Security update for qemu

This update for qemu fixes several issues.

These security issues were fixed:

- CVE-2017-2620: In CIRRUS_BLTMODE_MEMSYSSRC mode the bitblit copy routine cirrus_bitblt_cputovideo failed to check the memory region, allowing for an out-of-bounds write that allows for privilege escalation (bsc#1024972)
- CVE-2017-2615: An error in the bitblt copy operation could have allowed a malicious guest administrator to cause an out of bounds memory access, possibly leading to information disclosure or privilege escalation (bsc#1023004)
- CVE-2017-5856: The MegaRAID SAS 8708EM2 Host Bus Adapter emulation support was vulnerable to a memory leakage issue allowing a privileged user to leak host memory resulting in DoS (bsc#1023053)
- CVE-2016-9776: The ColdFire Fast Ethernet Controller emulator support was vulnerable to an infinite loop issue while receiving packets in 'mcf_fec_receive'. A privileged user/process inside guest could have used this issue to crash the Qemu process on the host leading to DoS (bsc#1013285)
- CVE-2016-9911: The USB EHCI Emulation support was vulnerable to a memory leakage issue while processing packet data in 'ehci_init_transfer'. A guest user/process could have used this issue to leak host memory, resulting in DoS for the host (bsc#1014111)
- CVE-2016-9907: The USB redirector usb-guest support was vulnerable to a memory leakage flaw when destroying the USB redirector in 'usbredir_handle_destroy'. A guest user/process could have used this issue to leak host memory, resulting in DoS for a host (bsc#1014109)
- CVE-2016-9921: The Cirrus CLGD 54xx VGA Emulator support was vulnerable to a divide by zero issue while copying VGA data. A privileged user inside guest could have used this flaw to crash the process instance on the host, resulting in DoS (bsc#1014702)
- CVE-2016-9922: The Cirrus CLGD 54xx VGA Emulator support was vulnerable to a divide by zero issue while copying VGA data. A privileged user inside guest could have used this flaw to crash the process instance on the host, resulting in DoS (bsc#1014702)
- CVE-2016-10155: The virtual hardware watchdog 'wdt_i6300esb' was vulnerable to a memory leakage issue allowing a privileged user to cause a DoS and/or potentially crash the Qemu process on the host (bsc#1021129)
- CVE-2017-5526: The ES1370 audio device emulation support was vulnerable to a memory leakage issue allowing a privileged user inside the guest to cause a DoS and/or potentially crash the Qemu process on the host (bsc#1020589)
- CVE-2017-5525: The ac97 audio device emulation support was vulnerable to a memory leakage issue allowing a privileged user inside the guest to cause a DoS and/or potentially crash the Qemu process on the host (bsc#1020491)
- CVE-2017-5667: The SDHCI device emulation support was vulnerable to an OOB heap access issue allowing a privileged user inside the guest to crash the Qemu process resulting in DoS or potentially execute arbitrary code with privileges of the Qemu process on the host (bsc#1022541)
- CVE-2017-5898: The CCID Card device emulator support was vulnerable to an integer overflow allowing a privileged user inside the guest to crash the Qemu process resulting in DoS (bnc#1023907)

These non-security issues were fixed:

- Fix post script for qemu-guest-agent rpm to actually activate the guest agent at rpm install time
- Fixed various inaccuracies in cirrus vga device emulation
- Fixed cause of infrequent migration failures from bad virtio device state (bsc#1020928)
- Fixed virtio interface failure (bsc#1015048)
- Fixed graphical update errors introduced by previous security fix (bsc#1016779)
- Fixed uint64 property parsing and add regression tests (bsc#937125)

This update was imported from the SUSE:SLE-12-SP1:Update update project.

Fixed bugs
bnc#1013285
VUL-0: CVE-2016-9776: qemu: net: mcf_fec: infinite loop while receiving data in mcf_fec_receive
bnc#1020491
VUL-0: CVE-2017-5525: kvm: qemu: audio: memory leakage in ac97 device
bnc#1014109
VUL-0: CVE-2016-9907: qemu: usb: redirector: memory leakage when destroying redirector
bnc#1023004
VUL-0: CVE-2017-2615: kvm: qemu: display: cirrus: oob access while doing bitblt copy backward mode [XSA-208]
bnc#937125
SLES 12 KVM host: disks with hardcoded WWNs create error: "early end of file from monitor: possible problem:"
bnc#1024972
VUL-0: EMBARGOED: CVE-2017-2620: qemu,kvm: cirrus_bitblt_cputovideo does not check if memory region is safe (XSA-209)
bnc#1020928
L3: live migration does not start for 2/100 attempts
bnc#1014111
VUL-0: CVE-2016-9911: qemu: usb: ehci: memory leakage in ehci_init_transfer
bnc#1016779
QEMU after qemu update login screen on top of SLES11SP4 HVM guests is broken
bnc#1020589
VUL-0: CVE-2017-5526: kvm: qemu: audio: memory leakage in es1370 device
bnc#1023053
VUL-0: CVE-2017-5856: kvm,qemu: scsi/megasas: host memory leakage in megasas_handle_dcmd
bnc#1015169
VUL-0: CVE-2016-9921, CVE-2016-9922: xen: qemu: display: cirrus_vga: a divide by zero in cirrus_do_copy
bnc#1022541
VUL-0: CVE-2017-5667: kvm: qemu: sd: sdhci OOB access during multi block SDMA transfer
bnc#1015048
nova-kvm: VMs shutdown shortly after live migration
bnc#1021129
VUL-0: CVE-2016-10155: kvm: qemu: watchdog: memory leakage in virtual hardware watchdog wdt_i6300esb
bnc#1014702
VUL-0: CVE-2016-9921, CVE-2016-9922: qemu: display: cirrus_vga: a divide by zero in cirrus_do_copy
bnc#1023907
VUL-0: CVE-2017-5898: kvm: qemu: usb: integer overflow in emulated_apdu_from_guest
Selected Binaries
openSUSE Build Service is sponsored by