"Ubuntu Security Notice USN-863-1 December 03, 2009
qemu-kvm vulnerability
https://launchpad.net/bugs/458521
===========================================================
A security issue affects the following Ubuntu releases:
Ubuntu 9.10
This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.
The problem can be corrected by upgrading your system to the
following package versions:
Ubuntu 9.10:
qemu-kvm 0.11.0-0ubuntu6.3
After a standard system upgrade you need to restart any QEMU guests to
effect the necessary changes.
Details follow:
It was discovered that QEMU did not properly setup the virtio networking
features available to its guests. A remote attacker could exploit this to
crash QEMU guests which use virtio networking on Linux kernels earlier
than 2.6.26.
Updated packages for Ubuntu 9.10:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/q/qemu-kvm/qemu-kvm_0.11.0-0ubuntu6.3.diff.gz
Size/MD5: 48984 14fa43af0ed17b918c50803f91b1480d
http://security.ubuntu.com/ubuntu/pool/main/q/qemu-kvm/qemu-kvm_0.11.0-0ubuntu6.3.dsc
Size/MD5: 1377 18f25eed2408085a81ad70f39d74a835
http://security.ubuntu.com/ubuntu/pool/main/q/qemu-kvm/qemu-kvm_0.11.0.orig.tar.gz
Size/MD5: 4382897 440837a062967102a68e634d57eaf719
amd64 architecture (Athlon64, Opteron, EM64T Xeon):
http://security.ubuntu.com/ubuntu/pool/main/q/qemu-kvm/kvm_84+dfsg-0ubuntu16+0.11.0+0ubuntu6.3_amd64.deb
Size/MD5: 9106 b15b1b8a62f13822a3932abd54a5f924
http://security.ubuntu.com/ubuntu/pool/main/q/qemu-kvm/qemu-kvm_0.11.0-0ubuntu6.3_amd64.deb
Size/MD5: 2813520 49b26fe83d6c4a5c9befd6716a3431a9
http://security.ubuntu.com/ubuntu/pool/universe/q/qemu-kvm/qemu-arm-static_0.11.0-0ubuntu6.3_amd64.deb
Size/MD5: 636074 d9f0b9d5ff621c8b56b9fca53c0ae5d2
http://security.ubuntu.com/ubuntu/pool/universe/q/qemu-kvm/qemu-kvm-extras_0.11.0-0ubuntu6.3_amd64.deb
Size/MD5: 15469258 dd6a9beb5c7d51b43785df232a3a3c40
http://security.ubuntu.com/ubuntu/pool/universe/q/qemu-kvm/qemu_0.11.0-0ubuntu6.3_amd64.deb
Size/MD5: 8560 2bb181fcf769aafd08d26aa531bb24a4
i386 architecture (x86 compatible Intel/AMD):
http://security.ubuntu.com/ubuntu/pool/main/q/qemu-kvm/kvm_84+dfsg-0ubuntu16+0.11.0+0ubuntu6.3_i386.deb
Size/MD5: 9104 0a0a8a786ad29625fe5aa3de79c5cd98
http://security.ubuntu.com/ubuntu/pool/main/q/qemu-kvm/qemu-kvm_0.11.0-0ubuntu6.3_i386.deb
Size/MD5: 2592100 3023e22d5e6b3ff51fcf3641cd039e93
http://security.ubuntu.com/ubuntu/pool/universe/q/qemu-kvm/qemu-arm-static_0.11.0-0ubuntu6.3_i386.deb
Size/MD5: 558556 5d369da01ec40b1d79b7e015d9982302
http://security.ubuntu.com/ubuntu/pool/universe/q/qemu-kvm/qemu-kvm-extras_0.11.0-0ubuntu6.3_i386.deb
Size/MD5: 13984728 5464f6de725b919cdb4bd7252d221016
http://security.ubuntu.com/ubuntu/pool/universe/q/qemu-kvm/qemu_0.11.0-0ubuntu6.3_i386.deb
Size/MD5: 8562 3e34c884aff529f95a2975cdb08b2723
lpia architecture (Low Power Intel Architecture):
http://ports.ubuntu.com/pool/main/q/qemu-kvm/kvm_84+dfsg-0ubuntu16+0.11.0+0ubuntu6.3_lpia.deb
Size/MD5: 9104 156a8ede19f2d65929e73f119415f1b7
http://ports.ubuntu.com/pool/main/q/qemu-kvm/qemu-kvm_0.11.0-0ubuntu6.3_lpia.deb
Size/MD5: 2621316 02b4e9168fdacc9ab8955de557c64a7d
http://ports.ubuntu.com/pool/universe/q/qemu-kvm/qemu-arm-static_0.11.0-0ubuntu6.3_lpia.deb
Size/MD5: 578522 eb5a953dc2d59c2893656467bc879c25
http://ports.ubuntu.com/pool/universe/q/qemu-kvm/qemu-kvm-extras_0.11.0-0ubuntu6.3_lpia.deb
Size/MD5: 14110238 ee2d23ca2c7d25f37e5cb4d315730ad4
http://ports.ubuntu.com/pool/universe/q/qemu-kvm/qemu_0.11.0-0ubuntu6.3_lpia.deb
Size/MD5: 8560 7c2df17d8e67444172c9093c28a01d71
--eAbsdosE1cNLO4uF
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature
Content-Disposition: inline
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
iEYEARECAAYFAksYGQAACgkQW0JvuRdL8BrNQACfScCAdIfUNm2VtSPcMCN2MEIj
kxcAn03InrjpFS+mosKgV7LWqtBa0WOG
=W7sT
-----END PGP SIGNATURE-----
"
The Big Reunion Festival gets ready to partyUSN-850-3: poppler vulnerabilities
This entry was posted
on 1:50 PM
.
Archives
-
▼
2009
(488)
-
▼
December
(41)
- DSA 1958-1: New libtool packages fix privilege esc...
- DSA 1957-1: New aria2 packages fix arbitrary code ...
- DSA-1962-1: New kvm packages fix several vulnerabi...
- USN-873-1: Firefox 3.0 and Xulrunner 1.9 vulnerabi...
- DSA 1961-1: New bind9 packages fix cache poisoning
- DSA 1963-1: New unbound packages fix DNSSEC valida...
- RHSA-2009:1694-01 Critical: java-1.6.0-ibm securit...
- RHSA-2009:1688-01 Moderate: condor security update
- GLSA 200912-02 Ruby on Rails: Multiple vulnerabil...
- RHSA-2009:1689-01 Moderate: condor security update
- DSA 1960-1: New acpid packages fix weak file permi...
- USN-874-1: Firefox 3.5 and Xulrunner 1.9.1 vulnera...
- DSA 1954-1: New cacti packages fix insufficient in...
- DSA-1959-1: New ganeti packages fix arbitrary comm...
- USN-875-1: Red Hat Cluster Suite vulnerabilities
- RHSA-2009:1680-01 Important: xpdf security update
- DSA 1956-1: New xulrunner packages fix several vul...
- RHSA-2009:1682-01 Important: kdegraphics security ...
- RHSA-2009:1671-01 Important: kernel security and b...
- DSA-1953-1: New expat packages fix denial of service
- RHSA-2009:1670-01 Important: kernel security and b...
- DSA 1952-2: End-of-life announcement for asterisk ...
- USN-871-1: KDE vulnerability
- USN-871-2: KDE 4 vulnerabilities
- RHSA-2009:1658-01 Critical: flash-plugin security ...
- USN-867-1: Ntp vulnerability
- USN-868-1: GRUB 2 vulnerability
- USN-869-1: Linux kernel vulnerabilities
- USN-870-1: PyGreSQL vulnerability
- USN-866-1: gnome-screensaver vulnerability
- RHSA-2009:1647-01 Critical: java-1.5.0-ibm securit...
- DSA 1947-1: New Shibboleth packages fix cross-site...
- RHSA-2009:1643-01 Critical: java-1.4.2-ibm securit...
- DSA 1945-1: New gforge packages fix denial of service
- DSA 1946-1: New belpic packages fix cryptographic ...
- DSA 1944-1: New request-tracker packages fix sessi...
- USN-863-1: QEMU vulnerability
- RHSA-2009:1635-01 Important: kernel-rt security, b...
- DSA 1943-1: New openldap2.3/openldap packages fix ...
- RHSA-2009:1619-01 Moderate: dstat security update
- GLSA 200912-01 OpenSSL: Multiple vulnerabilities
-
▼
December
(41)