Security update for qemu
This update for qemu fixes the following issues: - CVE-2024-26327: Fixed buffer overflow via invalid SR/IOV NumVFs value (bsc#1220062). - CVE-2024-24474: Fixed integer overflow results in buffer overflow via SCSI command (bsc#1220134). - CVE-2023-6693: Fixed stack buffer overflow in virtio_net_flush_tx() (bsc#1218484). - CVE-2023-1544: Fixed out-of-bounds read in pvrdma_ring_next_elem_read() (bsc#1209554). - CVE-2024-26328: Fixed invalid NumVFs value handled in NVME SR/IOV implementation (bsc#1220065). The following non-security bug was fixed: - Removing in-use mediated device should fail with error message instead of hang (bsc#1205316).
02 / AFFECTED SOFTWARE
Affected packages
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
This update for qemu fixes the following issues: - CVE-2024-26327: Fixed buffer overflow via invalid SR/IOV NumVFs value (bsc#1220062). - CVE-2024-24474: Fixed integer overflow results in buffer overflow via SCSI command (bsc#1220134). - CVE-2023-6693: Fixed stack buffer overflow in virtio_net_flush_tx() (bsc#1218484). - CVE-2023-1544: Fixed out-of-bounds read in pvrdma_ring_next_elem_read() (bsc#1209554). - CVE-2024-26328: Fixed invalid NumVFs value handled in NVME SR/IOV implementation (bsc#1220065). The following non-security bug was fixed: - Removing in-use mediated device should fail with error message instead of hang (bsc#1205316).
05 / REFERENCES
Further evidence
- https://bugzilla.suse.com/1205316
- https://bugzilla.suse.com/1209554
- https://bugzilla.suse.com/1218484
- https://bugzilla.suse.com/1220062
- https://bugzilla.suse.com/1220065
- https://bugzilla.suse.com/1220134
- https://www.suse.com/security/cve/CVE-2023-1544
- https://www.suse.com/security/cve/CVE-2023-6693
- https://www.suse.com/security/cve/CVE-2024-24474
- https://www.suse.com/security/cve/CVE-2024-26327
- https://www.suse.com/security/cve/CVE-2024-26328
- https://www.suse.com/support/update/announcement/2024/suse-su-20241103-1/