emulators/qemu-devel: multiple vulnerabilities

[feld]

Summary

Hello,

These CVEs have not been dealth with in the ports tree yet. I'm not sure
if non-devel qemu or static/sbruno/etc flavors are also vulnerable?
Maybe Xen stuff? Can someone lend a hand?

Thanks!

[junovitch]

Regarding emulators/qemu,
It may be vulnerable and we do have CVE-2015-5154, CVE-2015-5166, CVE-2015-5165 from a prior PR still valid against this. In https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=202402#c17 Sean brought up getting guidance from Juergen on a way ahead.

Regarding emulators/qemu-sbruno and emulators/qemu-user-static,
They would be impacted and it looks like https://github.com/seanbruno/qemu-bsd-user will need a fresh pull from upstream.

Regarding Xen,
I don't see any security advisory from them just yet at http://xenbits.xen.org/xsa/

[junovitch]

As a cross reference (for CVE-2015-5225 at least)
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=203112

[feld]

The goalposts keep moving. Here's another one we need to patch

http://seclists.org/oss-sec/2015/q3/579

[sbruno]

I suspect that this might be a deprecated review at this time. emulators/qemu now tracks the stable release of QEMU.

[bofh]

In D3691#76188, @feld wrote:

The goalposts keep moving. Here's another one we need to patch

http://seclists.org/oss-sec/2015/q3/579

This has been addressed in qemu-devel 2.5.0.