Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug report.
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=238723
Summary: CVE-2007-13{20-23}, CVE-2007-1366: qemu multiple
vulnerabilities
Product: Fedora Extras
Version: fc6
Platform: All
URL:
http://www.vuxml.org/freebsd/0ac89b39-f829-11db-b55c-
000e0c6d38a9.html
OS/Version: Linux
Status: NEW
Severity: medium
Priority: medium
Component: qemu
AssignedTo: dwmw2(a)redhat.com
ReportedBy: ville.skytta(a)iki.fi
QAContact: extras-qa(a)fedoraproject.org
CC: fedora-security-list@redhat.com,j.w.r.degoede(a)hhs.nl
Not sure if these affect any qemu versions in Fedora, but here goes:
http://www.vuxml.org/freebsd/0ac89b39-f829-11db-b55c-000e0c6d38a9.html
"Several vulnerabilities have been discovered in the QEMU processor emulator,
which may lead to the execution of arbitrary code or denial of service. The
Common Vulnerabilities and Exposures project identifies the following problems:
CVE-2007-1320
Tavis Ormandy discovered that a memory management routine of the Cirrus video
driver performs insufficient bounds checking, which might allow the execution of
arbitrary code through a heap overflow.
CVE-2007-1321
Tavis Ormandy discovered that the NE2000 network driver and the socket code
perform insufficient input validation, which might allow the execution of
arbitrary code through a heap overflow.
CVE-2007-1322
Tavis Ormandy discovered that the "icebp" instruction can be abused to
terminate
the emulation, resulting in denial of service.
CVE-2007-1323
Tavis Ormandy discovered that the NE2000 network driver and the socket code
perform insufficient input validation, which might allow the execution of
arbitrary code through a heap overflow.
CVE-2007-1366
Tavis Ormandy discovered that the "aam" instruction can be abused to crash qemu
through a division by zero, resulting in denial of service."
--
Configure bugmail:
https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.
