Your message dated Mon, 03 Jun 2019 10:02:18 +0000
with message-id <[email protected]>
and subject line Bug#901017: fixed in qemu 1:2.8+dfsg-6+deb9u6
has caused the Debian Bug report #901017,
regarding qemu: CVE-2018-11806: slirp: heap buffer overflow while reassembling
fragmented datagrams
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
901017: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=901017
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: qemu
Version: 1:2.12+dfsg-3
Severity: grave
Tags: patch security upstream
Forwarded: https://lists.gnu.org/archive/html/qemu-devel/2018-06/msg01012.html
Hi,
The following vulnerability was published for qemu.
CVE-2018-11806[0]:
slirp: heap buffer overflow while reassembling fragmented datagrams
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2018-11806
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11806
[1] https://lists.gnu.org/archive/html/qemu-devel/2018-06/msg01012.html
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: qemu
Source-Version: 1:2.8+dfsg-6+deb9u6
We believe that the bug you reported is fixed in the latest version of
qemu, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Michael Tokarev <[email protected]> (supplier of updated qemu package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Format: 1.8
Date: Wed, 29 May 2019 14:39:09 +0300
Source: qemu
Binary: qemu qemu-system qemu-block-extra qemu-system-common qemu-system-misc
qemu-system-arm qemu-system-mips qemu-system-ppc qemu-system-sparc
qemu-system-x86 qemu-user qemu-user-static qemu-user-binfmt qemu-utils
qemu-guest-agent qemu-kvm
Architecture: source
Version: 1:2.8+dfsg-6+deb9u6
Distribution: stretch-security
Urgency: medium
Maintainer: Debian QEMU Team <[email protected]>
Changed-By: Michael Tokarev <[email protected]>
Description:
qemu - fast processor emulator
qemu-block-extra - extra block backend modules for qemu-system and qemu-utils
qemu-guest-agent - Guest-side qemu-system agent
qemu-kvm - QEMU Full virtualization on x86 hardware
qemu-system - QEMU full system emulation binaries
qemu-system-arm - QEMU full system emulation binaries (arm)
qemu-system-common - QEMU full system emulation binaries (common files)
qemu-system-mips - QEMU full system emulation binaries (mips)
qemu-system-misc - QEMU full system emulation binaries (miscellaneous)
qemu-system-ppc - QEMU full system emulation binaries (ppc)
qemu-system-sparc - QEMU full system emulation binaries (sparc)
qemu-system-x86 - QEMU full system emulation binaries (x86)
qemu-user - QEMU user mode emulation binaries
qemu-user-binfmt - QEMU user mode binfmt registration for qemu-user
qemu-user-static - QEMU user mode emulation binaries (static version)
qemu-utils - QEMU utilities
Closes: 901017 902725 911499 912535 914599 914604 914727 916397 921525 922635
929067 929353
Changes:
qemu (1:2.8+dfsg-6+deb9u6) stretch-security; urgency=medium
.
[ Moritz Mühlenhoff <[email protected]> ]
* slirp-correct-size-computation-concatenating-mbuf-CVE-2018-11806.patch
(Closes: #901017, CVE-2018-11806)
* qga-check-bytes-count-read-by-guest-file-read-CVE-2018-12617.patch
(Closes: #902725, CVE-2018-12617)
* usb-mtp-use-O_NOFOLLOW-and-O_CLOEXEC-CVE-2018-16872.patch
(Closes: #916397, CVE-2018-16872)
* rtl8139-fix-possible-out-of-bound-access-CVE-2018-17958.patch
(Closes: #911499, CVE-2018-17958)
* lsi53c895a-check-message-length-value-is-valid-CVE-2018-18849.patch
(Closes: #912535, CVE-2018-18849)
* ppc-pnv-check-size-before-data-buffer-access-CVE-2018-18954.patch
(Closes: #914604, CVE-2018-18954)
* 9p-write-lock-path-in-v9fs-co_open2.patch
9p-take-write-lock-on-fid-path-updates-CVE-2018-19364.patch
(Closes: #914599, CVE-2018-19364)
* 9p-fix-QEMU-crash-when-renaming-files-CVE-2018-19489.patch
(Closes: #914727, CVE-2018-19489)
* i2c-ddc-fix-oob-read-CVE-2019-3812.patch
(Closes: #922635, CVE-2019-3812)
* slirp-check-data-length-while-emulating-ident-function-CVE-2019-6778.patch
(Closes: #921525, CVE-2019-6778)
* slirp-check-sscanf-result-when-emulating-ident-CVE-2019-9824.patch
(Closes: CVE-2019-9824)
.
[ Michael Tokarev ]
* enable-md-clear.patch
define new CPUID for MDS
(Closes: #929067)
(Closes: CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091)
* qxl-check-release-info-object-CVE-2019-12155.patch
fixes null-pointer deref in qxl cleanup code
(Closes: #929353, CVE-2019-12155)
Checksums-Sha1:
77f1affa75e189d4d4fd18afabecb85029f95ad2 5579 qemu_2.8+dfsg-6+deb9u6.dsc
a95daacb4ec953c972e6f06fc20b8b2311e13c99 160688
qemu_2.8+dfsg-6+deb9u6.debian.tar.xz
5ab201d41676fc348109796dab1b77e7ace9a6d6 10688
qemu_2.8+dfsg-6+deb9u6_source.buildinfo
Checksums-Sha256:
3c478c5b3cf794795c042bfaab007c4c938850461bb675b7bd3935ac4f896857 5579
qemu_2.8+dfsg-6+deb9u6.dsc
0bf185c3a72d400e82785a82ce91fd7128f87676e7ffa07eeec0c813deb54a19 160688
qemu_2.8+dfsg-6+deb9u6.debian.tar.xz
faa2372a78580657b43f9f223af24feec00f4f5d7ab0fc9ab6a31bc070d007d5 10688
qemu_2.8+dfsg-6+deb9u6_source.buildinfo
Files:
f13b237940ede0bf4c7945642471bcbc 5579 otherosfs optional
qemu_2.8+dfsg-6+deb9u6.dsc
6a4872d066b015bdf56e33abdb8de50d 160688 otherosfs optional
qemu_2.8+dfsg-6+deb9u6.debian.tar.xz
a9009de8c777f4dc0e21ba5e2486a0cd 10688 otherosfs optional
qemu_2.8+dfsg-6+deb9u6_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQFDBAEBCAAtFiEEe3O61ovnosKJMUsicBtPaxppPlkFAlzudGgPHG1qdEB0bHMu
bXNrLnJ1AAoJEHAbT2saaT5Zt4AIAMZySkKhcHSGSv5vncIrNwXFB9kz8+cnpQnl
BSEclrxy9FskwVuakN7tyHHB9GrhPfnascHbd0+mJIJffWeIr6RxNrcdAEJxspos
xcEVx/0PDe6agrziFMjdciQAbbp/LCsS3p2FLvsIs5q4bD2xjYIKamxBXj48npd5
H1Q+fe/cm4MPiGwhYMhKD4M3nZ6FLafCats1KSMPIJqCAOZDke8PxtEu9Zs23n+q
dQZT3et0ufLFtUCvQJCt/kObetJyKEemBtWmHt0mg27tAmPD8DaU8rC8jMo0WZ8w
v+nAsGPGtqEJsHyFHuK+/b89eCUZTaigbQNVcaRG3mOvpSqX+Zs=
=PcmR
-----END PGP SIGNATURE-----
--- End Message ---
