SUSE-SU-2019:2278-1: moderate: Security update for qemu
sle-security-updates at lists.suse.com
sle-security-updates at lists.suse.com
Wed Sep 4 07:12:13 MDT 2019
SUSE Security Update: Security update for qemu
______________________________________________________________________________
Announcement ID: SUSE-SU-2019:2278-1
Rating: moderate
References: #1127077 #1135902 #1139926 #1140402 #1143794
Cross-References: CVE-2019-12155 CVE-2019-13164 CVE-2019-14378
Affected Products:
SUSE CaaS Platform 3.0
______________________________________________________________________________
An update that solves three vulnerabilities and has two
fixes is now available.
Description:
This update for qemu fixes the following issues:
Security issues fixed:
- CVE-2019-14378: Security fix for heap overflow in ip_reass on big packet
input (bsc#1143794).
- CVE-2019-12155: Security fix for null pointer dereference while
releasing spice resources (bsc#1135902).
- CVE-2019-13164: Security fix for qemu-bridge-helper ACL can be bypassed
when names are too long (bsc#1140402).
Bug fixes:
- Provide qcow2 L2 caching improvements, which allows for better storage
performance in certain configurations (bsc#1139926, ECO-130).
- Fix setting speed of migration while vm uses hugepages (bsc#1127077).
Patch Instructions:
To install this SUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- SUSE CaaS Platform 3.0:
To install this update, use the SUSE CaaS Platform Velum dashboard.
It will inform you if it detects new updates and let you then trigger
updating of the complete cluster in a controlled way.
Package List:
- SUSE CaaS Platform 3.0 (x86_64):
qemu-debugsource-2.9.1-6.41.1
qemu-guest-agent-2.9.1-6.41.1
qemu-guest-agent-debuginfo-2.9.1-6.41.1
References:
https://www.suse.com/security/cve/CVE-2019-12155.html
https://www.suse.com/security/cve/CVE-2019-13164.html
https://www.suse.com/security/cve/CVE-2019-14378.html
https://bugzilla.suse.com/1127077
https://bugzilla.suse.com/1135902
https://bugzilla.suse.com/1139926
https://bugzilla.suse.com/1140402
https://bugzilla.suse.com/1143794
More information about the sle-security-updates
mailing list