CVE-2016-4020: memory leak in kvmvapic.c (bz #1326904)
CVE-2016-4439: scsi: esb: OOB write #1 (bz #1337503) CVE-2016-4441: scsi: esb: OOB write #2 (bz #1337506) Fix regression installing windows 7 with qxl/vga (bz #1339267)
This commit is contained in:
parent
e0a4eb7219
commit
2f99a7807d
|
@ -0,0 +1,32 @@
|
|||
From: Prasad J Pandit <pjp@fedoraproject.org>
|
||||
Date: Thu, 7 Apr 2016 12:50:08 +0530
|
||||
Subject: [PATCH] i386: kvmvapic: initialise imm32 variable
|
||||
|
||||
When processing Task Priorty Register(TPR) access, it could leak
|
||||
automatic stack variable 'imm32' in patch_instruction().
|
||||
Initialise the variable to avoid it.
|
||||
|
||||
Reported by: Donghai Zdh <donghai.zdh@alibaba-inc.com>
|
||||
Cc: qemu-stable@nongnu.org
|
||||
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
|
||||
Message-Id: <1460013608-16670-1-git-send-email-ppandit@redhat.com>
|
||||
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
|
||||
|
||||
(cherry picked from commit 691a02e2ce0c413236a78dee6f2651c937b09fb0)
|
||||
---
|
||||
hw/i386/kvmvapic.c | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/hw/i386/kvmvapic.c b/hw/i386/kvmvapic.c
|
||||
index f0922da..97f3646 100644
|
||||
--- a/hw/i386/kvmvapic.c
|
||||
+++ b/hw/i386/kvmvapic.c
|
||||
@@ -393,7 +393,7 @@ static void patch_instruction(VAPICROMState *s, X86CPU *cpu, target_ulong ip)
|
||||
CPUX86State *env = &cpu->env;
|
||||
VAPICHandlers *handlers;
|
||||
uint8_t opcode[2];
|
||||
- uint32_t imm32;
|
||||
+ uint32_t imm32 = 0;
|
||||
target_ulong current_pc = 0;
|
||||
target_ulong current_cs_base = 0;
|
||||
int current_flags = 0;
|
|
@ -0,0 +1,39 @@
|
|||
From: Prasad J Pandit <pjp@fedoraproject.org>
|
||||
Date: Thu, 19 May 2016 16:09:30 +0530
|
||||
Subject: [PATCH] esp: check command buffer length before write(CVE-2016-4439)
|
||||
|
||||
The 53C9X Fast SCSI Controller(FSC) comes with an internal 16-byte
|
||||
FIFO buffer. It is used to handle command and data transfer. While
|
||||
writing to this command buffer 's->cmdbuf[TI_BUFSZ=16]', a check
|
||||
was missing to validate input length. Add check to avoid OOB write
|
||||
access.
|
||||
|
||||
Fixes CVE-2016-4439.
|
||||
|
||||
Reported-by: Li Qiang <liqiang6-s@360.cn>
|
||||
Cc: qemu-stable@nongnu.org
|
||||
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
|
||||
Message-Id: <1463654371-11169-2-git-send-email-ppandit@redhat.com>
|
||||
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
|
||||
(cherry picked from commit c98c6c105f66f05aa0b7c1d2a4a3f716450907ef)
|
||||
---
|
||||
hw/scsi/esp.c | 6 +++++-
|
||||
1 file changed, 5 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/hw/scsi/esp.c b/hw/scsi/esp.c
|
||||
index 272d13d..cda9755 100644
|
||||
--- a/hw/scsi/esp.c
|
||||
+++ b/hw/scsi/esp.c
|
||||
@@ -446,7 +446,11 @@ void esp_reg_write(ESPState *s, uint32_t saddr, uint64_t val)
|
||||
break;
|
||||
case ESP_FIFO:
|
||||
if (s->do_cmd) {
|
||||
- s->cmdbuf[s->cmdlen++] = val & 0xff;
|
||||
+ if (s->cmdlen < TI_BUFSZ) {
|
||||
+ s->cmdbuf[s->cmdlen++] = val & 0xff;
|
||||
+ } else {
|
||||
+ trace_esp_error_fifo_overrun();
|
||||
+ }
|
||||
} else if (s->ti_size == TI_BUFSZ - 1) {
|
||||
trace_esp_error_fifo_overrun();
|
||||
} else {
|
|
@ -0,0 +1,73 @@
|
|||
From: Prasad J Pandit <pjp@fedoraproject.org>
|
||||
Date: Thu, 19 May 2016 16:09:31 +0530
|
||||
Subject: [PATCH] esp: check dma length before reading scsi
|
||||
command(CVE-2016-4441)
|
||||
|
||||
The 53C9X Fast SCSI Controller(FSC) comes with an internal 16-byte
|
||||
FIFO buffer. It is used to handle command and data transfer.
|
||||
Routine get_cmd() uses DMA to read scsi commands into this buffer.
|
||||
Add check to validate DMA length against buffer size to avoid any
|
||||
overrun.
|
||||
|
||||
Fixes CVE-2016-4441.
|
||||
|
||||
Reported-by: Li Qiang <liqiang6-s@360.cn>
|
||||
Cc: qemu-stable@nongnu.org
|
||||
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
|
||||
Message-Id: <1463654371-11169-3-git-send-email-ppandit@redhat.com>
|
||||
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
|
||||
(cherry picked from commit 6c1fef6b59563cc415f21e03f81539ed4b33ad90)
|
||||
---
|
||||
hw/scsi/esp.c | 11 +++++++----
|
||||
1 file changed, 7 insertions(+), 4 deletions(-)
|
||||
|
||||
diff --git a/hw/scsi/esp.c b/hw/scsi/esp.c
|
||||
index cda9755..63a2a01 100644
|
||||
--- a/hw/scsi/esp.c
|
||||
+++ b/hw/scsi/esp.c
|
||||
@@ -80,7 +80,7 @@ void esp_request_cancelled(SCSIRequest *req)
|
||||
}
|
||||
}
|
||||
|
||||
-static uint32_t get_cmd(ESPState *s, uint8_t *buf)
|
||||
+static uint32_t get_cmd(ESPState *s, uint8_t *buf, uint8_t buflen)
|
||||
{
|
||||
uint32_t dmalen;
|
||||
int target;
|
||||
@@ -90,6 +90,9 @@ static uint32_t get_cmd(ESPState *s, uint8_t *buf)
|
||||
dmalen = s->rregs[ESP_TCLO];
|
||||
dmalen |= s->rregs[ESP_TCMID] << 8;
|
||||
dmalen |= s->rregs[ESP_TCHI] << 16;
|
||||
+ if (dmalen > buflen) {
|
||||
+ return 0;
|
||||
+ }
|
||||
s->dma_memory_read(s->dma_opaque, buf, dmalen);
|
||||
} else {
|
||||
dmalen = s->ti_size;
|
||||
@@ -164,7 +167,7 @@ static void handle_satn(ESPState *s)
|
||||
s->dma_cb = handle_satn;
|
||||
return;
|
||||
}
|
||||
- len = get_cmd(s, buf);
|
||||
+ len = get_cmd(s, buf, sizeof(buf));
|
||||
if (len)
|
||||
do_cmd(s, buf);
|
||||
}
|
||||
@@ -178,7 +181,7 @@ static void handle_s_without_atn(ESPState *s)
|
||||
s->dma_cb = handle_s_without_atn;
|
||||
return;
|
||||
}
|
||||
- len = get_cmd(s, buf);
|
||||
+ len = get_cmd(s, buf, sizeof(buf));
|
||||
if (len) {
|
||||
do_busid_cmd(s, buf, 0);
|
||||
}
|
||||
@@ -190,7 +193,7 @@ static void handle_satn_stop(ESPState *s)
|
||||
s->dma_cb = handle_satn_stop;
|
||||
return;
|
||||
}
|
||||
- s->cmdlen = get_cmd(s, s->cmdbuf);
|
||||
+ s->cmdlen = get_cmd(s, s->cmdbuf, sizeof(s->cmdbuf));
|
||||
if (s->cmdlen) {
|
||||
trace_esp_handle_satn_stop(s->cmdlen);
|
||||
s->do_cmd = 1;
|
|
@ -0,0 +1,233 @@
|
|||
From: Gerd Hoffmann <kraxel@redhat.com>
|
||||
Date: Tue, 17 May 2016 10:54:54 +0200
|
||||
Subject: [PATCH] vga: add sr_vbe register set
|
||||
|
||||
Commit "fd3c136 vga: make sure vga register setup for vbe stays intact
|
||||
(CVE-2016-3712)." causes a regression. The win7 installer is unhappy
|
||||
because it can't freely modify vga registers any more while in vbe mode.
|
||||
|
||||
This patch introduces a new sr_vbe register set. The vbe_update_vgaregs
|
||||
will fill sr_vbe[] instead of sr[]. Normal vga register reads and
|
||||
writes go to sr[]. Any sr register read access happens through a new
|
||||
sr() helper function which will read from sr_vbe[] with vbe active and
|
||||
from sr[] otherwise.
|
||||
|
||||
This way we can allow guests update sr[] registers as they want, without
|
||||
allowing them disrupt vbe video modes that way.
|
||||
|
||||
Cc: qemu-stable@nongnu.org
|
||||
Reported-by: Thomas Lamprecht <thomas@lamprecht.org>
|
||||
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
|
||||
Message-id: 1463475294-14119-1-git-send-email-kraxel@redhat.com
|
||||
(cherry picked from commit 94ef4f337fb614f18b765a8e0e878a4c23cdedcd)
|
||||
---
|
||||
hw/display/vga.c | 50 ++++++++++++++++++++++++++++----------------------
|
||||
hw/display/vga_int.h | 1 +
|
||||
2 files changed, 29 insertions(+), 22 deletions(-)
|
||||
|
||||
diff --git a/hw/display/vga.c b/hw/display/vga.c
|
||||
index e721b2d..fac17e8 100644
|
||||
--- a/hw/display/vga.c
|
||||
+++ b/hw/display/vga.c
|
||||
@@ -147,6 +147,11 @@ static inline bool vbe_enabled(VGACommonState *s)
|
||||
return s->vbe_regs[VBE_DISPI_INDEX_ENABLE] & VBE_DISPI_ENABLED;
|
||||
}
|
||||
|
||||
+static inline uint8_t sr(VGACommonState *s, int idx)
|
||||
+{
|
||||
+ return vbe_enabled(s) ? s->sr_vbe[idx] : s->sr[idx];
|
||||
+}
|
||||
+
|
||||
static void vga_update_memory_access(VGACommonState *s)
|
||||
{
|
||||
hwaddr base, offset, size;
|
||||
@@ -161,8 +166,8 @@ static void vga_update_memory_access(VGACommonState *s)
|
||||
s->has_chain4_alias = false;
|
||||
s->plane_updated = 0xf;
|
||||
}
|
||||
- if ((s->sr[VGA_SEQ_PLANE_WRITE] & VGA_SR02_ALL_PLANES) ==
|
||||
- VGA_SR02_ALL_PLANES && s->sr[VGA_SEQ_MEMORY_MODE] & VGA_SR04_CHN_4M) {
|
||||
+ if ((sr(s, VGA_SEQ_PLANE_WRITE) & VGA_SR02_ALL_PLANES) ==
|
||||
+ VGA_SR02_ALL_PLANES && sr(s, VGA_SEQ_MEMORY_MODE) & VGA_SR04_CHN_4M) {
|
||||
offset = 0;
|
||||
switch ((s->gr[VGA_GFX_MISC] >> 2) & 3) {
|
||||
case 0:
|
||||
@@ -232,7 +237,7 @@ static void vga_precise_update_retrace_info(VGACommonState *s)
|
||||
((s->cr[VGA_CRTC_OVERFLOW] >> 6) & 2)) << 8);
|
||||
vretr_end_line = s->cr[VGA_CRTC_V_SYNC_END] & 0xf;
|
||||
|
||||
- clocking_mode = (s->sr[VGA_SEQ_CLOCK_MODE] >> 3) & 1;
|
||||
+ clocking_mode = (sr(s, VGA_SEQ_CLOCK_MODE) >> 3) & 1;
|
||||
clock_sel = (s->msr >> 2) & 3;
|
||||
dots = (s->msr & 1) ? 8 : 9;
|
||||
|
||||
@@ -484,7 +489,6 @@ void vga_ioport_write(void *opaque, uint32_t addr, uint32_t val)
|
||||
printf("vga: write SR%x = 0x%02x\n", s->sr_index, val);
|
||||
#endif
|
||||
s->sr[s->sr_index] = val & sr_mask[s->sr_index];
|
||||
- vbe_update_vgaregs(s);
|
||||
if (s->sr_index == VGA_SEQ_CLOCK_MODE) {
|
||||
s->update_retrace_info(s);
|
||||
}
|
||||
@@ -678,13 +682,13 @@ static void vbe_update_vgaregs(VGACommonState *s)
|
||||
|
||||
if (s->vbe_regs[VBE_DISPI_INDEX_BPP] == 4) {
|
||||
shift_control = 0;
|
||||
- s->sr[VGA_SEQ_CLOCK_MODE] &= ~8; /* no double line */
|
||||
+ s->sr_vbe[VGA_SEQ_CLOCK_MODE] &= ~8; /* no double line */
|
||||
} else {
|
||||
shift_control = 2;
|
||||
/* set chain 4 mode */
|
||||
- s->sr[VGA_SEQ_MEMORY_MODE] |= VGA_SR04_CHN_4M;
|
||||
+ s->sr_vbe[VGA_SEQ_MEMORY_MODE] |= VGA_SR04_CHN_4M;
|
||||
/* activate all planes */
|
||||
- s->sr[VGA_SEQ_PLANE_WRITE] |= VGA_SR02_ALL_PLANES;
|
||||
+ s->sr_vbe[VGA_SEQ_PLANE_WRITE] |= VGA_SR02_ALL_PLANES;
|
||||
}
|
||||
s->gr[VGA_GFX_MODE] = (s->gr[VGA_GFX_MODE] & ~0x60) |
|
||||
(shift_control << 5);
|
||||
@@ -834,7 +838,7 @@ uint32_t vga_mem_readb(VGACommonState *s, hwaddr addr)
|
||||
break;
|
||||
}
|
||||
|
||||
- if (s->sr[VGA_SEQ_MEMORY_MODE] & VGA_SR04_CHN_4M) {
|
||||
+ if (sr(s, VGA_SEQ_MEMORY_MODE) & VGA_SR04_CHN_4M) {
|
||||
/* chain 4 mode : simplest access */
|
||||
assert(addr < s->vram_size);
|
||||
ret = s->vram_ptr[addr];
|
||||
@@ -902,11 +906,11 @@ void vga_mem_writeb(VGACommonState *s, hwaddr addr, uint32_t val)
|
||||
break;
|
||||
}
|
||||
|
||||
- if (s->sr[VGA_SEQ_MEMORY_MODE] & VGA_SR04_CHN_4M) {
|
||||
+ if (sr(s, VGA_SEQ_MEMORY_MODE) & VGA_SR04_CHN_4M) {
|
||||
/* chain 4 mode : simplest access */
|
||||
plane = addr & 3;
|
||||
mask = (1 << plane);
|
||||
- if (s->sr[VGA_SEQ_PLANE_WRITE] & mask) {
|
||||
+ if (sr(s, VGA_SEQ_PLANE_WRITE) & mask) {
|
||||
assert(addr < s->vram_size);
|
||||
s->vram_ptr[addr] = val;
|
||||
#ifdef DEBUG_VGA_MEM
|
||||
@@ -919,7 +923,7 @@ void vga_mem_writeb(VGACommonState *s, hwaddr addr, uint32_t val)
|
||||
/* odd/even mode (aka text mode mapping) */
|
||||
plane = (s->gr[VGA_GFX_PLANE_READ] & 2) | (addr & 1);
|
||||
mask = (1 << plane);
|
||||
- if (s->sr[VGA_SEQ_PLANE_WRITE] & mask) {
|
||||
+ if (sr(s, VGA_SEQ_PLANE_WRITE) & mask) {
|
||||
addr = ((addr & ~1) << 1) | plane;
|
||||
if (addr >= s->vram_size) {
|
||||
return;
|
||||
@@ -994,7 +998,7 @@ void vga_mem_writeb(VGACommonState *s, hwaddr addr, uint32_t val)
|
||||
|
||||
do_write:
|
||||
/* mask data according to sr[2] */
|
||||
- mask = s->sr[VGA_SEQ_PLANE_WRITE];
|
||||
+ mask = sr(s, VGA_SEQ_PLANE_WRITE);
|
||||
s->plane_updated |= mask; /* only used to detect font change */
|
||||
write_mask = mask16[mask];
|
||||
if (addr * sizeof(uint32_t) >= s->vram_size) {
|
||||
@@ -1150,10 +1154,10 @@ static void vga_get_text_resolution(VGACommonState *s, int *pwidth, int *pheight
|
||||
/* total width & height */
|
||||
cheight = (s->cr[VGA_CRTC_MAX_SCAN] & 0x1f) + 1;
|
||||
cwidth = 8;
|
||||
- if (!(s->sr[VGA_SEQ_CLOCK_MODE] & VGA_SR01_CHAR_CLK_8DOTS)) {
|
||||
+ if (!(sr(s, VGA_SEQ_CLOCK_MODE) & VGA_SR01_CHAR_CLK_8DOTS)) {
|
||||
cwidth = 9;
|
||||
}
|
||||
- if (s->sr[VGA_SEQ_CLOCK_MODE] & 0x08) {
|
||||
+ if (sr(s, VGA_SEQ_CLOCK_MODE) & 0x08) {
|
||||
cwidth = 16; /* NOTE: no 18 pixel wide */
|
||||
}
|
||||
width = (s->cr[VGA_CRTC_H_DISP] + 1);
|
||||
@@ -1195,7 +1199,7 @@ static void vga_draw_text(VGACommonState *s, int full_update)
|
||||
int64_t now = qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL);
|
||||
|
||||
/* compute font data address (in plane 2) */
|
||||
- v = s->sr[VGA_SEQ_CHARACTER_MAP];
|
||||
+ v = sr(s, VGA_SEQ_CHARACTER_MAP);
|
||||
offset = (((v >> 4) & 1) | ((v << 1) & 6)) * 8192 * 4 + 2;
|
||||
if (offset != s->font_offsets[0]) {
|
||||
s->font_offsets[0] = offset;
|
||||
@@ -1504,11 +1508,11 @@ static void vga_draw_graphic(VGACommonState *s, int full_update)
|
||||
}
|
||||
|
||||
if (shift_control == 0) {
|
||||
- if (s->sr[VGA_SEQ_CLOCK_MODE] & 8) {
|
||||
+ if (sr(s, VGA_SEQ_CLOCK_MODE) & 8) {
|
||||
disp_width <<= 1;
|
||||
}
|
||||
} else if (shift_control == 1) {
|
||||
- if (s->sr[VGA_SEQ_CLOCK_MODE] & 8) {
|
||||
+ if (sr(s, VGA_SEQ_CLOCK_MODE) & 8) {
|
||||
disp_width <<= 1;
|
||||
}
|
||||
}
|
||||
@@ -1572,7 +1576,7 @@ static void vga_draw_graphic(VGACommonState *s, int full_update)
|
||||
|
||||
if (shift_control == 0) {
|
||||
full_update |= update_palette16(s);
|
||||
- if (s->sr[VGA_SEQ_CLOCK_MODE] & 8) {
|
||||
+ if (sr(s, VGA_SEQ_CLOCK_MODE) & 8) {
|
||||
v = VGA_DRAW_LINE4D2;
|
||||
} else {
|
||||
v = VGA_DRAW_LINE4;
|
||||
@@ -1580,7 +1584,7 @@ static void vga_draw_graphic(VGACommonState *s, int full_update)
|
||||
bits = 4;
|
||||
} else if (shift_control == 1) {
|
||||
full_update |= update_palette16(s);
|
||||
- if (s->sr[VGA_SEQ_CLOCK_MODE] & 8) {
|
||||
+ if (sr(s, VGA_SEQ_CLOCK_MODE) & 8) {
|
||||
v = VGA_DRAW_LINE2D2;
|
||||
} else {
|
||||
v = VGA_DRAW_LINE2;
|
||||
@@ -1627,7 +1631,7 @@ static void vga_draw_graphic(VGACommonState *s, int full_update)
|
||||
#if 0
|
||||
printf("w=%d h=%d v=%d line_offset=%d cr[0x09]=0x%02x cr[0x17]=0x%02x linecmp=%d sr[0x01]=0x%02x\n",
|
||||
width, height, v, line_offset, s->cr[9], s->cr[VGA_CRTC_MODE],
|
||||
- s->line_compare, s->sr[VGA_SEQ_CLOCK_MODE]);
|
||||
+ s->line_compare, sr(s, VGA_SEQ_CLOCK_MODE));
|
||||
#endif
|
||||
addr1 = (s->start_addr * 4);
|
||||
bwidth = (width * bits + 7) / 8;
|
||||
@@ -1779,6 +1783,7 @@ void vga_common_reset(VGACommonState *s)
|
||||
{
|
||||
s->sr_index = 0;
|
||||
memset(s->sr, '\0', sizeof(s->sr));
|
||||
+ memset(s->sr_vbe, '\0', sizeof(s->sr_vbe));
|
||||
s->gr_index = 0;
|
||||
memset(s->gr, '\0', sizeof(s->gr));
|
||||
s->ar_index = 0;
|
||||
@@ -1881,10 +1886,10 @@ static void vga_update_text(void *opaque, console_ch_t *chardata)
|
||||
/* total width & height */
|
||||
cheight = (s->cr[VGA_CRTC_MAX_SCAN] & 0x1f) + 1;
|
||||
cw = 8;
|
||||
- if (!(s->sr[VGA_SEQ_CLOCK_MODE] & VGA_SR01_CHAR_CLK_8DOTS)) {
|
||||
+ if (!(sr(s, VGA_SEQ_CLOCK_MODE) & VGA_SR01_CHAR_CLK_8DOTS)) {
|
||||
cw = 9;
|
||||
}
|
||||
- if (s->sr[VGA_SEQ_CLOCK_MODE] & 0x08) {
|
||||
+ if (sr(s, VGA_SEQ_CLOCK_MODE) & 0x08) {
|
||||
cw = 16; /* NOTE: no 18 pixel wide */
|
||||
}
|
||||
width = (s->cr[VGA_CRTC_H_DISP] + 1);
|
||||
@@ -2050,6 +2055,7 @@ static int vga_common_post_load(void *opaque, int version_id)
|
||||
|
||||
/* force refresh */
|
||||
s->graphic_mode = -1;
|
||||
+ vbe_update_vgaregs(s);
|
||||
return 0;
|
||||
}
|
||||
|
||||
diff --git a/hw/display/vga_int.h b/hw/display/vga_int.h
|
||||
index 40ba6a4..103cac2 100644
|
||||
--- a/hw/display/vga_int.h
|
||||
+++ b/hw/display/vga_int.h
|
||||
@@ -99,6 +99,7 @@ typedef struct VGACommonState {
|
||||
MemoryRegion chain4_alias;
|
||||
uint8_t sr_index;
|
||||
uint8_t sr[256];
|
||||
+ uint8_t sr_vbe[256];
|
||||
uint8_t gr_index;
|
||||
uint8_t gr[256];
|
||||
uint8_t ar_index;
|
16
qemu.spec
16
qemu.spec
|
@ -40,7 +40,7 @@
|
|||
Summary: QEMU is a FAST! processor emulator
|
||||
Name: qemu
|
||||
Version: 2.4.1
|
||||
Release: 9%{?dist}
|
||||
Release: 10%{?dist}
|
||||
Epoch: 2
|
||||
License: GPLv2+ and LGPLv2+ and BSD
|
||||
Group: Development/Tools
|
||||
|
@ -164,6 +164,14 @@ Patch0123: 0123-pc-acpi-tpm-add-missing-MMIO-resource-to-PCI0._CRS.patch
|
|||
Patch0124: 0124-tpm-acpi-remove-IRQ-from-TPM-s-CRS-to-make-Windows-n.patch
|
||||
# Fix ./configure with ccache
|
||||
Patch0125: 0125-configure-disallow-ccache-during-compile-tests.patch
|
||||
# CVE-2016-4020: memory leak in kvmvapic.c (bz #1326904)
|
||||
Patch0126: 0126-i386-kvmvapic-initialise-imm32-variable.patch
|
||||
# CVE-2016-4439: scsi: esb: OOB write #1 (bz #1337503)
|
||||
Patch0127: 0127-esp-check-command-buffer-length-before-write-CVE-201.patch
|
||||
# CVE-2016-4441: scsi: esb: OOB write #2 (bz #1337506)
|
||||
Patch0128: 0128-esp-check-dma-length-before-reading-scsi-command-CVE.patch
|
||||
# Fix regression installing windows 7 with qxl/vga (bz #1339267)
|
||||
Patch0129: 0129-vga-add-sr_vbe-register-set.patch
|
||||
|
||||
BuildRequires: SDL2-devel
|
||||
BuildRequires: zlib-devel
|
||||
|
@ -1309,6 +1317,12 @@ getent passwd qemu >/dev/null || \
|
|||
|
||||
|
||||
%changelog
|
||||
* Thu May 26 2016 Cole Robinson <crobinso@redhat.com> - 2:2.4.1-10
|
||||
- CVE-2016-4020: memory leak in kvmvapic.c (bz #1326904)
|
||||
- CVE-2016-4439: scsi: esb: OOB write #1 (bz #1337503)
|
||||
- CVE-2016-4441: scsi: esb: OOB write #2 (bz #1337506)
|
||||
- Fix regression installing windows 7 with qxl/vga (bz #1339267)
|
||||
|
||||
* Mon May 09 2016 Cole Robinson <crobinso@redhat.com> - 2:2.4.1-9
|
||||
- CVE-2016-3710: incorrect bounds checking in vga (bz #1334345)
|
||||
- CVE-2016-3712: out of bounds read in vga (bz #1334342)
|
||||
|
|
Loading…
Reference in New Issue