[SECURITY] [DLA 619-1] qemu-kvm security update

2016-09-1117:44:21

lists.debian.org

CVSS2

2.1

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

AI Score

8.2

Confidence

High

EPSS

0.001

Percentile

25.4%

JSON

Package : qemu-kvm
Version : 1.1.2+dfsg-6+deb7u15
CVE ID : CVE-2016-7116

qemu-kvm built with the VirtFS, host directory sharing via Plan 9 File System
(9pfs) support, is vulnerable to a directory/path traversal issue. It could
occur while creating or accessing files on a shared host directory.

A privileged user inside guest could use this flaw to access undue files on the
host.

For Debian 7 "Wheezy", these problems have been fixed in version
1.1.2+dfsg-6+deb7u15.

We recommend that you upgrade your qemu-kvm packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

OSVersionArchitecturePackageVersionFilename
Debian7amd64qemu-kvm< 1.1.2+dfsg-6+deb7u15qemu-kvm_1.1.2+dfsg-6+deb7u15_amd64.deb
Debian8i386qemu-utils< 1:2.1+dfsg-12+deb8u8qemu-utils_1:2.1+dfsg-12+deb8u8_i386.deb
Debian7armhfqemu< 1.1.2+dfsg-6+deb7u15qemu_1.1.2+dfsg-6+deb7u15_armhf.deb
Debian8i386qemu-user-static< 1:2.1+dfsg-12+deb8u8qemu-user-static_1:2.1+dfsg-12+deb8u8_i386.deb
Debian7amd64qemu-system< 1.1.2+dfsg-6+deb7u15qemu-system_1.1.2+dfsg-6+deb7u15_amd64.deb
Debian8armelqemu-system-x86< 1:2.1+dfsg-12+deb8u8qemu-system-x86_1:2.1+dfsg-12+deb8u8_armel.deb
Debian7i386qemu-user-static< 1.1.2+dfsg-6+deb7u15qemu-user-static_1.1.2+dfsg-6+deb7u15_i386.deb
Debian7i386kvm< 1:1.1.2+dfsg-6+deb7u15kvm_1:1.1.2+dfsg-6+deb7u15_i386.deb
Debian7armelqemu-utils< 1.1.2+dfsg-6+deb7u15qemu-utils_1.1.2+dfsg-6+deb7u15_armel.deb
Debian8armelqemu< 1:2.1+dfsg-12+deb8u8qemu_1:2.1+dfsg-12+deb8u8_armel.deb

OS	Version	Architecture	Package	Version	Filename
Debian	7	amd64	qemu-kvm	< 1.1.2+dfsg-6+deb7u15	qemu-kvm_1.1.2+dfsg-6+deb7u15_amd64.deb
Debian	8	i386	qemu-utils	< 1:2.1+dfsg-12+deb8u8	qemu-utils_1:2.1+dfsg-12+deb8u8_i386.deb
Debian	7	armhf	qemu	< 1.1.2+dfsg-6+deb7u15	qemu_1.1.2+dfsg-6+deb7u15_armhf.deb
Debian	8	i386	qemu-user-static	< 1:2.1+dfsg-12+deb8u8	qemu-user-static_1:2.1+dfsg-12+deb8u8_i386.deb
Debian	7	amd64	qemu-system	< 1.1.2+dfsg-6+deb7u15	qemu-system_1.1.2+dfsg-6+deb7u15_amd64.deb
Debian	8	armel	qemu-system-x86	< 1:2.1+dfsg-12+deb8u8	qemu-system-x86_1:2.1+dfsg-12+deb8u8_armel.deb
Debian	7	i386	qemu-user-static	< 1.1.2+dfsg-6+deb7u15	qemu-user-static_1.1.2+dfsg-6+deb7u15_i386.deb
Debian	7	i386	kvm	< 1:1.1.2+dfsg-6+deb7u15	kvm_1:1.1.2+dfsg-6+deb7u15_i386.deb
Debian	7	armel	qemu-utils	< 1.1.2+dfsg-6+deb7u15	qemu-utils_1.1.2+dfsg-6+deb7u15_armel.deb
Debian	8	armel	qemu	< 1:2.1+dfsg-12+deb8u8	qemu_1:2.1+dfsg-12+deb8u8_armel.deb