CVE-2016-7423

Published: 10 October 2016

The mptsas_process_scsi_io_request function in QEMU (aka Quick Emulator), when built with LSI SAS1068 Host Bus emulation support, allows local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) via vectors involving MPTSASRequest objects.

Priority

CVSS 3 base score: 4.4

Status

Package	Release	Status
qemu Launchpad, Ubuntu, Debian	Upstream	Needed




	Ubuntu 16.04 LTS (Xenial Xerus)	Not vulnerable (code not present)
	Ubuntu 14.04 ESM (Trusty Tahr)	Not vulnerable (code not present)
	Patches: Upstream: http://git.qemu.org/?p=qemu.git;a=commit;h=670e56d3ed2918b3861d9216f2c0540d9e9ae0d5
qemu-kvm Launchpad, Ubuntu, Debian	Upstream	Not vulnerable




	Ubuntu 16.04 LTS (Xenial Xerus)	Does not exist
	Ubuntu 14.04 ESM (Trusty Tahr)	Does not exist

References

Bugs

Join the discussion

Canonical is offering Extended Security Maintenance

Canonical is offering Ubuntu 14.04 Extended Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM