rpm package
suse/kvm&distro=SUSE Linux Enterprise Point of Sale 11 SP3
pkg:rpm/suse/kvm&distro=SUSE%20Linux%20Enterprise%20Point%20of%20Sale%2011%20SP3
Vulnerabilities (82)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2021-20257 | — | < 1.4.2-53.38.1 | 1.4.2-53.38.1 | Mar 16, 2022 | An infinite loop flaw was found in the e1000 NIC emulator of the QEMU. This issue occurs while processing transmits (tx) descriptors in process_tx_desc if various descriptor fields are initialized with invalid values. This flaw allows a guest to consume CPU cycles on the host, re | ||
| CVE-2021-3594 | — | < 1.4.2-53.41.1 | 1.4.2-53.41.1 | Jun 15, 2021 | An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the udp_input() function and could occur while processing a udp packet that is smaller than the size of the 'udphdr' structure. This issue may lead to out-of-bound | ||
| CVE-2021-3592 | — | < 1.4.2-53.41.1 | 1.4.2-53.41.1 | Jun 15, 2021 | An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the bootp_input() function and could occur while processing a udp packet that is smaller than the size of the 'bootp_t' structure. A malicious guest could use this | ||
| CVE-2021-20221 | — | < 1.4.2-53.41.1 | 1.4.2-53.41.1 | May 13, 2021 | An out-of-bounds heap buffer access issue was found in the ARM Generic Interrupt Controller emulator of QEMU up to and including qemu 4.2.0on aarch64 platform. The issue occurs because while writing an interrupt ID to the controller memory area, it is not masked to be 4 bits wide | ||
| CVE-2021-20181 | — | < 1.4.2-53.38.1 | 1.4.2-53.38.1 | May 13, 2021 | A race condition flaw was found in the 9pfs server implementation of QEMU up to and including 5.2.0. This flaw allows a malicious 9p client to cause a use-after-free error, potentially escalating their privileges on the system. The highest threat from this vulnerability is to con | ||
| CVE-2021-3416 | — | < 1.4.2-53.41.1 | 1.4.2-53.41.1 | Mar 18, 2021 | A potential stack overflow via infinite loop issue was found in various NIC emulators of QEMU in versions up to and including 5.2.0. The issue occurs in loopback mode of a NIC wherein reentrant DMA checks get bypassed. A guest user/process may use this flaw to consume CPU cycles | ||
| CVE-2020-29443 | — | < 1.4.2-53.38.1 | 1.4.2-53.38.1 | Jan 22, 2021 | ide_atapi_cmd_reply_end in hw/ide/atapi.c in QEMU 5.1.0 allows out-of-bounds read access because a buffer index is not validated. | ||
| CVE-2020-11947 | — | < 1.4.2-53.41.1 | 1.4.2-53.41.1 | Dec 31, 2020 | iscsi_aio_ioctl_cb in block/iscsi.c in QEMU 4.1.0 has a heap-based buffer over-read that may disclose unrelated information from process memory to an attacker. | ||
| CVE-2020-25723 | — | < 1.4.2-53.38.1 | 1.4.2-53.38.1 | Dec 2, 2020 | A reachable assertion issue was found in the USB EHCI emulation code of QEMU. It could occur while processing USB requests due to missing handling of DMA memory map failure. A malicious privileged user within the guest may abuse this flaw to send bogus USB requests and crash the | ||
| CVE-2020-25624 | — | < 1.4.2-53.38.1 | 1.4.2-53.38.1 | Nov 30, 2020 | hw/usb/hcd-ohci.c in QEMU 5.0.0 has a stack-based buffer over-read via values obtained from the host controller driver. | ||
| CVE-2020-29130 | — | < 1.4.2-53.38.1 | 1.4.2-53.38.1 | Nov 26, 2020 | slirp.c in libslirp through 4.3.1 has a buffer over-read because it tries to read a certain amount of header data even if that exceeds the total packet length. | ||
| CVE-2020-25625 | — | < 1.4.2-53.38.1 | 1.4.2-53.38.1 | Sep 25, 2020 | hw/usb/hcd-ohci.c in QEMU 5.0.0 has an infinite loop when a TD list has a loop. | ||
| CVE-2020-25084 | — | < 1.4.2-53.38.1 | 1.4.2-53.38.1 | Sep 25, 2020 | QEMU 5.0.0 has a use-after-free in hw/usb/hcd-xhci.c because the usb_packet_map return value is not checked. | ||
| CVE-2020-14364 | — | < 1.4.2-53.38.1 | 1.4.2-53.38.1 | Aug 31, 2020 | An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU in versions before 5.2.0. This issue occurs while processing USB packets from a guest when USBDevice 'setup_len' exceeds its 'data_buf[4096]' in the do_token_in, do_token_out routines. This flaw all | ||
| CVE-2020-12829 | — | < 1.4.2-53.38.1 | 1.4.2-53.38.1 | Aug 31, 2020 | In QEMU through 5.0.0, an integer overflow was found in the SM501 display driver implementation. This flaw occurs in the COPY_AREA macro while handling MMIO write operations through the sm501_2d_engine_write() callback. A local attacker could abuse this flaw to crash the QEMU pro | ||
| CVE-2020-15863 | — | < 1.4.2-53.41.1 | 1.4.2-53.41.1 | Jul 28, 2020 | hw/net/xgmac.c in the XGMAC Ethernet controller in QEMU before 07-20-2020 has a buffer overflow. This occurs during packet transmission and affects the highbank and midway emulated machines. A guest user or process could use this flaw to crash the QEMU process on the host, result | ||
| CVE-2020-15469 | — | < 1.4.2-53.41.1 | 1.4.2-53.41.1 | Jul 2, 2020 | In QEMU 4.2.0, a MemoryRegionOps object may lack read/write callback methods, leading to a NULL pointer dereference. | ||
| CVE-2020-13765 | — | < 1.4.2-53.38.1 | 1.4.2-53.38.1 | Jun 4, 2020 | rom_copy() in hw/core/loader.c in QEMU 4.0 and 4.1.0 does not validate the relationship between two addresses, which allows attackers to trigger an invalid memory copy operation. | ||
| CVE-2020-13362 | — | < 1.4.2-53.38.1 | 1.4.2-53.38.1 | May 28, 2020 | In QEMU 5.0.0 and earlier, megasas_lookup_frame in hw/scsi/megasas.c has an out-of-bounds read via a crafted reply_queue_head field from a guest OS user. | ||
| CVE-2020-13361 | — | < 1.4.2-53.38.1 | 1.4.2-53.38.1 | May 28, 2020 | In QEMU 5.0.0 and earlier, es1370_transfer_audio in hw/audio/es1370.c does not properly validate the frame count, which allows guest OS users to trigger an out-of-bounds access during an es1370_write() operation. |
- CVE-2021-20257Mar 16, 2022affected < 1.4.2-53.38.1fixed 1.4.2-53.38.1
An infinite loop flaw was found in the e1000 NIC emulator of the QEMU. This issue occurs while processing transmits (tx) descriptors in process_tx_desc if various descriptor fields are initialized with invalid values. This flaw allows a guest to consume CPU cycles on the host, re
- CVE-2021-3594Jun 15, 2021affected < 1.4.2-53.41.1fixed 1.4.2-53.41.1
An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the udp_input() function and could occur while processing a udp packet that is smaller than the size of the 'udphdr' structure. This issue may lead to out-of-bound
- CVE-2021-3592Jun 15, 2021affected < 1.4.2-53.41.1fixed 1.4.2-53.41.1
An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the bootp_input() function and could occur while processing a udp packet that is smaller than the size of the 'bootp_t' structure. A malicious guest could use this
- CVE-2021-20221May 13, 2021affected < 1.4.2-53.41.1fixed 1.4.2-53.41.1
An out-of-bounds heap buffer access issue was found in the ARM Generic Interrupt Controller emulator of QEMU up to and including qemu 4.2.0on aarch64 platform. The issue occurs because while writing an interrupt ID to the controller memory area, it is not masked to be 4 bits wide
- CVE-2021-20181May 13, 2021affected < 1.4.2-53.38.1fixed 1.4.2-53.38.1
A race condition flaw was found in the 9pfs server implementation of QEMU up to and including 5.2.0. This flaw allows a malicious 9p client to cause a use-after-free error, potentially escalating their privileges on the system. The highest threat from this vulnerability is to con
- CVE-2021-3416Mar 18, 2021affected < 1.4.2-53.41.1fixed 1.4.2-53.41.1
A potential stack overflow via infinite loop issue was found in various NIC emulators of QEMU in versions up to and including 5.2.0. The issue occurs in loopback mode of a NIC wherein reentrant DMA checks get bypassed. A guest user/process may use this flaw to consume CPU cycles
- CVE-2020-29443Jan 22, 2021affected < 1.4.2-53.38.1fixed 1.4.2-53.38.1
ide_atapi_cmd_reply_end in hw/ide/atapi.c in QEMU 5.1.0 allows out-of-bounds read access because a buffer index is not validated.
- CVE-2020-11947Dec 31, 2020affected < 1.4.2-53.41.1fixed 1.4.2-53.41.1
iscsi_aio_ioctl_cb in block/iscsi.c in QEMU 4.1.0 has a heap-based buffer over-read that may disclose unrelated information from process memory to an attacker.
- CVE-2020-25723Dec 2, 2020affected < 1.4.2-53.38.1fixed 1.4.2-53.38.1
A reachable assertion issue was found in the USB EHCI emulation code of QEMU. It could occur while processing USB requests due to missing handling of DMA memory map failure. A malicious privileged user within the guest may abuse this flaw to send bogus USB requests and crash the
- CVE-2020-25624Nov 30, 2020affected < 1.4.2-53.38.1fixed 1.4.2-53.38.1
hw/usb/hcd-ohci.c in QEMU 5.0.0 has a stack-based buffer over-read via values obtained from the host controller driver.
- CVE-2020-29130Nov 26, 2020affected < 1.4.2-53.38.1fixed 1.4.2-53.38.1
slirp.c in libslirp through 4.3.1 has a buffer over-read because it tries to read a certain amount of header data even if that exceeds the total packet length.
- CVE-2020-25625Sep 25, 2020affected < 1.4.2-53.38.1fixed 1.4.2-53.38.1
hw/usb/hcd-ohci.c in QEMU 5.0.0 has an infinite loop when a TD list has a loop.
- CVE-2020-25084Sep 25, 2020affected < 1.4.2-53.38.1fixed 1.4.2-53.38.1
QEMU 5.0.0 has a use-after-free in hw/usb/hcd-xhci.c because the usb_packet_map return value is not checked.
- CVE-2020-14364Aug 31, 2020affected < 1.4.2-53.38.1fixed 1.4.2-53.38.1
An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU in versions before 5.2.0. This issue occurs while processing USB packets from a guest when USBDevice 'setup_len' exceeds its 'data_buf[4096]' in the do_token_in, do_token_out routines. This flaw all
- CVE-2020-12829Aug 31, 2020affected < 1.4.2-53.38.1fixed 1.4.2-53.38.1
In QEMU through 5.0.0, an integer overflow was found in the SM501 display driver implementation. This flaw occurs in the COPY_AREA macro while handling MMIO write operations through the sm501_2d_engine_write() callback. A local attacker could abuse this flaw to crash the QEMU pro
- CVE-2020-15863Jul 28, 2020affected < 1.4.2-53.41.1fixed 1.4.2-53.41.1
hw/net/xgmac.c in the XGMAC Ethernet controller in QEMU before 07-20-2020 has a buffer overflow. This occurs during packet transmission and affects the highbank and midway emulated machines. A guest user or process could use this flaw to crash the QEMU process on the host, result
- CVE-2020-15469Jul 2, 2020affected < 1.4.2-53.41.1fixed 1.4.2-53.41.1
In QEMU 4.2.0, a MemoryRegionOps object may lack read/write callback methods, leading to a NULL pointer dereference.
- CVE-2020-13765Jun 4, 2020affected < 1.4.2-53.38.1fixed 1.4.2-53.38.1
rom_copy() in hw/core/loader.c in QEMU 4.0 and 4.1.0 does not validate the relationship between two addresses, which allows attackers to trigger an invalid memory copy operation.
- CVE-2020-13362May 28, 2020affected < 1.4.2-53.38.1fixed 1.4.2-53.38.1
In QEMU 5.0.0 and earlier, megasas_lookup_frame in hw/scsi/megasas.c has an out-of-bounds read via a crafted reply_queue_head field from a guest OS user.
- CVE-2020-13361May 28, 2020affected < 1.4.2-53.38.1fixed 1.4.2-53.38.1
In QEMU 5.0.0 and earlier, es1370_transfer_audio in hw/audio/es1370.c does not properly validate the frame count, which allows guest OS users to trigger an out-of-bounds access during an es1370_write() operation.
Page 1 of 5