------------------------------------------------------------------------
Pardus Linux Security Advisory 2010-33            security@pardus.org.tr
------------------------------------------------------------------------
      Date: 2010-02-14
  Severity: 4
      Type: Local
------------------------------------------------------------------------

Summary
=======

Multiple vulnerabilities have been fixed in Qemu, which can be exploited
by malicious people to cause denial of service (application  crash)  or 
potentially compromise a vulnerable system. 


Description
===========

CVE-2010-0297: 

When using certain USB in the guest system the qemu process crashs when 
a usb control request is greater than 1024 bytes. 



CVE-2009-3616: 

Multiple use-after-free vulnerabilities in vnc.c in the VNC  server  in 
QEMU might allow guest OS users to execute arbitrary code on the host OS
by  establishing a  connection  from  a  VNC  client  and   then   (1)  
disconnecting  during data  transfer,  (2)  sending  a  message  using  
incorrect integer data types,  or  (3)  using  the  Fuzzy  Screen  Mode 
protocol, related to double free vulnerabilities. 





Affected packages:

  Pardus 2009:
    qemu, all before 0.10.5-17-5


Resolution
==========

There are update(s) for qemu. You can update them via Package Manager or
with a single command from console: 

    pisi up qemu

References
==========

  * http://bugs.pardus.org.tr/show_bug.cgi?id=12222
  * http://bugs.pardus.org.tr/show_bug.cgi?id=12221