qemu: CVE-2015-6815: net: e1000 infinite loop issue

Related Vulnerabilities: CVE-2015-6815   CVE-2015-6855  

Debian Bug report logs - #798101
qemu: CVE-2015-6815: net: e1000 infinite loop issue

version graph

Reported by: Salvatore Bonaccorso <carnil@debian.org>

Date: Sat, 5 Sep 2015 16:33:06 UTC

Severity: important

Tags: patch, security, upstream

Found in version qemu/1.1.2+dfsg-6a

Fixed in versions qemu/1:2.4+dfsg-2, qemu/1:2.1+dfsg-12+deb8u3, qemu/1.1.2+dfsg-6a+deb7u10, qemu-kvm/1.1.2+dfsg-6+deb7u10

Done: Michael Tokarev <mjt@tls.msk.ru>

Bug is archived. No further changes may be made.

Toggle useless messages

View this report as an mbox folder, status mbox, maintainer mbox


Report forwarded to debian-bugs-dist@lists.debian.org, carnil@debian.org, team@security.debian.org, secure-testing-team@lists.alioth.debian.org, Debian QEMU Team <pkg-qemu-devel@lists.alioth.debian.org>:
Bug#798101; Package src:qemu. (Sat, 05 Sep 2015 16:33:09 GMT) (full text, mbox, link).


Acknowledgement sent to Salvatore Bonaccorso <carnil@debian.org>:
New Bug report received and forwarded. Copy sent to carnil@debian.org, team@security.debian.org, secure-testing-team@lists.alioth.debian.org, Debian QEMU Team <pkg-qemu-devel@lists.alioth.debian.org>. (Sat, 05 Sep 2015 16:33:09 GMT) (full text, mbox, link).


Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: qemu: CVE-2015-6815: net: e1000 infinite loop issue
Date: Sat, 05 Sep 2015 18:31:28 +0200
Source: qemu
Version: 1.1.2+dfsg-6a
Severity: important
Tags: security upstream patch

Hi,

the following vulnerability was published for qemu.

CVE-2015-6815[0]:
Qemu: net: e1000 infinite loop issue

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2015-6815
[1] https://lists.gnu.org/archive/html/qemu-devel/2015-09/msg01199.html

The fix is not yet in the qemu git repository.

Regards,
Salvatore



Added tag(s) pending. Request was from <mjt@tls.msk.ru> to control@bugs.debian.org. (Mon, 07 Sep 2015 14:21:03 GMT) (full text, mbox, link).


Reply sent to Michael Tokarev <mjt@tls.msk.ru>:
You have taken responsibility. (Fri, 11 Sep 2015 17:42:17 GMT) (full text, mbox, link).


Notification sent to Salvatore Bonaccorso <carnil@debian.org>:
Bug acknowledged by developer. (Fri, 11 Sep 2015 17:42:17 GMT) (full text, mbox, link).


Message #12 received at 798101-close@bugs.debian.org (full text, mbox, reply):

From: Michael Tokarev <mjt@tls.msk.ru>
To: 798101-close@bugs.debian.org
Subject: Bug#798101: fixed in qemu 1:2.4+dfsg-2
Date: Fri, 11 Sep 2015 17:40:35 +0000
Source: qemu
Source-Version: 1:2.4+dfsg-2

We believe that the bug you reported is fixed in the latest version of
qemu, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 798101@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Michael Tokarev <mjt@tls.msk.ru> (supplier of updated qemu package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.8
Date: Fri, 11 Sep 2015 19:54:07 +0300
Source: qemu
Binary: qemu qemu-system qemu-block-extra qemu-system-common qemu-system-misc qemu-system-arm qemu-system-mips qemu-system-ppc qemu-system-sparc qemu-system-x86 qemu-user qemu-user-static qemu-user-binfmt qemu-utils qemu-guest-agent qemu-kvm libcacard0 libcacard-dev libcacard-tools
Architecture: source
Version: 1:2.4+dfsg-2
Distribution: unstable
Urgency: high
Maintainer: Debian QEMU Team <pkg-qemu-devel@lists.alioth.debian.org>
Changed-By: Michael Tokarev <mjt@tls.msk.ru>
Description:
 libcacard-dev - Virtual Common Access Card (CAC) Emulator (development files)
 libcacard-tools - Virtual Common Access Card (CAC) Emulator (tools)
 libcacard0 - Virtual Common Access Card (CAC) Emulator (runtime library)
 qemu       - fast processor emulator
 qemu-block-extra - extra block backend modules for qemu-system and qemu-utils
 qemu-guest-agent - Guest-side qemu-system agent
 qemu-kvm   - QEMU Full virtualization on x86 hardware
 qemu-system - QEMU full system emulation binaries
 qemu-system-arm - QEMU full system emulation binaries (arm)
 qemu-system-common - QEMU full system emulation binaries (common files)
 qemu-system-mips - QEMU full system emulation binaries (mips)
 qemu-system-misc - QEMU full system emulation binaries (miscelaneous)
 qemu-system-ppc - QEMU full system emulation binaries (ppc)
 qemu-system-sparc - QEMU full system emulation binaries (sparc)
 qemu-system-x86 - QEMU full system emulation binaries (x86)
 qemu-user  - QEMU user mode emulation binaries
 qemu-user-binfmt - QEMU user mode binfmt registration for qemu-user
 qemu-user-static - QEMU user mode emulation binaries (static version)
 qemu-utils - QEMU utilities
Closes: 798101
Changes:
 qemu (1:2.4+dfsg-2) unstable; urgency=high
 .
   * Add e1000-avoid-infinite-loop-in-transmit-CVE-2015-6815.patch.
     CVE-2015-6815: net: e1000 infinite loop issue in processing transmit
     descriptor.  (Closes: #798101 CVE-2015-6815)
   * Add ide-fix-ATAPI-command-permissions-CVE-2015-6855.patch.
     CVE-2015-6855: ide: qemu allows arbitrary commands to be sent to an ATAPI
     device from guest, while illegal comands might have security impact,
     f.e. WIN_READ_NATIVE_MAX results in divide by zero error.
     (Closes: CVE-2015-6855)
Checksums-Sha1:
 212f9a2e788e38ff1960d2f22f31435da5053adb 6038 qemu_2.4+dfsg-2.dsc
 c341787fb498cb69b5ffeb83a9f9ea7383ae312d 64272 qemu_2.4+dfsg-2.debian.tar.xz
Checksums-Sha256:
 5793dce2c0b247042e2355135f820a981f55ff4a07ea228528187db57961549f 6038 qemu_2.4+dfsg-2.dsc
 5773a126dcb6bbfdcb785058ae8acd26e2b4a53be14f20d5c05be045b4017f57 64272 qemu_2.4+dfsg-2.debian.tar.xz
Files:
 fcba6939e144a71ae03c9aa485473fff 6038 otherosfs optional qemu_2.4+dfsg-2.dsc
 cb12f2603f5a206b529851b7984a4904 64272 otherosfs optional qemu_2.4+dfsg-2.debian.tar.xz

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQEcBAEBAgAGBQJV8weoAAoJEL7lnXSkw9fbaKcH/jmDNlt975Pu3FAGEj31SrWy
LaCZ9ieOPGU5WAo9GAEIV6ZH19s8aFZmjzO3NiWRzcUKLAP73iQWiWXat851C8jO
6uyJaZRxcK/KLxDG2xMJuQ0vJxCO5aUE7cQ2LSP3pV6h0VSuZ+wYtMs7+GytGkoZ
tJ8bx8h8FDCrvIvcGC5Jsy6Bw//fiFJWT74tj77GCTnu1dwfrcrxNubgvQvA4A84
U/EClIfb9XLCG09kO5yRvvZAnPwRN+uVSYwPCB0uMY8mj712qT8XwiFR0Z7Q17Qc
Ht9+CzU7qzj8b0pETvMCnmk2rt5/jfPzYy92Dzl68Ol3M/+RN7QE/APS8T0vYCU=
=74OA
-----END PGP SIGNATURE-----




Reply sent to Michael Tokarev <mjt@tls.msk.ru>:
You have taken responsibility. (Tue, 22 Sep 2015 21:27:17 GMT) (full text, mbox, link).


Notification sent to Salvatore Bonaccorso <carnil@debian.org>:
Bug acknowledged by developer. (Tue, 22 Sep 2015 21:27:18 GMT) (full text, mbox, link).


Message #17 received at 798101-close@bugs.debian.org (full text, mbox, reply):

From: Michael Tokarev <mjt@tls.msk.ru>
To: 798101-close@bugs.debian.org
Subject: Bug#798101: fixed in qemu 1:2.1+dfsg-12+deb8u3
Date: Tue, 22 Sep 2015 21:22:51 +0000
Source: qemu
Source-Version: 1:2.1+dfsg-12+deb8u3

We believe that the bug you reported is fixed in the latest version of
qemu, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 798101@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Michael Tokarev <mjt@tls.msk.ru> (supplier of updated qemu package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Mon, 07 Sep 2015 16:54:32 +0300
Source: qemu
Binary: qemu qemu-system qemu-system-common qemu-system-misc qemu-system-arm qemu-system-mips qemu-system-ppc qemu-system-sparc qemu-system-x86 qemu-user qemu-user-static qemu-user-binfmt qemu-utils qemu-guest-agent qemu-kvm
Architecture: source
Version: 1:2.1+dfsg-12+deb8u3
Distribution: jessie-security
Urgency: high
Maintainer: Debian QEMU Team <pkg-qemu-devel@lists.alioth.debian.org>
Changed-By: Michael Tokarev <mjt@tls.msk.ru>
Description:
 qemu       - fast processor emulator
 qemu-guest-agent - Guest-side qemu-system agent
 qemu-kvm   - QEMU Full virtualization on x86 hardware
 qemu-system - QEMU full system emulation binaries
 qemu-system-arm - QEMU full system emulation binaries (arm)
 qemu-system-common - QEMU full system emulation binaries (common files)
 qemu-system-mips - QEMU full system emulation binaries (mips)
 qemu-system-misc - QEMU full system emulation binaries (miscelaneous)
 qemu-system-ppc - QEMU full system emulation binaries (ppc)
 qemu-system-sparc - QEMU full system emulation binaries (sparc)
 qemu-system-x86 - QEMU full system emulation binaries (x86)
 qemu-user  - QEMU user mode emulation binaries
 qemu-user-binfmt - QEMU user mode binfmt registration for qemu-user
 qemu-user-static - QEMU user mode emulation binaries (static version)
 qemu-utils - QEMU utilities
Closes: 798101
Changes:
 qemu (1:2.1+dfsg-12+deb8u3) jessie-security; urgency=high
 .
   * Acknowlege the previous update.  Thank you Salvatore for the hard
     work you did fixing so many security issues.
   * rename last patches removing numeric prefixes, so that different series
     wont intermix with each other, add Bug-Debian: headers.
   * Add e1000-avoid-infinite-loop-in-transmit-CVE-2015-6815.patch.
     CVE-2015-6815: net: e1000 infinite loop issue in processing transmit
     descriptor.  (Closes: #798101 CVE-2015-6815)
   * Add ide-fix-ATAPI-command-permissions-CVE-2015-6855.patch.
     CVE-2015-6855: ide: qemu allows arbitrary commands to be sent to an ATAPI
     device from guest, while illegal comands might have security impact,
     f.e. WIN_READ_NATIVE_MAX results in divide by zero error.
     (Closes: CVE-2015-6855)
Checksums-Sha1:
 12f136a532dd661f69ea5507a15d21157925e1bd 5174 qemu_2.1+dfsg-12+deb8u3.dsc
 161963b8a07b5ebdee3c952d88556f626aaf21e9 114600 qemu_2.1+dfsg-12+deb8u3.debian.tar.xz
Checksums-Sha256:
 f8a84d05f9e5355da1a1fdedb2e4c73e28765e22ab85c1b17c5ddd89877a2f96 5174 qemu_2.1+dfsg-12+deb8u3.dsc
 b21806211af1568fe1caea6f8d8e0825de953548bcb581218440f6350da4aad8 114600 qemu_2.1+dfsg-12+deb8u3.debian.tar.xz
Files:
 9cd48301a7fd4f6d2864668d0a305c8c 5174 otherosfs optional qemu_2.1+dfsg-12+deb8u3.dsc
 f449d1801402737756dcb73db1db4e6f 114600 otherosfs optional qemu_2.1+dfsg-12+deb8u3.debian.tar.xz

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBCAAGBQJV8+hJAAoJEL7lnXSkw9fb/d8H/AxvQgpNvn67Ovbf5UUFoLUO
DvMq9dIzMU3NwqJsc2kI73sUktHGRthc+gg+NkVspsN8XrYVF0UeydrOoHVKmhZk
GGz1kNlNIIEqV70Ajmo8cqvc/r189GYIJ39lRrNsdUY8K4COqwMy4c2YzJIkQMmh
hvof2H/wYDwN17CZ6JdppEV+kpcaXfYFXRepdo32ziET/UeBKR5optB+HYFl+e4Z
kdYN8JGHblcVgkTxd5hlajENO9g8RDxcvukQSC1pmpu8BGblAwDSXyl8/Bfj/gek
UyKst58oCXgRgNDECJM8pgris3QxP67a3DXNePSOcYc7lmnJpOhTW28AvkFWIMk=
=FUMV
-----END PGP SIGNATURE-----




Reply sent to Michael Tokarev <mjt@tls.msk.ru>:
You have taken responsibility. (Tue, 22 Sep 2015 21:33:08 GMT) (full text, mbox, link).


Notification sent to Salvatore Bonaccorso <carnil@debian.org>:
Bug acknowledged by developer. (Tue, 22 Sep 2015 21:33:08 GMT) (full text, mbox, link).


Message #22 received at 798101-close@bugs.debian.org (full text, mbox, reply):

From: Michael Tokarev <mjt@tls.msk.ru>
To: 798101-close@bugs.debian.org
Subject: Bug#798101: fixed in qemu 1.1.2+dfsg-6a+deb7u10
Date: Tue, 22 Sep 2015 21:29:26 +0000
Source: qemu
Source-Version: 1.1.2+dfsg-6a+deb7u10

We believe that the bug you reported is fixed in the latest version of
qemu, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 798101@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Michael Tokarev <mjt@tls.msk.ru> (supplier of updated qemu package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.8
Date: Fri, 11 Sep 2015 19:40:24 +0300
Source: qemu
Binary: qemu qemu-keymaps qemu-system qemu-user qemu-user-static qemu-utils
Architecture: source all amd64
Version: 1.1.2+dfsg-6a+deb7u10
Distribution: wheezy-security
Urgency: high
Maintainer: Debian QEMU Team <pkg-qemu-devel@lists.alioth.debian.org>
Changed-By: Michael Tokarev <mjt@tls.msk.ru>
Description: 
 qemu       - fast processor emulator
 qemu-keymaps - QEMU keyboard maps
 qemu-system - QEMU full system emulation binaries
 qemu-user  - QEMU user mode emulation binaries
 qemu-user-static - QEMU user mode emulation binaries (static version)
 qemu-utils - QEMU utilities
Closes: 798101
Changes: 
 qemu (1.1.2+dfsg-6a+deb7u10) wheezy-security; urgency=high
 .
   * Acknowlege the previous update.  Thank you Salvatore for the hard
     work you did fixing so many security issues.
   * rename last patches removing numeric prefixes, so that different series
     wont intermix with each other, add Bug-Debian: headers.
   * Add e1000-avoid-infinite-loop-in-transmit-CVE-2015-6815.patch.
     CVE-2015-6815: net: e1000 infinite loop issue in processing transmit
     descriptor.  (Closes: #798101 CVE-2015-6815)
   * Add ide-fix-ATAPI-command-permissions-CVE-2015-6855.patch.
     CVE-2015-6855: ide: qemu allows arbitrary commands to be sent to an ATAPI
     device from guest, while illegal comands might have security impact,
     f.e. WIN_READ_NATIVE_MAX results in divide by zero error.
     (Closes: CVE-2015-6855)
Checksums-Sha1: 
 8062ee11cfe5864e4d028a3a1c2f35dc2a0595c5 2621 qemu_1.1.2+dfsg-6a+deb7u10.dsc
 256fcdd9a4ad7af905c0bc0402b2dc221a07154a 118100 qemu_1.1.2+dfsg-6a+deb7u10.debian.tar.gz
 f072b6bdbf94bd55ededb8dfc68d502f41a67e76 50278 qemu-keymaps_1.1.2+dfsg-6a+deb7u10_all.deb
 f28131c27e665be22b90523448e861945c63045d 115688 qemu_1.1.2+dfsg-6a+deb7u10_amd64.deb
 d41809f760fe59fcd486425eaab94a919c8c9952 27895684 qemu-system_1.1.2+dfsg-6a+deb7u10_amd64.deb
 94fed93c1793d9e06bffef98ec90bcbc5c9e135c 7724448 qemu-user_1.1.2+dfsg-6a+deb7u10_amd64.deb
 e99a7ef2fb79fe20f0401f6fd6acb4aa97cdee15 16569130 qemu-user-static_1.1.2+dfsg-6a+deb7u10_amd64.deb
 0988be422ef153e143382661a0edbdf50a63c4cf 664674 qemu-utils_1.1.2+dfsg-6a+deb7u10_amd64.deb
Checksums-Sha256: 
 d74f848fc13169defba592c96056ba68f2575bcc4b5e54e774b71458dbe8a1ec 2621 qemu_1.1.2+dfsg-6a+deb7u10.dsc
 196be60b0b8f22004a24763177cedff1dc51db4fb1ba1feefe0afc791c4c4c71 118100 qemu_1.1.2+dfsg-6a+deb7u10.debian.tar.gz
 ff659865e58bca127ae25438b838b1fc6e70a6d352900af929bcd0a937883f10 50278 qemu-keymaps_1.1.2+dfsg-6a+deb7u10_all.deb
 57b4b823ac96d3ad71e468401272a738862da613b3533b6047e45ed2e12de436 115688 qemu_1.1.2+dfsg-6a+deb7u10_amd64.deb
 0b5c8a501986d6869780c6f865b255bf311087d674d3068d6569c684b35c8bda 27895684 qemu-system_1.1.2+dfsg-6a+deb7u10_amd64.deb
 d5929889bd57c24dba0d1e17fb9a56ff69a161d84bfafbf70f091a88daa48297 7724448 qemu-user_1.1.2+dfsg-6a+deb7u10_amd64.deb
 43f602ab5c7475d42a196d44c40d7d5b1ff276106884a485ae166b9c188baaab 16569130 qemu-user-static_1.1.2+dfsg-6a+deb7u10_amd64.deb
 75f542b7c8cbe8882f76b1407de8559ffc6ab6836cafec9407788a124e4f2c3a 664674 qemu-utils_1.1.2+dfsg-6a+deb7u10_amd64.deb
Files: 
 570ace858ba58f50263bda47cd757f85 2621 misc optional qemu_1.1.2+dfsg-6a+deb7u10.dsc
 546a7fee6237da801614a860ac2cf161 118100 misc optional qemu_1.1.2+dfsg-6a+deb7u10.debian.tar.gz
 3d3f01b35b2a379494bceedbaff6bcbb 50278 misc optional qemu-keymaps_1.1.2+dfsg-6a+deb7u10_all.deb
 676f9896c8be49f630ae078b654916ed 115688 misc optional qemu_1.1.2+dfsg-6a+deb7u10_amd64.deb
 6c24a0f6f8c9b12d6c04006eaf0440ec 27895684 misc optional qemu-system_1.1.2+dfsg-6a+deb7u10_amd64.deb
 e33da4a2a6ea71049b560895c8fa4829 7724448 misc optional qemu-user_1.1.2+dfsg-6a+deb7u10_amd64.deb
 300a08db3fd7689357174dca30b7e74b 16569130 misc optional qemu-user-static_1.1.2+dfsg-6a+deb7u10_amd64.deb
 a183df7de0721e7a9cea3acdced5525b 664674 misc optional qemu-utils_1.1.2+dfsg-6a+deb7u10_amd64.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQEcBAEBAgAGBQJV9WJ9AAoJEL7lnXSkw9fbsHwH/2caK6czYJeqhztBIassoaRL
m19TRmAwjOavi5LsWs4GxGXvxO+DsfNpbyYf7SRRxfF97gldDPwCLm/gyNQ+vHfr
lYQ/BTrsQ5cfD7shUcNk6jZuZdNKAqAAtWZk8uUPXa5uJswvlbyUMCU82e2iqlUE
DyNeUjM9smyqN/NyxHLthi3f+LpNyTwDUzMKVJ7B/Nn1WgLJA402rAMOJ19NNx3N
qQ4X00C270suAjPL1HFoPdbEIDqods04yFH/RYu2ybFHnAfaOCYCZ5hy4iWJ2VAL
ZdwBKROlZIbJ2ycSvglZ2/OM6VIbu0CjiV+q9YStX1Q9iKirkmWwhmF7NZwuPpk=
=KkYv
-----END PGP SIGNATURE-----




Reply sent to Michael Tokarev <mjt@tls.msk.ru>:
You have taken responsibility. (Tue, 22 Sep 2015 21:33:12 GMT) (full text, mbox, link).


Notification sent to Salvatore Bonaccorso <carnil@debian.org>:
Bug acknowledged by developer. (Tue, 22 Sep 2015 21:33:12 GMT) (full text, mbox, link).


Message #27 received at 798101-close@bugs.debian.org (full text, mbox, reply):

From: Michael Tokarev <mjt@tls.msk.ru>
To: 798101-close@bugs.debian.org
Subject: Bug#798101: fixed in qemu-kvm 1.1.2+dfsg-6+deb7u10
Date: Tue, 22 Sep 2015 21:31:00 +0000
Source: qemu-kvm
Source-Version: 1.1.2+dfsg-6+deb7u10

We believe that the bug you reported is fixed in the latest version of
qemu-kvm, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 798101@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Michael Tokarev <mjt@tls.msk.ru> (supplier of updated qemu-kvm package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.8
Date: Fri, 11 Sep 2015 19:40:36 +0300
Source: qemu-kvm
Binary: qemu-kvm qemu-kvm-dbg kvm
Architecture: source amd64
Version: 1.1.2+dfsg-6+deb7u10
Distribution: wheezy-security
Urgency: high
Maintainer: Michael Tokarev <mjt@tls.msk.ru>
Changed-By: Michael Tokarev <mjt@tls.msk.ru>
Description: 
 kvm        - dummy transitional package from kvm to qemu-kvm
 qemu-kvm   - Full virtualization on x86 hardware
 qemu-kvm-dbg - Debugging info for qemu-kvm
Closes: 798101
Changes: 
 qemu-kvm (1.1.2+dfsg-6+deb7u10) wheezy-security; urgency=high
 .
   * Acknowlege the previous update.  Thank you Salvatore for the hard
     work you did fixing so many security issues.
   * rename last patches removing numeric prefixes, so that different series
     wont intermix with each other, add Bug-Debian: headers.
   * Add e1000-avoid-infinite-loop-in-transmit-CVE-2015-6815.patch.
     CVE-2015-6815: net: e1000 infinite loop issue in processing transmit
     descriptor.  (Closes: #798101 CVE-2015-6815)
   * Add ide-fix-ATAPI-command-permissions-CVE-2015-6855.patch.
     CVE-2015-6855: ide: qemu allows arbitrary commands to be sent to an ATAPI
     device from guest, while illegal comands might have security impact,
     f.e. WIN_READ_NATIVE_MAX results in divide by zero error.
     (Closes: CVE-2015-6855)
Checksums-Sha1: 
 667f74222aa07e5a43236a25fe5381c7064c0ae6 2141 qemu-kvm_1.1.2+dfsg-6+deb7u10.dsc
 6c4691306499a871b4e74e9cc066f389154f3e49 106265 qemu-kvm_1.1.2+dfsg-6+deb7u10.debian.tar.gz
 e384c72cc3de94c9168280934b3629fb0778372f 1680630 qemu-kvm_1.1.2+dfsg-6+deb7u10_amd64.deb
 ff5b4675eccd3ea0bdcfa4f7037859d7e629c7ab 5273410 qemu-kvm-dbg_1.1.2+dfsg-6+deb7u10_amd64.deb
 db1f29ab8462c94f014b7471e51b1c76e0a840ed 24762 kvm_1.1.2+dfsg-6+deb7u10_amd64.deb
Checksums-Sha256: 
 c1aca86b56076eb4ba645440533181d3ead183d25bf0432fef85809bb10e3cc8 2141 qemu-kvm_1.1.2+dfsg-6+deb7u10.dsc
 8961c1b99215cb8a5d7698e5eee9a6cb6102e364a788005129480e7b2e516d4a 106265 qemu-kvm_1.1.2+dfsg-6+deb7u10.debian.tar.gz
 fd8ee23d8a102d3c415cd5dc9d7da7be4e239eb8245a378ae159df6ba00a9c52 1680630 qemu-kvm_1.1.2+dfsg-6+deb7u10_amd64.deb
 0a572f885bd0dde9330eab8925fdaf5d0173d2fed23e5c98d2d685c50bc9f795 5273410 qemu-kvm-dbg_1.1.2+dfsg-6+deb7u10_amd64.deb
 d42e77bfa208f7795459a609a0bd6c2b69c69df60e5f4644b591949917105e76 24762 kvm_1.1.2+dfsg-6+deb7u10_amd64.deb
Files: 
 349b87d8e8cdc20a8c9e283081e48798 2141 misc optional qemu-kvm_1.1.2+dfsg-6+deb7u10.dsc
 5c29c9f82f6fac56482cff1ad02b62a7 106265 misc optional qemu-kvm_1.1.2+dfsg-6+deb7u10.debian.tar.gz
 08cf5f79f6f216371af82f5194c854ae 1680630 misc optional qemu-kvm_1.1.2+dfsg-6+deb7u10_amd64.deb
 db255c378f9af2698678b59feb8b1215 5273410 debug extra qemu-kvm-dbg_1.1.2+dfsg-6+deb7u10_amd64.deb
 13e1118153c30aeafaea032e8c0916aa 24762 oldlibs extra kvm_1.1.2+dfsg-6+deb7u10_amd64.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQEcBAEBAgAGBQJV9WJ6AAoJEL7lnXSkw9fbrbAH/0tRwNtR9R8TYZteYWgNIB8C
9d+F5LZSk/wpRfkh6N533LT1sEbbbsCoMXV8sgDscYTBoGM/n9jKto8T++ySmV4O
wo9ZhFJaJMCtUap0ft1CLnOdvXBwkXUYZ0dJ/q0DCKRNTxOrNt/0hEZEOZlvkh/0
bQOfLEvASpS2RE7C7ZKvHAscs+6iAcjCNPUpRugy60KQE6/JJEvflWtS8PZ9fj4N
n82313wR6eMdUwwyKQeQPbpybbafxOKppdvSQWlmjWgO1ZcVKi0lWs5v0H4m152V
oLOK6I+1vocQ6N0PgwDjVGjzlWBkoa4zo5eqGakFUEwy/HXAdy3u+bOFTZnTtEU=
=1o8y
-----END PGP SIGNATURE-----




Information forwarded to debian-bugs-dist@lists.debian.org, Debian QEMU Team <pkg-qemu-devel@lists.alioth.debian.org>:
Bug#798101; Package src:qemu. (Wed, 28 Oct 2015 13:42:04 GMT) (full text, mbox, link).


Acknowledgement sent to "Interfax Service" <incoming@interfax.net>:
Extra info received and forwarded to list. Copy sent to Debian QEMU Team <pkg-qemu-devel@lists.alioth.debian.org>. (Wed, 28 Oct 2015 13:42:04 GMT) (full text, mbox, link).


Bug archived. Request was from Debbugs Internal Request <owner@bugs.debian.org> to internal_control@bugs.debian.org. (Thu, 26 Nov 2015 07:25:05 GMT) (full text, mbox, link).


Send a report that this bug log contains spam.


Debian bug tracking system administrator <owner@bugs.debian.org>. Last modified: Wed Jun 19 17:53:01 2019; Machine Name: buxtehude

Debian Bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

Copyright © 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson, 2005-2017 Don Armstrong, and many other contributors.