USN-3414-2: QEMU regression
USN-3414-2: QEMU regression Ubuntu Security Notice USN-3414-2 20th September, 2017 qemu regression A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 17.04 Ubuntu 16.04 LTS Ubuntu 14.04 LTS Summary USN-3414-1 introduced a regression in QEMU. Software description qemu – Machine emulator and virtualizer Details USN-3414-1 fixed vulnerabilities in QEMU. The patch backport forCVE-2017-9375 was incomplete and caused a regression in the USB xHCIcontroller emulation support. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Leo Gaspard discovered that QEMU incorrectly handled VirtFS access control. A guest attacker could use this issue to elevate privileges inside the guest. (CVE-2017-7493) Li Qiang discovered that QEMU incorrectly handled VMWare PVSCSI emulation. A privileged attacker inside the guest could use this issue to cause QEMU to consume resources or crash, resulting in a denial of service. (CVE-2017-8112) [ more… ]