SUSE-SU-2025:21230-1: important: Security update for qemu
SLE-SECURITY-UPDATES
null at suse.de
Mon Dec 22 16:30:07 UTC 2025
# Security update for qemu
Announcement ID: SUSE-SU-2025:21230-1
Release Date: 2025-12-18T12:50:21Z
Rating: important
References:
* bsc#1230042
* bsc#1250984
* bsc#1253002
* bsc#1254286
* bsc#1254494
Cross-References:
* CVE-2025-11234
* CVE-2025-12464
CVSS scores:
* CVE-2025-11234 ( SUSE ): 8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
* CVE-2025-11234 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2025-11234 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2025-12464 ( SUSE ): 6.9
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
* CVE-2025-12464 ( SUSE ): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2025-12464 ( NVD ): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products:
* SUSE Linux Micro 6.2
An update that solves two vulnerabilities and has three fixes can now be
installed.
## Description:
This update for qemu fixes the following issues:
Update to version 10.0.7.
Security issues fixed:
* CVE-2025-12464: stack-based buffer overflow in the e1000 network device
operations can be exploited by a malicious guest user to crash the QEMU
process on the host (bsc#1253002).
* CVE-2025-11234: use-after-free in WebSocket handshake operations can be
exploited by a malicious client with network access to the VNC WebSocket
port to cause a denial-of-service (bsc#1250984).
Other updates and bugfixes:
* Version 10.0.7:
* kvm: Fix kvm_vm_ioctl() and kvm_device_ioctl() return value
* docs/devel: Update URL for make-pullreq script
* target/arm: Fix assert on BRA.
* hw/aspeed/{xdma, rtc, sdhci}: Fix endianness to DEVICE_LITTLE_ENDIAN
* hw/core/machine: Provide a description for aux-ram-share property
* hw/pci: Make msix_init take a uint32_t for nentries
* block/io_uring: avoid potentially getting stuck after resubmit at the end of
ioq_submit()
* block-backend: Fix race when resuming queued requests
* ui/vnc: Fix qemu abort when query vnc info
* chardev/char-pty: Do not ignore chr_write() failures
* hw/display/exynos4210_fimd: Account for zero length in
fimd_update_memory_section()
* hw/arm/armv7m: Disable reentrancy guard for v7m_sysreg_ns_ops MRs
* hw/arm/aspeed: Fix missing SPI IRQ connection causing DMA interrupt failure
* migration: Fix transition to COLO state from precopy
* Full backport list: https://lore.kernel.org/qemu-
devel/1765037524.347582.2700543.nullmailer at tls.msk.ru/
* Version 10.0.6:
* linux-user/microblaze: Fix little-endianness binary
* target/hppa: correct size bit parity for fmpyadd
* target/i386: user: do not set up a valid LDT on reset
* async: access bottom half flags with qatomic_read
* target/i386: fix x86_64 pushw op
* i386/tcg/smm_helper: Properly apply DR values on SMM entry / exit
* i386/cpu: Prevent delivering SIPI during SMM in TCG mode
* i386/kvm: Expose ARCH_CAP_FB_CLEAR when invulnerable to MDS
* target/i386: Fix CR2 handling for non-canonical addresses
* block/curl.c: Use explicit long constants in curl_easy_setopt calls
* pcie_sriov: Fix broken MMIO accesses from SR-IOV VFs
* target/riscv: rvv: Fix vslide1[up|down].vx unexpected result when XLEN2 and
SEWd
* target/riscv: Fix ssamoswap error handling
* Full backport list: https://lore.kernel.org/qemu-
devel/1761022287.744330.6357.nullmailer at tls.msk.ru/
* Version 10.0.5:
* tests/functional/test_aarch64_sbsaref_freebsd: Fix the URL of the ISO image
* tests/functional/test_ppc_bamboo: Replace broken link with working assets
* physmem: Destroy all CPU AddressSpaces on unrealize
* memory: New AS helper to serialize destroy+free
* include/system/memory.h: Clarify address_space_destroy() behaviour
* migration: Fix state transition in postcopy_start() error handling
* target/riscv: rvv: Modify minimum VLEN according to enabled vector
extensions
* target/riscv: rvv: Replace checking V by checking Zve32x
* target/riscv: Fix endianness swap on compressed instructions
* hw/riscv/riscv-iommu: Fixup PDT Nested Walk
* Full backport list: https://lore.kernel.org/qemu-
devel/1759986125.676506.643525.nullmailer at tls.msk.ru/
* [openSUSE][RPM]: really fix *-virtio-gpu-pci dependency on ARM
(bsc#1254286).
* [openSUSE][RPM] spec: make glusterfs support conditional (bsc#1254494).
## Patch Instructions:
To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
* SUSE Linux Micro 6.2
zypper in -t patch SUSE-SL-Micro-6.2-112=1
## Package List:
* SUSE Linux Micro 6.2 (aarch64 ppc64le s390x x86_64)
* qemu-chardev-spice-10.0.7-160000.1.1
* qemu-block-ssh-10.0.7-160000.1.1
* qemu-tools-10.0.7-160000.1.1
* qemu-hw-display-virtio-gpu-10.0.7-160000.1.1
* qemu-guest-agent-debuginfo-10.0.7-160000.1.1
* qemu-hw-usb-host-10.0.7-160000.1.1
* qemu-audio-spice-10.0.7-160000.1.1
* qemu-debugsource-10.0.7-160000.1.1
* qemu-hw-display-virtio-vga-10.0.7-160000.1.1
* qemu-block-ssh-debuginfo-10.0.7-160000.1.1
* qemu-debuginfo-10.0.7-160000.1.1
* qemu-pr-helper-10.0.7-160000.1.1
* qemu-ui-spice-core-10.0.7-160000.1.1
* qemu-chardev-spice-debuginfo-10.0.7-160000.1.1
* qemu-hw-usb-redirect-10.0.7-160000.1.1
* qemu-hw-usb-host-debuginfo-10.0.7-160000.1.1
* qemu-block-iscsi-debuginfo-10.0.7-160000.1.1
* qemu-ui-spice-core-debuginfo-10.0.7-160000.1.1
* qemu-hw-display-virtio-gpu-pci-10.0.7-160000.1.1
* qemu-ui-opengl-debuginfo-10.0.7-160000.1.1
* qemu-hw-display-virtio-gpu-pci-debuginfo-10.0.7-160000.1.1
* qemu-guest-agent-10.0.7-160000.1.1
* qemu-pr-helper-debuginfo-10.0.7-160000.1.1
* qemu-10.0.7-160000.1.1
* qemu-hw-display-qxl-debuginfo-10.0.7-160000.1.1
* qemu-ksm-10.0.7-160000.1.1
* qemu-hw-display-qxl-10.0.7-160000.1.1
* qemu-audio-spice-debuginfo-10.0.7-160000.1.1
* qemu-img-10.0.7-160000.1.1
* qemu-ui-opengl-10.0.7-160000.1.1
* qemu-hw-usb-redirect-debuginfo-10.0.7-160000.1.1
* qemu-hw-display-virtio-vga-debuginfo-10.0.7-160000.1.1
* qemu-block-iscsi-10.0.7-160000.1.1
* qemu-tools-debuginfo-10.0.7-160000.1.1
* qemu-hw-display-virtio-gpu-debuginfo-10.0.7-160000.1.1
* qemu-img-debuginfo-10.0.7-160000.1.1
* SUSE Linux Micro 6.2 (noarch)
* qemu-seabios-10.0.71.16.3_3_g3d33c746-160000.1.1
* qemu-SLOF-10.0.7-160000.1.1
* qemu-ipxe-10.0.7-160000.1.1
* qemu-vgabios-10.0.71.16.3_3_g3d33c746-160000.1.1
* qemu-lang-10.0.7-160000.1.1
* SUSE Linux Micro 6.2 (x86_64)
* qemu-x86-debuginfo-10.0.7-160000.1.1
* qemu-vmsr-helper-debuginfo-10.0.7-160000.1.1
* qemu-x86-10.0.7-160000.1.1
* qemu-vmsr-helper-10.0.7-160000.1.1
* SUSE Linux Micro 6.2 (aarch64)
* qemu-arm-debuginfo-10.0.7-160000.1.1
* qemu-arm-10.0.7-160000.1.1
* SUSE Linux Micro 6.2 (ppc64le)
* qemu-ppc-debuginfo-10.0.7-160000.1.1
* qemu-ppc-10.0.7-160000.1.1
* SUSE Linux Micro 6.2 (s390x)
* qemu-s390x-debuginfo-10.0.7-160000.1.1
* qemu-hw-s390x-virtio-gpu-ccw-10.0.7-160000.1.1
* qemu-hw-s390x-virtio-gpu-ccw-debuginfo-10.0.7-160000.1.1
* qemu-s390x-10.0.7-160000.1.1
## References:
* https://www.suse.com/security/cve/CVE-2025-11234.html
* https://www.suse.com/security/cve/CVE-2025-12464.html
* https://bugzilla.suse.com/show_bug.cgi?id=1230042
* https://bugzilla.suse.com/show_bug.cgi?id=1250984
* https://bugzilla.suse.com/show_bug.cgi?id=1253002
* https://bugzilla.suse.com/show_bug.cgi?id=1254286
* https://bugzilla.suse.com/show_bug.cgi?id=1254494
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.suse.com/pipermail/sle-security-updates/attachments/20251222/913f48f7/attachment.htm>
More information about the sle-security-updates
mailing list