FEDORA-2015-9601

FEDORA-2015-9599

SUSE-SU-2015:1152

SUSE-SU-2015:1519

openSUSE-SU-2015:1965

DSA-3284

DSA-3285

[oss-security] 20150513 QEMU 2.3.0 tmp vulns CVE request

[oss-security] 20150516 Re: QEMU 2.3.0 tmp vulns CVE request

[oss-security] 20150523 Re: QEMU 2.3.0 tmp vulns CVE request

74809

1032547

USN-2630-1

https://bugzilla.redhat.com/show_bug.cgi?id=1222892

According to the versions of the qemu-kvm packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In QEMU 3.0.0, tcp_emu in slirp/tcp_subr.c has a     heap-based buffer overflow.(CVE-2019-6778)

  - The MSI-X MMIO support in hw/pci/msix.c in QEMU (aka     Quick Emulator) allows local guest OS privileged users     to cause a denial of service (NULL pointer dereference     and QEMU process crash) by leveraging failure to define     the .write method.(CVE-2015-7549)

  - The ne2000_receive function in the NE2000 NIC emulation     support (hw/net/ne2000.c) in QEMU before 2.5.1 allows     local guest OS administrators to cause a denial of     service (infinite loop and QEMU process crash) via     crafted values for the PSTART and PSTOP registers,     involving ring buffer control.(CVE-2016-2841)

  - Memory leak in QEMU (aka Quick Emulator), when built     with USB EHCI Emulation support, allows local guest OS     privileged users to cause a denial of service (memory     consumption) by repeatedly hot-unplugging the     device.(CVE-2017-9374)

  - Integer overflow in the macro ROUND_UP (n, d) in Quick     Emulator (Qemu) allows a user to cause a denial of     service (Qemu process crash).(CVE-2017-18043)

  - Memory leak in the serial_exit_core function in     hw/char/serial.c in QEMU (aka Quick Emulator) allows     local guest OS privileged users to cause a denial of     service (host memory consumption and QEMU process     crash) via a large number of device unplug     operations.(CVE-2017-5579)

  - The slirp_smb function in net/slirp.c in QEMU 2.3.0 and     earlier creates temporary files with predictable names,     which allows local users to cause a denial of service     (instantiation failure) by creating /tmp/qemu-smb.*-*     files before the program.(CVE-2015-4037)

  - The mcf_fec_do_tx function in hw/net/mcf_fec.c in QEMU     (aka Quick Emulator) does not properly limit the buffer     descriptor count when transmitting packets, which     allows local guest OS administrators to cause a denial     of service (infinite loop and QEMU process crash) via     vectors involving a buffer descriptor with a length of     0 and crafted values in bd.flags.(CVE-2016-7908)

  - hw/net/vmxnet3.c in QEMU 2.0.0-rc0, 1.7.1, and earlier     allows local guest users to cause a denial of service     or possibly execute arbitrary code via vectors related     to (1) RX or (2) TX queue numbers or (3) interrupt     indices. NOTE: some of these details are obtained from     third party information.(CVE-2013-4544)

  - Multiple integer overflows in the USB Net device     emulator (hw/usb/dev-network.c) in QEMU before 2.5.1     allow local guest OS administrators to cause a denial     of service (QEMU process crash) or obtain sensitive     host memory information via a remote NDIS control     message packet that is mishandled in the (1)     rndis_query_response, (2) rndis_set_response, or (3)     usb_net_handle_dataout function.(CVE-2016-2538)

  - Qemu emulator <= 3.0.0 built with the NE2000 NIC     emulation support is vulnerable to an integer overflow,     which could lead to buffer overflow issue. It could     occur when receiving packets over the network. A user     inside guest could use this flaw to crash the Qemu     process resulting in DoS.(CVE-2018-10839)

  - Memory leak in QEMU (aka Quick Emulator), when built     with IDE AHCI Emulation support, allows local guest OS     privileged users to cause a denial of service (memory     consumption) by repeatedly hot-unplugging the AHCI     device.(CVE-2017-9373)

  - tcp_emu in slirp/tcp_subr.c (aka slirp/src/tcp_subr.c)     in QEMU 3.0.0 uses uninitialized data in an snprintf     call, leading to Information disclosure.(CVE-2019-9824)

  - QEMU (aka Quick Emulator), when built with MegaRAID SAS     8708EM2 Host Bus Adapter emulation support, allows     local guest OS privileged users to cause a denial of     service (NULL pointer dereference and QEMU process     crash) via vectors involving megasas command     processing.(CVE-2017-9503)

  - Buffer overflow in hw/ide/ahci.c in QEMU before 1.7.2     allows remote attackers to cause a denial of service     and possibly execute arbitrary code via vectors related     to migrating ports.(CVE-2013-4526)

  - Buffer overflow in hw/ssi/pl022.c in QEMU before 1.7.2     allows remote attackers to cause a denial of service or     possibly execute arbitrary code via crafted     tx_fifo_head and rx_fifo_head values in a savevm     image.(CVE-2013-4530)

  - Multiple buffer overflows in the tsc210x_load function     in hw/input/tsc210x.c in QEMU before 1.7.2 might allow     remote attackers to execute arbitrary code via a     crafted (1) precision, (2) nextprecision, (3) function,     or (4) nextfunction value in a savevm     image.(CVE-2013-4539)

  - Buffer overflow in scoop_gpio_handler_update in QEMU     before 1.7.2 might allow remote attackers to execute     arbitrary code via a large (1) prev_level, (2)     gpio_level, or (3) gpio_dir value in a savevm     image.(CVE-2013-4540)

  - The sdhci_sdma_transfer_multi_blocks function in     hw/sd/sdhci.c in QEMU (aka Quick Emulator) allows local     OS guest privileged users to cause a denial of service     (infinite loop and QEMU process crash) via vectors     involving the transfer mode register during multi block     transfer.(CVE-2017-5987)

  - Microarchitectural Store Buffer Data Sampling (MSBDS):
    Store buffers on some microprocessors utilizing     speculative execution may allow an authenticated user     to potentially enable information disclosure via a side     channel with local access. A list of impacted products     can be found here:
    https://www.intel.com/content/dam/www/public/us/en/docu     ments/corporate-information/SA00233-microcode-update-gu     idance_05132019.pdf(CVE-2018-12126)

  - Microarchitectural Load Port Data Sampling (MLPDS):
    Load ports on some microprocessors utilizing     speculative execution may allow an authenticated user     to potentially enable information disclosure via a side     channel with local access. A list of impacted products     can be found here:
    https://www.intel.com/content/dam/www/public/us/en/docu     ments/corporate-information/SA00233-microcode-update-gu     idance_05132019.pdf(CVE-2018-12127)

  - Microarchitectural Fill Buffer Data Sampling (MFBDS):
    Fill buffers on some microprocessors utilizing     speculative execution may allow an authenticated user     to potentially enable information disclosure via a side     channel with local access. A list of impacted products     can be found here:
    https://www.intel.com/content/dam/www/public/us/en/docu     ments/corporate-information/SA00233-microcode-update-gu     idance_05132019.pdf(CVE-2018-12130)

  - Microarchitectural Data Sampling Uncacheable Memory     (MDSUM): Uncacheable memory on some microprocessors     utilizing speculative execution may allow an     authenticated user to potentially enable information     disclosure via a side channel with local access. A list     of impacted products can be found here:
    https://www.intel.com/content/dam/www/public/us/en/docu     ments/corporate-information/SA00233-microcode-update-gu     idance_05132019.pdf(CVE-2019-11091)

  - interface_release_resource in hw/display/qxl.c in QEMU     4.0.0 has a NULL pointer dereference.(CVE-2019-12155)

  - Heap-based buffer overflow in the .receive callback of     xlnx.xps-ethernetlite in QEMU (aka Quick Emulator)     allows attackers to execute arbitrary code on the QEMU     host via a large ethlite packet.(CVE-2016-7161)

  - Heap-based buffer overflow in the ne2000_receive     function in hw/net/ne2000.c in QEMU before 2.4.0.1     allows guest OS users to cause a denial of service     (instance crash) or possibly execute arbitrary code via     vectors related to receiving packets.(CVE-2015-5279)

  - The sdhci_sdma_transfer_multi_blocks function in     hw/sd/sdhci.c in QEMU (aka Quick Emulator) allows local     guest OS privileged users to cause a denial of service     (out-of-bounds heap access and crash) or execute     arbitrary code on the QEMU host via vectors involving     the data transfer length.(CVE-2017-5667)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Xen was updated to fix the following vulnerabilities :

CVE-2014-0222: Qcow1 L2 table size integer overflows (bsc#877642)

CVE-2015-4037: Insecure temporary file use in /net/slirp.c (bsc#932267)

CVE-2015-5239: Integer overflow in vnc_client_read() and protocol_client_msg() (bsc#944463)

CVE-2015-7504: Heap buffer overflow vulnerability in pcnet emulator (XSA-162, bsc#956411)

CVE-2015-7971: Some pmu and profiling hypercalls log without rate limiting (XSA-152, bsc#950706)

CVE-2015-8104: Guest to host DoS by triggering an infinite loop in microcode via #DB exception (bsc#954405)

CVE-2015-5307: Guest to host DOS by intercepting #AC (XSA-156, bsc#953527)

CVE-2015-8339: XENMEM_exchange error handling issues (XSA-159, bsc#956408)

CVE-2015-8340: XENMEM_exchange error handling issues (XSA-159, bsc#956408)

CVE-2015-7512: Buffer overflow in pcnet's non-loopback mode (bsc#962360)

CVE-2015-8550: Paravirtualized drivers incautious about shared memory contents (XSA-155, bsc#957988)

CVE-2015-8504: Avoid floating point exception in vnc support (bsc#958493)

CVE-2015-8555: Information leak in legacy x86 FPU/XMM initialization (XSA-165, bsc#958009)

Ioreq handling possibly susceptible to multiple read issue (XSA-166, bsc#958523)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Xen was updated to fix 6 security issues.

These security issues were fixed :

  - CVE-2014-0222: Validate L2 table size to avoid integer     overflows (bsc#877642).

  - CVE-2015-4037: Insecure temporary file use in     /net/slirp.c (bsc#932267).

  - CVE-2015-7835: Uncontrolled creation of large page     mappings by PV guests (bsc#950367).

  - CVE-2015-7969: Leak of per-domain profiling-related vcpu     pointer array (DoS) (bsc#950705 bsc#950703).

  - CVE-2015-7971: Some pmu and profiling hypercalls log     without rate limiting (bsc#950706).

  - CVE-2015-7972: Populate-on-demand balloon size     inaccuracy can crash guests (bsc#951845).

xen was updated to fix 12 security issues.

These security issues were fixed :

  - CVE-2015-7972: Populate-on-demand balloon size     inaccuracy can crash guests (bsc#951845).

  - CVE-2015-7969: Leak of main per-domain vcpu pointer     array (DoS) (bsc#950703).

  - CVE-2015-7969: Leak of per-domain profiling-related vcpu     pointer array (DoS) (bsc#950705).

  - CVE-2015-7971: Some pmu and profiling hypercalls log     without rate limiting (bsc#950706).

  - CVE-2015-4037: Insecure temporary file use in     /net/slirp.c (bsc#932267).

  - CVE-2014-0222: Validate L2 table size to avoid integer     overflows (bsc#877642).

  - CVE-2015-7835: Uncontrolled creation of large page     mappings by PV guests (bsc#950367).

  - CVE-2015-7311: libxl fails to honour readonly flag on     disks with qemu-xen (bsc#947165).

  - CVE-2015-5165: QEMU leak of uninitialized heap memory in     rtl8139 device model (bsc#939712).

  - CVE-2015-5166: Use after free in QEMU/Xen block unplug     protocol (bsc#939709).

  - CVE-2015-5154: Host code execution via IDE subsystem     CD-ROM (bsc#938344).

  - CVE-2015-3259: xl command line config handling stack     overflow (bsc#935634).

These non-security issues were fixed :

  - bsc#907514: Bus fatal error and sles12 sudden reboot has     been observed

  - bsc#910258: SLES12 Xen host crashes with FATAL NMI after     shutdown of guest with VT-d NIC

  - bsc#918984: Bus fatal error and sles11-SP4 sudden reboot     has been observed

  - bsc#923967: Partner-L3: Bus fatal error and sles11-SP3     sudden reboot has been observed

  - bsc#901488: Intel ixgbe driver assigns rx/tx queues per     core resulting in irq problems on servers with a large     amount of CPU cores

  - bsc#945167: Running command xl pci-assignable-add     03:10.1 secondly show errors

  - bsc#949138: Setting vcpu affinity under Xen causes     libvirtd abort

  - bsc#944463: VUL-0: CVE-2015-5239: qemu-kvm: Integer     overflow in vnc_client_read() and protocol_client_msg()

  - bsc#944697: VUL-1: CVE-2015-6815: qemu: net: e1000:
    infinite loop issue

  - bsc#925466: Kdump does not work in a XEN environment

xen was updated to fix eight security issues.

These security issues were fixed :

  - CVE-2015-4037: The slirp_smb function in net/slirp.c     created temporary files with predictable names, which     allowed local users to cause a denial of service     (instantiation failure) by creating /tmp/qemu-smb.*-*     files before the program (bsc#932267).

  - CVE-2014-0222: Integer overflow in the qcow_open     function allowed remote attackers to cause a denial of     service (crash) via a large L2 table in a QCOW version 1     image (bsc#877642).

  - CVE-2015-7835: Uncontrolled creation of large page     mappings by PV guests (bsc#950367).

  - CVE-2015-5239: Integer overflow in vnc_client_read() and     protocol_client_msg() (bsc#944463).

  - CVE-2015-6815: With e1000 NIC emulation support it was     possible to enter an infinite loop (bsc#944697).

  - CVE-2015-7969: Leak of main per-domain vcpu pointer     array leading to denial of service (bsc#950703).

  - CVE-2015-7969: Leak of per-domain profiling- related     vcpu pointer array leading to denial of service     (bsc#950705).

  - CVE-2015-7971: Some pmu and profiling hypercalls log     without rate limiting (bsc#950706).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

xen was updated to fix 13 security issues.

These security issues were fixed :

  - CVE-2015-7972: Populate-on-demand balloon size     inaccuracy can crash guests (bsc#951845).

  - CVE-2015-7969: Leak of main per-domain vcpu pointer     array (DoS) (bsc#950703).

  - CVE-2015-7969: Leak of per-domain profiling-related vcpu     pointer array (DoS) (bsc#950705).

  - CVE-2015-7971: Some pmu and profiling hypercalls log     without rate limiting (bsc#950706).

  - CVE-2015-4037: Insecure temporary file use in     /net/slirp.c (bsc#932267).

  - CVE-2014-0222: Validate L2 table size to avoid integer     overflows (bsc#877642).

  - CVE-2015-7835: Uncontrolled creation of large page     mappings by PV guests (bsc#950367).

  - CVE-2015-7311: libxl fails to honour readonly flag on     disks with qemu-xen (bsc#947165).

  - CVE-2015-5165: QEMU leak of uninitialized heap memory in     rtl8139 device model (bsc#939712).

  - CVE-2015-5166: Use after free in QEMU/Xen block unplug     protocol (bsc#939709).

  - CVE-2015-5239: Integer overflow in vnc_client_read() and     protocol_client_msg() (bsc#944463).

  - CVE-2015-6815: e1000: infinite loop issue (bsc#944697).

  - CVE-2015-5154: Host code execution via IDE subsystem     CD-ROM (bsc#938344).

This non-security issues was fixed :

  - bsc#941074: VmError: Device 51728 (vbd) could not be     connected. Hotplug scripts not working.

xen was updated to version 4.4.3 to fix nine security issues.

These security issues were fixed :

  - CVE-2015-4037: The slirp_smb function in net/slirp.c     created temporary files with predictable names, which     allowed local users to cause a denial of service     (instantiation failure) by creating /tmp/qemu-smb.*-*     files before the program (bsc#932267).

  - CVE-2014-0222: Integer overflow in the qcow_open     function allowed remote attackers to cause a denial of     service (crash) via a large L2 table in a QCOW version 1     image (bsc#877642).

  - CVE-2015-7835: Uncontrolled creation of large page     mappings by PV guests (bsc#950367).

  - CVE-2015-7311: libxl in Xen did not properly handle the     readonly flag on disks when using the qemu-xen device     model, which allowed local guest users to write to a     read-only disk image (bsc#947165).

  - CVE-2015-5239: Integer overflow in vnc_client_read() and     protocol_client_msg() (bsc#944463).

  - CVE-2015-6815: With e1000 NIC emulation support it was     possible to enter an infinite loop (bsc#944697).

  - CVE-2015-7969: Leak of main per-domain vcpu pointer     array leading to denial of service (bsc#950703).

  - CVE-2015-7969: Leak of per-domain profiling- related     vcpu pointer array leading to denial of service     (bsc#950705).

  - CVE-2015-7971: Some pmu and profiling hypercalls log     without rate limiting (bsc#950706).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

xen was updated to fix nine security issues.

These security issues were fixed :

  - CVE-2015-4037: The slirp_smb function in net/slirp.c     created temporary files with predictable names, which     allowed local users to cause a denial of service     (instantiation failure) by creating /tmp/qemu-smb.*-*     files before the program (bsc#932267).

  - CVE-2014-0222: Integer overflow in the qcow_open     function allowed remote attackers to cause a denial of     service (crash) via a large L2 table in a QCOW version 1     image (bsc#877642).

  - CVE-2015-7835: Uncontrolled creation of large page     mappings by PV guests (bsc#950367).

  - CVE-2015-7311: libxl in Xen did not properly handle the     readonly flag on disks when using the qemu-xen device     model, which allowed local guest users to write to a     read-only disk image (bsc#947165).

  - CVE-2015-5239: Integer overflow in vnc_client_read() and     protocol_client_msg() (bsc#944463).

  - CVE-2015-6815: With e1000 NIC emulation support it was     possible to enter an infinite loop (bsc#944697).

  - CVE-2015-7969: Leak of main per-domain vcpu pointer     array leading to denial of service (bsc#950703).

  - CVE-2015-7969: Leak of per-domain profiling- related     vcpu pointer array leading to denial of service     (bsc#950705).

  - CVE-2015-7971: Some pmu and profiling hypercalls log     without rate limiting (bsc#950706).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

qemu was updated to fix two security issues and augments one non-security bug fix.

The following vulnerabilities were fixed :

  - CVE-2015-3209: heap overflow in qemu pcnet controller     allowing guest to host escape (XSA-135) (bsc#932770)

  - CVE-2015-4037: Avoid predictable directory name for smb     config (bsc#932267)

The fix for the following non-security bug was improved :

  - bsc#893892: Use improved upstream patch for display     issue affecting installs of SLES 11 VMs on SLES 12

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

KVM was updated to fix two security issues :

CVE-2015-3209: Heap overflow in qemu pcnet controller allowing guest to host escape. (bsc#932770)

CVE-2015-4037: Predictable directory names for smb configuration.
(bsc#932267)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- User interface freezes when entering space character in     Xfig (bz #1151253)

    - CVE-2015-4037: insecure temporary file use in       /net/slirp.c (bz #1222894)

    - Backport {Haswell,Broadwell}-noTSX cpu models (bz       #1213053)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities were discovered in qemu-kvm, a full virtualization solution on x86 hardware.

  - CVE-2015-3209     Matt Tait of Google's Project Zero security team     discovered a flaw in the way QEMU's AMD PCnet Ethernet     emulation handles multi-TMD packets with a length above     4096 bytes. A privileged guest user in a guest with an     AMD PCNet ethernet card enabled can potentially use this     flaw to execute arbitrary code on the host with the     privileges of the hosting QEMU process.

  - CVE-2015-4037     Kurt Seifried of Red Hat Product Security discovered     that QEMU's user mode networking stack uses predictable     temporary file names when the -smb option is used. An     unprivileged user can use this flaw to cause a denial of     service.

Several vulnerabilities were discovered in qemu, a fast processor emulator.

  - CVE-2015-3209     Matt Tait of Google's Project Zero security team     discovered a flaw in the way QEMU's AMD PCnet Ethernet     emulation handles multi-TMD packets with a length above     4096 bytes. A privileged guest user in a guest with an     AMD PCNet ethernet card enabled can potentially use this     flaw to execute arbitrary code on the host with the     privileges of the hosting QEMU process.

  - CVE-2015-4037     Kurt Seifried of Red Hat Product Security discovered     that QEMU's user mode networking stack uses predictable     temporary file names when the -smb option is used. An     unprivileged user can use this flaw to cause a denial of     service.

  - CVE-2015-4103     Jan Beulich of SUSE discovered that the QEMU Xen code     does not properly restrict write access to the host MSI     message data field, allowing a malicious guest to cause     a denial of service.

  - CVE-2015-4104     Jan Beulich of SUSE discovered that the QEMU Xen code     does not properly restrict access to PCI MSI mask bits,     allowing a malicious guest to cause a denial of service.

  - CVE-2015-4105     Jan Beulich of SUSE reported that the QEMU Xen code     enables logging for PCI MSI-X pass-through error     messages, allowing a malicious guest to cause a denial     of service.

  - CVE-2015-4106     Jan Beulich of SUSE discovered that the QEMU Xen code     does not properly restrict write access to the PCI     config space for certain PCI pass-through devices,     allowing a malicious guest to cause a denial of service,     obtain sensitive information or potentially execute     arbitrary code.

- CVE-2015-4037: insecure temporary file use in     /net/slirp.c (bz #1222894)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Matt Tait discovered that QEMU incorrectly handled the virtual PCNET driver. A malicious guest could use this issue to cause a denial of service, or possibly execute arbitrary code on the host as the user running the QEMU process. In the default installation, when QEMU is used with libvirt, attackers would be isolated by the libvirt AppArmor profile. (CVE-2015-3209)

Kurt Seifried discovered that QEMU incorrectly handled certain temporary files. A local attacker could use this issue to cause a denial of service. (CVE-2015-4037)

Jan Beulich discovered that the QEMU Xen code incorrectly restricted write access to the host MSI message data field. A malicious guest could use this issue to cause a denial of service. This issue only applied to Ubuntu 14.04 LTS, Ubuntu 14.10 and Ubuntu 15.04.
(CVE-2015-4103)

Jan Beulich discovered that the QEMU Xen code incorrectly restricted access to the PCI MSI mask bits. A malicious guest could use this issue to cause a denial of service. This issue only applied to Ubuntu 14.04 LTS, Ubuntu 14.10 and Ubuntu 15.04. (CVE-2015-4104)

Jan Beulich discovered that the QEMU Xen code incorrectly handled MSI-X error messages. A malicious guest could use this issue to cause a denial of service. This issue only applied to Ubuntu 14.04 LTS, Ubuntu 14.10 and Ubuntu 15.04. (CVE-2015-4105)

Jan Beulich discovered that the QEMU Xen code incorrectly restricted write access to the PCI config space. A malicious guest could use this issue to cause a denial of service, obtain sensitive information, or possibly execute arbitrary code. This issue only applied to Ubuntu 14.04 LTS, Ubuntu 14.10 and Ubuntu 15.04. (CVE-2015-4106).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
130689	EulerOS 2.0 SP5 : qemu-kvm (EulerOS-SA-2019-2227)	Nessus	Huawei Local Security Checks	critical
89723	SUSE SLES10 Security Update : Xen (SUSE-SU-2016:0658-1)	Nessus	SuSE Local Security Checks	high
86961	openSUSE Security Update : xen (openSUSE-2015-730)	Nessus	SuSE Local Security Checks	high
86909	openSUSE Security Update : xen (openSUSE-2015-750)	Nessus	SuSE Local Security Checks	high
86865	SUSE SLES11 Security Update : xen (SUSE-SU-2015:1952-1)	Nessus	SuSE Local Security Checks	high
86863	openSUSE Security Update : xen (openSUSE-2015-729)	Nessus	SuSE Local Security Checks	high
86756	SUSE SLED12 / SLES12 Security Update : xen (SUSE-SU-2015:1908-1)	Nessus	SuSE Local Security Checks	high
86753	SUSE SLED11 / SLES11 Security Update : xen (SUSE-SU-2015:1894-1)	Nessus	SuSE Local Security Checks	high
86704	SUSE SLED11 / SLES11 Security Update : xen (SUSE-SU-2015:1853-1)	Nessus	SuSE Local Security Checks	high
85902	SUSE SLED12 / SLES12 Security Update : qemu (SUSE-SU-2015:1519-1)	Nessus	SuSE Local Security Checks	high
84443	SUSE SLED11 / SLES11 Security Update : KVM (SUSE-SU-2015:1152-1)	Nessus	SuSE Local Security Checks	high
84307	Fedora 21 : qemu-2.1.3-8.fc21 (2015-9599)	Nessus	Fedora Local Security Checks	low
84168	Debian DSA-3285-1 : qemu-kvm - security update	Nessus	Debian Local Security Checks	high
84167	Debian DSA-3284-1 : qemu - security update	Nessus	Debian Local Security Checks	high
84131	Fedora 22 : qemu-2.3.0-5.fc22 (2015-9601)	Nessus	Fedora Local Security Checks	low
84118	Ubuntu 12.04 LTS / 14.04 LTS / 14.10 / 15.04 : qemu, qemu-kvm vulnerabilities (USN-2630-1)	Nessus	Ubuntu Local Security Checks	high

CVE-2015-4037

Description

References

Details

Risk Information

CVSS v2.0

Vulnerable Software

Configuration 1

Tenable Plugins