Integer overflow in the qcow_open function in block/qcow.c in QEMU before 1.7.2 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a large image size, which triggers a buffer overflow or out-of-bounds read.

Integer overflow in the qcow_open function in block/qcow.c in QEMU before 1.7.2 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a large image size, which triggers a buffer overflow or out-of-bounds read.

qemu: virtio-net: buffer overflow on invalid state load qemu: virtio-net: out-of-bounds buffer write on load qemu: virtio-net: out-of-bounds buffer write on invalid state load qemu: virtio: out-of-bounds buffer write on invalid state load qemu: hpet: buffer overrun on invalid state load qemu: hw/pci/pcie_aer.c: buffer overrun on invalid state load qemu: virtio: insufficient validation of num_sg when mapping qemu: virtio: insufficient validation of num_sg when mapping qemu: usb: insufficient sanity checking of setup_index+setup_len in post_load qemu: virtio-scsi: buffer overrun on invalid state load qemu: virtio: buffer overrun on incoming migration qemu: virtio: out-of-bounds buffer write on state load with invalid config_len Qemu: qcow1: validate L2 table size to avoid integer overflows Qemu: qcow1: validate image size to avoid out-of-bounds memory access Qemu: usb: fix up post load checks

Qemu: qcow1: validate L2 table size to avoid integer overflows Qemu: qcow1: validate image size to avoid out-of-bounds memory access

Security update for kvm

Affected: Ubuntu:14.04:LTS: qemu

Integer overflow in the qcow_open function in block/qcow.c in QEMU before 1.7.2 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a large image size, which triggers a buffer overflow or out-of-bounds read.