[SECURITY] [DLA 3759-1] qemu security update

2024-03-1117:27:07

lists.debian.org

qemu

vulnerabilities

debian 10 buster

security update

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

8.1

Confidence

High

EPSS

0.001

Percentile

38.9%

JSON

Debian LTS Advisory DLA-3759-1 [email protected]
https://www.debian.org/lts/security/ Adrian Bunk
March 11, 2024 https://wiki.debian.org/LTS

Package : qemu
Version : 1:3.1+dfsg-8+deb10u12
CVE ID : CVE-2023-2861 CVE-2023-3354 CVE-2023-5088

Multiple vulnerabilities have been fixed in the machine emulator
and virtualizer QEMU.

CVE-2023-2861

9pfs did not prohibit opening special files on the host side

CVE-2023-3354

remote unauthenticated clients could cause denial of service in VNC server

CVE-2023-5088

IDE guest I/O operation addressed to an arbitrary disk offset might 
get targeted to offset 0 instead

For Debian 10 buster, these problems have been fixed in version
1:3.1+dfsg-8+deb10u12.

We recommend that you upgrade your qemu packages.

For the detailed security status of qemu please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/qemu

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

OSVersionArchitecturePackageVersionFilename
Debian12s390xqemu-system-sparc-dbgsym< 1:7.2+dfsg-7+deb12u1qemu-system-sparc-dbgsym_1:7.2+dfsg-7+deb12u1_s390x.deb
Debian12armhfqemu-system-sparc-dbgsym< 1:7.2+dfsg-7+deb12u1qemu-system-sparc-dbgsym_1:7.2+dfsg-7+deb12u1_armhf.deb
Debian12arm64qemu-system-arm< 1:7.2+dfsg-7+deb12u1qemu-system-arm_1:7.2+dfsg-7+deb12u1_arm64.deb
Debian11i386qemu-guest-agent< 1:5.2+dfsg-11+deb11u3qemu-guest-agent_1:5.2+dfsg-11+deb11u3_i386.deb
Debian11mipselqemu-system-mips-dbgsym< 1:5.2+dfsg-11+deb11u3qemu-system-mips-dbgsym_1:5.2+dfsg-11+deb11u3_mipsel.deb
Debian12arm64qemu-system-arm-dbgsym< 1:7.2+dfsg-7+deb12u2qemu-system-arm-dbgsym_1:7.2+dfsg-7+deb12u2_arm64.deb
Debian12mips64elqemu-system-common-dbgsym< 1:7.2+dfsg-7+deb12u1qemu-system-common-dbgsym_1:7.2+dfsg-7+deb12u1_mips64el.deb
Debian11armhfqemu-system-x86-dbgsym< 1:5.2+dfsg-11+deb11u3qemu-system-x86-dbgsym_1:5.2+dfsg-11+deb11u3_armhf.deb
Debian12amd64qemu-system-ppc-dbgsym< 1:7.2+dfsg-7+deb12u2qemu-system-ppc-dbgsym_1:7.2+dfsg-7+deb12u2_amd64.deb
Debian12amd64qemu-system-common-dbgsym< 1:7.2+dfsg-7+deb12u3qemu-system-common-dbgsym_1:7.2+dfsg-7+deb12u3_amd64.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	s390x	qemu-system-sparc-dbgsym	< 1:7.2+dfsg-7+deb12u1	qemu-system-sparc-dbgsym_1:7.2+dfsg-7+deb12u1_s390x.deb
Debian	12	armhf	qemu-system-sparc-dbgsym	< 1:7.2+dfsg-7+deb12u1	qemu-system-sparc-dbgsym_1:7.2+dfsg-7+deb12u1_armhf.deb
Debian	12	arm64	qemu-system-arm	< 1:7.2+dfsg-7+deb12u1	qemu-system-arm_1:7.2+dfsg-7+deb12u1_arm64.deb
Debian	11	i386	qemu-guest-agent	< 1:5.2+dfsg-11+deb11u3	qemu-guest-agent_1:5.2+dfsg-11+deb11u3_i386.deb
Debian	11	mipsel	qemu-system-mips-dbgsym	< 1:5.2+dfsg-11+deb11u3	qemu-system-mips-dbgsym_1:5.2+dfsg-11+deb11u3_mipsel.deb
Debian	12	arm64	qemu-system-arm-dbgsym	< 1:7.2+dfsg-7+deb12u2	qemu-system-arm-dbgsym_1:7.2+dfsg-7+deb12u2_arm64.deb
Debian	12	mips64el	qemu-system-common-dbgsym	< 1:7.2+dfsg-7+deb12u1	qemu-system-common-dbgsym_1:7.2+dfsg-7+deb12u1_mips64el.deb
Debian	11	armhf	qemu-system-x86-dbgsym	< 1:5.2+dfsg-11+deb11u3	qemu-system-x86-dbgsym_1:5.2+dfsg-11+deb11u3_armhf.deb
Debian	12	amd64	qemu-system-ppc-dbgsym	< 1:7.2+dfsg-7+deb12u2	qemu-system-ppc-dbgsym_1:7.2+dfsg-7+deb12u2_amd64.deb
Debian	12	amd64	qemu-system-common-dbgsym	< 1:7.2+dfsg-7+deb12u3	qemu-system-common-dbgsym_1:7.2+dfsg-7+deb12u3_amd64.deb