oss-security - Re: CVE-2015-1779 qemu: vnc: insufficient resource limiting in VNC websockets decoder

Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Thu, 9 Apr 2015 16:30:44 +0200
From: Petr Matousek <pmatouse@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE-2015-1779 qemu: vnc: insufficient resource
 limiting in VNC websockets decoder

On Tue, Mar 24, 2015 at 08:20:55AM +0100, Petr Matousek wrote:
> Upstream patch submission:
> https://lists.gnu.org/archive/html/qemu-devel/2015-03/msg04894.html

Upstream patches:

http://git.qemu.org/?p=qemu.git;a=commit;h=a2bebfd6e09d
http://git.qemu.org/?p=qemu.git;a=commit;h=2cdb5e142fb93

Please note that the first patch committed to QEMU project git is
slightly different than the initial submission as it includes fix
for a regression caused by the original patch.

Thanks,
-- 
Petr Matousek / Red Hat Product Security
PGP: 0xC44977CA 8107 AF16 A416 F9AF 18F3  D874 3E78 6F42 C449 77CA

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.