qemu-6.1.0-34.1 on GA media SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2024:11597-1 Final 1 1 2024-06-15T00:00:00Z current 2024-06-15T00:00:00Z 2024-06-15T00:00:00Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z qemu-6.1.0-34.1 on GA media These are all security issues fixed in the qemu-6.1.0-34.1 package on the GA media of openSUSE Tumbleweed. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-Tumbleweed-2024-11597 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/security/rating/ SUSE Security Ratings https://www.suse.com/security/cve/CVE-2021-3713/ SUSE CVE CVE-2021-3713 page https://www.suse.com/security/cve/CVE-2021-3748/ SUSE CVE CVE-2021-3748 page openSUSE Tumbleweed qemu-6.1.0-34.1 qemu-accel-qtest-6.1.0-34.1 qemu-accel-tcg-x86-6.1.0-34.1 qemu-arm-6.1.0-34.1 qemu-audio-alsa-6.1.0-34.1 qemu-audio-jack-6.1.0-34.1 qemu-audio-pa-6.1.0-34.1 qemu-audio-spice-6.1.0-34.1 qemu-block-curl-6.1.0-34.1 qemu-block-dmg-6.1.0-34.1 qemu-block-gluster-6.1.0-34.1 qemu-block-iscsi-6.1.0-34.1 qemu-block-nfs-6.1.0-34.1 qemu-block-rbd-6.1.0-34.1 qemu-block-ssh-6.1.0-34.1 qemu-chardev-baum-6.1.0-34.1 qemu-chardev-spice-6.1.0-34.1 qemu-extra-6.1.0-34.1 qemu-guest-agent-6.1.0-34.1 qemu-hw-display-qxl-6.1.0-34.1 qemu-hw-display-virtio-gpu-6.1.0-34.1 qemu-hw-display-virtio-gpu-pci-6.1.0-34.1 qemu-hw-display-virtio-vga-6.1.0-34.1 qemu-hw-s390x-virtio-gpu-ccw-6.1.0-34.1 qemu-hw-usb-host-6.1.0-34.1 qemu-hw-usb-redirect-6.1.0-34.1 qemu-hw-usb-smartcard-6.1.0-34.1 qemu-ipxe-1.0.0+-34.1 qemu-ivshmem-tools-6.1.0-34.1 qemu-ksm-6.1.0-34.1 qemu-kvm-6.1.0-34.1 qemu-lang-6.1.0-34.1 qemu-microvm-6.1.0-34.1 qemu-ppc-6.1.0-34.1 qemu-s390x-6.1.0-34.1 qemu-seabios-1.14.0_0_g155821a-34.1 qemu-sgabios-8-34.1 qemu-skiboot-6.1.0-34.1 qemu-tools-6.1.0-34.1 qemu-ui-curses-6.1.0-34.1 qemu-ui-gtk-6.1.0-34.1 qemu-ui-opengl-6.1.0-34.1 qemu-ui-spice-app-6.1.0-34.1 qemu-ui-spice-core-6.1.0-34.1 qemu-vgabios-1.14.0_0_g155821a-34.1 qemu-vhost-user-gpu-6.1.0-34.1 qemu-x86-6.1.0-34.1 qemu-6.1.0-34.1 as a component of openSUSE Tumbleweed qemu-accel-qtest-6.1.0-34.1 as a component of openSUSE Tumbleweed qemu-accel-tcg-x86-6.1.0-34.1 as a component of openSUSE Tumbleweed qemu-arm-6.1.0-34.1 as a component of openSUSE Tumbleweed qemu-audio-alsa-6.1.0-34.1 as a component of openSUSE Tumbleweed qemu-audio-jack-6.1.0-34.1 as a component of openSUSE Tumbleweed qemu-audio-pa-6.1.0-34.1 as a component of openSUSE Tumbleweed qemu-audio-spice-6.1.0-34.1 as a component of openSUSE Tumbleweed qemu-block-curl-6.1.0-34.1 as a component of openSUSE Tumbleweed qemu-block-dmg-6.1.0-34.1 as a component of openSUSE Tumbleweed qemu-block-gluster-6.1.0-34.1 as a component of openSUSE Tumbleweed qemu-block-iscsi-6.1.0-34.1 as a component of openSUSE Tumbleweed qemu-block-nfs-6.1.0-34.1 as a component of openSUSE Tumbleweed qemu-block-rbd-6.1.0-34.1 as a component of openSUSE Tumbleweed qemu-block-ssh-6.1.0-34.1 as a component of openSUSE Tumbleweed qemu-chardev-baum-6.1.0-34.1 as a component of openSUSE Tumbleweed qemu-chardev-spice-6.1.0-34.1 as a component of openSUSE Tumbleweed qemu-extra-6.1.0-34.1 as a component of openSUSE Tumbleweed qemu-guest-agent-6.1.0-34.1 as a component of openSUSE Tumbleweed qemu-hw-display-qxl-6.1.0-34.1 as a component of openSUSE Tumbleweed qemu-hw-display-virtio-gpu-6.1.0-34.1 as a component of openSUSE Tumbleweed qemu-hw-display-virtio-gpu-pci-6.1.0-34.1 as a component of openSUSE Tumbleweed qemu-hw-display-virtio-vga-6.1.0-34.1 as a component of openSUSE Tumbleweed qemu-hw-s390x-virtio-gpu-ccw-6.1.0-34.1 as a component of openSUSE Tumbleweed qemu-hw-usb-host-6.1.0-34.1 as a component of openSUSE Tumbleweed qemu-hw-usb-redirect-6.1.0-34.1 as a component of openSUSE Tumbleweed qemu-hw-usb-smartcard-6.1.0-34.1 as a component of openSUSE Tumbleweed qemu-ipxe-1.0.0+-34.1 as a component of openSUSE Tumbleweed qemu-ivshmem-tools-6.1.0-34.1 as a component of openSUSE Tumbleweed qemu-ksm-6.1.0-34.1 as a component of openSUSE Tumbleweed qemu-kvm-6.1.0-34.1 as a component of openSUSE Tumbleweed qemu-lang-6.1.0-34.1 as a component of openSUSE Tumbleweed qemu-microvm-6.1.0-34.1 as a component of openSUSE Tumbleweed qemu-ppc-6.1.0-34.1 as a component of openSUSE Tumbleweed qemu-s390x-6.1.0-34.1 as a component of openSUSE Tumbleweed qemu-seabios-1.14.0_0_g155821a-34.1 as a component of openSUSE Tumbleweed qemu-sgabios-8-34.1 as a component of openSUSE Tumbleweed qemu-skiboot-6.1.0-34.1 as a component of openSUSE Tumbleweed qemu-tools-6.1.0-34.1 as a component of openSUSE Tumbleweed qemu-ui-curses-6.1.0-34.1 as a component of openSUSE Tumbleweed qemu-ui-gtk-6.1.0-34.1 as a component of openSUSE Tumbleweed qemu-ui-opengl-6.1.0-34.1 as a component of openSUSE Tumbleweed qemu-ui-spice-app-6.1.0-34.1 as a component of openSUSE Tumbleweed qemu-ui-spice-core-6.1.0-34.1 as a component of openSUSE Tumbleweed qemu-vgabios-1.14.0_0_g155821a-34.1 as a component of openSUSE Tumbleweed qemu-vhost-user-gpu-6.1.0-34.1 as a component of openSUSE Tumbleweed qemu-x86-6.1.0-34.1 as a component of openSUSE Tumbleweed An out-of-bounds write flaw was found in the UAS (USB Attached SCSI) device emulation of QEMU in versions prior to 6.2.0-rc0. The device uses the guest supplied stream number unchecked, which can lead to out-of-bounds access to the UASDevice->data3 and UASDevice->status3 fields. A malicious guest user could use this flaw to crash QEMU or potentially achieve code execution with the privileges of the QEMU process on the host. CVE-2021-3713 openSUSE Tumbleweed:qemu-6.1.0-34.1 openSUSE Tumbleweed:qemu-accel-qtest-6.1.0-34.1 openSUSE Tumbleweed:qemu-accel-tcg-x86-6.1.0-34.1 openSUSE Tumbleweed:qemu-arm-6.1.0-34.1 openSUSE Tumbleweed:qemu-audio-alsa-6.1.0-34.1 openSUSE Tumbleweed:qemu-audio-jack-6.1.0-34.1 openSUSE Tumbleweed:qemu-audio-pa-6.1.0-34.1 openSUSE Tumbleweed:qemu-audio-spice-6.1.0-34.1 openSUSE Tumbleweed:qemu-block-curl-6.1.0-34.1 openSUSE Tumbleweed:qemu-block-dmg-6.1.0-34.1 openSUSE Tumbleweed:qemu-block-gluster-6.1.0-34.1 openSUSE Tumbleweed:qemu-block-iscsi-6.1.0-34.1 openSUSE Tumbleweed:qemu-block-nfs-6.1.0-34.1 openSUSE Tumbleweed:qemu-block-rbd-6.1.0-34.1 openSUSE Tumbleweed:qemu-block-ssh-6.1.0-34.1 openSUSE Tumbleweed:qemu-chardev-baum-6.1.0-34.1 openSUSE Tumbleweed:qemu-chardev-spice-6.1.0-34.1 openSUSE Tumbleweed:qemu-extra-6.1.0-34.1 openSUSE Tumbleweed:qemu-guest-agent-6.1.0-34.1 openSUSE Tumbleweed:qemu-hw-display-qxl-6.1.0-34.1 openSUSE Tumbleweed:qemu-hw-display-virtio-gpu-6.1.0-34.1 openSUSE Tumbleweed:qemu-hw-display-virtio-gpu-pci-6.1.0-34.1 openSUSE Tumbleweed:qemu-hw-display-virtio-vga-6.1.0-34.1 openSUSE Tumbleweed:qemu-hw-s390x-virtio-gpu-ccw-6.1.0-34.1 openSUSE Tumbleweed:qemu-hw-usb-host-6.1.0-34.1 openSUSE Tumbleweed:qemu-hw-usb-redirect-6.1.0-34.1 openSUSE Tumbleweed:qemu-hw-usb-smartcard-6.1.0-34.1 openSUSE Tumbleweed:qemu-ipxe-1.0.0+-34.1 openSUSE Tumbleweed:qemu-ivshmem-tools-6.1.0-34.1 openSUSE Tumbleweed:qemu-ksm-6.1.0-34.1 openSUSE Tumbleweed:qemu-kvm-6.1.0-34.1 openSUSE Tumbleweed:qemu-lang-6.1.0-34.1 openSUSE Tumbleweed:qemu-microvm-6.1.0-34.1 openSUSE Tumbleweed:qemu-ppc-6.1.0-34.1 openSUSE Tumbleweed:qemu-s390x-6.1.0-34.1 openSUSE Tumbleweed:qemu-seabios-1.14.0_0_g155821a-34.1 openSUSE Tumbleweed:qemu-sgabios-8-34.1 openSUSE Tumbleweed:qemu-skiboot-6.1.0-34.1 openSUSE Tumbleweed:qemu-tools-6.1.0-34.1 openSUSE Tumbleweed:qemu-ui-curses-6.1.0-34.1 openSUSE Tumbleweed:qemu-ui-gtk-6.1.0-34.1 openSUSE Tumbleweed:qemu-ui-opengl-6.1.0-34.1 openSUSE Tumbleweed:qemu-ui-spice-app-6.1.0-34.1 openSUSE Tumbleweed:qemu-ui-spice-core-6.1.0-34.1 openSUSE Tumbleweed:qemu-vgabios-1.14.0_0_g155821a-34.1 openSUSE Tumbleweed:qemu-vhost-user-gpu-6.1.0-34.1 openSUSE Tumbleweed:qemu-x86-6.1.0-34.1 important 4.6 AV:L/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-3713.html CVE-2021-3713 https://bugzilla.suse.com/1189702 SUSE Bug 1189702 A use-after-free vulnerability was found in the virtio-net device of QEMU. It could occur when the descriptor's address belongs to the non direct access region, due to num_buffers being set after the virtqueue elem has been unmapped. A malicious guest could use this flaw to crash QEMU, resulting in a denial of service condition, or potentially execute code on the host with the privileges of the QEMU process. CVE-2021-3748 openSUSE Tumbleweed:qemu-6.1.0-34.1 openSUSE Tumbleweed:qemu-accel-qtest-6.1.0-34.1 openSUSE Tumbleweed:qemu-accel-tcg-x86-6.1.0-34.1 openSUSE Tumbleweed:qemu-arm-6.1.0-34.1 openSUSE Tumbleweed:qemu-audio-alsa-6.1.0-34.1 openSUSE Tumbleweed:qemu-audio-jack-6.1.0-34.1 openSUSE Tumbleweed:qemu-audio-pa-6.1.0-34.1 openSUSE Tumbleweed:qemu-audio-spice-6.1.0-34.1 openSUSE Tumbleweed:qemu-block-curl-6.1.0-34.1 openSUSE Tumbleweed:qemu-block-dmg-6.1.0-34.1 openSUSE Tumbleweed:qemu-block-gluster-6.1.0-34.1 openSUSE Tumbleweed:qemu-block-iscsi-6.1.0-34.1 openSUSE Tumbleweed:qemu-block-nfs-6.1.0-34.1 openSUSE Tumbleweed:qemu-block-rbd-6.1.0-34.1 openSUSE Tumbleweed:qemu-block-ssh-6.1.0-34.1 openSUSE Tumbleweed:qemu-chardev-baum-6.1.0-34.1 openSUSE Tumbleweed:qemu-chardev-spice-6.1.0-34.1 openSUSE Tumbleweed:qemu-extra-6.1.0-34.1 openSUSE Tumbleweed:qemu-guest-agent-6.1.0-34.1 openSUSE Tumbleweed:qemu-hw-display-qxl-6.1.0-34.1 openSUSE Tumbleweed:qemu-hw-display-virtio-gpu-6.1.0-34.1 openSUSE Tumbleweed:qemu-hw-display-virtio-gpu-pci-6.1.0-34.1 openSUSE Tumbleweed:qemu-hw-display-virtio-vga-6.1.0-34.1 openSUSE Tumbleweed:qemu-hw-s390x-virtio-gpu-ccw-6.1.0-34.1 openSUSE Tumbleweed:qemu-hw-usb-host-6.1.0-34.1 openSUSE Tumbleweed:qemu-hw-usb-redirect-6.1.0-34.1 openSUSE Tumbleweed:qemu-hw-usb-smartcard-6.1.0-34.1 openSUSE Tumbleweed:qemu-ipxe-1.0.0+-34.1 openSUSE Tumbleweed:qemu-ivshmem-tools-6.1.0-34.1 openSUSE Tumbleweed:qemu-ksm-6.1.0-34.1 openSUSE Tumbleweed:qemu-kvm-6.1.0-34.1 openSUSE Tumbleweed:qemu-lang-6.1.0-34.1 openSUSE Tumbleweed:qemu-microvm-6.1.0-34.1 openSUSE Tumbleweed:qemu-ppc-6.1.0-34.1 openSUSE Tumbleweed:qemu-s390x-6.1.0-34.1 openSUSE Tumbleweed:qemu-seabios-1.14.0_0_g155821a-34.1 openSUSE Tumbleweed:qemu-sgabios-8-34.1 openSUSE Tumbleweed:qemu-skiboot-6.1.0-34.1 openSUSE Tumbleweed:qemu-tools-6.1.0-34.1 openSUSE Tumbleweed:qemu-ui-curses-6.1.0-34.1 openSUSE Tumbleweed:qemu-ui-gtk-6.1.0-34.1 openSUSE Tumbleweed:qemu-ui-opengl-6.1.0-34.1 openSUSE Tumbleweed:qemu-ui-spice-app-6.1.0-34.1 openSUSE Tumbleweed:qemu-ui-spice-core-6.1.0-34.1 openSUSE Tumbleweed:qemu-vgabios-1.14.0_0_g155821a-34.1 openSUSE Tumbleweed:qemu-vhost-user-gpu-6.1.0-34.1 openSUSE Tumbleweed:qemu-x86-6.1.0-34.1 moderate 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-3748.html CVE-2021-3748 https://bugzilla.suse.com/1189938 SUSE Bug 1189938