<?xml version="1.0" encoding="UTF-8"?>
<oval_definitions xsi:schemaLocation="http://oval.mitre.org/XMLSchema/oval-definitions-5 oval-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#linux linux-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#independent independent-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-common-5 oval-common-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#unix unix-definitions-schema.xsd" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5" xmlns:oval-def="http://oval.mitre.org/XMLSchema/oval-definitions-5">
  <generator>
    <oval:product_name>The OVAL Repository</oval:product_name>
    <oval:schema_version>5.4</oval:schema_version>
    <oval:timestamp>2015-09-03T06:24:36.290-04:00</oval:timestamp>
  </generator>
  <definitions>
    <definition id="oval:org.mitre.oval:def:29063" version="3" class="patch">
      <metadata>
        <title>DSA-3259-1 qemu -- qemu</title>
        <affected family="unix">
          <platform>Debian 8</platform>
          <platform>Debian 7</platform>
          <product>qemu</product>
        </affected>
        <reference source="VENDOR" ref_url="https://lists.debian.org/debian-security-announce/2015/msg00148.html" ref_id="DSA-3259-1"/>
        <reference source="CVE" ref_url="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9718" ref_id="CVE-2014-9718"/>
        <reference source="CVE" ref_url="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1779" ref_id="CVE-2015-1779"/>
        <reference source="CVE" ref_url="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2756" ref_id="CVE-2015-2756"/>
        <reference source="CVE" ref_url="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3456" ref_id="CVE-2015-3456"/>
        <description>Several vulnerabilities were discovered in the qemu virtualisation solution: CVE-2014-9718 It was discovered that the IDE controller emulation is susceptible to denial of service. CVE-2015-1779 Daniel P. Berrange discovered a denial of service vulnerability in the VNC web socket decoder. CVE-2015-2756 Jan Beulich discovered that unmediated PCI command register could result in denial of service. CVE-2015-3456 Jason Geffner discovered a buffer overflow in the emulated floppy disk drive, resulting in the potential execution of arbitrary code.</description>
        <oval_repository>
          <dates>
            <submitted date="2015-06-02T16:15:26">
              <contributor organization="SecPod Technologies">SecPod Team</contributor>
            </submitted>
            <status_change date="2015-06-03T12:28:40.684-04:00">DRAFT</status_change>
            <status_change date="2015-06-22T04:00:45.537-04:00">INTERIM</status_change>
            <status_change date="2015-07-13T04:00:16.698-04:00">ACCEPTED</status_change>
          </dates>
          <status>ACCEPTED</status>
        </oval_repository>
      </metadata>
      <criteria operator="OR">
        <criteria operator="AND" comment="Release section">
          <extend_definition comment="Debian 8 is installed" definition_ref="oval:org.mitre.oval:def:28919"/>
          <criterion comment="Installed architecture is all" test_ref="oval:org.mitre.oval:tst:10881"/>
          <criterion comment="qemu DPKG is earlier than 1:2.1+dfsg-12" test_ref="oval:org.mitre.oval:tst:138933"/>
        </criteria>
        <criteria operator="AND" comment="Release section">
          <extend_definition comment="Debian 7 is installed" definition_ref="oval:org.mitre.oval:def:19338"/>
          <criterion comment="Installed architecture is all" test_ref="oval:org.mitre.oval:tst:10881"/>
          <criterion comment="qemu DPKG is earlier than 0:1.1.2+dfsg-6a+deb7u7" test_ref="oval:org.mitre.oval:tst:138215"/>
        </criteria>
      </criteria>
    </definition>
    <definition id="oval:org.mitre.oval:def:28919" version="3" class="inventory">
      <metadata>
        <title>Debian 8 is installed</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <reference source="CPE" ref_id="cpe:/o:debian:debian:8"/>
        <description>Debian 8 (Jessie) is installed</description>
        <oval_repository>
          <dates>
            <submitted date="2015-04-27T13:00:00">
              <contributor organization="ALTX-SOFT">Maria Mikhno</contributor>
            </submitted>
            <status_change date="2015-04-28T15:08:47.718-04:00">DRAFT</status_change>
            <status_change date="2015-05-18T04:00:12.845-04:00">INTERIM</status_change>
            <status_change date="2015-06-08T04:00:15.077-04:00">ACCEPTED</status_change>
          </dates>
          <status>ACCEPTED</status>
        </oval_repository>
      </metadata>
      <criteria>
        <criterion comment="Debian 8 is installed" test_ref="oval:org.mitre.oval:tst:138403"/>
      </criteria>
    </definition>
    <definition id="oval:org.mitre.oval:def:19338" version="7" class="inventory">
      <metadata>
        <title>Debian 7 is installed</title>
        <affected family="unix">
          <platform>Debian 7</platform>
        </affected>
        <reference source="CPE" ref_id="cpe:/o:debian:debian:7"/>
        <description>Debian 7 (wheezy) is installed</description>
        <oval_repository>
          <dates>
            <submitted date="2013-10-24T16:31:26.748+04:00">
              <contributor organization="ALTX-SOFT">Maria Kedovskaya</contributor>
            </submitted>
            <status_change date="2013-11-21T13:32:29.313-05:00">DRAFT</status_change>
            <status_change date="2013-12-09T04:00:17.274-05:00">INTERIM</status_change>
            <status_change date="2013-12-30T04:00:22.941-05:00">ACCEPTED</status_change>
            <modified comment="EDITED oval:org.mitre.oval:def:19338 - New definitions (patch) for the Debian DSA" date="2014-02-19T08:00:00.123-05:00">
              <contributor organization="ALTX-SOFT">Sergey Artykhov</contributor>
            </modified>
            <status_change date="2014-02-19T08:04:26.432-05:00">INTERIM</status_change>
            <status_change date="2014-03-10T04:00:21.467-04:00">ACCEPTED</status_change>
            <modified comment="EDITED oval:org.mitre.oval:ste:24187 - inventory updates for Debian 6.0, 7" date="2014-06-02T14:43:00.817-04:00">
              <contributor organization="ALTX-SOFT">Sergey Artykhov</contributor>
            </modified>
            <status_change date="2014-06-02T14:45:00.369-04:00">INTERIM</status_change>
            <status_change date="2014-06-23T04:05:36.645-04:00">ACCEPTED</status_change>
          </dates>
          <status>ACCEPTED</status>
        </oval_repository>
      </metadata>
      <criteria>
        <criterion comment="Debian 7 is installed" test_ref="oval:org.mitre.oval:tst:87585"/>
      </criteria>
    </definition>
  </definitions>
  <tests>
    <textfilecontent54_test id="oval:org.mitre.oval:tst:138403" version="1" comment="Debian 8 is installed" check_existence="at_least_one_exists" check="all" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent">
      <object object_ref="oval:org.mitre.oval:obj:26771"/>
      <state state_ref="oval:org.mitre.oval:ste:38227"/>
    </textfilecontent54_test>
    <textfilecontent54_test id="oval:org.mitre.oval:tst:87585" version="2" comment="Debian 7 is installed" check_existence="at_least_one_exists" check="all" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent">
      <object object_ref="oval:org.mitre.oval:obj:26771"/>
      <state state_ref="oval:org.mitre.oval:ste:24187"/>
    </textfilecontent54_test>
    <dpkginfo_test id="oval:org.mitre.oval:tst:138933" version="1" comment="qemu DPKG is earlier than 1:2.1+dfsg-12" check_existence="at_least_one_exists" check="all" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
      <object object_ref="oval:org.mitre.oval:obj:7822"/>
      <state state_ref="oval:org.mitre.oval:ste:38670"/>
    </dpkginfo_test>
    <dpkginfo_test id="oval:org.mitre.oval:tst:138215" version="1" comment="qemu DPKG is earlier than 0:1.1.2+dfsg-6a+deb7u7" check_existence="at_least_one_exists" check="all" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
      <object object_ref="oval:org.mitre.oval:obj:7822"/>
      <state state_ref="oval:org.mitre.oval:ste:38698"/>
    </dpkginfo_test>
    <uname_test id="oval:org.mitre.oval:tst:10881" version="1" comment="Installed architecture is all" check_existence="at_least_one_exists" check="all" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix">
      <object object_ref="oval:org.mitre.oval:obj:2759"/>
    </uname_test>
  </tests>
  <objects>
    <textfilecontent54_object id="oval:org.mitre.oval:obj:26771" version="1" comment="Object holds Debian version" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent">
      <path>/etc</path>
      <filename>debian_version</filename>
      <pattern operation="pattern match">^(\d).*$</pattern>
      <instance datatype="int">1</instance>
    </textfilecontent54_object>
    <dpkginfo_object id="oval:org.mitre.oval:obj:7822" version="1" comment="qemu package information" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
      <name>qemu</name>
    </dpkginfo_object>
    <uname_object id="oval:org.mitre.oval:obj:2759" version="1" comment="The single uname object." xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix"/>
  </objects>
  <states>
    <textfilecontent54_state id="oval:org.mitre.oval:ste:38227" version="1" comment="State matches version 8" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent">
      <subexpression>8</subexpression>
    </textfilecontent54_state>
    <textfilecontent54_state id="oval:org.mitre.oval:ste:24187" version="2" comment="State matches version 7" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent">
      <subexpression>7</subexpression>
    </textfilecontent54_state>
    <dpkginfo_state id="oval:org.mitre.oval:ste:38670" version="1" comment="version is earlier than 1:2.1+dfsg-12" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
      <evr datatype="evr_string" operation="less than">1:2.1+dfsg-12</evr>
    </dpkginfo_state>
    <dpkginfo_state id="oval:org.mitre.oval:ste:38698" version="1" comment="version is earlier than 0:1.1.2+dfsg-6a+deb7u7" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
      <evr datatype="evr_string" operation="less than">0:1.1.2+dfsg-6a+deb7u7</evr>
    </dpkginfo_state>
  </states>
</oval_definitions>