[Secure-testing-team] Bug#822344: qemu: CVE-2016-4037: usb: Infinite loop vulnerability in usb_ehci using siTD process

[Salvatore Bonaccorso]

Source: qemu
Version: 1.1.2+dfsg-6
Severity: important
Tags: security upstream patch

Hi,

the following vulnerability was published for qemu. As far I understand
the fix consists as well in revertint the original commit for
CVE-2015-8558[1], since it causes problems and then addressed with [2].

CVE-2016-4037[0]:
usb: Infinite loop vulnerability in usb_ehci using siTD process

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2016-4037
[1] http://git.qemu.org/?p=qemu.git;a=commitdiff;h=a49923d2837d20510d645d3758f1ad87c32d0730
[2] http://git.qemu.org/?p=qemu.git;a=commitdiff;h=1ae3f2f178087711f9591350abad133525ba93f2

Does not warrant a DSA on it's own, but can be included in a future one.

Regards,
Salvatore