rpm package
suse/qemu&distro=SUSE Linux Enterprise Desktop 12 SP4
pkg:rpm/suse/qemu&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP4
Vulnerabilities (27)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2018-12207 | Med | 6.5 | < 2.11.2-5.23.2 | 2.11.2-5.23.2 | Nov 14, 2019 | Improper invalidation for page table updates by a virtual guest operating system for multiple Intel(R) Processors may allow an authenticated user to potentially enable denial of service of the host system via local access. | |
| CVE-2019-11135 | Med | 6.5 | < 2.11.2-5.23.2 | 2.11.2-5.23.2 | Nov 14, 2019 | TSX Asynchronous Abort condition on some CPUs utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. | |
| CVE-2019-12068 | Low | 3.8 | < 2.11.2-5.23.2 | 2.11.2-5.23.2 | Sep 24, 2019 | In QEMU 1:4.1-1, 1:2.1+dfsg-12+deb8u6, 1:2.8+dfsg-6+deb9u8, 1:3.1+dfsg-8~deb10u1, 1:3.1+dfsg-8+deb10u2, and 1:2.1+dfsg-12+deb8u12 (fixed), when executing script in lsi_execute_script(), the LSI scsi adapter emulator advances 's->dsp' index to read next opcode. This can lead to an | |
| CVE-2019-14378 | Hig | 8.8 | < 2.11.2-5.18.1 | 2.11.2-5.18.1 | Jul 29, 2019 | ip_reass in ip_input.c in libslirp 4.0.0 has a heap-based buffer overflow via a large packet because it mishandles a case involving the first fragment. | |
| CVE-2019-13164 | Hig | 7.8 | < 2.11.2-5.18.1 | 2.11.2-5.18.1 | Jul 3, 2019 | qemu-bridge-helper.c in QEMU 3.1 and 4.0.0 does not ensure that a network interface name (obtained from bridge.conf or a --br=bridge option) is limited to the IFNAMSIZ size, which can lead to an ACL bypass. | |
| CVE-2019-9824 | Med | 5.5 | < 2.11.2-5.13.1 | 2.11.2-5.13.1 | Jun 3, 2019 | tcp_emu in slirp/tcp_subr.c (aka slirp/src/tcp_subr.c) in QEMU 3.0.0 uses uninitialized data in an snprintf call, leading to Information disclosure. | |
| CVE-2018-20815 | Cri | 9.8 | < 2.11.2-5.13.1 | 2.11.2-5.13.1 | May 31, 2019 | In QEMU 3.1.0, load_device_tree in device_tree.c calls the deprecated load_image function, which has a buffer overflow risk. | |
| CVE-2019-11091 | Med | 5.6 | < 2.11.2-5.13.1 | 2.11.2-5.13.1 | May 30, 2019 | Microarchitectural Data Sampling Uncacheable Memory (MDSUM): Uncacheable memory on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products c | |
| CVE-2018-12130 | Med | 5.9 | < 2.11.2-5.13.1 | 2.11.2-5.13.1 | May 30, 2019 | Microarchitectural Fill Buffer Data Sampling (MFBDS): Fill buffers on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found h | |
| CVE-2018-12127 | Med | 5.6 | < 2.11.2-5.13.1 | 2.11.2-5.13.1 | May 30, 2019 | Microarchitectural Load Port Data Sampling (MLPDS): Load ports on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here: | |
| CVE-2018-12126 | Med | 5.6 | < 2.11.2-5.13.1 | 2.11.2-5.13.1 | May 30, 2019 | Microarchitectural Store Buffer Data Sampling (MSBDS): Store buffers on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found | |
| CVE-2019-12155 | Hig | 7.5 | < 2.11.2-5.18.1 | 2.11.2-5.18.1 | May 24, 2019 | interface_release_resource in hw/display/qxl.c in QEMU 3.1.x through 4.0.0 has a NULL pointer dereference. | |
| CVE-2019-8934 | Low | 3.3 | < 2.11.2-5.13.1 | 2.11.2-5.13.1 | Mar 21, 2019 | hw/ppc/spapr.c in QEMU through 3.1.0 allows Information Exposure because the hypervisor shares the /proc/device-tree/system-id and /proc/device-tree/model system attributes with a guest. | |
| CVE-2019-6778 | Hig | 7.8 | < 2.11.2-5.8.1 | 2.11.2-5.8.1 | Mar 21, 2019 | In QEMU 3.0.0, tcp_emu in slirp/tcp_subr.c has a heap-based buffer overflow. | |
| CVE-2018-18849 | Med | 5.5 | < 2.11.2-5.5.1 | 2.11.2-5.5.1 | Mar 21, 2019 | In Qemu 3.0.0, lsi_do_msgin in hw/scsi/lsi53c895a.c allows out-of-bounds access by triggering an invalid msg_len value. | |
| CVE-2019-3812 | Med | 4.4 | < 2.11.2-5.13.1 | 2.11.2-5.13.1 | Feb 19, 2019 | QEMU, through version 2.10 and through version 3.1.0, is vulnerable to an out-of-bounds read of up to 128 bytes in the hw/i2c/i2c-ddc.c:i2c_ddc() function. A local attacker with permission to execute i2c commands could exploit this to read stack memory of the qemu process on the | |
| CVE-2018-20126 | Med | 5.5 | < 2.11.2-5.23.2 | 2.11.2-5.23.2 | Dec 20, 2018 | hw/rdma/vmw/pvrdma_cmd.c in QEMU allows create_cq and create_qp memory leaks because errors are mishandled. | |
| CVE-2018-16872 | Med | 5.3 | < 2.11.2-5.8.1 | 2.11.2-5.8.1 | Dec 13, 2018 | A flaw was found in qemu Media Transfer Protocol (MTP). The code opening files in usb_mtp_get_object and usb_mtp_get_partial_object and directories in usb_mtp_object_readdir doesn't consider that the underlying filesystem may have changed since the time lstat(2) was called in usb | |
| CVE-2018-19489 | Med | 4.7 | < 2.11.2-5.8.1 | 2.11.2-5.8.1 | Dec 13, 2018 | v9fs_wstat in hw/9pfs/9p.c in QEMU allows guest OS users to cause a denial of service (crash) because of a race condition during file renaming. | |
| CVE-2018-19364 | Med | 5.5 | < 2.11.2-5.8.1 | 2.11.2-5.8.1 | Dec 13, 2018 | hw/9pfs/cofile.c and hw/9pfs/9p.c in QEMU can modify an fid path while it is being accessed by a second thread, leading to (for example) a use-after-free outcome. |
- affected < 2.11.2-5.23.2fixed 2.11.2-5.23.2
Improper invalidation for page table updates by a virtual guest operating system for multiple Intel(R) Processors may allow an authenticated user to potentially enable denial of service of the host system via local access.
- affected < 2.11.2-5.23.2fixed 2.11.2-5.23.2
TSX Asynchronous Abort condition on some CPUs utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access.
- affected < 2.11.2-5.23.2fixed 2.11.2-5.23.2
In QEMU 1:4.1-1, 1:2.1+dfsg-12+deb8u6, 1:2.8+dfsg-6+deb9u8, 1:3.1+dfsg-8~deb10u1, 1:3.1+dfsg-8+deb10u2, and 1:2.1+dfsg-12+deb8u12 (fixed), when executing script in lsi_execute_script(), the LSI scsi adapter emulator advances 's->dsp' index to read next opcode. This can lead to an
- affected < 2.11.2-5.18.1fixed 2.11.2-5.18.1
ip_reass in ip_input.c in libslirp 4.0.0 has a heap-based buffer overflow via a large packet because it mishandles a case involving the first fragment.
- affected < 2.11.2-5.18.1fixed 2.11.2-5.18.1
qemu-bridge-helper.c in QEMU 3.1 and 4.0.0 does not ensure that a network interface name (obtained from bridge.conf or a --br=bridge option) is limited to the IFNAMSIZ size, which can lead to an ACL bypass.
- affected < 2.11.2-5.13.1fixed 2.11.2-5.13.1
tcp_emu in slirp/tcp_subr.c (aka slirp/src/tcp_subr.c) in QEMU 3.0.0 uses uninitialized data in an snprintf call, leading to Information disclosure.
- affected < 2.11.2-5.13.1fixed 2.11.2-5.13.1
In QEMU 3.1.0, load_device_tree in device_tree.c calls the deprecated load_image function, which has a buffer overflow risk.
- affected < 2.11.2-5.13.1fixed 2.11.2-5.13.1
Microarchitectural Data Sampling Uncacheable Memory (MDSUM): Uncacheable memory on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products c
- affected < 2.11.2-5.13.1fixed 2.11.2-5.13.1
Microarchitectural Fill Buffer Data Sampling (MFBDS): Fill buffers on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found h
- affected < 2.11.2-5.13.1fixed 2.11.2-5.13.1
Microarchitectural Load Port Data Sampling (MLPDS): Load ports on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here:
- affected < 2.11.2-5.13.1fixed 2.11.2-5.13.1
Microarchitectural Store Buffer Data Sampling (MSBDS): Store buffers on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found
- affected < 2.11.2-5.18.1fixed 2.11.2-5.18.1
interface_release_resource in hw/display/qxl.c in QEMU 3.1.x through 4.0.0 has a NULL pointer dereference.
- affected < 2.11.2-5.13.1fixed 2.11.2-5.13.1
hw/ppc/spapr.c in QEMU through 3.1.0 allows Information Exposure because the hypervisor shares the /proc/device-tree/system-id and /proc/device-tree/model system attributes with a guest.
- affected < 2.11.2-5.8.1fixed 2.11.2-5.8.1
In QEMU 3.0.0, tcp_emu in slirp/tcp_subr.c has a heap-based buffer overflow.
- affected < 2.11.2-5.5.1fixed 2.11.2-5.5.1
In Qemu 3.0.0, lsi_do_msgin in hw/scsi/lsi53c895a.c allows out-of-bounds access by triggering an invalid msg_len value.
- affected < 2.11.2-5.13.1fixed 2.11.2-5.13.1
QEMU, through version 2.10 and through version 3.1.0, is vulnerable to an out-of-bounds read of up to 128 bytes in the hw/i2c/i2c-ddc.c:i2c_ddc() function. A local attacker with permission to execute i2c commands could exploit this to read stack memory of the qemu process on the
- affected < 2.11.2-5.23.2fixed 2.11.2-5.23.2
hw/rdma/vmw/pvrdma_cmd.c in QEMU allows create_cq and create_qp memory leaks because errors are mishandled.
- affected < 2.11.2-5.8.1fixed 2.11.2-5.8.1
A flaw was found in qemu Media Transfer Protocol (MTP). The code opening files in usb_mtp_get_object and usb_mtp_get_partial_object and directories in usb_mtp_object_readdir doesn't consider that the underlying filesystem may have changed since the time lstat(2) was called in usb
- affected < 2.11.2-5.8.1fixed 2.11.2-5.8.1
v9fs_wstat in hw/9pfs/9p.c in QEMU allows guest OS users to cause a denial of service (crash) because of a race condition during file renaming.
- affected < 2.11.2-5.8.1fixed 2.11.2-5.8.1
hw/9pfs/cofile.c and hw/9pfs/9p.c in QEMU can modify an fid path while it is being accessed by a second thread, leading to (for example) a use-after-free outcome.
Page 1 of 2