qemu (1:2.5+dfsg-5ubuntu10.51) xenial-security; urgency=medium

  * SECURITY REGRESSION: fix multiple regressions caused by CVE-2020-13754
    security update (LP: #1914883)
    - debian/patches/CVE-2020-13754-5.patch: allow 64-bit accesses in
      hw/timer/slavio_timer.c.
    - debian/patches/CVE-2020-13754-9.patch: fix valid.max_access_size to
      access address registers in hw/usb/hcd-xhci.c.

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 10 Feb 2021 08:40:41 -0500

qemu (1:2.5+dfsg-5ubuntu10.49) xenial-security; urgency=medium

  * SECURITY UPDATE: heap overread in iscsi_aio_ioctl_cb
    - debian/patches/CVE-2020-11947.patch: fix heap-buffer-overflow in
      block/iscsi.c.
    - CVE-2020-11947
  * SECURITY UPDATE: use-after-free in e1000e
    - debian/patches/CVE-2020-15859.patch: forbid the reentrant RX in
      net/queue.c.
    - CVE-2020-15859
  * SECURITY UPDATE: out of bounds read in atapi
    - debian/patches/CVE-2020-29443-1.patch: assert that the buffer pointer
      is in range in hw/ide/atapi.c.
    - debian/patches/CVE-2020-29443-2.patch: check logical block address
      and read size in hw/ide/atapi.c.
    - CVE-2020-29443
  * SECURITY UPDATE: use after free in 9p
    - debian/patches/CVE-2021-20181.patch: fully restart unreclaim loop in
      hw/9pfs/virtio-9p.c.
    - CVE-2021-20181

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 03 Feb 2021 12:56:37 -0500

qemu (1:2.5+dfsg-5ubuntu10.48) xenial-security; urgency=medium

  * SECURITY UPDATE: heap buffer overflow in sdhci_sdma_transfer_multi_blocks()
    - debian/patches/CVE-2020-17380.patch: fix DMA Transfer Block Size
      field in hw/sd/sdhci.c.
    - CVE-2020-17380
    - CVE-2020-25085
  * SECURITY UPDATE: use-after-free via unchecked return value
    - debian/patches/CVE-2020-25084.patch: check return value of
      'usb_packet_map' in hw/usb/hcd-xhci.c.
    - CVE-2020-25084
  * SECURITY UPDATE: out-of-bound access issue
    - debian/patches/CVE-2020-25624.patch: check len and frame_number
      variables in hw/usb/hcd-ohci.c.
    - CVE-2020-25624
  * SECURITY UPDATE: infinite loop when a TD list has a loop
    - debian/patches/CVE-2020-25625.patch: check for processed TD before
      retire in hw/usb/hcd-ohci.c.
    - CVE-2020-25625
  * SECURITY UPDATE: assertion failure through usb_packet_unmap()
    - debian/patches/CVE-2020-25723.patch: check return value of
      'usb_packet_map' in hw/usb/hcd-ehci.c.
    - CVE-2020-25723
  * SECURITY UPDATE: assertion failure
    - debian/patches/CVE-2020-27617.patch: remove an assert call in
      eth_get_gso_type in net/eth.c.
    - CVE-2020-27617

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Fri, 20 Nov 2020 08:19:16 -0500

qemu (1:2.5+dfsg-5ubuntu10.47) xenial; urgency=medium

  * d/p/u/lp-1894942-*: fix virtio-ccw host/guest notification (LP: #1894942)

 -- Christian Ehrhardt <christian.ehrhardt@canonical.com>  Mon, 21 Sep 2020 15:50:56 +0200

qemu (1:2.5+dfsg-5ubuntu10.46) xenial-security; urgency=medium

  * SECURITY UPDATE: out-of-bounds read/write in USB emulator
    - debian/patches/CVE-2020-14364-pre.patch: check RNDIS message length
      in hw/usb/core.c.
    - debian/patches/CVE-2020-14364.patch: fix setup_len init in
      hw/usb/core.c.
    - CVE-2020-14364

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 15 Sep 2020 10:09:45 -0400

qemu (1:2.5+dfsg-5ubuntu10.45) xenial-security; urgency=medium

  * SECURITY UPDATE: out-of-bounds read and write in sm501
    - debian/patches/CVE-2020-12829-pre0.patch: fix hardware cursor.
    - debian/patches/CVE-2020-12829-pre1.patch: use values from the pitch
      register for 2D operations.
    - debian/patches/CVE-2020-12829-pre2.patch: implement negated
      destination raster operation mode.
    - debian/patches/CVE-2020-12829-pre3.patch: log unimplemented raster
      operation modes.
    - debian/patches/CVE-2020-12829-pre4.patch: fix support for non-zero
      frame buffer start address.
    - debian/patches/CVE-2020-12829-pre5.patch: set updated region dirty
      after 2D operation.
    - debian/patches/CVE-2020-12829-pre6.patch: adjust endianness of pixel
      value in rectangle fill.
    - debian/patches/CVE-2020-12829-pre7.patch: convert printf +
      abort to qemu_log_mask.
    - debian/patches/CVE-2020-12829-pre8.patch: shorten long
      variable names in sm501_2d_operation.
    - debian/patches/CVE-2020-12829-pre9.patch: use BIT(x) macro to
      shorten constant.
    - debian/patches/CVE-2020-12829-pre10.patch: clean up local
      variables in sm501_2d_operation.
    - debian/patches/CVE-2020-12829.patch: replace hand written
      implementation with pixman where possible.
    - debian/patches/CVE-2020-12829-2.patch: optimize small overlapping
      blits.
    - debian/patches/CVE-2020-12829-3.patch: fix bounds checks.
    - debian/patches/CVE-2020-12829-4.patch: drop unneded variable.
    - debian/patches/CVE-2020-12829-5.patch: do not allow guest to set
      invalid format.
    - debian/patches/CVE-2020-12829-6.patch: introduce variable for
      commonly used value for better readability.
    - debian/patches/CVE-2020-12829-7.patch: fix and optimize overlap
      check.
    - CVE-2020-12829
  * SECURITY UPDATE: out-of-bounds read during sdhci_write() operations
    - debian/patches/CVE-2020-13253.patch: do not switch to ReceivingData
      if address is invalid in hw/sd/sd.c.
    - CVE-2020-13253
  * SECURITY UPDATE: out-of-bounds access during es1370_write() operation
    - debian/patches/CVE-2020-13361.patch: check total frame count against
      current frame in hw/audio/es1370.c.
    - CVE-2020-13361
  * SECURITY UPDATE: out-of-bounds read via crafted reply_queue_head
    - debian/patches/CVE-2020-13362-1.patch: use unsigned type for
      reply_queue_head and check index in hw/scsi/megasas.c.
    - debian/patches/CVE-2020-13362-2.patch: avoid NULL pointer dereference
      in hw/scsi/megasas.c.
    - debian/patches/CVE-2020-13362-3.patch: use unsigned type for positive
      numeric fields in hw/scsi/megasas.c.
    - CVE-2020-13362
  * SECURITY UPDATE: NULL pointer dereference related to BounceBuffer
    - debian/patches/CVE-2020-13659.patch: set map length to zero when
      returning NULL in exec.c, include/exec/memory.h.
    - CVE-2020-13659
  * SECURITY UPDATE: out-of-bounds access via msi-x mmio operation
    - debian/patches/CVE-2020-13754-1.patch: revert accepting mismatching
      sizes in memory_region_access_valid in memory.c.
    - debian/patches/CVE-2020-13754-2.patch: accept byte and word access to
      core ACPI registers in hw/acpi/core.c.
    - CVE-2020-13754
  * SECURITY UPDATE: invalid memory copy operation via rom_copy
    - debian/patches/CVE-2020-13765.patch: add extra check to
      hw/core/loader.c.
    - CVE-2020-13765
  * SECURITY UPDATE: buffer overflow in XGMAC Ethernet controller
    - debian/patches/CVE-2020-15863.patch: check bounds in hw/net/xgmac.c.
    - CVE-2020-15863

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 11 Aug 2020 14:48:43 -0400

qemu (1:2.5+dfsg-5ubuntu10.44) xenial-security; urgency=medium

  * SECURITY UPDATE: memory leak in zrle_compress_data
    - debian/patches/ubuntu/CVE-2019-20382.patch: fix memory leak when vnc
      disconnect in ui/vnc-enc-tight.c, ui/vnc-enc-zrle.inc.c, ui/vnc.c,
      ui/vnc.h.
    - CVE-2019-20382
  * SECURITY UPDATE: use-after-free in ip_reass()
    - debian/patches/ubuntu/CVE-2020-1983.patch: fix buffer handling in
      slirp/ip_input.c.
    - CVE-2020-1983

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Thu, 14 May 2020 08:58:54 -0400

qemu (1:2.5+dfsg-5ubuntu10.43) xenial-security; urgency=medium

  * SECURITY UPDATE: OOB heap access via unexpected iSCSI Server response
    - debian/patches/CVE-2020-1711.patch: cap block count from GET LBA
      STATUS in block/iscsi.c.
    - CVE-2020-1711
  * SECURITY UPDATE: heap-based overflow in slirp networking
    - debian/patches/CVE-2020-7039-1.patch: fix oob issue in
      slirp/tcp_subr.c.
    - debian/patches/CVE-2020-7039-2.patch: use correct size while
      emulating IRC commands in slirp/tcp_subr.c.
    - debian/patches/CVE-2020-7039-3.patch: use correct size while
      emulating commands in slirp/tcp_subr.c.
    - CVE-2020-7039
  * SECURITY UPDATE: buffer overflow via incorrect snprintf return codes
    - debian/patches/CVE-2020-8608-1.patch: add slirp_fmt() helpers to
      slirp/slirp.c, slirp/slirp.h.
    - debian/patches/CVE-2020-8608-2.patch: fix unsafe snprintf() usages in
      slirp/tcp_subr.c.
    - CVE-2020-8608

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Thu, 13 Feb 2020 07:06:36 -0500

qemu (1:2.5+dfsg-5ubuntu10.42) xenial-security; urgency=medium

  * SECURITY UPDATE: infinite loop when executing LSI scsi adapter
    emulator scripts
    - d/p/CVE-2019-12068.patch: Move the existing loop exit
    - CVE-2019-12068
  * SECURITY UPDATE: null pointer dereference in qxl display driver
    - d/p/CVE-2019-12155.patch: qxl: check release info object
    - CVE-2019-12155
  * SECURITY UPDATE: qemu-bridge-helper interface name buffer overflow
    - d/p/CVE-2019-13164.patch: qemu-bridge-helper: restrict
      interface name to IFNAMSIZ
    - CVE-2019-13164
  * SECURITY UPDATE: heap overflow in slirp
    - d/p/CVE-2019-14378.patch: slirp: Fix heap overflow in ip_reass
      on big packet input
    - CVE-2019-14378
  * SECURITY UPDATE: use after free vulnerability in slirp
    - d/p/CVE-2019-15890.patch: slirp: ip_reass: Fix use after free
    - CVE-2019-15890

 -- Steve Beattie <sbeattie@ubuntu.com>  Mon, 04 Nov 2019 13:30:56 -0800

qemu (1:2.5+dfsg-5ubuntu10.41) xenial; urgency=medium

  * d/p/ubuntu/lp-1830243-s390-bios-Skip-bootmap-signature-entries.patch:
    tolerate guests with secure boot loaders (LP: #1830243)

 -- Christian Ehrhardt <christian.ehrhardt@canonical.com>  Thu, 04 Jul 2019 14:47:56 +0200

# For older changelog entries, run 'apt-get changelog qemu-guest-agent'
