CVE-2015-5154

Publication date 27 July 2015

Last updated 24 July 2024

Ubuntu priority

Description

Heap-based buffer overflow in the IDE subsystem in QEMU, as used in Xen 4.5.x and earlier, when the container has a CDROM drive enabled, allows local guest users to execute arbitrary code on the host via unspecified ATAPI commands.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
qemu	15.04 vivid	Fixed 1:2.2+dfsg-5expubuntu9.3
	14.10 utopic	Ignored end of life
	14.04 LTS trusty	Fixed 2.0.0+dfsg-2ubuntu1.15
	12.04 LTS precise	Not in release
qemu-kvm	15.04 vivid	Not in release
	14.10 utopic	Not in release
	14.04 LTS trusty	Not in release
	12.04 LTS precise	Not affected
xen	15.04 vivid	Not affected
	14.10 utopic	Ignored end of life
	14.04 LTS trusty	Fixed 4.4.2-0ubuntu0.14.04.2
	12.04 LTS precise	Fixed 4.1.6.1-0ubuntu0.12.04.6

Notes

mdeslaur

This is XSA-138 introduced by http://git.qemu.org/?p=qemu.git;a=commit;h=ce560dcf

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
qemu	Upstream: https://lists.gnu.org/archive/html/qemu-devel/2015-07/msg05162.html Upstream: http://git.qemu.org/?p=qemu.git;a=commit;h=d2ff85854512574e7209f295e87b0835d5b032c6 Upstream: http://git.qemu.org/?p=qemu.git;a=commit;h=03441c3a4a42beb25460dd11592539030337d0f8 Upstream: http://git.qemu.org/?p=qemu.git;a=commit;h=cb72cba83021fa42719e73a5249c12096a4d1cfc

References

Related Ubuntu Security Notices (USN)

USN-2692-1
QEMU vulnerabilities
28 July 2015