File _patchinfo of Package patchinfo.4227

<patchinfo incident="4227">
  <issue id="1013285" tracker="bnc">VUL-0: CVE-2016-9776: qemu: net: mcf_fec: infinite loop while receiving data in mcf_fec_receive</issue>
  <issue id="1014109" tracker="bnc">VUL-0: CVE-2016-9907: qemu: usb: redirector: memory leakage when destroying redirector</issue>
  <issue id="1023004" tracker="bnc">VUL-0: CVE-2017-2615: kvm: qemu: display: cirrus: oob access while doing bitblt copy backward mode [XSA-208]</issue>
  <issue id="1024972" tracker="bnc">VUL-0: EMBARGOED: CVE-2017-2620: qemu,kvm: cirrus_bitblt_cputovideo does not check if memory region is safe (XSA-209)</issue>
  <issue id="1014111" tracker="bnc">VUL-0: CVE-2016-9911: qemu: usb: ehci: memory leakage in ehci_init_transfer</issue>
  <issue id="1016779" tracker="bnc">QEMU after qemu update login screen on top of SLES11SP4 HVM guests is broken</issue>
  <issue id="1023053" tracker="bnc">VUL-0: CVE-2017-5856: kvm,qemu: scsi/megasas: host memory leakage in megasas_handle_dcmd</issue>
  <issue id="1015169" tracker="bnc">VUL-0: CVE-2016-9921, CVE-2016-9922: xen: qemu: display: cirrus_vga: a divide by zero in cirrus_do_copy</issue>
  <issue id="1022541" tracker="bnc">VUL-0: CVE-2017-5667: kvm: qemu: sd: sdhci OOB access during multi block SDMA transfer</issue>
  <issue id="1015048" tracker="bnc">nova-kvm: VMs shutdown shortly after live migration</issue>
  <issue id="1014702" tracker="bnc">VUL-0: CVE-2016-9921, CVE-2016-9922: qemu: display: cirrus_vga: a divide by zero in cirrus_do_copy</issue>
  <issue id="1021129" tracker="bnc">VUL-0: CVE-2016-10155: kvm: qemu: watchdog: memory leakage in virtual hardware watchdog wdt_i6300esb</issue>
  <issue id="1023907" tracker="bnc">VUL-0: CVE-2017-5898: kvm: qemu: usb: integer overflow in emulated_apdu_from_guest</issue>
  <issue id="2016-10155" tracker="cve" />
  <issue id="2017-5898" tracker="cve" />
  <issue id="2017-2615" tracker="cve" />
  <issue id="2016-9776" tracker="cve" />
  <issue id="2016-9922" tracker="cve" />
  <issue id="2017-5856" tracker="cve" />
  <issue id="2017-5667" tracker="cve" />
  <issue id="2017-2620" tracker="cve" />
  <issue id="2016-9921" tracker="cve" />
  <issue id="2016-9907" tracker="cve" />
  <issue id="2016-9911" tracker="cve" />
  <category>security</category>
  <rating>important</rating>
  <packager>bfrogers</packager>
  <description>
This update for qemu fixes several issues.

These security issues were fixed:

- CVE-2017-2620: In CIRRUS_BLTMODE_MEMSYSSRC mode the bitblit copy routine cirrus_bitblt_cputovideo failed to check the memory region, allowing for an out-of-bounds write that allows for privilege escalation (bsc#1024972)
- CVE-2017-2615: An error in the bitblt copy operation could have allowed a malicious guest administrator to cause an out of bounds memory access, possibly leading to information disclosure or privilege escalation (bsc#1023004)
- CVE-2017-5856: The MegaRAID SAS 8708EM2 Host Bus Adapter emulation support was vulnerable to a memory leakage issue allowing a privileged user to leak host memory resulting in DoS (bsc#1023053)
- CVE-2016-9776: The ColdFire Fast Ethernet Controller emulator support was vulnerable to an infinite loop issue while receiving packets in 'mcf_fec_receive'. A privileged user/process inside guest could have used this issue to crash the Qemu process on the host leading to DoS (bsc#1013285)
- CVE-2016-9911: The USB EHCI Emulation support was vulnerable to a memory leakage issue while processing packet data in 'ehci_init_transfer'. A guest user/process could have used this issue to leak host memory, resulting in DoS for the host (bsc#1014111)
- CVE-2016-9907: The USB redirector usb-guest support was vulnerable to a memory leakage flaw when destroying the USB redirector in 'usbredir_handle_destroy'.  A guest user/process could have used this issue to leak host memory, resulting in DoS for a host (bsc#1014109)
- CVE-2016-9921: The Cirrus CLGD 54xx VGA Emulator support was vulnerable to a divide by zero issue while copying VGA data. A privileged user inside guest could have used this flaw to crash the process instance on the host, resulting in DoS (bsc#1014702)
- CVE-2016-9922: The Cirrus CLGD 54xx VGA Emulator support was vulnerable to a divide by zero issue while copying VGA data. A privileged user inside guest could have used this flaw to crash the process instance on the host, resulting in DoS (bsc#1014702)
- CVE-2017-5667: The SDHCI device emulation support was vulnerable to an OOB heap access issue allowing a privileged user inside the guest to crash the Qemu process resulting in DoS or potentially execute arbitrary code with privileges of the Qemu process on the host (bsc#1022541)
- CVE-2017-5898: The CCID Card device emulator support was vulnerable to an integer overflow allowing a privileged user inside the guest to crash the Qemu process resulting in DoS (bnc#1023907)
- CVE-2016-10155: The i6300esb watchdog emulation support was vulnerable to a memory leakage issue allowing a privileged user inside the guest to leak memory on the host resulting in DoS (bnc#1021129)

These non-security issues were fixed:

- Fixed various inaccuracies in cirrus vga device emulation
- Fixed virtio interface failure (bsc#1015048)
- Fixed graphical update errors introduced by previous security fix (bsc#1016779)
</description>
  <summary>Security update for qemu</summary>
</patchinfo>