http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=0be839a2701369f669532ea5884c15bead1c6e08

http://rhn.redhat.com/errata/RHSA-2015-0349.html

http://rhn.redhat.com/errata/RHSA-2015-0624.html

http://thread.gmane.org/gmane.comp.emulators.qemu/306117

https://bugzilla.redhat.com/show_bug.cgi?id=1163075

https://exchange.xforce.ibmcloud.com/vulnerabilities/99194

It was found that certain values that were read when loading RAM during migration were not validated. A user able to alter the savevm data (either on the disk or over the wire during migration) could use either of these flaws to corrupt QEMU process memory on the (destination) host, which could potentially result in arbitrary code execution on the host with the privileges of the QEMU process.

The host_from_stream_offset function in arch_init.c in QEMU, when loading RAM during migration, allows remote attackers to execute arbitrary code via a crafted (1) offset or (2) length value in savevm data.

Red Hat, Inc. (AV:L/AC:H/Au:N/C:P/I:P/A:P)

https://access.redhat.com/errata/RHSA-2015:0349 [No Types Assigned]

https://access.redhat.com/errata/RHSA-2015:0624 [No Types Assigned]

https://access.redhat.com/security/cve/CVE-2014-7840 [No Types Assigned]

The host_from_stream_offset function in arch_init.c in QEMU, when loading RAM during migration, allows remote attackers to execute arbitrary code via a crafted (1) offset or (2) length value in savevm data.

It was found that certain values that were read when loading RAM during migration were not validated. A user able to alter the savevm data (either on the disk or over the wire during migration) could use either of these flaws to corrupt QEMU process memory on the (destination) host, which could potentially result in arbitrary code execution on the host with the privileges of the QEMU process.

Red Hat, Inc. (AV:L/AC:H/Au:N/C:P/I:P/A:P)

http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=0be839a2701369f669532ea5884c15bead1c6e08 [No Types Assigned]

https://access.redhat.com/errata/RHSA-2015:0349 [No Types Assigned]

https://access.redhat.com/errata/RHSA-2015:0624 [No Types Assigned]

https://access.redhat.com/security/cve/CVE-2014-7840 [No Types Assigned]

http://git.qemu.org/?p=qemu.git;a=commit;h=0be839a2701369f669532ea5884c15bead1c6e08 [Patch, Vendor Advisory]

OR
     *cpe:2.3:a:qemu:qemu:-:*:*:*:*:*:*:*

OR
     *cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
     *cpe:2.3:o:redhat:enterprise_linux_eus:7.3:*:*:*:*:*:*:*
     *cpe:2.3:o:redhat:enterprise_linux_eus:7.4:*:*:*:*:*:*:*
     *cpe:2.3:o:redhat:enterprise_linux_eus:7.5:*:*:*:*:*:*:*
     *cpe:2.3:o:redhat:enterprise_linux_eus:7.6:*:*:*:*:*:*:*
     *cpe:2.3:o:redhat:enterprise_linux_eus:7.7:*:*:*:*:*:*:*
     *cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
     *cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*

AND
     OR
          *cpe:2.3:a:redhat:virtualization:3.0:*:*:*:*:*:*:*
     OR
          cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*

OR
     *cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:* versions up to (including) 2.1.3

OR
     *cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
     *cpe:2.3:o:redhat:enterprise_linux_hpc_node:7.0:*:*:*:*:*:*:*
     *cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
     *cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*

http://git.qemu.org/?p=qemu.git;a=commit;h=0be839a2701369f669532ea5884c15bead1c6e08 Issue Tracking, Patch, Vendor Advisory

http://git.qemu.org/?p=qemu.git;a=commit;h=0be839a2701369f669532ea5884c15bead1c6e08 Patch, Vendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=1163075 Issue Tracking

https://bugzilla.redhat.com/show_bug.cgi?id=1163075 Issue Tracking, Third Party Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/99194 No Types Assigned

https://exchange.xforce.ibmcloud.com/vulnerabilities/99194 Third Party Advisory, VDB Entry

https://exchange.xforce.ibmcloud.com/vulnerabilities/99194 [No Types Assigned]

http://xforce.iss.net/xforce/xfdb/99194 [Third Party Advisory]

Configuration 1
     OR
          *cpe:2.3:a:qemu:qemu:-:*:*:*:*:*:*:*

Configuration 1
     OR
          *cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
          *cpe:2.3:o:redhat:enterprise_linux_hpc_node:7.0:*:*:*:*:*:*:*
          *cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
          *cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
Configuration 2
     OR
          *cpe:2.3:a:qemu:qemu:-:*:*:*:*:*:*:*

http://git.qemu.org/?p=qemu.git;a=commit;h=0be839a2701369f669532ea5884c15bead1c6e08 Vendor Advisory

http://git.qemu.org/?p=qemu.git;a=commit;h=0be839a2701369f669532ea5884c15bead1c6e08 Issue Tracking, Vendor Advisory, Patch

http://rhn.redhat.com/errata/RHSA-2015-0349.html No Types Assigned

http://rhn.redhat.com/errata/RHSA-2015-0349.html Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2015-0624.html No Types Assigned

http://rhn.redhat.com/errata/RHSA-2015-0624.html Third Party Advisory

http://thread.gmane.org/gmane.comp.emulators.qemu/306117 No Types Assigned

http://thread.gmane.org/gmane.comp.emulators.qemu/306117 Broken Link

http://xforce.iss.net/xforce/xfdb/99194 No Types Assigned

http://xforce.iss.net/xforce/xfdb/99194 Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=1163075 No Types Assigned

https://bugzilla.redhat.com/show_bug.cgi?id=1163075 Issue Tracking

http://rhn.redhat.com/errata/RHSA-2015-0349.html

http://rhn.redhat.com/errata/RHSA-2015-0624.html

(AV:N/AC:L/Au:N/C:P/I:P/A:P)

CWE-20

Configuration 1
     OR
          *cpe:2.3:a:qemu:qemu:-:*:*:*:*:*:*:*

http://git.qemu.org/?p=qemu.git;a=commit;h=0be839a2701369f669532ea5884c15bead1c6e08 No Types Assigned

http://git.qemu.org/?p=qemu.git;a=commit;h=0be839a2701369f669532ea5884c15bead1c6e08 Advisory