From ${URL} : Quick Emulator(Qemu) built with the virtio-9p back-end support is vulnerable to a null pointer dereference issue. It could occur while doing an I/O vector unmarshalling operation in v9fs_iov_vunmarshal() routine. A privileged user/process inside guest could use this flaw to crash the Qemu process instance resulting in Dos. Upstream patch: --------------- -> https://lists.gnu.org/archive/html/qemu-devel/2016-09/msg07143.html @maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.
Stabilization on bug #598046 commit 5a981e9d23127c779dc8ecb1d05ef08fe4d3a011 Author: Matthias Maier <tamiko@gentoo.org> Date: Wed Oct 26 16:47:50 2016 -0500 app-emulation/qemu: multiple security fixes for 2.7.0-r5 CVE-2016-7907, bug 596048 CVE-2016-7908, bug 596048 CVE-2016-7909, bug 596048 CVE-2016-7994, bug 596738 CVE-2016-7994, bug 596738 CVE-2016-8576, bug 596752 CVE-2016-8577, bug 596776 CVE-2016-8578, bug 596774 CVE-2016-8668, bug 597110 CVE-2016-8669, bug 597108 CVE-2016-8669, bug 597108 CVE-2016-8909, bug 598044 CVE-2016-8910, bug 598046 Package-Manager: portage-2.3.0
2.7.0-r5 is stable, all vulnerable versions dropped. Security, please vote.
This issue was resolved and addressed in GLSA 201611-11 at https://security.gentoo.org/glsa/201611-11 by GLSA coordinator Aaron Bauman (b-man).