lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Sat, 8 Sep 2012 16:32:19 -0500
From: Raphael Geissert <>
Subject: [SECURITY] [DSA 2543-1] xen-qemu-dm-4.0 security update

Hash: SHA1

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2543-1                                   Raphael Geissert
September 08, 2012           
- -------------------------------------------------------------------------

Package        : xen-qemu-dm-4.0
Vulnerability  : multiple
Problem type   : local
Debian-specific: no
CVE ID         : CVE-2012-3515 CVE-2012-4411

Multiple vulnerabilities have been discovered in xen-qemu-dm-4.0, the Xen
Qemu Device Model virtual machine hardware emulator. The Common
Vulnerabilities and Exposures project identifies the following problems:


    The device model for HVM domains does not properly handle VT100
    escape sequences when emulating certain devices with a virtual
    console backend. An attacker within a guest with access to the
    vulnerable virtual console could overwrite memory of the device
    model and escalate privileges to that of the device model process.


    The qemu monitor was enabled by default, allowing administrators of
    a guest to access resources of the host, possibly escalate privileges
    or access resources belonging to another guest.

For the stable distribution (squeeze), these problems have been fixed in
version 4.0.1-2+squeeze2.

The testing distribution (wheezy), and the unstable distribution (sid),
no longer contain this package.

We recommend that you upgrade your xen-qemu-dm-4.0 packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at:

Mailing list:
Version: GnuPG v1.4.12 (GNU/Linux)


Powered by blists - more mailing lists