741 lines
36 KiB
JSON
741 lines
36 KiB
JSON
{
|
||
"Definition": [
|
||
{
|
||
"ID": "oval:org.altlinux.errata:def:20191973",
|
||
"Version": "oval:org.altlinux.errata:def:20191973",
|
||
"Class": "patch",
|
||
"Metadata": {
|
||
"Title": "ALT-PU-2019-1973: package `qemu` update to version 4.0.0-alt1",
|
||
"AffectedList": [
|
||
{
|
||
"Family": "unix",
|
||
"Platforms": [
|
||
"ALT Linux branch p11"
|
||
],
|
||
"Products": [
|
||
"ALT Container"
|
||
]
|
||
}
|
||
],
|
||
"References": [
|
||
{
|
||
"RefID": "ALT-PU-2019-1973",
|
||
"RefURL": "https://errata.altlinux.org/ALT-PU-2019-1973",
|
||
"Source": "ALTPU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2019-01871",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2019-01871",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2019-01957",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2019-01957",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2019-01958",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2019-01958",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2019-01959",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2019-01959",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2019-01960",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2019-01960",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2020-00722",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2020-00722",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2020-00749",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2020-00749",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2020-03199",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2020-03199",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2020-03200",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2020-03200",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2020-03201",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2020-03201",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2020-03202",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2020-03202",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2020-03203",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2020-03203",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2020-03211",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2020-03211",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2021-05174",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2021-05174",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "CVE-2018-12126",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2018-12126",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2018-12127",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2018-12127",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2018-12130",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2018-12130",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2018-16872",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2018-16872",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2018-20123",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2018-20123",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2018-20124",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2018-20124",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2018-20125",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2018-20125",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2018-20126",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2018-20126",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2018-20191",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2018-20191",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2018-20216",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2018-20216",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2018-20815",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2018-20815",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2019-11091",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2019-11091",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2019-3812",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2019-3812",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2019-8934",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2019-8934",
|
||
"Source": "CVE"
|
||
}
|
||
],
|
||
"Description": "This update upgrades qemu to version 4.0.0-alt1. \nSecurity Fix(es):\n\n * BDU:2019-01871: Уязвимость функции load_device_tree эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю выполнять произвольный код\n\n * BDU:2019-01957: Уязвимость процессоров Intel, связанная с микроархитектурной выборкой данных некэшируемой памяти (MDSUM), позволяющая нарушителю раскрыть защищаемую информацию\n\n * BDU:2019-01958: Уязвимость порта загрузки MLPDS микропрограммного обеспечения Intel, связанная с раскрытием информации, позволяющая нарушителю получить доступ к конфиденциальной информации\n\n * BDU:2019-01959: Уязвимость процессоров Intel, связанная с восстановлением содержимого буферов заполнения (MFBDS), позволяющая нарушителю раскрыть защищаемую информацию\n\n * BDU:2019-01960: Уязвимость буфера данных MSBDS микропрограммного обеспечения Intel, позволяющая нарушителю получить доступ к конфиденциальной информации\n\n * BDU:2020-00722: Уязвимость функций i2c_ddc эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю раскрыть защищаемую информацию\n\n * BDU:2020-00749: Уязвимость реализации протокола qemu Media Transfer Protocol эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю получить несанкционированный доступ к информации\n\n * BDU:2020-03199: Уязвимость функции pvrdma_realize виртуального сетевого адаптера PVRDMA эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании\n\n * BDU:2020-03200: Уязвимость компонента hw/rdma/rdma_backend.c виртуального сетевого адаптера PVRDMA эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании\n\n * BDU:2020-03201: Уязвимость компонента hw/rdma/vmw/pvrdma_cmd.c виртуального сетевого адаптера PVRDMA эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании\n\n * BDU:2020-03202: Уязвимость функций create_cq и create_qp виртуального сетевого адаптера PVRDMA эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании\n\n * BDU:2020-03203: Уязвимость функций uar_read и uar_write виртуального сетевого адаптера PVRDMA эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании\n\n * BDU:2020-03211: Уязвимость функции pvrdma_idx_ring_has_ виртуального сетевого адаптера PVRDMA эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании\n\n * BDU:2021-05174: Уязвимость компонента hw/ppc/spapr.c эмулятора аппаратного обеспечения QEMU, связанная с недостатками разграничения доступа к портам, позволяющая нарушителю получить доступ к конфиденциальным данным\n\n * CVE-2018-12126: Microarchitectural Store Buffer Data Sampling (MSBDS): Store buffers on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here: https://www.intel.com/content/dam/www/public/us/en/documents/corporate-information/SA00233-microcode-update-guidance_05132019.pdf\n\n * CVE-2018-12127: Microarchitectural Load Port Data Sampling (MLPDS): Load ports on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here: https://www.intel.com/content/dam/www/public/us/en/documents/corporate-information/SA00233-microcode-update-guidance_05132019.pdf\n\n * CVE-2018-12130: Microarchitectural Fill Buffer Data Sampling (MFBDS): Fill buffers on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here: https://www.intel.com/content/dam/www/public/us/en/documents/corporate-information/SA00233-microcode-update-guidance_05132019.pdf\n\n * CVE-2018-16872: A flaw was found in qemu Media Transfer Protocol (MTP). The code opening files in usb_mtp_get_object and usb_mtp_get_partial_object and directories in usb_mtp_object_readdir doesn't consider that the underlying filesystem may have changed since the time lstat(2) was called in usb_mtp_object_alloc, a classical TOCTTOU problem. An attacker with write access to the host filesystem shared with a guest can use this property to navigate the host filesystem in the context of the QEMU process and read any file the QEMU process has access to. Access to the filesystem may be local or via a network share protocol such as CIFS.\n\n * CVE-2018-20123: pvrdma_realize in hw/rdma/vmw/pvrdma_main.c in QEMU has a Memory leak after an initialisation error.\n\n * CVE-2018-20124: hw/rdma/rdma_backend.c in QEMU allows guest OS users to trigger out-of-bounds access via a PvrdmaSqWqe ring element with a large num_sge value.\n\n * CVE-2018-20125: hw/rdma/vmw/pvrdma_cmd.c in QEMU allows attackers to cause a denial of service (NULL pointer dereference or excessive memory allocation) in create_cq_ring or create_qp_rings.\n\n * CVE-2018-20126: hw/rdma/vmw/pvrdma_cmd.c in QEMU allows create_cq and create_qp memory leaks because errors are mishandled.\n\n * CVE-2018-20191: hw/rdma/vmw/pvrdma_main.c in QEMU does not implement a read operation (such as uar_read by analogy to uar_write), which allows attackers to cause a denial of service (NULL pointer dereference).\n\n * CVE-2018-20216: QEMU can have an infinite loop in hw/rdma/vmw/pvrdma_dev_ring.c because return values are not checked (and -1 is mishandled).\n\n * CVE-2018-20815: In QEMU 3.1.0, load_device_tree in device_tree.c calls the deprecated load_image function, which has a buffer overflow risk.\n\n * CVE-2019-11091: Microarchitectural Data Sampling Uncacheable Memory (MDSUM): Uncacheable memory on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here: https://www.intel.com/content/dam/www/public/us/en/documents/corporate-information/SA00233-microcode-update-guidance_05132019.pdf\n\n * CVE-2019-3812: QEMU, through version 2.10 and through version 3.1.0, is vulnerable to an out-of-bounds read of up to 128 bytes in the hw/i2c/i2c-ddc.c:i2c_ddc() function. A local attacker with permission to execute i2c commands could exploit this to read stack memory of the qemu process on the host.\n\n * CVE-2019-8934: hw/ppc/spapr.c in QEMU through 3.1.0 allows Information Exposure because the hypervisor shares the /proc/device-tree/system-id and /proc/device-tree/model system attributes with a guest.",
|
||
"Advisory": {
|
||
"From": "errata.altlinux.org",
|
||
"Severity": "Critical",
|
||
"Rights": "Copyright 2024 BaseALT Ltd.",
|
||
"Issued": {
|
||
"Date": "2019-06-03"
|
||
},
|
||
"Updated": {
|
||
"Date": "2019-06-03"
|
||
},
|
||
"BDUs": [
|
||
{
|
||
"ID": "BDU:2019-01871",
|
||
"CVSS": "AV:L/AC:H/Au:S/C:P/I:P/A:C",
|
||
"CVSS3": "AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H",
|
||
"CWE": "CWE-122",
|
||
"Href": "https://bdu.fstec.ru/vul/2019-01871",
|
||
"Impact": "High",
|
||
"Public": "20181214"
|
||
},
|
||
{
|
||
"ID": "BDU:2019-01957",
|
||
"CVSS": "AV:L/AC:H/Au:S/C:C/I:N/A:N",
|
||
"CVSS3": "AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
|
||
"CWE": "CWE-203, CWE-385",
|
||
"Href": "https://bdu.fstec.ru/vul/2019-01957",
|
||
"Impact": "Low",
|
||
"Public": "20190306"
|
||
},
|
||
{
|
||
"ID": "BDU:2019-01958",
|
||
"CVSS": "AV:L/AC:M/Au:S/C:C/I:N/A:N",
|
||
"CVSS3": "AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
|
||
"CWE": "CWE-200, CWE-203, CWE-385",
|
||
"Href": "https://bdu.fstec.ru/vul/2019-01958",
|
||
"Impact": "Low",
|
||
"Public": "20190306"
|
||
},
|
||
{
|
||
"ID": "BDU:2019-01959",
|
||
"CVSS": "AV:L/AC:H/Au:S/C:C/I:N/A:N",
|
||
"CVSS3": "AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
|
||
"CWE": "CWE-200, CWE-203, CWE-385",
|
||
"Href": "https://bdu.fstec.ru/vul/2019-01959",
|
||
"Impact": "Low",
|
||
"Public": "20190306"
|
||
},
|
||
{
|
||
"ID": "BDU:2019-01960",
|
||
"CVSS": "AV:L/AC:H/Au:N/C:C/I:N/A:N",
|
||
"CVSS3": "AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
||
"CWE": "CWE-200, CWE-203, CWE-385",
|
||
"Href": "https://bdu.fstec.ru/vul/2019-01960",
|
||
"Impact": "Low",
|
||
"Public": "20190306"
|
||
},
|
||
{
|
||
"ID": "BDU:2020-00722",
|
||
"CVSS": "AV:L/AC:L/Au:S/C:C/I:N/A:N",
|
||
"CVSS3": "AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
||
"CWE": "CWE-125",
|
||
"Href": "https://bdu.fstec.ru/vul/2020-00722",
|
||
"Impact": "Low",
|
||
"Public": "20190507"
|
||
},
|
||
{
|
||
"ID": "BDU:2020-00749",
|
||
"CVSS": "AV:N/AC:H/Au:S/C:C/I:N/A:N",
|
||
"CVSS3": "AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
||
"CWE": "CWE-20, CWE-362, CWE-367",
|
||
"Href": "https://bdu.fstec.ru/vul/2020-00749",
|
||
"Impact": "Low",
|
||
"Public": "20180613"
|
||
},
|
||
{
|
||
"ID": "BDU:2020-03199",
|
||
"CVSS": "AV:L/AC:L/Au:N/C:N/I:N/A:C",
|
||
"CVSS3": "AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
|
||
"CWE": "CWE-772",
|
||
"Href": "https://bdu.fstec.ru/vul/2020-03199",
|
||
"Impact": "Low",
|
||
"Public": "20181213"
|
||
},
|
||
{
|
||
"ID": "BDU:2020-03200",
|
||
"CVSS": "AV:L/AC:L/Au:N/C:N/I:N/A:C",
|
||
"CVSS3": "AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
|
||
"CWE": "CWE-125",
|
||
"Href": "https://bdu.fstec.ru/vul/2020-03200",
|
||
"Impact": "Low",
|
||
"Public": "20181213"
|
||
},
|
||
{
|
||
"ID": "BDU:2020-03201",
|
||
"CVSS": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
|
||
"CVSS3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
|
||
"CWE": "CWE-476",
|
||
"Href": "https://bdu.fstec.ru/vul/2020-03201",
|
||
"Impact": "High",
|
||
"Public": "20181213"
|
||
},
|
||
{
|
||
"ID": "BDU:2020-03202",
|
||
"CVSS": "AV:L/AC:L/Au:N/C:N/I:N/A:C",
|
||
"CVSS3": "AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
|
||
"CWE": "CWE-772",
|
||
"Href": "https://bdu.fstec.ru/vul/2020-03202",
|
||
"Impact": "Low",
|
||
"Public": "20181213"
|
||
},
|
||
{
|
||
"ID": "BDU:2020-03203",
|
||
"CVSS": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
|
||
"CVSS3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
|
||
"CWE": "CWE-476",
|
||
"Href": "https://bdu.fstec.ru/vul/2020-03203",
|
||
"Impact": "High",
|
||
"Public": "20181212"
|
||
},
|
||
{
|
||
"ID": "BDU:2020-03211",
|
||
"CVSS": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
|
||
"CVSS3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
|
||
"CWE": "CWE-252, CWE-835",
|
||
"Href": "https://bdu.fstec.ru/vul/2020-03211",
|
||
"Impact": "High",
|
||
"Public": "20181213"
|
||
},
|
||
{
|
||
"ID": "BDU:2021-05174",
|
||
"CVSS": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
|
||
"CVSS3": "AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
|
||
"CWE": "CWE-668",
|
||
"Href": "https://bdu.fstec.ru/vul/2021-05174",
|
||
"Impact": "Low",
|
||
"Public": "20190221"
|
||
}
|
||
],
|
||
"CVEs": [
|
||
{
|
||
"ID": "CVE-2018-12126",
|
||
"CVSS": "AV:L/AC:M/Au:N/C:C/I:N/A:N",
|
||
"CVSS3": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
|
||
"CWE": "CWE-200",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2018-12126",
|
||
"Impact": "Low",
|
||
"Public": "20190530"
|
||
},
|
||
{
|
||
"ID": "CVE-2018-12127",
|
||
"CVSS": "AV:L/AC:M/Au:N/C:C/I:N/A:N",
|
||
"CVSS3": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
|
||
"CWE": "CWE-200",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2018-12127",
|
||
"Impact": "Low",
|
||
"Public": "20190530"
|
||
},
|
||
{
|
||
"ID": "CVE-2018-12130",
|
||
"CVSS": "AV:L/AC:M/Au:N/C:C/I:N/A:N",
|
||
"CVSS3": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
|
||
"CWE": "CWE-200",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2018-12130",
|
||
"Impact": "Low",
|
||
"Public": "20190530"
|
||
},
|
||
{
|
||
"ID": "CVE-2018-16872",
|
||
"CVSS": "AV:N/AC:M/Au:S/C:P/I:N/A:N",
|
||
"CVSS3": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2018-16872",
|
||
"Impact": "Low",
|
||
"Public": "20181213"
|
||
},
|
||
{
|
||
"ID": "CVE-2018-20123",
|
||
"CVSS": "AV:L/AC:L/Au:N/C:N/I:N/A:P",
|
||
"CVSS3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
|
||
"CWE": "CWE-772",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2018-20123",
|
||
"Impact": "Low",
|
||
"Public": "20181217"
|
||
},
|
||
{
|
||
"ID": "CVE-2018-20124",
|
||
"CVSS": "AV:L/AC:L/Au:N/C:N/I:N/A:P",
|
||
"CVSS3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
|
||
"CWE": "CWE-125",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2018-20124",
|
||
"Impact": "Low",
|
||
"Public": "20181220"
|
||
},
|
||
{
|
||
"ID": "CVE-2018-20125",
|
||
"CVSS": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
|
||
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
|
||
"CWE": "CWE-476",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2018-20125",
|
||
"Impact": "High",
|
||
"Public": "20181220"
|
||
},
|
||
{
|
||
"ID": "CVE-2018-20126",
|
||
"CVSS": "AV:L/AC:L/Au:N/C:N/I:N/A:P",
|
||
"CVSS3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
|
||
"CWE": "CWE-772",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2018-20126",
|
||
"Impact": "Low",
|
||
"Public": "20181220"
|
||
},
|
||
{
|
||
"ID": "CVE-2018-20191",
|
||
"CVSS": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
|
||
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
|
||
"CWE": "CWE-476",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2018-20191",
|
||
"Impact": "High",
|
||
"Public": "20181220"
|
||
},
|
||
{
|
||
"ID": "CVE-2018-20216",
|
||
"CVSS": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
|
||
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
|
||
"CWE": "CWE-252",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2018-20216",
|
||
"Impact": "High",
|
||
"Public": "20181220"
|
||
},
|
||
{
|
||
"ID": "CVE-2018-20815",
|
||
"CVSS": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
||
"CVSS3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||
"CWE": "CWE-119",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2018-20815",
|
||
"Impact": "Critical",
|
||
"Public": "20190531"
|
||
},
|
||
{
|
||
"ID": "CVE-2019-11091",
|
||
"CVSS": "AV:L/AC:M/Au:N/C:C/I:N/A:N",
|
||
"CVSS3": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
|
||
"CWE": "NVD-CWE-noinfo",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2019-11091",
|
||
"Impact": "Low",
|
||
"Public": "20190530"
|
||
},
|
||
{
|
||
"ID": "CVE-2019-3812",
|
||
"CVSS": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
|
||
"CVSS3": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2019-3812",
|
||
"Impact": "Low",
|
||
"Public": "20190219"
|
||
},
|
||
{
|
||
"ID": "CVE-2019-8934",
|
||
"CVSS": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
|
||
"CVSS3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
|
||
"CWE": "CWE-668",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2019-8934",
|
||
"Impact": "Low",
|
||
"Public": "20190321"
|
||
}
|
||
],
|
||
"AffectedCPEs": {
|
||
"CPEs": [
|
||
"cpe:/o:alt:container:11"
|
||
]
|
||
}
|
||
}
|
||
},
|
||
"Criteria": {
|
||
"Operator": "AND",
|
||
"Criterions": [
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:3001",
|
||
"Comment": "ALT Linux must be installed"
|
||
}
|
||
],
|
||
"Criterias": [
|
||
{
|
||
"Operator": "OR",
|
||
"Criterions": [
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20191973001",
|
||
"Comment": "ivshmem-tools is earlier than 0:4.0.0-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20191973002",
|
||
"Comment": "qemu is earlier than 0:4.0.0-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20191973003",
|
||
"Comment": "qemu-audio-alsa is earlier than 0:4.0.0-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20191973004",
|
||
"Comment": "qemu-audio-oss is earlier than 0:4.0.0-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20191973005",
|
||
"Comment": "qemu-audio-pa is earlier than 0:4.0.0-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20191973006",
|
||
"Comment": "qemu-audio-sdl is earlier than 0:4.0.0-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20191973007",
|
||
"Comment": "qemu-aux is earlier than 0:4.0.0-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20191973008",
|
||
"Comment": "qemu-block-curl is earlier than 0:4.0.0-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20191973009",
|
||
"Comment": "qemu-block-dmg is earlier than 0:4.0.0-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20191973010",
|
||
"Comment": "qemu-block-gluster is earlier than 0:4.0.0-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20191973011",
|
||
"Comment": "qemu-block-iscsi is earlier than 0:4.0.0-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20191973012",
|
||
"Comment": "qemu-block-nfs is earlier than 0:4.0.0-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20191973013",
|
||
"Comment": "qemu-block-rbd is earlier than 0:4.0.0-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20191973014",
|
||
"Comment": "qemu-block-ssh is earlier than 0:4.0.0-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20191973015",
|
||
"Comment": "qemu-common is earlier than 0:4.0.0-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20191973016",
|
||
"Comment": "qemu-doc is earlier than 0:4.0.0-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20191973017",
|
||
"Comment": "qemu-guest-agent is earlier than 0:4.0.0-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20191973018",
|
||
"Comment": "qemu-img is earlier than 0:4.0.0-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20191973019",
|
||
"Comment": "qemu-kvm is earlier than 0:4.0.0-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20191973020",
|
||
"Comment": "qemu-kvm-core is earlier than 0:4.0.0-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20191973021",
|
||
"Comment": "qemu-system is earlier than 0:4.0.0-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20191973022",
|
||
"Comment": "qemu-system-aarch64 is earlier than 0:4.0.0-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20191973023",
|
||
"Comment": "qemu-system-aarch64-core is earlier than 0:4.0.0-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20191973024",
|
||
"Comment": "qemu-system-alpha is earlier than 0:4.0.0-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20191973025",
|
||
"Comment": "qemu-system-alpha-core is earlier than 0:4.0.0-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20191973026",
|
||
"Comment": "qemu-system-arm is earlier than 0:4.0.0-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20191973027",
|
||
"Comment": "qemu-system-arm-core is earlier than 0:4.0.0-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20191973028",
|
||
"Comment": "qemu-system-cris is earlier than 0:4.0.0-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20191973029",
|
||
"Comment": "qemu-system-cris-core is earlier than 0:4.0.0-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20191973030",
|
||
"Comment": "qemu-system-hppa is earlier than 0:4.0.0-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20191973031",
|
||
"Comment": "qemu-system-hppa-core is earlier than 0:4.0.0-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20191973032",
|
||
"Comment": "qemu-system-lm32 is earlier than 0:4.0.0-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20191973033",
|
||
"Comment": "qemu-system-lm32-core is earlier than 0:4.0.0-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20191973034",
|
||
"Comment": "qemu-system-m68k is earlier than 0:4.0.0-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20191973035",
|
||
"Comment": "qemu-system-m68k-core is earlier than 0:4.0.0-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20191973036",
|
||
"Comment": "qemu-system-microblaze is earlier than 0:4.0.0-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20191973037",
|
||
"Comment": "qemu-system-microblaze-core is earlier than 0:4.0.0-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20191973038",
|
||
"Comment": "qemu-system-mips is earlier than 0:4.0.0-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20191973039",
|
||
"Comment": "qemu-system-mips-core is earlier than 0:4.0.0-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20191973040",
|
||
"Comment": "qemu-system-moxie is earlier than 0:4.0.0-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20191973041",
|
||
"Comment": "qemu-system-moxie-core is earlier than 0:4.0.0-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20191973042",
|
||
"Comment": "qemu-system-nios2 is earlier than 0:4.0.0-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20191973043",
|
||
"Comment": "qemu-system-nios2-core is earlier than 0:4.0.0-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20191973044",
|
||
"Comment": "qemu-system-or1k is earlier than 0:4.0.0-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20191973045",
|
||
"Comment": "qemu-system-or1k-core is earlier than 0:4.0.0-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20191973046",
|
||
"Comment": "qemu-system-ppc is earlier than 0:4.0.0-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20191973047",
|
||
"Comment": "qemu-system-ppc-core is earlier than 0:4.0.0-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20191973048",
|
||
"Comment": "qemu-system-riscv is earlier than 0:4.0.0-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20191973049",
|
||
"Comment": "qemu-system-riscv-core is earlier than 0:4.0.0-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20191973050",
|
||
"Comment": "qemu-system-s390x is earlier than 0:4.0.0-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20191973051",
|
||
"Comment": "qemu-system-s390x-core is earlier than 0:4.0.0-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20191973052",
|
||
"Comment": "qemu-system-sh4 is earlier than 0:4.0.0-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20191973053",
|
||
"Comment": "qemu-system-sh4-core is earlier than 0:4.0.0-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20191973054",
|
||
"Comment": "qemu-system-sparc is earlier than 0:4.0.0-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20191973055",
|
||
"Comment": "qemu-system-sparc-core is earlier than 0:4.0.0-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20191973056",
|
||
"Comment": "qemu-system-tricore is earlier than 0:4.0.0-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20191973057",
|
||
"Comment": "qemu-system-tricore-core is earlier than 0:4.0.0-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20191973058",
|
||
"Comment": "qemu-system-unicore32 is earlier than 0:4.0.0-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20191973059",
|
||
"Comment": "qemu-system-unicore32-core is earlier than 0:4.0.0-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20191973060",
|
||
"Comment": "qemu-system-x86 is earlier than 0:4.0.0-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20191973061",
|
||
"Comment": "qemu-system-x86-core is earlier than 0:4.0.0-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20191973062",
|
||
"Comment": "qemu-system-xtensa is earlier than 0:4.0.0-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20191973063",
|
||
"Comment": "qemu-system-xtensa-core is earlier than 0:4.0.0-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20191973064",
|
||
"Comment": "qemu-tools is earlier than 0:4.0.0-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20191973065",
|
||
"Comment": "qemu-ui-curses is earlier than 0:4.0.0-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20191973066",
|
||
"Comment": "qemu-ui-gtk is earlier than 0:4.0.0-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20191973067",
|
||
"Comment": "qemu-ui-sdl is earlier than 0:4.0.0-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20191973068",
|
||
"Comment": "qemu-user is earlier than 0:4.0.0-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20191973069",
|
||
"Comment": "qemu-user-binfmt is earlier than 0:4.0.0-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20191973070",
|
||
"Comment": "qemu-user-static is earlier than 0:4.0.0-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20191973071",
|
||
"Comment": "qemu-user-static-binfmt is earlier than 0:4.0.0-alt1"
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
}
|
||
]
|
||
} |