Affected: AlmaLinux:9: qemu-guest-agent, AlmaLinux:9: qemu-img, AlmaLinux:9: qemu-kvm, AlmaLinux:9: qemu-kvm-audio-pa, AlmaLinux:9: qemu-kvm-block-curl, AlmaLinux:9: qemu-kvm-block-rbd, AlmaLinux:9: qemu-kvm-common, AlmaLinux:9: qemu-kvm-core, AlmaLinux:9: qemu-kvm-device-display-virtio-gpu, AlmaLinux:9: qemu-kvm-device-display-virtio-gpu-ccw and 9 more

Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM.

The following packages have been upgraded to a later upstream version: qemu-kvm (7.2.0). (BZ#2111769, BZ#2135806)

Security Fix(es):

* QEMU: VNC: integer underflow in vnc_client_cut_text_ext leads to CPU exhaustion (CVE-2022-3165) * QEMU: ACPI ERST: memory corruption issues in read_erst_record and write_erst_record (CVE-2022-4172)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Withdrawn by the publisher.

virt:rhel bug fix update for RHSA-2023:2757

An integer underflow issue was found in the QEMU VNC server while processing ClientCutText messages in the extended format. A malicious client could use this flaw to make QEMU unresponsive by sending a specially crafted payload message, resulting in a denial of service.

An integer underflow issue was found in the QEMU VNC server while processing ClientCutText messages in the extended format. A malicious client could use this flaw to make QEMU unresponsive by sending a specially crafted payload message, resulting in a denial of service.

Affected: openEuler:22.03-LTS: qemu

QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.

QEMU has two operating modes:

Full system emulation. In this mode, QEMU emulates a full system (for example a PC), including one or several processors and various peripherals. It can be used to launch different Operating Systems without rebooting the PC or to debug system code.

User mode emulation. In this mode, QEMU can launch processes compiled for one CPU on another CPU. It can be used to launch the Wine Windows API emulator (https://www.winehq.org) or to ease cross-compilation and cross-debugging. You can refer to https://www.qemu.org for more infortmation. Security Fix(es): An integer underflow issue was found in the QEMU VNC server while processing ClientCutText messages in the extended format. A malicious client could use this flaw to make QEMU unresponsive by sending a specially crafted payload message, resulting in a denial of service.(CVE-2022-3165)

ntfs-3g: heap-based buffer overflow in ntfsck QEMU: VNC: integer underflow in vnc_client_cut_text_ext leads to CPU exhaustion ntfs-3g: crafted NTFS image can cause heap exhaustion in ntfs_get_attribute_value ntfs-3g: crafted NTFS image can cause a heap-based buffer overflow in ntfs_names_full_collate ntfs-3g: crafted NTFS image can cause a heap-based buffer overflow in ntfs_mft_rec_alloc ntfs-3g: crafted NTFS image can cause a heap-based buffer overflow in ntfs_check_log_client_array tpm2: TCG TPM2.0 implementations vulnerable to memory corruption

Affected: Ubuntu:22.04:LTS: qemu

An integer underflow issue was found in the QEMU VNC server while processing ClientCutText messages in the extended format. A malicious client could use this flaw to make QEMU unresponsive by sending a specially crafted payload message, resulting in a denial of service.

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in QEMU ausnutzen, um einen Denial of Service Angriff durchzuführen.