--===============6093103871961483089==
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature";
 boundary="FL5UXtIhxfXey3p5"
Content-Disposition: inline


--FL5UXtIhxfXey3p5
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

===========================================================
Ubuntu Security Notice USN-1063-1         February 14, 2011
qemu-kvm vulnerability
CVE-2011-0011
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 9.10
Ubuntu 10.04 LTS
Ubuntu 10.10

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 9.10:
  kvm                             0.11.0-0ubuntu6.4
  qemu                            0.11.0-0ubuntu6.4
  qemu-arm-static                 0.11.0-0ubuntu6.4
  qemu-kvm                        0.11.0-0ubuntu6.4
  qemu-kvm-extras                 0.11.0-0ubuntu6.4

Ubuntu 10.04 LTS:
  kvm                             0.12.3+noroms-0ubuntu9.4
  qemu                            0.12.3+noroms-0ubuntu9.4
  qemu-arm-static                 0.12.3+noroms-0ubuntu9.4
  qemu-common                     0.12.3+noroms-0ubuntu9.4
  qemu-kvm                        0.12.3+noroms-0ubuntu9.4
  qemu-kvm-extras                 0.12.3+noroms-0ubuntu9.4
  qemu-kvm-extras-static          0.12.3+noroms-0ubuntu9.4

Ubuntu 10.10:
  kvm                             0.12.5+noroms-0ubuntu7.2
  qemu                            0.12.5+noroms-0ubuntu7.2
  qemu-arm-static                 0.12.5+noroms-0ubuntu7.2
  qemu-kvm                        0.12.5+noroms-0ubuntu7.2
  qemu-kvm-extras                 0.12.5+noroms-0ubuntu7.2
  qemu-kvm-extras-static          0.12.5+noroms-0ubuntu7.2

After a standard system update you need to restart any running QEMU sessions
to make all the necessary changes.

Details follow:

Neil Wilson discovered that if VNC passwords were blank in QEMU
configurations, access to VNC sessions was allowed without a password
instead of being disabled. A remote attacker could connect to running
VNC sessions of QEMU and directly control the system. By default, QEMU
does not start VNC sessions.


Updated packages for Ubuntu 9.10:

  Source archives:

    qemu-kvm_0.11.0-0ubuntu6.4.diff.gz
      Size/MD5:    49951 b1eb8586a033e224d929ffee2f372e7b
    qemu-kvm_0.11.0-0ubuntu6.4.dsc
      Size/MD5:     2056 ce3fa0319c9d0c0f07c5264d1c89f4aa
    qemu-kvm_0.11.0.orig.tar.gz
      Size/MD5:  4382897 440837a062967102a68e634d57eaf719

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):

    kvm_84+dfsg-0ubuntu16+0.11.0+0ubuntu6.4_amd64.deb
      Size/MD5:     9268 77a356214c0573a0cad03a590f3abc39
    qemu-kvm_0.11.0-0ubuntu6.4_amd64.deb
      Size/MD5:  2813560 3917642c38b4e4eb87c34c2defaba0a6
    qemu-arm-static_0.11.0-0ubuntu6.4_amd64.deb
      Size/MD5:   636276 35dcc645220981dd2b21d4b6f6fcfe98
    qemu-kvm-extras_0.11.0-0ubuntu6.4_amd64.deb
      Size/MD5: 15469464 0e0cf0c3cb235b03dfe2f871935fc24d
    qemu_0.11.0-0ubuntu6.4_amd64.deb
      Size/MD5:     8724 d5ce47a96404c1bc774f0381871a73d3

  i386 architecture (x86 compatible Intel/AMD):

    kvm_84+dfsg-0ubuntu16+0.11.0+0ubuntu6.4_i386.deb
      Size/MD5:     9264 e7fd0bb4ffc6ee6a0af381963dc38db7
    qemu-kvm_0.11.0-0ubuntu6.4_i386.deb
      Size/MD5:  2592266 0d0574ef0726f86b9a9c0c0ee825a4b7
    qemu-arm-static_0.11.0-0ubuntu6.4_i386.deb
      Size/MD5:   558988 bb3e361f0b739fa47e23348eea83c0b2
    qemu-kvm-extras_0.11.0-0ubuntu6.4_i386.deb
      Size/MD5: 13984592 4a5bad4d141286b9730aee17e8e7f601
    qemu_0.11.0-0ubuntu6.4_i386.deb
      Size/MD5:     8726 e6118d53d74abca674bf097d368da333

  lpia architecture (Low Power Intel Architecture):

    kvm_84+dfsg-0ubuntu16+0.11.0+0ubuntu6.4_lpia.deb
      Size/MD5:     9266 c6876667f4913ed354cf856208357d5c
    qemu-kvm_0.11.0-0ubuntu6.4_lpia.deb
      Size/MD5:  2621292 7c38852bf5ae9f51a5b72ab419162c44
    qemu-arm-static_0.11.0-0ubuntu6.4_lpia.deb
      Size/MD5:   578778 a2ab4d647e97f543b54bda1914eb3456
    qemu-kvm-extras_0.11.0-0ubuntu6.4_lpia.deb
      Size/MD5: 14110322 cae30bd890e32b1dad2c12be0063d429
    qemu_0.11.0-0ubuntu6.4_lpia.deb
      Size/MD5:     8720 effdfd7814e75becc5317f30624f3131

Updated packages for Ubuntu 10.04 LTS:

  Source archives:

    qemu-kvm_0.12.3+noroms-0ubuntu9.4.diff.gz
      Size/MD5:    59055 ddd620576dad48286d6844784606f663
    qemu-kvm_0.12.3+noroms-0ubuntu9.4.dsc
      Size/MD5:     2195 0cfe7be7ae0d42394c7faa4d7b14cd4d
    qemu-kvm_0.12.3+noroms.orig.tar.gz
      Size/MD5:  3855993 3d06a46426bf2e9d13c271532e128155

  Architecture independent packages:

    qemu-common_0.12.3+noroms-0ubuntu9.4_all.deb
      Size/MD5:    29614 db3d44856d4abca79224bc3c75d8a107

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):

    kvm_84+dfsg-0ubuntu16+0.12.3+noroms+0ubuntu9.4_amd64.deb
      Size/MD5:    14688 c6b47811b8500acd877067d46ccea77c
    qemu-kvm_0.12.3+noroms-0ubuntu9.4_amd64.deb
      Size/MD5:  2952078 13d4bfa4883e4868222b46cec34cdbf3
    qemu-arm-static_0.12.3+noroms-0ubuntu9.4_amd64.deb
      Size/MD5:    14234 a0fd5588781d377a701224241bedde0a
    qemu-kvm-extras-static_0.12.3+noroms-0ubuntu9.4_amd64.deb
      Size/MD5: 11183532 de3f7e009353e6f0eca9bba6c745afa2
    qemu-kvm-extras_0.12.3+noroms-0ubuntu9.4_amd64.deb
      Size/MD5: 16943070 056670a82ab408912444af029156df9e
    qemu_0.12.3+noroms-0ubuntu9.4_amd64.deb
      Size/MD5:    14082 a85a7e312b308bd60041aec0a6aaab0e

  i386 architecture (x86 compatible Intel/AMD):

    kvm_84+dfsg-0ubuntu16+0.12.3+noroms+0ubuntu9.4_i386.deb
      Size/MD5:    14690 ed7b59c87f0a24390c250ceaaff57587
    qemu-kvm_0.12.3+noroms-0ubuntu9.4_i386.deb
      Size/MD5:  2557370 cbff84fc36b0af7ad84ed6945fd4270f
    qemu-arm-static_0.12.3+noroms-0ubuntu9.4_i386.deb
      Size/MD5:    14236 b8951772f70aa22d0a9a81a2a4102f91
    qemu-kvm-extras-static_0.12.3+noroms-0ubuntu9.4_i386.deb
      Size/MD5:  8926712 40f7dd7ec241ce0521442839e29f7098
    qemu-kvm-extras_0.12.3+noroms-0ubuntu9.4_i386.deb
      Size/MD5: 14483128 667bfa9b046cba5470961abe0222b8b6
    qemu_0.12.3+noroms-0ubuntu9.4_i386.deb
      Size/MD5:    14074 0491a031d555399f5a67a2b8f1d1fb27

  armel architecture (ARM Architecture):

    kvm_84+dfsg-0ubuntu16+0.12.3+noroms+0ubuntu9.4_armel.deb
      Size/MD5:    14696 ba439027498f93ef1f0de2b80e932137
    qemu-kvm-extras_0.12.3+noroms-0ubuntu9.4_armel.deb
      Size/MD5: 15352518 f23a678eecc1046f83d7d48ef419aa7f
    qemu_0.12.3+noroms-0ubuntu9.4_armel.deb
      Size/MD5:    14084 4beb4cd934c0a504a29b84fd5e8cc56d

  powerpc architecture (Apple Macintosh G3/G4/G5):

    kvm_84+dfsg-0ubuntu16+0.12.3+noroms+0ubuntu9.4_powerpc.deb
      Size/MD5:    14690 ec59a9867512187e7c25d942b315e498
    qemu-kvm_0.12.3+noroms-0ubuntu9.4_powerpc.deb
      Size/MD5:  2878074 eb7f446a8fc88686e60cdc4622a60596
    qemu-kvm-extras_0.12.3+noroms-0ubuntu9.4_powerpc.deb
      Size/MD5: 16044010 e35c6be48ca03d4c73abb8f47c2782ba
    qemu_0.12.3+noroms-0ubuntu9.4_powerpc.deb
      Size/MD5:    14078 44aaec5fe491fd6028b257b8c4b44553

  sparc architecture (Sun SPARC/UltraSPARC):

    kvm_84+dfsg-0ubuntu16+0.12.3+noroms+0ubuntu9.4_sparc.deb
      Size/MD5:    42850 5e211af4450bba271debdc8539451c31
    qemu_0.12.3+noroms-0ubuntu9.4_sparc.deb
      Size/MD5:    14074 bebc621f4091c9a35dbc0f6b68a25983

Updated packages for Ubuntu 10.10:

  Source archives:

    qemu-kvm_0.12.5+noroms-0ubuntu7.2.diff.gz
      Size/MD5:    59296 62995fbdb4c625defd2e4f2f7cc97b14
    qemu-kvm_0.12.5+noroms-0ubuntu7.2.dsc
      Size/MD5:     2221 3d97883f347516f5aefc59fa96919569
    qemu-kvm_0.12.5+noroms.orig.tar.gz
      Size/MD5:  4722351 c7303c30432dc4eb0a39bb85a9d15cc9

  Architecture independent packages:

    qemu-common_0.12.5+noroms-0ubuntu7.2_all.deb
      Size/MD5:    31566 a3de989fa047a4267df2aea092e8c009

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):

    kvm_84+dfsg-0ubuntu16+0.12.5+noroms+0ubuntu7.2_amd64.deb
      Size/MD5:    16050 3862d4b962732b539d8b25b069e156ee
    qemu-kvm_0.12.5+noroms-0ubuntu7.2_amd64.deb
      Size/MD5:  2957096 69bc0a937f2e04ca32c09732dc191453
    qemu-arm-static_0.12.5+noroms-0ubuntu7.2_amd64.deb
      Size/MD5:    15680 5dad6903eb7aa01d25360170306ab330
    qemu-kvm-extras-static_0.12.5+noroms-0ubuntu7.2_amd64.deb
      Size/MD5: 11168302 91bc79c088eaad99c7a49383893c2fdc
    qemu-kvm-extras_0.12.5+noroms-0ubuntu7.2_amd64.deb
      Size/MD5: 16957714 ff9c39105e09c6a4102c3cf3dbf3107a
    qemu_0.12.5+noroms-0ubuntu7.2_amd64.deb
      Size/MD5:    15524 8273e72ea1150187c776c8dac8ed2488

  i386 architecture (x86 compatible Intel/AMD):

    kvm_84+dfsg-0ubuntu16+0.12.5+noroms+0ubuntu7.2_i386.deb
      Size/MD5:    16044 9c3462e5d6a0755d3fa69ca11d933aef
    qemu-kvm_0.12.5+noroms-0ubuntu7.2_i386.deb
      Size/MD5:  2564790 ada35e13122697d5fea9773639654024
    qemu-arm-static_0.12.5+noroms-0ubuntu7.2_i386.deb
      Size/MD5:    15682 b242ac1ce847b1d6d63e8539b41a176a
    qemu-kvm-extras-static_0.12.5+noroms-0ubuntu7.2_i386.deb
      Size/MD5:  9135998 b65dfb9ef035cc01c071205c1ec6e5ec
    qemu-kvm-extras_0.12.5+noroms-0ubuntu7.2_i386.deb
      Size/MD5: 14505730 0ed7b21c70261300999943ca3bcf1816
    qemu_0.12.5+noroms-0ubuntu7.2_i386.deb
      Size/MD5:    15526 b535c8f8e4b401fe0bbbf8a8d9d6217b

  armel architecture (ARM Architecture):

    kvm_84+dfsg-0ubuntu16+0.12.5+noroms+0ubuntu7.2_armel.deb
      Size/MD5:    16052 e2216cd3d34a0c0e3a26e1043f394576
    qemu-kvm-extras_0.12.5+noroms-0ubuntu7.2_armel.deb
      Size/MD5: 16686058 ef388115c1a3f3a2c6c9dffd2c81effc
    qemu_0.12.5+noroms-0ubuntu7.2_armel.deb
      Size/MD5:    15528 fb3afeddcfa09f079fb898959ac6c3b5

  powerpc architecture (Apple Macintosh G3/G4/G5):

    kvm_84+dfsg-0ubuntu16+0.12.5+noroms+0ubuntu7.2_powerpc.deb
      Size/MD5:    16050 ab495cfe0e2c0fd319eba2b8a3e9ff64
    qemu-kvm_0.12.5+noroms-0ubuntu7.2_powerpc.deb
      Size/MD5:  2887434 4a636ec1c5a06cbf729d2213291aa2ee
    qemu-kvm-extras_0.12.5+noroms-0ubuntu7.2_powerpc.deb
      Size/MD5: 16064224 3f0f63526a0215877b3c619bbdea0ffe
    qemu_0.12.5+noroms-0ubuntu7.2_powerpc.deb
      Size/MD5:    15528 d930a7237b7efe1d7a7c10d755ab1ded


--FL5UXtIhxfXey3p5
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Kees Cook <kees@outflux.net>

iQIcBAEBCgAGBQJNWaKWAAoJEIly9N/cbcAmdzoQAIthb9oeDj/yglubKn+8h3qV
PVNtfpIk6CGROLFfPUQmYxIOwnMnXdJMrD8c0S6lFuaRUoW318tHqNvOYVNFcQrv
x24r0Vy+qyeZJrp0TGDxtf/w8JCCGJvuFdcMlM8uF77b3NydfdfPmTaptQ+ZDLpo
wVz8BpL14fXpt/ZxdvGK56h8WyczOl1p9AEhxynV51F4HNF/WH5bqHJPN2ReTshU
77cPeYQrjfLF2tYCzZlYLzBWv5D25hosNKVawcApSXE1Ku1ka20yftoRz4HCEreY
yIImXb4jB7wCGHjuDnSdSMOFiDG+EGcncoJtfGkpVFC4nmOF86ZbwoHJhfHoMxbB
p5b6CKGRhFweBS1I9sZW77CBOE11wjGglFsWbVTINZ/wjfeJsf+6FHg+Kv6ZiPPm
q5goYcBupFfmNikh9yKCNsL5SDyBNGQPcnj+LxYSAXdcbJ1DRp0I0OilNJUw4pOY
89L8+j40zNBc2b4K795NjYxIkYMWRTjV9DUG7ymuPfDV6iHsd82v08yv5d4ilLTB
d/wZ2BKi2vQPYpMncobd/NfyC1bZHV62zNt5UayeDFwDBagsdGPKmEYzQLPixxf6
kg54rycMA4kZ7x8vSy0ehPjsMSXF+/KtAdPkOHujKz3Frosc1sdGI6pmyydO+Xn+
gQQQNR+P8u9fWG50J1wW
=6qdi
-----END PGP SIGNATURE-----

--FL5UXtIhxfXey3p5--


--===============6093103871961483089==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

-- 
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce

--===============6093103871961483089==--