From 7ce1486aae150c7a9110f9ede719a335fd2d8729 Mon Sep 17 00:00:00 2001 From: Stefan Fritsch Date: Sat, 26 May 2007 08:22:56 +0000 Subject: release qemu DTSA git-svn-id: svn+ssh://svn.debian.org/svn/secure-testing@5925 e39458fd-73e7-0310-bf30-c45bca0a0e42 --- website/DTSA/DTSA-38-1.html | 114 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 114 insertions(+) create mode 100644 website/DTSA/DTSA-38-1.html (limited to 'website') diff --git a/website/DTSA/DTSA-38-1.html b/website/DTSA/DTSA-38-1.html new file mode 100644 index 0000000000..1b3f842a6f --- /dev/null +++ b/website/DTSA/DTSA-38-1.html @@ -0,0 +1,114 @@ + + + Debian testing security team - Advisory + + + + +
+ + + + + Debian Project +
+
+ + + + + + + + + + + +
+ Debian testing security team - Advisory +
+ + +
+ + +

DTSA-38-1

+
+
Date Reported:
+
May 26th, 2007
+
Affected Package:
+
qemu
+
Vulnerability:
+
several vulnerabilities
+
Problem-Scope:
+
local
+
Debian-specific:
+
No
+
CVE:
+
+CVE-2007-1320 +CVE-2007-1321 +CVE-2007-1322 +CVE-2007-1323 +CVE-2007-1366 +
+
More information:
+
Several vulnerabilities have been discovered in the QEMU processor 
+emulator, which may lead to the execution of arbitrary code or denial of 
+service. The Common Vulnerabilities and Exposures project identifies the 
+following problems: 
+ 
+CVE-2007-1320 
+ Tavis Ormandy discovered that a memory management routine of the Cirrus 
+ video driver performs insufficient bounds checking, which might 
+ allow the execution of arbitrary code through a heap overflow. 
+ 
+CVE-2007-1321 
+ Tavis Ormandy discovered that the NE2000 network driver and the socket 
+ code perform insufficient input validation, which might allow the 
+ execution of arbitrary code through a heap overflow. 
+ 
+CVE-2007-1322 
+ Tavis Ormandy discovered that the "icebp" instruction can be abused to 
+ terminate the emulation, resulting in denial of service. 
+ 
+CVE-2007-1323 
+ Tavis Ormandy discovered that the NE2000 network driver and the socket 
+ code perform insufficient input validation, which might allow the 
+ execution of arbitrary code through a heap overflow. 
+ 
+CVE-2007-1366 
+ Tavis Ormandy discovered that the "aam" instruction can be abused to 
+ crash qemu through a division by zero, resulting in denial of 
+ service. 
+
+
For the testing distribution (lenny) this is fixed in version 0.8.2-5lenny1
+
For the unstable distribution (sid) this is fixed in version 0.9.0-2
+
This upgrade is recommended if you use qemu.
+
If you have the secure testing lines in your sources.list, you can update by running this command as root:
+ +
apt-get update && apt-get upgrade
+
+ +
+
To use the Debian testing security archive, add the following lines to your /etc/apt/sources.list:
+
+
deb http://security.debian.org/ testing/updates main contrib non-free
+
deb-src http://security.debian.org/ testing/updates main contrib non-free
+
+ + +
+ + Valid HTML 4.01! + + Valid CSS! + + + + -- cgit v1.2.3