Debian has issued an advisory on January 15: http://www.debian.org/security/2013/dsa-2607 Patched packages uploaded for Mageia 2 and Cauldron. Patch also checked into Mageia 1 SVN. Advisory: ======================== Updated qemu-kvm packages fix security vulnerability: It was discovered that the e1000 emulation code in QEMU does not enforce frame size limits in the same way as the real hardware does. This could trigger buffer overflows in the guest operating system driver for that network card, assuming that the host system does not discard such frames (which it will by default) (CVE-2012-6075). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6075 http://www.debian.org/security/2013/dsa-2607 ======================== Updated packages in core/updates_testing: ======================== qemu-1.0-6.3.mga2 qemu-img-1.0-6.3.mga2 from qemu-1.0-6.3.mga2.src.rpm
Seems difficult to reproduce and low risk so just testing the updated packages
Testing procedure: https://bugs.mageia.org/show_bug.cgi?id=6694#c3
Whiteboard: (none) => has_procedure
Testing complete mga2 64
Whiteboard: has_procedure => has_procedure mga2-64-OK
I'll test Mageia 2 i586 shortly.
CC: (none) => davidwhodgins
Testing complete on Mageia 2 i586. Could someone from the sysadmin team push the srpm qemu-1.0-6.3.mga2.src.rpm from Mageia 2 Core Updates Testing to Core Updates. Advisory: Updated qemu-kvm packages fix security vulnerability: It was discovered that the e1000 emulation code in QEMU does not enforce frame size limits in the same way as the real hardware does. This could trigger buffer overflows in the guest operating system driver for that network card, assuming that the host system does not discard such frames (which it will by default) (CVE-2012-6075). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6075 http://www.debian.org/security/2013/dsa-2607 https://bugs.mageia.org/show_bug.cgi?id=8715
Keywords: (none) => validated_updateCC: (none) => sysadmin-bugsWhiteboard: has_procedure mga2-64-OK => has_procedure mga2-64-OK MGA2-32-OK
Update pushed: https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0025
Status: NEW => RESOLVEDCC: (none) => tmbResolution: (none) => FIXED