[ubuntu/focal-security] qemu 1:4.2-3ubuntu6.4 (Accepted)

[Marc Deslauriers]

qemu (1:4.2-3ubuntu6.4) focal-security; urgency=medium

  * SECURITY UPDATE: assert failure in nbd
    - debian/patches/ubuntu/CVE-2020-10761.patch: avoid long error message
      assertions in nbd/server.c, tests/qemu-iotests/143,
      tests/qemu-iotests/143.out.
    - CVE-2020-10761
  * SECURITY UPDATE: out-of-bounds read and write in sm501
    - debian/patches/ubuntu/CVE-2020-12829-pre1.patch: convert printf +
      abort to qemu_log_mask.
    - debian/patches/ubuntu/CVE-2020-12829-pre2.patch: shorten long
      variable names in sm501_2d_operation.
    - debian/patches/ubuntu/CVE-2020-12829-pre3.patch: use BIT(x) macro to
      shorten constant.
    - debian/patches/ubuntu/CVE-2020-12829-pre4.patch: clean up local
      variables in sm501_2d_operation.
    - debian/patches/ubuntu/CVE-2020-12829.patch: replace hand written
      implementation with pixman where possible.
    - debian/patches/ubuntu/CVE-2020-12829-2.patch: optimize small
      overlapping blits.
    - debian/patches/ubuntu/CVE-2020-12829-3.patch: fix bounds checks.
    - debian/patches/ubuntu/CVE-2020-12829-4.patch: drop unneded variable.
    - debian/patches/ubuntu/CVE-2020-12829-5.patch: do not allow guest to
      set invalid format.
    - debian/patches/ubuntu/CVE-2020-12829-6.patch: introduce variable for
      commonly used value for better readability.
    - debian/patches/ubuntu/CVE-2020-12829-7.patch: fix and optimize
      overlap check.
    - CVE-2020-12829
  * SECURITY UPDATE: out-of-bounds read during sdhci_write() operations
    - debian/patches/ubuntu/CVE-2020-13253.patch: do not switch to
      ReceivingData if address is invalid in hw/sd/sd.c.
    - CVE-2020-13253
  * SECURITY UPDATE: out-of-bounds access during es1370_write() operation
    - debian/patches/ubuntu/CVE-2020-13361.patch: check total frame count
      against current frame in hw/audio/es1370.c.
    - CVE-2020-13361
  * SECURITY UPDATE: out-of-bounds read via crafted reply_queue_head
    - debian/patches/ubuntu/CVE-2020-13362-1.patch: use unsigned type for
      reply_queue_head and check index in hw/scsi/megasas.c.
    - debian/patches/ubuntu/CVE-2020-13362-2.patch: avoid NULL pointer
      dereference in hw/scsi/megasas.c.
    - debian/patches/ubuntu/CVE-2020-13362-3.patch: use unsigned type for
      positive numeric fields in hw/scsi/megasas.c.
    - CVE-2020-13362
  * SECURITY UPDATE: NULL pointer dereference related to BounceBuffer
    - debian/patches/ubuntu/CVE-2020-13659.patch: set map length to zero
      when returning NULL in exec.c, include/exec/memory.h.
    - CVE-2020-13659
  * SECURITY UPDATE: out-of-bounds access via msi-x mmio operation
    - debian/patches/ubuntu/CVE-2020-13754-1.patch: revert accepting
      mismatching sizes in memory_region_access_valid in memory.c.
    - debian/patches/ubuntu/CVE-2020-13754-2.patch: accept byte and word
      access to core ACPI registers in hw/acpi/core.c.
    - CVE-2020-13754
  * SECURITY UPDATE: infinite recursion in ati-vga
    - debian/patches/ubuntu/CVE-2020-13800.patch: check mm_index before
      recursive call in hw/display/ati.c.
    - CVE-2020-13800
  * SECURITY UPDATE: division by zero in oss_write()
    - debian/patches/ubuntu/CVE-2020-14415.patch: fix buffer pos
      calculation in audio/ossaudio.c.
    - CVE-2020-14415
  * SECURITY UPDATE: buffer overflow in XGMAC Ethernet controller
    - debian/patches/ubuntu/CVE-2020-15863.patch: check bounds in
      hw/net/xgmac.c.
    - CVE-2020-15863
  * SECURITY UPDATE: reachable assertion failure
    - debian/patches/ubuntu/CVE-2020-16092.patch: fix assertion failure in
      hw/net/net_tx_pkt.c.
    - CVE-2020-16092

qemu (1:4.2-3ubuntu6.3) focal; urgency=medium

  * debian/patches/ubuntu/lp-1878973-*: fix assert in qemu-guest-agent that
    crashes it on shutdown (LP: #1878973)
  * d/p/ubuntu/lp-1882774-*: fix issues with VMX subfeatures on systems not
    supporting to set them (LP: #1882774)

qemu (1:4.2-3ubuntu6.2) focal; urgency=medium

  * d/p/ubuntu/lp-1805256*: Fixes for QEMU on aarch64 ARM hosts
    - async: use explicit memory barriers (LP: #1805256)
    - aio-wait: delegate polling of main AioContext if BQL not held

Date: 2020-08-13 17:18:17.666838+00:00
Changed-By: Marc Deslauriers <marc.deslauriers at canonical.com>
https://launchpad.net/ubuntu/+source/qemu/1:4.2-3ubuntu6.4
-------------- next part --------------
Sorry, changesfile not available.