[Secure-testing-team] Bug#817183: qemu: CVE-2016-2858: rng-random: arbitrary stack based allocation leading to corruption

[Salvatore Bonaccorso]

Source: qemu
Version: 1.3.0+dfsg-1~exp1
Severity: important
Tags: security upstream

Hi,

the following vulnerability was published for qemu.

CVE-2016-2858[0]:
rng-random: arbitrary stack based allocation leading to corruption

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2016-2858
[1] https://bugzilla.redhat.com/show_bug.cgi?id=1314676
[2] http://git.qemu.org/?p=qemu.git;a=commit;h=60253ed1e6ec6d8e5ef2efe7bf755f475dce9956
[3] http://git.qemu.org/?p=qemu.git;a=commit;h=a9b7b2ad7b075dba5495271706670e5c6b1304bc (v1.3.0-rc0)

Should have been at least been introduced in v1.3.0-rc0.

Regards,
Salvatore