[USN-4283-1] QEMU vulnerabilities

[Marc Deslauriers]

==========================================================================
Ubuntu Security Notice USN-4283-1
February 18, 2020

qemu vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 19.10
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS

Summary:

Several security issues were fixed in QEMU.

Software Description:
- qemu: Machine emulator and virtualizer

Details:

Felipe Franciosi, Raphael Norwitz, and Peter Turschmid discovered that QEMU
incorrectly handled iSCSI server responses. A remote attacker in control of
the iSCSI server could use this issue to cause QEMU to crash, leading to a
denial of service, or possibly execute arbitrary code. (CVE-2020-1711)

It was discovered that the QEMU libslirp component incorrectly handled
memory. A remote attacker could use this issue to cause QEMU to crash,
resulting in a denial of service, or possibly execute arbitrary code.
(CVE-2020-7039, CVE-2020-8608)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 19.10:
  qemu                            1:4.0+dfsg-0ubuntu9.4
  qemu-system                     1:4.0+dfsg-0ubuntu9.4
  qemu-system-arm                 1:4.0+dfsg-0ubuntu9.4
  qemu-system-mips                1:4.0+dfsg-0ubuntu9.4
  qemu-system-ppc                 1:4.0+dfsg-0ubuntu9.4
  qemu-system-s390x               1:4.0+dfsg-0ubuntu9.4
  qemu-system-sparc               1:4.0+dfsg-0ubuntu9.4
  qemu-system-x86                 1:4.0+dfsg-0ubuntu9.4

Ubuntu 18.04 LTS:
  qemu                            1:2.11+dfsg-1ubuntu7.23
  qemu-system                     1:2.11+dfsg-1ubuntu7.23
  qemu-system-arm                 1:2.11+dfsg-1ubuntu7.23
  qemu-system-mips                1:2.11+dfsg-1ubuntu7.23
  qemu-system-ppc                 1:2.11+dfsg-1ubuntu7.23
  qemu-system-s390x               1:2.11+dfsg-1ubuntu7.23
  qemu-system-sparc               1:2.11+dfsg-1ubuntu7.23
  qemu-system-x86                 1:2.11+dfsg-1ubuntu7.23

Ubuntu 16.04 LTS:
  qemu                            1:2.5+dfsg-5ubuntu10.43
  qemu-system                     1:2.5+dfsg-5ubuntu10.43
  qemu-system-aarch64             1:2.5+dfsg-5ubuntu10.43
  qemu-system-arm                 1:2.5+dfsg-5ubuntu10.43
  qemu-system-mips                1:2.5+dfsg-5ubuntu10.43
  qemu-system-ppc                 1:2.5+dfsg-5ubuntu10.43
  qemu-system-s390x               1:2.5+dfsg-5ubuntu10.43
  qemu-system-sparc               1:2.5+dfsg-5ubuntu10.43
  qemu-system-x86                 1:2.5+dfsg-5ubuntu10.43

After a standard system update you need to restart all QEMU virtual
machines to make all the necessary changes.

References:
  https://usn.ubuntu.com/4283-1
  CVE-2020-1711, CVE-2020-7039, CVE-2020-8608

Package Information:
  https://launchpad.net/ubuntu/+source/qemu/1:4.0+dfsg-0ubuntu9.4
  https://launchpad.net/ubuntu/+source/qemu/1:2.11+dfsg-1ubuntu7.23
  https://launchpad.net/ubuntu/+source/qemu/1:2.5+dfsg-5ubuntu10.43

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20200218/d2557eb7/attachment-0001.sig>