A qemu security update has been released for Debian GNU/Linux 8 Extended LTS to address two security issues.

ELA-249-1 qemu security update

Package qemu
Version 1:2.1+dfsg-12+deb8u16
Related CVE CVE-2020-13659 CVE-2020-15863

There were two following CVE(s) reported against src:qemu.

CVE-2020-13659: address_space_map in exec.c in QEMU 4.2.0 can trigger a NULL pointer dereference related to BounceBuffer.

CVE-2020-15863: stack-based overflow in xgmac_enet_send() in hw/net/xgmac.c.

For Debian 8 jessie, these problems have been fixed in version 1:2.1+dfsg-12+deb8u16.

We recommend that you upgrade your qemu packages.

Further information about Extended LTS security advisories can be found at: https://deb.freexian.com/extended-lts/

  ELA-249-1 qemu security update