SUSE Security Update: Security update for qemu ______________________________________________________________________________
Announcement ID: SUSE-SU-2019:0471-1 Rating: important References: #1116717 #1117275 #1119493 #1123156 Cross-References: CVE-2018-16872 CVE-2018-19364 CVE-2018-19489 CVE-2019-6778 Affected Products: SUSE Linux Enterprise Server 12-SP1-LTSS ______________________________________________________________________________
An update that fixes four vulnerabilities is now available.
Description:
This update for qemu fixes the following issues:
Security issue fixed:
- CVE-2019-6778: Fixed a heap buffer overflow issue in the SLiRP networking implementation (bsc#1123156). - CVE-2018-16872: Fixed a host security vulnerability related to handling symlinks in usb-mtp (bsc#1119493). - CVE-2018-19489: Fixed a denial of service vulnerability in virtfs (bsc#1117275). - CVE-2018-19364: Fixed a use-after-free if the virtfs interface resulting in a denial of service (bsc#1116717).
Patch Instructions:
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- SUSE Linux Enterprise Server 12-SP1-LTSS:
zypper in -t patch SUSE-SLE-SERVER-12-SP1-2019-471=1
Package List:
- SUSE Linux Enterprise Server 12-SP1-LTSS (ppc64le s390x x86_64):