qemu was updated to fix 29 security issues.

These security issues were fixed :

  - CVE-2016-4439: Avoid OOB access in 53C9X emulation     (bsc#980711)

  - CVE-2016-4441: Avoid OOB access in 53C9X emulation     (bsc#980723)

  - CVE-2016-4952: Avoid OOB access in Vmware PV SCSI     emulation (bsc#981266)

  - CVE-2015-8817: Avoid OOB access in PCI dma I/O     (bsc#969121)

  - CVE-2015-8818: Avoid OOB access in PCI dma I/O     (bsc#969122)

  - CVE-2016-3710: Fixed VGA emulation based OOB access with     potential for guest escape (bsc#978158)

  - CVE-2016-3712: Fixed VGa emulation based DOS and OOB     read access exploit (bsc#978160)

  - CVE-2016-4037: Fixed USB ehci based DOS (bsc#976109)

  - CVE-2016-2538: Fixed potential OOB access in USB net     device emulation (bsc#967969)

  - CVE-2016-2841: Fixed OOB access / hang in ne2000     emulation (bsc#969350)

  - CVE-2016-2858: Avoid potential DOS when using QEMU     pseudo random number generator (bsc#970036)

  - CVE-2016-2857: Fixed OOB access when processing IP     checksums (bsc#970037)

  - CVE-2016-4001: Fixed OOB access in Stellaris enet     emulated nic (bsc#975128)

  - CVE-2016-4002: Fixed OOB access in MIPSnet emulated     controller (bsc#975136)

  - CVE-2016-4020: Fixed possible host data leakage to guest     from TPR access (bsc#975700)

  - CVE-2016-2197: Prevent AHCI NULL pointer dereference     when using FIS CLB engine (bsc#964411)

  - CVE-2015-5745: Buffer overflow in virtio-serial     (bsc#940929).

  - CVE-2015-7549: PCI NULL pointer dereferences     (bsc#958917).

  - CVE-2015-8504: VNC floating point exception     (bsc#958491).

  - CVE-2015-8558: Infinite loop in ehci_advance_state     resulting in DoS (bsc#959005).

  - CVE-2015-8567: A guest repeatedly activating a vmxnet3     device can leak host memory (bsc#959386).

  - CVE-2015-8568: A guest repeatedly activating a vmxnet3     device can leak host memory (bsc#959386).

  - CVE-2015-8613: Wrong sized memset in megasas command     handler (bsc#961358).

  - CVE-2015-8619: Potential DoS for long HMP sendkey     command argument (bsc#960334).

  - CVE-2015-8743: OOB memory access in ne2000 ioport r/w     functions (bsc#960725).

  - CVE-2015-8744: Incorrect l2 header validation could have     lead to a crash via assert(2) call (bsc#960835).

  - CVE-2015-8745: Reading IMR registers could have lead to     a crash via assert(2) call (bsc#960708).

  - CVE-2016-1568: AHCI use-after-free in aio port commands     (bsc#961332).

  - CVE-2016-1714: Potential OOB memory access in processing     firmware configuration (bsc#961691).

  - CVE-2016-1922: NULL pointer dereference when processing     hmp i/o command (bsc#962320).

  - CVE-2016-1981: Potential DoS (infinite loop) in e1000     device emulation by malicious privileged user within     guest (bsc#963782).

  - CVE-2016-2198: Malicious privileged guest user were able     to cause DoS by writing to read-only EHCI capabilities     registers (bsc#964413).

This non-security issue was fixed

  - bsc#886378: qemu truncates vhd images in virt-rescue

This update was imported from the SUSE:SLE-12-SP1:Update update project.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The ehci_process_itd function in hw/usb/hcd-ehci.c in QEMU allows local guest OS administrators to cause a     denial of service (infinite loop and CPU consumption) via a circular isochronous transfer descriptor (iTD)     list. (CVE-2015-8558)

Note that Nessus relies on the presence of the package as reported by the vendor.

PV superpage functionality missing sanity checks [XSA-167, CVE-2016-1570] VMX: intercept issue with INVLPG on non-canonical address [XSA-168, CVE-2016-1571] Qemu: pci: NULL pointer dereference issue CVE-2015-7549 qemu: DoS by infinite loop in ehci_advance_state CVE-2015-8558 qemu: Heap-based buffer overrun during VM migration CVE-2015-8666 Qemu: net: vmxnet3: incorrect l2 header validation leads to a crash via assert(2) call CVE-2015-8744 qemu: Support reading IMR registers on bar0 CVE-2015-8745 Qemu: net: vmxnet3: host memory leakage CVE-2015-8567 CVE-2015-8568 Qemu: net: ne2000: OOB memory access in ioport r/w functions CVE-2015-8743

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities were discovered in qemu, a full virtualization solution on x86 hardware.

  - CVE-2015-7295     Jason Wang of Red Hat Inc. discovered that the Virtual     Network Device support is vulnerable to     denial-of-service (via resource exhaustion), that could     occur when receiving large packets.

  - CVE-2015-7504     Qinghao Tang of Qihoo 360 Inc. and Ling Liu of Qihoo 360     Inc. discovered that the PC-Net II ethernet controller     is vulnerable to a heap-based buffer overflow that could     result in denial-of-service (via application crash) or     arbitrary code execution.

  - CVE-2015-7512     Ling Liu of Qihoo 360 Inc. and Jason Wang of Red Hat     Inc. discovered that the PC-Net II ethernet controller     is vulnerable to a buffer overflow that could result in     denial-of-service (via application crash) or arbitrary     code execution.

  - CVE-2015-8345     Qinghao Tang of Qihoo 360 Inc. discovered that the     eepro100 emulator contains a flaw that could lead to an     infinite loop when processing Command Blocks, eventually     resulting in denial-of-service (via application crash).

  - CVE-2015-8504     Lian Yihan of Qihoo 360 Inc. discovered that the VNC     display driver support is vulnerable to an arithmetic     exception flaw that could lead to denial-of-service (via     application crash).

  - CVE-2015-8558     Qinghao Tang of Qihoo 360 Inc. discovered that the USB     EHCI emulation support contains a flaw that could lead     to an infinite loop during communication between the     host controller and a device driver. This could lead to     denial-of-service (via resource exhaustion).

  - CVE-2015-8743     Ling Liu of Qihoo 360 Inc. discovered that the NE2000     emulator is vulnerable to an out-of-bound read/write     access issue, potentially resulting in information leak     or memory corruption.

  - CVE-2016-1568     Qinghao Tang of Qihoo 360 Inc. discovered that the IDE     AHCI emulation support is vulnerable to a use-after-free     issue, that could lead to denial-of-service (via     application crash) or arbitrary code execution.

  - CVE-2016-1714     Donghai Zhu of Alibaba discovered that the Firmware     Configuration emulation support is vulnerable to an     out-of-bound read/write access issue, that could lead to     denial-of-service (via application crash) or arbitrary     code execution.

  - CVE-2016-1922     Ling Liu of Qihoo 360 Inc. discovered that 32-bit     Windows guests support is vulnerable to a NULL pointer     dereference issue, that could lead to denial-of-service     (via application crash).

Several vulnerabilities were discovered in qemu, a full virtualization solution on x86 hardware.

  - CVE-2015-7295     Jason Wang of Red Hat Inc. discovered that the Virtual     Network Device support is vulnerable to     denial-of-service, that could occur when receiving large     packets.

  - CVE-2015-7504     Qinghao Tang of Qihoo 360 Inc. and Ling Liu of Qihoo 360     Inc. discovered that the PC-Net II ethernet controller     is vulnerable to a heap-based buffer overflow that could     result in denial-of-service (via application crash) or     arbitrary code execution.

  - CVE-2015-7512     Ling Liu of Qihoo 360 Inc. and Jason Wang of Red Hat     Inc. discovered that the PC-Net II ethernet controller     is vulnerable to a buffer overflow that could result in     denial-of-service (via application crash) or arbitrary     code execution.

  - CVE-2015-7549     Qinghao Tang of Qihoo 360 Inc. and Ling Liu of Qihoo 360     Inc. discovered that the PCI MSI-X emulator is     vulnerable to a NULL pointer dereference issue, that     could lead to denial-of-service (via application crash).

  - CVE-2015-8345     Qinghao Tang of Qihoo 360 Inc. discovered that the     eepro100 emulator contains a flaw that could lead to an     infinite loop when processing Command Blocks, eventually     resulting in denial-of-service (via application crash).

  - CVE-2015-8504     Lian Yihan of Qihoo 360 Inc. discovered that the VNC     display driver support is vulnerable to an arithmetic     exception flaw that could lead to denial-of-service (via     application crash).

  - CVE-2015-8550     Felix Wilhelm of ERNW Research discovered that the PV     backend drivers are vulnerable to double fetch     vulnerabilities, possibly resulting in arbitrary code     execution.

  - CVE-2015-8558     Qinghao Tang of Qihoo 360 Inc. discovered that the USB     EHCI emulation support contains a flaw that could lead     to an infinite loop during communication between the     host controller and a device driver. This could lead to     denial-of-service (via resource exhaustion).

  - CVE-2015-8567 CVE-2015-8568     Qinghao Tang of Qihoo 360 Inc. discovered that the     vmxnet3 device emulator could be used to intentionally     leak host memory, thus resulting in denial-of-service.

  - CVE-2015-8613     Qinghao Tang of Qihoo 360 Inc. discovered that the SCSI     MegaRAID SAS HBA emulation support is vulnerable to a     stack-based buffer overflow issue, that could lead to     denial-of-service (via application crash).

  - CVE-2015-8619     Ling Liu of Qihoo 360 Inc. discovered that the Human     Monitor Interface support is vulnerable to an     out-of-bound write access issue that could result in     denial-of-service (via application crash).

  - CVE-2015-8743     Ling Liu of Qihoo 360 Inc. discovered that the NE2000     emulator is vulnerable to an out-of-bound read/write     access issue, potentially resulting in information leak     or memory corruption.

  - CVE-2015-8744     The vmxnet3 driver incorrectly processes small packets,     which could result in denial-of-service (via application     crash).

  - CVE-2015-8745     The vmxnet3 driver incorrectly processes Interrupt Mask     Registers, which could result in denial-of-service (via     application crash).

  - CVE-2016-1568     Qinghao Tang of Qihoo 360 Inc. discovered that the IDE     AHCI emulation support is vulnerable to a use-after-free     issue, that could lead to denial-of-service (via     application crash) or arbitrary code execution.

  - CVE-2016-1714     Donghai Zhu of Alibaba discovered that the Firmware     Configuration emulation support is vulnerable to an     out-of-bound read/write access issue, that could lead to     denial-of-service (via application crash) or arbitrary     code execution.

  - CVE-2016-1922     Ling Liu of Qihoo 360 Inc. discovered that 32-bit     Windows guests support is vulnerable to a NULL pointer     dereference issue, that could lead to denial-of-service     (via application crash).

  - CVE-2016-1981     The e1000 driver is vulnerable to an infinite loop issue     that could lead to denial-of-service (via application     crash).

ID	名前	製品	ファミリー	公開日	更新日	深刻度
91980	openSUSE Security Update : qemu (openSUSE-2016-839)	Nessus	SuSE Local Security Checks	2016/7/8	2021/1/19	critical
218737	Linux Distros Unpatched Vulnerability : CVE-2015-8558	Nessus	Misc.	2025/3/4	2025/9/4	medium
89503	Fedora 23 : xen-4.5.2-7.fc23 (2016-2c15b72b01)	Nessus	Fedora Local Security Checks	2016/3/4	2021/1/11	high
88628	Debian DSA-3469-1 : qemu - security update	Nessus	Debian Local Security Checks	2016/2/9	2021/1/11	critical
88630	Debian DSA-3471-1 : qemu - security update	Nessus	Debian Local Security Checks	2016/2/9	2021/1/11	critical

検出

プラグインの検索

critical

medium

high

critical

critical