ALT Linux Team

Package qemu update in sisyphus_riscv64 on 2025-11-09

ALT-PU-2025-14248-1

Package qemu updated to version 10.1.2-alt1 for branch sisyphus_riscv64.

Closed vulnerabilities

Published: 2024-10-30
Modified: 2025-11-07

BDU:2024-08773

Уязвимость функции usb_ep_get() (hw/net/core.c) эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании

Severity: MEDIUM (5.5) Vector: AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Severity: MEDIUM (4.6) Vector: AV:L/AC:L/Au:S/C:N/I:N/A:C
References:
Published: 2025-09-24

BDU:2025-11540

Уязвимость компонента hw/pci/pcie_sriov.c эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю выполнить произвольный код

Severity: MEDIUM (4.2) Vector: AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
Severity: LOW (3.2) Vector: AV:A/AC:H/Au:N/C:N/I:P/A:P
References:
Published: 2025-10-28

BDU:2025-13491

Уязвимость компонента hw/pci/pcie_sriov.c эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю выполнить произвольный код

Severity: MEDIUM (4.2) Vector: AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
Severity: LOW (3.2) Vector: AV:A/AC:H/Au:N/C:N/I:P/A:P
References:
Published: 2024-09-19
Modified: 2024-11-21

CVE-2024-8354

A flaw was found in QEMU. An assertion failure was present in the usb_ep_get() function in hw/net/core.c when trying to get the USB endpoint from a USB device. This flaw may allow a malicious unprivileged guest user to crash the QEMU process on the host and cause a denial of service condition.

Severity: MEDIUM (5.5) Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
References:
Published: 2025-07-25
Modified: 2025-07-25

CVE-2025-54566

hw/pci/pcie_sriov.c in QEMU through 10.0.3 has a migration state inconsistency, a related issue to CVE-2024-26327.

Severity: MEDIUM (4.2) Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
References:
Published: 2025-07-25
Modified: 2025-07-25

CVE-2025-54567

hw/pci/pcie_sriov.c in QEMU through 10.0.3 mishandles the VF Enable bit write mask, a related issue to CVE-2024-26327.

Severity: MEDIUM (4.2) Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
References:

CVE-2025-8860

No data currently available.

VKontakte | Telegram | YouTube | Forum | GitHub | Bugzilla
Version: 2.1.2
Back to top