The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-0816 advisory.

    - Resolves: bz#1518711       (CVE-2017-15268 qemu-kvm: Qemu: I/O: potential memory exhaustion via websock connection to VNC     [rhel-7.5])
    - Resolves: bz#1527405       (CVE-2017-15124 qemu-kvm: Qemu: memory exhaustion through framebuffer update request message in VNC     server [rhel-7.5])
    - Resolves: bz#1534691       (CVE-2018-5683 qemu-kvm: Qemu: Out-of-bounds read in vga_draw_text routine [rhel-7.5])
    - kvm-target-i386-cpu-add-new-CPUID-bits-for-indirect-bran.patch [CVE-2017-5715]
    - kvm-target-i386-add-support-for-SPEC_CTRL-MSR.patch [CVE-2017-5715]
    - kvm-target-i386-cpu-add-new-CPU-models-for-indirect-bran.patch [CVE-2017-5715]
    - Resolves: bz#1508745       (CVE-2017-13711 qemu-kvm: Qemu: Slirp: use-after-free when sending response [rhel-7.5])
    - Resolves: bz#1501121       (CVE-2017-14167 qemu-kvm: Qemu: i386: multiboot OOB access while loading kernel image [rhel-7.5])
    - Resolves: bz#1501295       (CVE-2017-15289 qemu-kvm: Qemu: cirrus: OOB access issue in  mode4and5 write functions [rhel-7.5])
    - Resolves: bz#1486642       (CVE-2017-13672 qemu-kvm: Qemu: vga: OOB read access during display update [rhel-7.5])
    - Resolves: bz#1466463       (CVE-2017-10664 qemu-kvm: Qemu: qemu-nbd: server breaks with SIGPIPE upon client abort [rhel-7.5])

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Oracle Linux 7 : qemu-kvm (ELSA-2018-0816)

high Nessus Plugin ID 109106

Version 1.3