rpm package
almalinux/python3-libnbd
pkg:rpm/almalinux/python3-libnbd
Vulnerabilities (87)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2020-15859 | — | < 1.2.2-1.module_el8.5.0+2608+72063365 | 1.2.2-1.module_el8.5.0+2608+72063365 | Jul 21, 2020 | QEMU 4.2.0 has a use-after-free in hw/net/e1000e_core.c because a guest OS user can trigger an e1000e packet with the data's address set to the e1000e's MMIO address. | ||
| CVE-2020-10756 | — | < 1.2.2-1.module_el8.5.0+2608+72063365 | 1.2.2-1.module_el8.5.0+2608+72063365 | Jul 9, 2020 | An out-of-bounds read vulnerability was found in the SLiRP networking implementation of the QEMU emulator. This flaw occurs in the icmp6_send_echoreply() routine while replying to an ICMP echo request, also known as ping. This flaw allows a malicious guest to leak the contents of | ||
| CVE-2020-13754 | — | < 1.2.2-1.module_el8.5.0+2608+72063365 | 1.2.2-1.module_el8.5.0+2608+72063365 | Jun 2, 2020 | hw/pci/msix.c in QEMU 4.2.0 allows guest OS users to trigger an out-of-bounds access via a crafted address in an msi-x mmio operation. | ||
| CVE-2020-10703 | — | < 1.2.2-1.module_el8.5.0+2608+72063365 | 1.2.2-1.module_el8.5.0+2608+72063365 | Jun 2, 2020 | A NULL pointer dereference was found in the libvirt API responsible introduced in upstream version 3.10.0, and fixed in libvirt 6.0.0, for fetching a storage pool based on its target path. In more detail, this flaw affects storage pools created without a target path such as netwo | ||
| CVE-2020-1983 | — | < 1.2.2-1.module_el8.5.0+2608+72063365 | 1.2.2-1.module_el8.5.0+2608+72063365 | Apr 22, 2020 | A use after free vulnerability in ip_reass() in ip_input.c of libslirp 4.2.0 and prior releases allows crafted packets to cause a denial of service. | ||
| CVE-2019-20485 | — | < 1.2.2-1.module_el8.5.0+2608+72063365 | 1.2.2-1.module_el8.5.0+2608+72063365 | Mar 19, 2020 | qemu/qemu_driver.c in libvirt before 6.0.0 mishandles the holding of a monitor job during a query to a guest agent, which allows attackers to cause a denial of service (API blockage). | ||
| CVE-2019-15890 | — | < 1.2.2-1.module_el8.5.0+2608+72063365 | 1.2.2-1.module_el8.5.0+2608+72063365 | Sep 6, 2019 | libslirp 4.0.0, as used in QEMU 4.1.0, has a use-after-free in ip_reass in ip_input.c. |
- CVE-2020-15859Jul 21, 2020affected < 1.2.2-1.module_el8.5.0+2608+72063365fixed 1.2.2-1.module_el8.5.0+2608+72063365
QEMU 4.2.0 has a use-after-free in hw/net/e1000e_core.c because a guest OS user can trigger an e1000e packet with the data's address set to the e1000e's MMIO address.
- CVE-2020-10756Jul 9, 2020affected < 1.2.2-1.module_el8.5.0+2608+72063365fixed 1.2.2-1.module_el8.5.0+2608+72063365
An out-of-bounds read vulnerability was found in the SLiRP networking implementation of the QEMU emulator. This flaw occurs in the icmp6_send_echoreply() routine while replying to an ICMP echo request, also known as ping. This flaw allows a malicious guest to leak the contents of
- CVE-2020-13754Jun 2, 2020affected < 1.2.2-1.module_el8.5.0+2608+72063365fixed 1.2.2-1.module_el8.5.0+2608+72063365
hw/pci/msix.c in QEMU 4.2.0 allows guest OS users to trigger an out-of-bounds access via a crafted address in an msi-x mmio operation.
- CVE-2020-10703Jun 2, 2020affected < 1.2.2-1.module_el8.5.0+2608+72063365fixed 1.2.2-1.module_el8.5.0+2608+72063365
A NULL pointer dereference was found in the libvirt API responsible introduced in upstream version 3.10.0, and fixed in libvirt 6.0.0, for fetching a storage pool based on its target path. In more detail, this flaw affects storage pools created without a target path such as netwo
- CVE-2020-1983Apr 22, 2020affected < 1.2.2-1.module_el8.5.0+2608+72063365fixed 1.2.2-1.module_el8.5.0+2608+72063365
A use after free vulnerability in ip_reass() in ip_input.c of libslirp 4.2.0 and prior releases allows crafted packets to cause a denial of service.
- CVE-2019-20485Mar 19, 2020affected < 1.2.2-1.module_el8.5.0+2608+72063365fixed 1.2.2-1.module_el8.5.0+2608+72063365
qemu/qemu_driver.c in libvirt before 6.0.0 mishandles the holding of a monitor job during a query to a guest agent, which allows attackers to cause a denial of service (API blockage).
- CVE-2019-15890Sep 6, 2019affected < 1.2.2-1.module_el8.5.0+2608+72063365fixed 1.2.2-1.module_el8.5.0+2608+72063365
libslirp 4.0.0, as used in QEMU 4.1.0, has a use-after-free in ip_reass in ip_input.c.
Page 5 of 5