[Secure-testing-commits] r44848 - data/CVE

[Salvatore Bonaccorso]

Author: carnil
Date: 2016-09-23 19:15:45 +0000 (Fri, 23 Sep 2016)
New Revision: 44848

Modified:
   data/CVE/list
Log:
Partially revert update for CVE-2016-7466, needs more investigation yet

Modified: data/CVE/list
===================================================================
--- data/CVE/list	2016-09-23 18:54:03 UTC (rev 44847)
+++ data/CVE/list	2016-09-23 19:15:45 UTC (rev 44848)
@@ -51,13 +51,13 @@
 CVE-2016-7466 [usb: xhci memory leakage during device unplug]
 	RESERVED
 	- qemu <unfixed> (bug #838687)
-	[jessie] - qemu <not-affected> (Vulnerable code introduced with 2.2.0-rc0)
-	[wheezy] - qemu <not-affected> (Vulnerable code introduced with 2.2.0-rc0)
-	- qemu-kvm <not-affected> (Vulnerable code not present)
+	- qemu-kvm <removed>
 	NOTE: https://lists.gnu.org/archive/html/qemu-devel/2016-09/msg02773.html
 	NOTE: Fixed by: http://git.qemu.org/?p=qemu.git;a=commit;h=b53dd4495ced2432a0b652ea895e651d07336f7e
-	NOTE: Introduced by:  http://git.qemu.org/?p=qemu.git;a=commit;h=53c30545fb34c43c84d62ea1c2b0dc6b53303c34 (v2.2.0-rc0)
+	NOTE: The usb_xhci_exit and thus the patches code was introduced in:
+	NOTE: http://git.qemu.org/?p=qemu.git;a=commit;h=53c30545fb34c43c84d62ea1c2b0dc6b53303c34 (v2.2.0-rc0)
 	NOTE: http://www.openwall.com/lists/oss-security/2016/09/19/8
+	TODO: check if older versions are affected even due to lack of usb_xhci_exit
 CVE-2016-8280
 	RESERVED
 CVE-2016-8279