CVE-2012-3515
Published: 6 September 2012
Qemu, as used in Xen 4.0, 4.1 and possibly other products, when emulating certain devices with a virtual console backend, allows local OS guest users to gain privileges via a crafted escape VT100 sequence that triggers the overwrite of a "device model's address space."
Notes
| Author | Note |
|---|---|
| kees | for full-virtualization issues, add qemu (and kvm) |
| mdeslaur | This is XSA-17 Also affects qemu-kvm |
| jdstrand | xen-qemu-dm-4.0 needs libxen-dev >= 4.0, but it isn't available in 11.04, as a result, there are no binaries available in 11.04. |
Priority
Status
| Package | Release | Status |
|---|---|---|
|
qemu-kvm Launchpad, Ubuntu, Debian |
hardy |
Does not exist
|
| lucid |
Released
(0.12.3+noroms-0ubuntu9.20)
|
|
| natty |
Released
(0.14.0+noroms-0ubuntu4.7)
|
|
| oneiric |
Released
(0.14.1+noroms-0ubuntu6.5)
|
|
| precise |
Released
(1.0+noroms-0ubuntu14.2)
|
|
| quantal |
Not vulnerable
(1.2.0+noroms-0ubuntu2)
|
|
| raring |
Does not exist
|
|
| saucy |
Does not exist
|
|
| upstream |
Needs triage
|
|
|
Patches: upstream: http://git.kernel.org/?p=virt/kvm/qemu-kvm.git;a=commit;h=3eea5498ca501922520b3447ba94815bfc109743 |
||
|
xen Launchpad, Ubuntu, Debian |
hardy |
Does not exist
|
| lucid |
Does not exist
|
|
| natty |
Does not exist
|
|
| oneiric |
Released
(4.1.1-2ubuntu4.4)
|
|
| precise |
Released
(4.1.2-2ubuntu2.4)
|
|
| quantal |
Not vulnerable
(4.1.3-3ubuntu1)
|
|
| raring |
Not vulnerable
|
|
| saucy |
Not vulnerable
|
|
| upstream |
Released
(4.1.3-2)
|
|
| Binaries built from this source package are in Universe and so are supported by the community. | ||
|
xen-3.1 Launchpad, Ubuntu, Debian |
hardy |
Ignored
(reached end-of-life)
|
| lucid |
Does not exist
|
|
| natty |
Does not exist
|
|
| oneiric |
Does not exist
|
|
| precise |
Does not exist
|
|
| quantal |
Does not exist
|
|
| raring |
Does not exist
|
|
| saucy |
Does not exist
|
|
| upstream |
Needs triage
|
|
| Binaries built from this source package are in Universe and so are supported by the community. | ||
|
xen-3.2 Launchpad, Ubuntu, Debian |
hardy |
Ignored
(reached end-of-life)
|
| lucid |
Does not exist
|
|
| natty |
Does not exist
|
|
| oneiric |
Does not exist
|
|
| precise |
Does not exist
|
|
| quantal |
Does not exist
|
|
| raring |
Does not exist
|
|
| saucy |
Does not exist
|
|
| upstream |
Needs triage
|
|
| Binaries built from this source package are in Universe and so are supported by the community. | ||
|
xen-3.3 Launchpad, Ubuntu, Debian |
hardy |
Does not exist
|
| lucid |
Ignored
(reached end-of-life)
|
|
| natty |
Ignored
(reached end-of-life)
|
|
| oneiric |
Does not exist
|
|
| precise |
Does not exist
|
|
| quantal |
Does not exist
|
|
| raring |
Does not exist
|
|
| saucy |
Does not exist
|
|
| upstream |
Needs triage
|
|
| Binaries built from this source package are in Universe and so are supported by the community. | ||
|
xen-qemu-dm-4.0 Launchpad, Ubuntu, Debian |
hardy |
Does not exist
|
| lucid |
Does not exist
|
|
| natty |
Ignored
|
|
| oneiric |
Does not exist
|
|
| precise |
Does not exist
|
|
| quantal |
Does not exist
|
|
| raring |
Does not exist
|
|
| saucy |
Does not exist
|
|
| upstream |
Needs triage
|
|
|
Patches: vendor: http://www.debian.org/security/2012/dsa-2543 |
||