SUSE-SU-2014:0623-1: important: Security update for kvm

[sle-security-updates at lists.suse.com]

   SUSE Security Update: Security update for kvm
______________________________________________________________________________

Announcement ID:    SUSE-SU-2014:0623-1
Rating:             important
References:         #812983 #817593 #842006 #864802 #870439 
Cross-References:   CVE-2013-2016 CVE-2013-4344 CVE-2013-4541
                    CVE-2014-0142 CVE-2014-0143 CVE-2014-0144
                    CVE-2014-0145 CVE-2014-0146 CVE-2014-0147
                   
Affected Products:
                    SUSE Linux Enterprise Server 11 SP3
                    SUSE Linux Enterprise Desktop 11 SP3
______________________________________________________________________________

   An update that fixes 9 vulnerabilities is now available. It
   includes one version update.

Description:


   The QEMU embedded within KVM received various security
   fixes.

   Various issues in the block layer have been fixed:

   * A virtio security issue in config io space handling
   (CVE-2013-2016).
   * A SCSI report LUNs buffer overflow (CVE-2013-4344).
   * A buffer overflow in the QEMU USB stack
   (CVE-2013-4541).

   Security Issue references:

   * CVE-2013-2016
   <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2016
   >
   * CVE-2013-4344
   <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4344
   >
   * CVE-2013-4541
   <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4541
   >
   * CVE-2014-0142
   <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0142
   >
   * CVE-2014-0143
   <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0143
   >
   * CVE-2014-0144
   <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0144
   >
   * CVE-2014-0145
   <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0145
   >
   * CVE-2014-0146
   <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0146
   >
   * CVE-2014-0147
   <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0147
   >


Patch Instructions:

   To install this SUSE Security Update use YaST online_update.
   Alternatively you can run the command listed for your product:

   - SUSE Linux Enterprise Server 11 SP3:

      zypper in -t patch slessp3-kvm-9142

   - SUSE Linux Enterprise Desktop 11 SP3:

      zypper in -t patch sledsp3-kvm-9142

   To bring your system up-to-date, use "zypper patch".


Package List:

   - SUSE Linux Enterprise Server 11 SP3 (i586 s390x x86_64) [New Version: 1.4.2]:

      kvm-1.4.2-0.11.1

   - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64) [New Version: 1.4.2]:

      kvm-1.4.2-0.11.1


References:

   http://support.novell.com/security/cve/CVE-2013-2016.html
   http://support.novell.com/security/cve/CVE-2013-4344.html
   http://support.novell.com/security/cve/CVE-2013-4541.html
   http://support.novell.com/security/cve/CVE-2014-0142.html
   http://support.novell.com/security/cve/CVE-2014-0143.html
   http://support.novell.com/security/cve/CVE-2014-0144.html
   http://support.novell.com/security/cve/CVE-2014-0145.html
   http://support.novell.com/security/cve/CVE-2014-0146.html
   http://support.novell.com/security/cve/CVE-2014-0147.html
   https://bugzilla.novell.com/812983
   https://bugzilla.novell.com/817593
   https://bugzilla.novell.com/842006
   https://bugzilla.novell.com/864802
   https://bugzilla.novell.com/870439
   http://download.suse.com/patch/finder/?keywords=7b040d1de764d7e94156d09f838af746