Debian Package Tracker
Register | Log in
Subscribe

qemu

fast processor emulator, dummy package

Choose email to subscribe with

general
  • source: qemu (main)
  • version: 1:5.2+dfsg-3
  • maintainer: Debian QEMU Team (archive) (DMD)
  • uploaders: Riku Voipio [DMD] – Michael Tokarev [DMD]
  • arch: all any
  • std-ver: 4.5.1
  • VCS: Git (Browse, QA)
versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]
[pool directory]
  • o-o-stable: 1:2.1+dfsg-12+deb8u6
  • o-o-sec: 1:2.1+dfsg-12+deb8u15
  • oldstable: 1:2.8+dfsg-6+deb9u9
  • old-sec: 1:2.8+dfsg-6+deb9u12
  • stable: 1:3.1+dfsg-8+deb10u8
  • stable-sec: 1:3.1+dfsg-8+deb10u8
  • stable-bpo: 1:5.2+dfsg-3~bpo10+1
  • testing: 1:5.2+dfsg-3
  • unstable: 1:5.2+dfsg-3
versioned links
  • 1:2.1+dfsg-12+deb8u6: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 1:2.1+dfsg-12+deb8u15: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 1:2.8+dfsg-6+deb9u9: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 1:2.8+dfsg-6+deb9u12: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 1:3.1+dfsg-8+deb10u8: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 1:5.0-14~bpo10+1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 1:5.2+dfsg-3~bpo10+1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 1:5.2+dfsg-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
binaries
  • qemu (41 bugs: 0, 17, 24, 0)
  • qemu-block-extra
  • qemu-guest-agent (1 bugs: 0, 1, 0, 0)
  • qemu-system (8 bugs: 0, 2, 6, 0)
  • qemu-system-arm (5 bugs: 0, 2, 3, 0)
  • qemu-system-common (5 bugs: 0, 0, 5, 0)
  • qemu-system-data
  • qemu-system-gui (4 bugs: 0, 3, 1, 0)
  • qemu-system-mips
  • qemu-system-misc
  • qemu-system-ppc (2 bugs: 0, 2, 0, 0)
  • qemu-system-sparc
  • qemu-system-x86 (23 bugs: 0, 20, 3, 0)
  • qemu-user (4 bugs: 0, 4, 0, 0)
  • qemu-user-binfmt (1 bugs: 0, 1, 0, 0)
  • qemu-user-static (22 bugs: 0, 20, 2, 0)
  • qemu-utils (2 bugs: 0, 1, 1, 0)
action needed
11 security issues in sid high
There are 11 open security issues in sid.
11 important issues:
  • CVE-2019-12067:
  • CVE-2020-14394:
  • CVE-2020-15469: In QEMU 4.2.0, a MemoryRegionOps object may lack read/write callback methods, leading to a NULL pointer dereference.
  • CVE-2020-17380:
  • CVE-2020-25741: fdctrl_write_data in hw/block/fdc.c in QEMU 5.0.0 has a NULL pointer dereference via a NULL block pointer for the current drive.
  • CVE-2020-25742: pci_change_irq_level in hw/pci/pci.c in QEMU before 5.1.1 has a NULL pointer dereference because pci_get_bus() might not return a valid pointer.
  • CVE-2020-25743: hw/ide/pci.c in QEMU before 5.1.1 can trigger a NULL pointer dereference because it lacks a pointer check before an ide_cancel_dma_sync call.
  • CVE-2020-35503:
  • CVE-2020-35504:
  • CVE-2020-35505:
  • CVE-2020-35506:
Please fix them.
Created: 2019-02-18 Last update: 2021-01-09 23:30
25 security issues in buster high
There are 25 open security issues in buster.
1 important issue:
  • CVE-2020-27821: A flaw was found in the memory management API of QEMU during the initialization of a memory region cache. This issue could lead to an out-of-bounds write access to the MSI-X table while performing MMIO operations. A guest user may abuse this flaw to crash the QEMU process on the host, resulting in a denial of service. This flaw affects QEMU versions prior to 5.2.0.
24 issues skipped by the security teams:
  • CVE-2019-12067:
  • CVE-2019-8934: hw/ppc/spapr.c in QEMU through 3.1.0 allows Information Exposure because the hypervisor shares the /proc/device-tree/system-id and /proc/device-tree/model system attributes with a guest.
  • CVE-2020-13253: sd_wp_addr in hw/sd/sd.c in QEMU 4.2.0 uses an unvalidated address, which leads to an out-of-bounds read during sdhci_write() operations. A guest OS user can crash the QEMU process.
  • CVE-2020-14394:
  • CVE-2020-15469: In QEMU 4.2.0, a MemoryRegionOps object may lack read/write callback methods, leading to a NULL pointer dereference.
  • CVE-2020-15859: QEMU 4.2.0 has a use-after-free in hw/net/e1000e_core.c because a guest OS user can trigger an e1000e packet with the data's address set to the e1000e's MMIO address.
  • CVE-2020-17380:
  • CVE-2020-25084: QEMU 5.0.0 has a use-after-free in hw/usb/hcd-xhci.c because the usb_packet_map return value is not checked.
  • CVE-2020-25085: QEMU 5.0.0 has a heap-based Buffer Overflow in flatview_read_continue in exec.c because hw/sd/sdhci.c mishandles a write operation in the SDHC_BLKSIZE case.
  • CVE-2020-25624: hw/usb/hcd-ohci.c in QEMU 5.0.0 has a stack-based buffer over-read via values obtained from the host controller driver.
  • CVE-2020-25625: hw/usb/hcd-ohci.c in QEMU 5.0.0 has an infinite loop when a TD list has a loop.
  • CVE-2020-25723: A reachable assertion issue was found in the USB EHCI emulation code of QEMU. It could occur while processing USB requests due to missing handling of DMA memory map failure. A malicious privileged user within the guest may abuse this flaw to send bogus USB requests and crash the QEMU process on the host, resulting in a denial of service.
  • CVE-2020-25741: fdctrl_write_data in hw/block/fdc.c in QEMU 5.0.0 has a NULL pointer dereference via a NULL block pointer for the current drive.
  • CVE-2020-25742: pci_change_irq_level in hw/pci/pci.c in QEMU before 5.1.1 has a NULL pointer dereference because pci_get_bus() might not return a valid pointer.
  • CVE-2020-25743: hw/ide/pci.c in QEMU before 5.1.1 can trigger a NULL pointer dereference because it lacks a pointer check before an ide_cancel_dma_sync call.
  • CVE-2020-27617: eth_get_gso_type in net/eth.c in QEMU 4.2.1 allows guest OS users to trigger an assertion failure. A guest can crash the QEMU process via packet data that lacks a valid Layer 3 protocol.
  • CVE-2020-27661:
  • CVE-2020-28916: hw/net/e1000e_core.c in QEMU 5.0.0 has an infinite loop via an RX descriptor with a NULL buffer address.
  • CVE-2020-29129: ncsi.c in libslirp through 4.3.1 has a buffer over-read because it tries to read a certain amount of header data even if that exceeds the total packet length.
  • CVE-2020-29130: slirp.c in libslirp through 4.3.1 has a buffer over-read because it tries to read a certain amount of header data even if that exceeds the total packet length.
  • CVE-2020-35503:
  • CVE-2020-35504:
  • CVE-2020-35505:
  • CVE-2020-35506:
Please fix them.
Created: 2019-01-22 Last update: 2021-01-09 23:30
11 security issues in bullseye high
There are 11 open security issues in bullseye.
6 important issues:
  • CVE-2019-12067:
  • CVE-2020-15469: In QEMU 4.2.0, a MemoryRegionOps object may lack read/write callback methods, leading to a NULL pointer dereference.
  • CVE-2020-17380:
  • CVE-2020-25741: fdctrl_write_data in hw/block/fdc.c in QEMU 5.0.0 has a NULL pointer dereference via a NULL block pointer for the current drive.
  • CVE-2020-25742: pci_change_irq_level in hw/pci/pci.c in QEMU before 5.1.1 has a NULL pointer dereference because pci_get_bus() might not return a valid pointer.
  • CVE-2020-25743: hw/ide/pci.c in QEMU before 5.1.1 can trigger a NULL pointer dereference because it lacks a pointer check before an ide_cancel_dma_sync call.
5 issues skipped by the security teams:
  • CVE-2020-14394:
  • CVE-2020-35503:
  • CVE-2020-35504:
  • CVE-2020-35505:
  • CVE-2020-35506:
Please fix them.
Created: 2019-07-07 Last update: 2021-01-09 23:30
lintian reports 5 errors and 28 warnings high
Lintian reports 5 errors and 28 warnings about this package. You should make the package lintian clean getting rid of them.
Created: 2020-09-21 Last update: 2020-09-21 06:04
Fails to build during reproducibility testing normal
A package building reproducibly enables third parties to verify that the source matches the distributed binaries. It has been identified that this source package produced different results, failed to build or had other issues in a test environment. Please read about how to improve the situation!
Created: 2020-09-10 Last update: 2021-01-18 18:04
3 bugs tagged patch in the BTS normal
The BTS contains patches fixing 3 bugs, consider including or untagging them.
Created: 2020-10-19 Last update: 2021-01-18 17:32
1 new commit since last upload, is it time to release? normal
vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:
commit efd44475c4587774a931710e75355ae3bf34abc6
Author: Michael Tokarev <mjt@tls.msk.ru>
Date:   Sun Jan 10 15:20:02 2021 +0300

    require libfdt >= 1.5.0-2 due to #931046
Created: 2021-01-10 Last update: 2021-01-18 16:04
Depends on packages which need a new maintainer normal
The packages that qemu depends on which need a new maintainer are:
  • sudo (#976244)
    • Suggests: sudo
  • usbredir (#911431)
    • Build-Depends: libusbredirparser-dev
    • Depends: libusbredirparser1 libusbredirparser1 libusbredirparser1 libusbredirparser1 libusbredirparser1 libusbredirparser1
Created: 2019-11-22 Last update: 2021-01-18 15:03
Multiarch hinter reports 2 issue(s) low
There are issues with the multiarch metadata for this package.
  • qemu could be converted to Architecture: all and marked Multi-Arch: foreign
  • qemu-system could be converted to Architecture: all and marked Multi-Arch: foreign
Created: 2020-12-30 Last update: 2021-01-18 15:31
21 ignored security issues in stretch low
There are 21 open security issues in stretch.
21 issues skipped by the security teams:
  • CVE-2018-15746: qemu-seccomp.c in QEMU might allow local OS guest users to cause a denial of service (guest crash) by leveraging mishandling of the seccomp policy for threads other than the main thread.
  • CVE-2018-18438: Qemu has integer overflows because IOReadHandler and its associated functions use a signed integer data type for a size value.
  • CVE-2018-19665: The Bluetooth subsystem in QEMU mishandles negative values for length variables, leading to memory corruption.
  • CVE-2019-12067:
  • CVE-2019-8934: hw/ppc/spapr.c in QEMU through 3.1.0 allows Information Exposure because the hypervisor shares the /proc/device-tree/system-id and /proc/device-tree/model system attributes with a guest.
  • CVE-2020-14394:
  • CVE-2020-15469: In QEMU 4.2.0, a MemoryRegionOps object may lack read/write callback methods, leading to a NULL pointer dereference.
  • CVE-2020-15859: QEMU 4.2.0 has a use-after-free in hw/net/e1000e_core.c because a guest OS user can trigger an e1000e packet with the data's address set to the e1000e's MMIO address.
  • CVE-2020-17380:
  • CVE-2020-25084: QEMU 5.0.0 has a use-after-free in hw/usb/hcd-xhci.c because the usb_packet_map return value is not checked.
  • CVE-2020-25741: fdctrl_write_data in hw/block/fdc.c in QEMU 5.0.0 has a NULL pointer dereference via a NULL block pointer for the current drive.
  • CVE-2020-25742: pci_change_irq_level in hw/pci/pci.c in QEMU before 5.1.1 has a NULL pointer dereference because pci_get_bus() might not return a valid pointer.
  • CVE-2020-25743: hw/ide/pci.c in QEMU before 5.1.1 can trigger a NULL pointer dereference because it lacks a pointer check before an ide_cancel_dma_sync call.
  • CVE-2020-27821: A flaw was found in the memory management API of QEMU during the initialization of a memory region cache. This issue could lead to an out-of-bounds write access to the MSI-X table while performing MMIO operations. A guest user may abuse this flaw to crash the QEMU process on the host, resulting in a denial of service. This flaw affects QEMU versions prior to 5.2.0.
  • CVE-2020-28916: hw/net/e1000e_core.c in QEMU 5.0.0 has an infinite loop via an RX descriptor with a NULL buffer address.
  • CVE-2020-29129: ncsi.c in libslirp through 4.3.1 has a buffer over-read because it tries to read a certain amount of header data even if that exceeds the total packet length.
  • CVE-2020-29130: slirp.c in libslirp through 4.3.1 has a buffer over-read because it tries to read a certain amount of header data even if that exceeds the total packet length.
  • CVE-2020-35503:
  • CVE-2020-35504:
  • CVE-2020-35505:
  • CVE-2020-35506:
Please fix them.
Created: 2017-05-31 Last update: 2021-01-09 23:30
Build log checks report 2 warnings low
Build log checks report 2 warnings
Created: 2020-09-03 Last update: 2020-12-09 14:35
news
[rss feed]
  • [2021-01-10] Accepted qemu 1:5.2+dfsg-3~bpo10+1 (source) into buster-backports (Michael Tokarev)
  • [2021-01-06] qemu 1:5.2+dfsg-3 MIGRATED to testing (Debian testing watch)
  • [2020-12-29] Accepted qemu 1:5.2+dfsg-3 (source) into unstable (Michael Tokarev)
  • [2020-12-10] Accepted qemu 1:5.2+dfsg-2 (source) into unstable (Michael Tokarev)
  • [2020-12-09] Accepted qemu 1:5.2+dfsg-1 (source) into unstable (Michael Tokarev)
  • [2020-11-29] Accepted qemu 1:2.8+dfsg-6+deb9u12 (source amd64) into oldstable (Thorsten Alteholz)
  • [2020-09-17] Accepted qemu 1:3.1+dfsg-8+deb10u8 (source) into proposed-updates->stable-new, proposed-updates (Debian FTP Masters) (signed by: Michael Tokarev)
  • [2020-09-13] Accepted qemu 1:2.8+dfsg-6+deb9u11 (source amd64) into oldstable (Abhijith PA)
  • [2020-09-06] Accepted qemu 1:3.1+dfsg-8+deb10u8 (source) into stable->embargoed, stable (Debian FTP Masters) (signed by: Michael Tokarev)
  • [2020-09-05] qemu 1:5.1+dfsg-4 MIGRATED to testing (Debian testing watch)
  • [2020-09-02] Accepted qemu 1:5.1+dfsg-4 (source) into unstable (Michael Tokarev)
  • [2020-08-24] qemu 1:5.1+dfsg-3 MIGRATED to testing (Debian testing watch)
  • [2020-08-17] Accepted qemu 1:5.1+dfsg-3 (source) into unstable (Michael Tokarev)
  • [2020-08-17] Accepted qemu 1:5.1+dfsg-2 (source) into unstable (Michael Tokarev)
  • [2020-08-17] Accepted qemu 1:5.1+dfsg-1 (source) into unstable (Michael Tokarev)
  • [2020-08-13] Accepted qemu 1:5.0-14~bpo10+1 (source amd64 all) into buster-backports, buster-backports (Debian FTP Masters) (signed by: Michael Tokarev)
  • [2020-08-12] Accepted qemu 1:5.1+dfsg-0exp1 (source) into experimental (Michael Tokarev)
  • [2020-08-12] qemu 1:5.0-14 MIGRATED to testing (Debian testing watch)
  • [2020-07-31] Accepted qemu 1:5.0-14 (source) into unstable (Michael Tokarev)
  • [2020-07-26] qemu 1:5.0-13 MIGRATED to testing (Debian testing watch)
  • [2020-07-25] Accepted qemu 1:2.8+dfsg-6+deb9u10 (source) into oldstable (Michael Tokarev)
  • [2020-07-25] Accepted qemu 1:3.1+dfsg-8+deb10u7 (source) into proposed-updates->stable-new, proposed-updates (Debian FTP Masters) (signed by: Michael Tokarev)
  • [2020-07-24] Accepted qemu 1:3.1+dfsg-8+deb10u7 (source) into stable->embargoed, stable (Debian FTP Masters) (signed by: Michael Tokarev)
  • [2020-07-23] Accepted qemu 1:3.1+dfsg-8+deb10u6 (source) into proposed-updates->stable-new, proposed-updates (Debian FTP Masters) (signed by: Michael Tokarev)
  • [2020-07-22] Accepted qemu 1:5.0-13 (source) into unstable (Michael Tokarev)
  • [2020-07-22] Accepted qemu 1:5.0-12 (source) into unstable (Michael Tokarev)
  • [2020-07-20] Accepted qemu 1:5.0-11 (source) into unstable (Michael Tokarev)
  • [2020-07-19] Accepted qemu 1:3.1+dfsg-8+deb10u6 (source) into stable->embargoed, stable (Debian FTP Masters) (signed by: Michael Tokarev)
  • [2020-07-18] Accepted qemu 1:5.0-10 (source) into unstable (Michael Tokarev)
  • [2020-07-18] Accepted qemu 1:5.0-9 (source) into unstable (Michael Tokarev)
  • 1
  • 2
bugs [bug history graph]
  • all: 152 164
  • RC: 0
  • I&N: 85 88
  • M&W: 67 76
  • F&P: 0
  • patch: 3
links
  • homepage
  • lintian (5, 28)
  • buildd: logs, checks, clang, reproducibility, cross
  • popcon
  • browse source code
  • edit tags
  • other distros
  • security tracker
  • screenshots
  • l10n (-, 87)
ubuntu Ubuntu logo [Information about Ubuntu for Debian Developers]
  • version: 1:5.2+dfsg-3ubuntu1
  • 76 bugs (2 patches)

Debian Package Tracker — Copyright 2013-2018 The Distro Tracker Developers
Report problems to the tracker.debian.org pseudo-package in the Debian BTS.
Documentation — Bugs — Git Repository — Contributing