUSE Leap 42.2:qemu-block-rbd-2.6.2-26.1 openSUSE Leap 42.2:qemu-block-ssh-2.6.2-26.1 openSUSE Leap 42.2:qemu-extra-2.6.2-26.1 openSUSE Leap 42.2:qemu-guest-agent-2.6.2-26.1 openSUSE Leap 42.2:qemu-ipxe-1.0.0-26.1 openSUSE Leap 42.2:qemu-kvm-2.6.2-26.1 openSUSE Leap 42.2:qemu-lang-2.6.2-26.1 openSUSE Leap 42.2:qemu-linux-user-2.6.2-26.1 openSUSE Leap 42.2:qemu-ppc-2.6.2-26.1 openSUSE Leap 42.2:qemu-s390-2.6.2-26.1 openSUSE Leap 42.2:qemu-seabios-1.9.1-26.1 openSUSE Leap 42.2:qemu-sgabios-8-26.1 openSUSE Leap 42.2:qemu-testsuite-2.6.2-26.1 openSUSE Leap 42.2:qemu-tools-2.6.2-26.1 openSUSE Leap 42.2:qemu-vgabios-1.9.1-26.1 openSUSE Leap 42.2:qemu-x86-2.6.2-26.1 moderate 1.5 AV:L/AC:M/Au:S/C:N/I:N/A:P Please Install the update. https://lists.opensuse.org/opensuse-security-announce/2017-01/msg00032.html https://www.suse.com/security/cve/CVE-2016-9912.html CVE-2016-9912 https://bugzilla.suse.com/1014112 SUSE Bug 1014112 Memory leak in the v9fs_device_unrealize_common function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local privileged guest OS users to cause a denial of service (host memory consumption and possibly QEMU process crash) via vectors involving the order of resource cleanup. CVE-2016-9913 openSUSE Leap 42.2:qemu-2.6.2-26.1 openSUSE Leap 42.2:qemu-arm-2.6.2-26.1 openSUSE Leap 42.2:qemu-block-curl-2.6.2-26.1 openSUSE Leap 42.2:qemu-block-dmg-2.6.2-26.1 openSUSE Leap 42.2:qemu-block-iscsi-2.6.2-26.1 openSUSE Leap 42.2:qemu-block-rbd-2.6.2-26.1 openSUSE Leap 42.2:qemu-block-ssh-2.6.2-26.1 openSUSE Leap 42.2:qemu-extra-2.6.2-26.1 openSUSE Leap 42.2:qemu-guest-agent-2.6.2-26.1 openSUSE Leap 42.2:qemu-ipxe-1.0.0-26.1 openSUSE Leap 42.2:qemu-kvm-2.6.2-26.1 openSUSE Leap 42.2:qemu-lang-2.6.2-26.1 openSUSE Leap 42.2:qemu-linux-user-2.6.2-26.1 openSUSE Leap 42.2:qemu-ppc-2.6.2-26.1 openSUSE Leap 42.2:qemu-s390-2.6.2-26.1 openSUSE Leap 42.2:qemu-seabios-1.9.1-26.1 openSUSE Leap 42.2:qemu-sgabios-8-26.1 openSUSE Leap 42.2:qemu-testsuite-2.6.2-26.1 openSUSE Leap 42.2:qemu-tools-2.6.2-26.1 openSUSE Leap 42.2:qemu-vgabios-1.9.1-26.1 openSUSE Leap 42.2:qemu-x86-2.6.2-26.1 moderate 1.5 AV:L/AC:M/Au:S/C:N/I:N/A:P Please Install the update. https://lists.opensuse.org/opensuse-security-announce/2017-01/msg00032.html https://www.suse.com/security/cve/CVE-2016-9913.html CVE-2016-9913 https://bugzilla.suse.com/1014110 SUSE Bug 1014110 https://bugzilla.suse.com/1014311 SUSE Bug 1014311 Quick emulator (Qemu) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to a divide by zero issue. It could occur while copying VGA data when cirrus graphics mode was set to be VGA. A privileged user inside guest could use this flaw to crash the Qemu process instance on the host, resulting in DoS. CVE-2016-9921 openSUSE Leap 42.2:qemu-2.6.2-26.1 openSUSE Leap 42.2:qemu-arm-2.6.2-26.1 openSUSE Leap 42.2:qemu-block-curl-2.6.2-26.1 openSUSE Leap 42.2:qemu-block-dmg-2.6.2-26.1 openSUSE Leap 42.2:qemu-block-iscsi-2.6.2-26.1 openSUSE Leap 42.2:qemu-block-rbd-2.6.2-26.1 openSUSE Leap 42.2:qemu-block-ssh-2.6.2-26.1 openSUSE Leap 42.2:qemu-extra-2.6.2-26.1 openSUSE Leap 42.2:qemu-guest-agent-2.6.2-26.1 openSUSE Leap 42.2:qemu-ipxe-1.0.0-26.1 openSUSE Leap 42.2:qemu-kvm-2.6.2-26.1 openSUSE Leap 42.2:qemu-lang-2.6.2-26.1 openSUSE Leap 42.2:qemu-linux-user-2.6.2-26.1 openSUSE Leap 42.2:qemu-ppc-2.6.2-26.1 openSUSE Leap 42.2:qemu-s390-2.6.2-26.1 openSUSE Leap 42.2:qemu-seabios-1.9.1-26.1 openSUSE Leap 42.2:qemu-sgabios-8-26.1 openSUSE Leap 42.2:qemu-testsuite-2.6.2-26.1 openSUSE Leap 42.2:qemu-tools-2.6.2-26.1 openSUSE Leap 42.2:qemu-vgabios-1.9.1-26.1 openSUSE Leap 42.2:qemu-x86-2.6.2-26.1 moderate 1.9 AV:L/AC:M/Au:N/C:N/I:N/A:P Please Install the update. https://lists.opensuse.org/opensuse-security-announce/2017-01/msg00032.html https://www.suse.com/security/cve/CVE-2016-9921.html CVE-2016-9921 https://bugzilla.suse.com/1014702 SUSE Bug 1014702 https://bugzilla.suse.com/1015169 SUSE Bug 1015169 https://bugzilla.suse.com/1178658 SUSE Bug 1178658 The cirrus_do_copy function in hw/display/cirrus_vga.c in QEMU (aka Quick Emulator), when cirrus graphics mode is VGA, allows local guest OS privileged users to cause a denial of service (divide-by-zero error and QEMU process crash) via vectors involving blit pitch values. CVE-2016-9922 openSUSE Leap 42.2:qemu-2.6.2-26.1 openSUSE Leap 42.2:qemu-arm-2.6.2-26.1 openSUSE Leap 42.2:qemu-block-curl-2.6.2-26.1 openSUSE Leap 42.2:qemu-block-dmg-2.6.2-26.1 openSUSE Leap 42.2:qemu-block-iscsi-2.6.2-26.1 openSUSE Leap 42.2:qemu-block-rbd-2.6.2-26.1 openSUSE Leap 42.2:qemu-block-ssh-2.6.2-26.1 openSUSE Leap 42.2:qemu-extra-2.6.2-26.1 openSUSE Leap 42.2:qemu-guest-agent-2.6.2-26.1 openSUSE Leap 42.2:qemu-ipxe-1.0.0-26.1 openSUSE Leap 42.2:qemu-kvm-2.6.2-26.1 openSUSE Leap 42.2:qemu-lang-2.6.2-26.1 openSUSE Leap 42.2:qemu-linux-user-2.6.2-26.1 openSUSE Leap 42.2:qemu-ppc-2.6.2-26.1 openSUSE Leap 42.2:qemu-s390-2.6.2-26.1 openSUSE Leap 42.2:qemu-seabios-1.9.1-26.1 openSUSE Leap 42.2:qemu-sgabios-8-26.1 openSUSE Leap 42.2:qemu-testsuite-2.6.2-26.1 openSUSE Leap 42.2:qemu-tools-2.6.2-26.1 openSUSE Leap 42.2:qemu-vgabios-1.9.1-26.1 openSUSE Leap 42.2:qemu-x86-2.6.2-26.1 moderate 1.5 AV:L/AC:M/Au:S/C:N/I:N/A:P Please Install the update. https://lists.opensuse.org/opensuse-security-announce/2017-01/msg00032.html https://www.suse.com/security/cve/CVE-2016-9922.html CVE-2016-9922 https://bugzilla.suse.com/1014702 SUSE Bug 1014702 https://bugzilla.suse.com/1015169 SUSE Bug 1015169 https://bugzilla.suse.com/1178658 SUSE Bug 1178658