FlawAtlas
Search the atlas
SUSE-SU-2026:0288-1 Not scored

Security update for qemu

This update for qemu fixes the following issues: Security issues fixed: - CVE-2025-12464: stack-based buffer overflow in the e1000 network device operations can be exploited by a malicious guest user to crash the QEMU process on the host (bsc#1253002). - CVE-2025-11234: use-after-free in WebSocket handshake operations can be exploited by a malicious client with network access to the VNC WebSocket port to cause a denial-of-service (bsc#1250984). Other updates and bugfixes: - [openSUSE][RPM] spec: require qemu-hw-display-virtio-gpu-pci for x86 too. - [openSUSE][RPM] spec: make glusterfs support conditional (bsc#1254494). - [openSUSE][RPM]: really fix *-virtio-gpu-pci dependency on ARM (bsc#1254286). - block/curl: fix curl internal handles handling (bsc#1252768). - [openSUSE][RPM] spec: qemu-vgabios is required on ppc (bsc#1230042).

Exploit probability Not scored
Published January 26, 2026
Required by Not available
Last source change March 23, 2026

02 / AFFECTED SOFTWARE

Affected packages

SUSE:Linux Enterprise Module for Basesystem 15 SP7 qemu
SUSE:Linux Enterprise Module for Package Hub 15 SP7 qemu
SUSE:Linux Enterprise Module for Package Hub 15 SP7 qemu-linux-user
SUSE:Linux Enterprise Module for Server Applications 15 SP7 qemu

03 / CONNECTIONS

Connected vulnerabilities

04 / EVIDENCE

Source records

Open Source Vulnerabilities SUSE-SU-2026:0288-1

This update for qemu fixes the following issues: Security issues fixed: - CVE-2025-12464: stack-based buffer overflow in the e1000 network device operations can be exploited by a malicious guest user to crash the QEMU process on the host (bsc#1253002). - CVE-2025-11234: use-after-free in WebSocket handshake operations can be exploited by a malicious client with network access to the VNC WebSocket port to cause a denial-of-service (bsc#1250984). Other updates and bugfixes: - [openSUSE][RPM] spec: require qemu-hw-display-virtio-gpu-pci for x86 too. - [openSUSE][RPM] spec: make glusterfs support conditional (bsc#1254494). - [openSUSE][RPM]: really fix *-virtio-gpu-pci dependency on ARM (bsc#1254286). - block/curl: fix curl internal handles handling (bsc#1252768). - [openSUSE][RPM] spec: qemu-vgabios is required on ppc (bsc#1230042).

View original source

05 / REFERENCES

Further evidence