qemu: CVE-2019-6501: scsi-generic: possible OOB access while handling inquiry request

Debian Bug report logs - #920222
qemu: CVE-2019-6501: scsi-generic: possible OOB access while handling inquiry request

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: qemu: CVE-2019-6501: scsi-generic: possible OOB access while handling inquiry request

Date: Tue, 22 Jan 2019 21:30:28 +0100

Source: qemu
Version: 1:3.1+dfsg-2
Severity: important
Tags: patch security upstream
Control: forwarded -1 https://lists.gnu.org/archive/html/qemu-devel/2019-01/msg02324.html

Hi,

The following vulnerability was published for qemu.

CVE-2019-6501[0]:
scsi-generic: possible OOB access while handling inquiry request

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2019-6501
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6501
[1] https://lists.gnu.org/archive/html/qemu-devel/2019-01/msg02324.html

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Message #12 received at 920222-close@bugs.debian.org (full text, mbox, reply):

From: Michael Tokarev <mjt@tls.msk.ru>

To: 920222-close@bugs.debian.org

Subject: Bug#920222: fixed in qemu 1:3.1+dfsg-3

Date: Wed, 06 Feb 2019 15:06:59 +0000

Source: qemu
Source-Version: 1:3.1+dfsg-3

We believe that the bug you reported is fixed in the latest version of
qemu, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 920222@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Michael Tokarev <mjt@tls.msk.ru> (supplier of updated qemu package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Wed, 06 Feb 2019 12:23:01 +0300
Source: qemu
Binary: qemu qemu-system qemu-block-extra qemu-system-data qemu-system-common qemu-system-gui qemu-system-misc qemu-system-arm qemu-system-mips qemu-system-ppc qemu-system-sparc qemu-system-x86 qemu-user qemu-user-static qemu-user-binfmt qemu-utils qemu-guest-agent qemu-kvm
Architecture: source
Version: 1:3.1+dfsg-3
Distribution: unstable
Urgency: medium
Maintainer: Debian QEMU Team <pkg-qemu-devel@lists.alioth.debian.org>
Changed-By: Michael Tokarev <mjt@tls.msk.ru>
Description:
 qemu       - fast processor emulator, dummy package
 qemu-block-extra - extra block backend modules for qemu-system and qemu-utils
 qemu-guest-agent - Guest-side qemu-system agent
 qemu-kvm   - QEMU Full virtualization on x86 hardware
 qemu-system - QEMU full system emulation binaries
 qemu-system-arm - QEMU full system emulation binaries (arm)
 qemu-system-common - QEMU full system emulation binaries (common files)
 qemu-system-data - QEMU full system emulation (data files)
 qemu-system-gui - QEMU full system emulation binaries (user interface and audio sup
 qemu-system-mips - QEMU full system emulation binaries (mips)
 qemu-system-misc - QEMU full system emulation binaries (miscellaneous)
 qemu-system-ppc - QEMU full system emulation binaries (ppc)
 qemu-system-sparc - QEMU full system emulation binaries (sparc)
 qemu-system-x86 - QEMU full system emulation binaries (x86)
 qemu-user  - QEMU user mode emulation binaries
 qemu-user-binfmt - QEMU user mode binfmt registration for qemu-user
 qemu-user-static - QEMU user mode emulation binaries (static version)
 qemu-utils - QEMU utilities
Closes: 881527 889885 892945 901407 913103 916279 916442 918378 919668 920032 920222 921525
Changes:
 qemu (1:3.1+dfsg-3) unstable; urgency=medium
 .
   [ Michael Tokarev ]
   * mention #696289 closed by 2.10
   * move ovmf to recommends on debian and update aarch ovmf refs
     (Closes: #889885)
   * remove /dev/kvm permission handling (moved to systemd 239-6)
     (Closes: #892945)
   * build qemu-palcode using alpha cross-compiler
     (Closes: #913103)
   * fix path in qemu-guest-agent.service (#918378), fixs Bind[s]To
     (Closes: #918378
   * use int for sparc64 timeval.tv_usec
     (Closes: #920032)
   * build-depend on libglusterfs-dev not glusterfs-common
     (Closes: #919668, #881527)
   * add breaks: qemu-system-data to qemu-system-common,
     to close #916279 completely (all this can be removed after buster)
     (Closes: #916279)
   * scsi-generic-avoid-possible-oob-access-to-r-buf-CVE-2019-6501.patch
     (Closes: #920222, CVE-2019-6501)
   * slirp-check-data-length-while-emulating-ident-function-CVE-2019-6778.patch
     (Closes: #921525)
   * pvrdma-release-device-resources-on-error-CVE-2018-20123.patch
     (Closes: #916442, CVE-2018-20123)
   * enable rdma and pvrdma, build-depend on
     librdmacm-dev, libibverbs-dev, libibumad-dev
   * sync debian/qemu-user-static.1 and debian/qemu-user.1 generate the latter
     from the former (finally Closes: #901407)
   * move ivshmem-server & ivshmem-client from qemu-utils to qemu-system-common
     (the binaries are also specific to qemu-system, not useable alone)
   * move qemu-pr-helper from qemu-utils to qemu-system-common -
     this is an internal qemu-system helper, with possible socket activation,
     not intended for use outside of qemu-system
 .
   [ Christian Ehrhardt ]
   * qemu-guest-agent: freeze-hook to ignore dpkg files (packaging changes)
Checksums-Sha1:
 da1d5534154ec9311bccd64a6ef8386afb81d60f 6120 qemu_3.1+dfsg-3.dsc
 de89565e70b77300575bf6a74c11f0d170c2bdb8 82652 qemu_3.1+dfsg-3.debian.tar.xz
 913c2f13d59d3118df2bd9d5ed525907cf4d38d4 16381 qemu_3.1+dfsg-3_source.buildinfo
Checksums-Sha256:
 95e36c31959ad65627467ade4e69dde307860df5382b59bdf579b26a961a6266 6120 qemu_3.1+dfsg-3.dsc
 6c1ccc131e59d6387c6f37be263f2a528895443646ec32159c41abf5dd71a812 82652 qemu_3.1+dfsg-3.debian.tar.xz
 4708a20d6111a6d8eb34b73d3f6bfa0a532001b89b3d071eae6ce3a6ed495e4d 16381 qemu_3.1+dfsg-3_source.buildinfo
Files:
 bf5e175fc0c9e87126b383b998665cfa 6120 otherosfs optional qemu_3.1+dfsg-3.dsc
 bfc662b1cf7bb71a02e644a9fb85acc1 82652 otherosfs optional qemu_3.1+dfsg-3.debian.tar.xz
 367b7f156d180504d19b8030bc1e07a6 16381 otherosfs optional qemu_3.1+dfsg-3_source.buildinfo

-----BEGIN PGP SIGNATURE-----

iQFDBAEBCAAtFiEEe3O61ovnosKJMUsicBtPaxppPlkFAlxa7mEPHG1qdEB0bHMu
bXNrLnJ1AAoJEHAbT2saaT5ZHPcH/irm4PoCiW2YpuqioEiv4jb9+Vtffndugoix
i59LgCW0xUuiHJXRPK6ZY32Wjcvkb43ZbzAQYiZmh6NVoS3RZJccv3h6O/fSaQJ6
2CQpIqtXkoXw82WJ6kOEfq5dj1tcyRNSxL504JsfaJ8ns5T5EemSMV4jsxocckBF
zW9bR9Cd40wbkcF6Q2NkFhZARQmcUj1pFjx0WqMhTco3AHSeFspLDe1OW06DqMWK
W7uoP8ITTUnM4BqIXQVIoV0VY7ocNz+0ElPQInkwzf+iBPBIgaPlmtbafTIwDqTZ
UYnj2HhABaP6M2T3oStKMsISGhJs/qKJ0x9CeXLcPB1U7pMow20=
=EGC1
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.