[ GLSA 201210-04 ] qemu-kvm: Multiple vulnerabilities

[GLSA]

Gentoo Linux Security Advisory

Title: qemu-kvm: Multiple vulnerabilities (GLSA 201210-04)
Severity: high
Exploitable: remote
Date: October 18, 2012
Bug(s): #364889, #365259, #372411, #373997, #400595, #430456
ID: 201210-04

Synopsis

Multiple vulnerabilities were found in qemu-kvm, allowing attackers
to execute arbitrary code.


Background

qemu-kvm provides QEMU and Kernel-based Virtual Machine userland tools.

Affected Packages

Package: app-emulation/qemu-kvm
Vulnerable: < 1.1.1-r1
Unaffected: >= 1.1.1-r1
Architectures: All supported architectures


Description

Multiple vulnerabilities have been discovered in qemu-kvm. Please review
the CVE identifiers referenced below for details.


Impact

These vulnerabilities allow a remote attacker to cause a Denial of
Service condition on the host server or qemu process, might allow for
arbitrary code execution or a symlink attack when qemu-kvm is in snapshot
mode.


Workaround

There is no known workaround at this time.

Resolution

All qemu-kvm users should upgrade to the latest version: