[ubuntu/jammy-security] qemu 1:6.2+dfsg-2ubuntu6.28 (Accepted)

[Fabian Toepfer]

qemu (1:6.2+dfsg-2ubuntu6.28) jammy-security; urgency=medium

  * SECURITY UPDATE: denial-of-service
    - debian/patches/CVE-2024-8354-2.patch: don't assert for SETUP to non-0
      endpoint in hw/usb/hcd-uhci.
    - CVE-2024-8354
  * SECURITY UPDATE: use-after-free
    - debian/patches/CVE-2025-11234-1.patch: release active GSource in TLS
      channel finalizer in io/channel-tls.c.
    - debian/patches/CVE-2025-11234-2.patch: move websock resource release to
      close method in io/channel-websock.c.
    - debian/patches/CVE-2025-11234-3.patch: fix use after free in websocket
      handshake code in io/channel-websock.c.
    - CVE-2025-11234

Date: 2026-03-03 19:53:10.308066+00:00
Changed-By: Fabian Toepfer <fabian.toepfer at canonical.com>
https://launchpad.net/ubuntu/+source/qemu/1:6.2+dfsg-2ubuntu6.28
-------------- next part --------------
Sorry, changesfile not available.