New changelog entries:
* SECURITY REGRESSION: Xen regression (LP: #1752761)
- debian/patches/CVE-2017-11334-1.patch: removed.
- debian/patches/CVE-2017-11334-2.patch: removed.
* This package does _not_ contain the changes from
(1:2.5+dfsg-5ubuntu10.23) in xenial-proposed.
New changelog entries:
* SECURITY UPDATE: DoS via guest ram block area
- debian/patches/CVE-2017-11334-1.patch: use qemu_ram_ptr_length to
access guest ram in exec.c.
- debian/patches/CVE-2017-11334-2.patch: add lock parameter to
qemu_ram_ptr_length in exec.c.
- CVE-2017-11334
* SECURITY UPDATE: code execution via multiboot out-of-bounds write
- debian/patches/CVE-2017-14167.patch: validate multiboot header
address values in hw/i386/multiboot.c.
- CVE-2017-14167
* SECURITY UPDATE: information disclosure via race in 9pfs
- debian/patches/CVE-2017-15038.patch: use g_malloc0 to allocate space
for xattr in hw/9pfs/virtio-9p.c.
- CVE-2017-15038
* SECURITY UPDATE: DoS via large option request in NBD server
- debian/patches/CVE-2017-15119.patch: reject options larger than 32M
in nbd.c.
- CVE-2017-15119
* SECURITY UPDATE: DoS in cirrus driver
- debian/patches/CVE-2017-15289.patch: fix oob access in mode4and5
write functions in hw/display/cirrus_vga.c.
- CVE-2017-15289
* SECURITY UPDATE: out-of-bounds access in ps2 driver
- debian/patches/CVE-2017-16845.patch: check PS2Queue pointers in
post_load routine in hw/input/ps2.c.
- CVE-2017-16845
* SECURITY UPDATE: DoS in Virtio Vring implementation
- debian/patches/CVE-2017-17381.patch: check VirtQueue Vring object is
set in hw/virtio/virtio.c.
- CVE-2017-17381
* SECURITY UPDATE: DoS via integer overflow in ROUND_UP
- debian/patches/CVE-2017-18043.patch: fix ROUND_UP in
include/qemu/osdep.h.
- CVE-2017-18043
* SECURITY UPDATE: DoS in VGA driver
- debian/patches/CVE-2018-5683.patch: check the validation of memory
addr when draw text in hw/display/vga.c.
- CVE-2018-5683
New changelog entries:
* debian/patches/ubuntu/lp-1712803-hypercalls_backport.patch: support
newer hcalls; Thanks to Yasmin Beatriz Alves da Silva. (LP: #1712803).
New changelog entries:
* SECURITY UPDATE: Add support for Spectre mitigations (LP: #1744882)
- debian/patches/CVE-2017-5715-1.patch: Lengthen X86CPUDefinition::
model_id in target-i386/cpu.c.
- debian/patches/CVE-2017-5715-2.patch: Add support for SPEC_CTRL MSR
in target-i386/cpu.h, target-i386/kvm.c, target-i386/machine.c.
- debian/patches/CVE-2017-5715-3pre1.patch: add FEAT_7_0_ECX and
FEAT_7_0_EDX in target-i386/cpu.c, target-i386/cpu.h.
- debian/patches/CVE-2017-5715-3.patch: Add spec-ctrl CPUID bit in
target-i386/cpu.c, target-i386/cpu.h.
- debian/patches/CVE-2017-5715-4.patch: Add FEAT_8000_0008_EBX CPUID
feature word in target-i386/cpu.c, target-i386/cpu.h.
- debian/patches/CVE-2017-5715-5.patch: Add new -IBRS versions of Intel
CPU models in target-i386/cpu.c.
- debian/patches/CVE-2017-5715-s390x-1.patch: add linux-header content
for bpbc in linux-headers/asm-s390/kvm.h, linux-headers/linux/kvm.h.
- debian/patches/CVE-2017-5715-s390x-2.patch: handle bpb feature in
target-s390x/cpu.c, target-s390x/cpu.h, target-s390x/kvm.c.
- CVE-2017-5715
New changelog entries:
* SECURITY REGRESSION: regression in in USB xHCI emulation (LP: #1718222)
- debian/patches/CVE-2017-9375-regression.patch: don't kick in
xhci_submit and xhci_fire_ctl_transfer in hw/usb/hcd-xhci.c.
