Multiple vulnerabilities have been discovered in xen-qemu-dm-4.0, the Xen QEMU Device Model virtual machine hardware emulator. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2012-3515: The device model for HVM domains does not properly handle VT100 escape sequences when emulating certain devices with a virtual console backend. An attacker within a guest with access to the vulnerable virtual console could overwrite memory of the device model and escalate privileges to that of the device model process. CVE-2012-4411: The QEMU monitor was enabled by default, allowing administrators of a guest to access resources of the host, possibly escalate privileges or access resources belonging to another guest. For the stable distribution (squeeze), these problems have been fixed in version 4.0.1-2+squeeze2. The testing distribution (wheezy), and the unstable distribution (sid), no longer contain this package. We recommend that you upgrade your xen-qemu-dm-4.0 packages.
Multiple vulnerabilities have been discovered in xen-qemu-dm-4.0, the Xen QEMU Device Model virtual machine hardware emulator. The Common Vulnerabilities and Exposures project identifies the following problems:
The device model for HVM domains does not properly handle VT100 escape sequences when emulating certain devices with a virtual console backend. An attacker within a guest with access to the vulnerable virtual console could overwrite memory of the device model and escalate privileges to that of the device model process.
The QEMU monitor was enabled by default, allowing administrators of a guest to access resources of the host, possibly escalate privileges or access resources belonging to another guest.
For the stable distribution (squeeze), these problems have been fixed in version 4.0.1-2+squeeze2.
The testing distribution (wheezy), and the unstable distribution (sid), no longer contain this package.
We recommend that you upgrade your xen-qemu-dm-4.0 packages.
Vulmon