MGASA-2014-0467
- Source
- https://advisories.mageia.org/MGASA-2014-0467.html
- Import Source
- https://advisories.mageia.org/MGASA-2014-0467.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/MGASA-2014-0467
- Upstream
- Published
- 2014-11-21T12:44:16Z
- Modified
- 2026-04-16T01:46:30Z
- Summary
- Updated qemu packages fix security vulnerabilities
- Details
-
The Advanced Threat Research team at Intel Security reported that guest provided parameter were insufficiently validated in rectangle functions in the vmware-vga driver. A privileged guest user could use this flaw to write into qemu address space on the host, potentially escalating their privileges to those of the qemu host process (CVE-2014-3689).
It was discovered that QEMU incorrectly handled USB xHCI controller live migration. An attacker could possibly use this issue to cause a denial of service, or possibly execute arbitrary code (CVE-2014-5263).
James Spadaro of Cisco reported insufficiently sanitized bits_per_pixel from the client in the QEMU VNC display driver. An attacker having access to the guest's VNC console could use this flaw to crash the guest (CVE-2014-7815).
Additionally, the qemu update in MGASA-2014-0426 did not have USB redirection support because Qemu 1.6.2 requires an updated libusbredirparser library. This update has been built against the updated usbredirparser library.
- References
-
- https://advisories.mageia.org/MGASA-2014-0467.html
- https://bugs.mageia.org/show_bug.cgi?id=14434
- http://advisories.mageia.org/MGASA-2014-0426.html
- https://www.debian.org/security/2014/dsa-3066
- http://www.ubuntu.com/usn/usn-2409-1/
- https://lists.fedoraproject.org/pipermail/package-announce/2014-November/143312.html
- Credits
-
-
- Mageia - COORDINATOR
-
Affected packages
Mageia:4 / qemu
Package
- Name
- qemu
- Purl
- pkg:rpm/mageia/qemu?arch=source&distro=mageia-4
Mageia:4 / usbredir
Package
- Name
- usbredir
- Purl
- pkg:rpm/mageia/usbredir?arch=source&distro=mageia-4