{"schemaVersion":3,"id":"SUSE-SU-2016:2628-1","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Security update for kvm\n\nkvm was updated to fix 16 security issues.\n\nThese security issues were fixed:\n- CVE-2015-6815: e1000 NIC emulation support was vulnerable to an infinite loop issue. A privileged user inside guest could have used this flaw to crash the Qemu instance resulting in DoS.  (bsc#944697).\n- CVE-2016-2391: The ohci_bus_start function in the USB OHCI emulation support (hw/usb/hcd-ohci.c) in QEMU allowed local guest OS administrators to cause a denial of service (NULL pointer dereference and QEMU process crash) via vectors related to multiple eof_timers (bsc#967013).\n- CVE-2016-2392: The is_rndis function in the USB Net device emulator (hw/usb/dev-network.c) in QEMU did not properly validate USB configuration descriptor objects, which allowed local guest OS administrators to cause a denial of service (NULL pointer dereference and QEMU process crash) via vectors involving a remote NDIS control message packet (bsc#967012).\n- CVE-2016-4453: The vmsvga_fifo_run function in hw/display/vmware_vga.c in QEMU allowed local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via a VGA command (bsc#982223).\n- CVE-2016-4454: The vmsvga_fifo_read_raw function in hw/display/vmware_vga.c in QEMU allowed local guest OS administrators to obtain sensitive host memory information or cause a denial of service (QEMU process crash) by changing FIFO registers and issuing a VGA command, which triggers an out-of-bounds read (bsc#982222).\n- CVE-2016-5105: The megasas_dcmd_cfg_read function in hw/scsi/megasas.c in QEMU, when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, used an uninitialized variable, which allowed local guest administrators to read host memory via vectors involving a MegaRAID Firmware Interface (MFI) command (bsc#982017).\n- CVE-2016-5106: The megasas_dcmd_set_properties function in hw/scsi/megasas.c in QEMU, when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, allowed local guest administrators to cause a denial of service (out-of-bounds write access) via vectors involving a MegaRAID Firmware Interface (MFI) command (bsc#982018).\n- CVE-2016-5107: The megasas_lookup_frame function in QEMU, when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, allowed local guest OS administrators to cause a denial of service (out-of-bounds read and crash) via unspecified vectors (bsc#982019).\n- CVE-2016-5126: Heap-based buffer overflow in the iscsi_aio_ioctl function in block/iscsi.c in QEMU allowed local guest OS users to cause a denial of service (QEMU process crash) or possibly execute arbitrary code via a crafted iSCSI asynchronous I/O ioctl call (bsc#982285).\n- CVE-2016-5238: The get_cmd function in hw/scsi/esp.c in QEMU allowed local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) via vectors related to reading from the information transfer buffer in non-DMA mode (bsc#982959).\n- CVE-2016-5337: The megasas_ctrl_get_info function in hw/scsi/megasas.c in QEMU allowed local guest OS administrators to obtain sensitive host memory information via vectors related to reading device control information (bsc#983961).\n- CVE-2016-5338: The (1) esp_reg_read and (2) esp_reg_write functions in hw/scsi/esp.c in QEMU allowed local guest OS administrators to cause a denial of service (QEMU process crash) or execute arbitrary code on the QEMU host via vectors related to the information transfer buffer (bsc#983982).\n- CVE-2016-5403: The virtqueue_pop function in hw/virtio/virtio.c in QEMU allowed local guest OS administrators to cause a denial of service (memory consumption and QEMU process crash) by submitting requests without waiting for completion (bsc#991080).\n- CVE-2016-6490: Infinite loop in the virtio framework. A privileged user inside the guest could have used this flaw to crash the Qemu instance on the host resulting in DoS (bsc#991466).\n- CVE-2016-7116: Host directory sharing via Plan 9 File System(9pfs) was vulnerable to a directory/path traversal issue. A privileged user inside guest could have used this flaw to access undue files on the host (bsc#996441).\n- CVE-2014-7815: The set_pixel_format function in ui/vnc.c in QEMU allowed remote attackers to cause a denial of service (crash) via a small bytes_per_pixel value (bsc#902737).","dates":{"published":"2016-10-25T14:22:27.000Z","modified":"2026-02-04T03:23:39.087Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"suse","product":"kvm&distro=SUSE Linux Enterprise Server 11 SP4","name":"kvm","label":"kvm&distro=SUSE Linux Enterprise Server 11 SP4","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/kvm&distro=SUSE Linux Enterprise Server 11 SP4","purlType":"rpm","versions":[{"text":"< 1.4.2-47.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.4.2-47.1","eol":null,"hubHref":null},{"vendor":"suse","product":"kvm&distro=SUSE Linux Enterprise Server for SAP Applications 11 SP4","name":"kvm","label":"kvm&distro=SUSE Linux Enterprise Server for SAP Applications 11 SP4","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/kvm&distro=SUSE Linux Enterprise Server for SAP Applications 11 SP4","purlType":"rpm","versions":[{"text":"< 1.4.2-47.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.4.2-47.1","eol":null,"hubHref":null}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20162628-1/","label":"www.suse.com/support/update/announcement/2016/suse-su-20162628-1/","hostname":"www.suse.com","tags":["Advisory"]},{"url":"https://bugzilla.suse.com/902737","label":"bugzilla.suse.com/902737","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/944697","label":"bugzilla.suse.com/944697","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/967012","label":"bugzilla.suse.com/967012","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/967013","label":"bugzilla.suse.com/967013","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/982017","label":"bugzilla.suse.com/982017","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/982018","label":"bugzilla.suse.com/982018","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/982019","label":"bugzilla.suse.com/982019","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/982222","label":"bugzilla.suse.com/982222","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/982223","label":"bugzilla.suse.com/982223","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/982285","label":"bugzilla.suse.com/982285","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/982959","label":"bugzilla.suse.com/982959","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/983961","label":"bugzilla.suse.com/983961","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/983982","label":"bugzilla.suse.com/983982","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/991080","label":"bugzilla.suse.com/991080","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/991466","label":"bugzilla.suse.com/991466","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/996441","label":"bugzilla.suse.com/996441","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7815","label":"www.suse.com/security/cve/CVE-2014-7815","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2015-6815","label":"www.suse.com/security/cve/CVE-2015-6815","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2391","label":"www.suse.com/security/cve/CVE-2016-2391","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2392","label":"www.suse.com/security/cve/CVE-2016-2392","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4453","label":"www.suse.com/security/cve/CVE-2016-4453","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4454","label":"www.suse.com/security/cve/CVE-2016-4454","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5105","label":"www.suse.com/security/cve/CVE-2016-5105","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5106","label":"www.suse.com/security/cve/CVE-2016-5106","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5107","label":"www.suse.com/security/cve/CVE-2016-5107","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5126","label":"www.suse.com/security/cve/CVE-2016-5126","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5238","label":"www.suse.com/security/cve/CVE-2016-5238","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5337","label":"www.suse.com/security/cve/CVE-2016-5337","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5338","label":"www.suse.com/security/cve/CVE-2016-5338","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5403","label":"www.suse.com/security/cve/CVE-2016-5403","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6490","label":"www.suse.com/security/cve/CVE-2016-6490","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7116","label":"www.suse.com/security/cve/CVE-2016-7116","hostname":"www.suse.com","tags":["WEB"]}],"lineage":{"upstream":["CVE-2014-7815","CVE-2015-6815","CVE-2016-2391","CVE-2016-2392","CVE-2016-4453","CVE-2016-4454","CVE-2016-5105","CVE-2016-5106","CVE-2016-5107","CVE-2016-5126","CVE-2016-5238","CVE-2016-5337","CVE-2016-5338","CVE-2016-5403","CVE-2016-6490","CVE-2016-7116"],"downstream":[],"duplicates":[],"related":["CVE-2014-7815","CVE-2015-6815","CVE-2016-2391","CVE-2016-2392","CVE-2016-4453","CVE-2016-4454","CVE-2016-5105","CVE-2016-5106","CVE-2016-5107","CVE-2016-5126","CVE-2016-5238","CVE-2016-5337","CVE-2016-5338","CVE-2016-5403","CVE-2016-6490","CVE-2016-7116"]},"timeline":[{"kind":"published","date":"2016-10-25T14:22:27.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-02-04T03:23:39.087Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T12:53:57.589Z","stale":false,"partial":false}}