rpm package
suse/qemu&distro=SUSE Linux Enterprise Module for Server Applications 15 SP2
pkg:rpm/suse/qemu&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Server%20Applications%2015%20SP2
Vulnerabilities (52)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2021-20221 | — | < 4.2.1-11.13.1 | 4.2.1-11.13.1 | May 13, 2021 | An out-of-bounds heap buffer access issue was found in the ARM Generic Interrupt Controller emulator of QEMU up to and including qemu 4.2.0on aarch64 platform. The issue occurs because while writing an interrupt ID to the controller memory area, it is not masked to be 4 bits wide | ||
| CVE-2021-20181 | — | < 4.2.1-11.13.1 | 4.2.1-11.13.1 | May 13, 2021 | A race condition flaw was found in the 9pfs server implementation of QEMU up to and including 5.2.0. This flaw allows a malicious 9p client to cause a use-after-free error, potentially escalating their privileges on the system. The highest threat from this vulnerability is to con | ||
| CVE-2021-3416 | — | < 4.2.1-11.16.3 | 4.2.1-11.16.3 | Mar 18, 2021 | A potential stack overflow via infinite loop issue was found in various NIC emulators of QEMU in versions up to and including 5.2.0. The issue occurs in loopback mode of a NIC wherein reentrant DMA checks get bypassed. A guest user/process may use this flaw to consume CPU cycles | ||
| CVE-2021-20255 | — | < 4.2.1-11.28.1 | 4.2.1-11.28.1 | Mar 9, 2021 | A stack overflow via an infinite recursion vulnerability was found in the eepro100 i8255x device emulator of QEMU. This issue occurs while processing controller commands due to a DMA reentry issue. This flaw allows a guest user or process to consume CPU cycles or crash the QEMU p | ||
| CVE-2021-20203 | — | < 4.2.1-11.13.1 | 4.2.1-11.13.1 | Feb 25, 2021 | An integer overflow issue was found in the vmxnet3 NIC emulator of the QEMU for versions up to v5.2.0. It may occur if a guest was to supply invalid values for rx/tx queue size or other NIC parameters. A privileged guest user may use this flaw to crash the QEMU process on the hos | ||
| CVE-2020-29443 | — | < 4.2.1-11.16.3 | 4.2.1-11.16.3 | Jan 22, 2021 | ide_atapi_cmd_reply_end in hw/ide/atapi.c in QEMU 5.1.0 allows out-of-bounds read access because a buffer index is not validated. | ||
| CVE-2020-11947 | — | < 4.2.1-11.13.1 | 4.2.1-11.13.1 | Dec 31, 2020 | iscsi_aio_ioctl_cb in block/iscsi.c in QEMU 4.1.0 has a heap-based buffer over-read that may disclose unrelated information from process memory to an attacker. | ||
| CVE-2020-27821 | — | < 4.2.1-11.16.3 | 4.2.1-11.16.3 | Dec 8, 2020 | A flaw was found in the memory management API of QEMU during the initialization of a memory region cache. This issue could lead to an out-of-bounds write access to the MSI-X table while performing MMIO operations. A guest user may abuse this flaw to crash the QEMU process on the | ||
| CVE-2020-28916 | — | < 4.2.1-11.16.3 | 4.2.1-11.16.3 | Dec 4, 2020 | hw/net/e1000e_core.c in QEMU 5.0.0 has an infinite loop via an RX descriptor with a NULL buffer address. | ||
| CVE-2020-25723 | — | < 4.2.1-11.16.3 | 4.2.1-11.16.3 | Dec 2, 2020 | A reachable assertion issue was found in the USB EHCI emulation code of QEMU. It could occur while processing USB requests due to missing handling of DMA memory map failure. A malicious privileged user within the guest may abuse this flaw to send bogus USB requests and crash the | ||
| CVE-2020-25624 | — | < 4.2.1-11.16.3 | 4.2.1-11.16.3 | Nov 30, 2020 | hw/usb/hcd-ohci.c in QEMU 5.0.0 has a stack-based buffer over-read via values obtained from the host controller driver. | ||
| CVE-2020-29129 | — | < 4.2.1-11.16.3 | 4.2.1-11.16.3 | Nov 26, 2020 | ncsi.c in libslirp through 4.3.1 has a buffer over-read because it tries to read a certain amount of header data even if that exceeds the total packet length. | ||
| CVE-2020-29130 | — | < 4.2.1-11.16.3 | 4.2.1-11.16.3 | Nov 26, 2020 | slirp.c in libslirp through 4.3.1 has a buffer over-read because it tries to read a certain amount of header data even if that exceeds the total packet length. | ||
| CVE-2020-27617 | — | < 4.2.1-11.16.3 | 4.2.1-11.16.3 | Nov 6, 2020 | eth_get_gso_type in net/eth.c in QEMU 4.2.1 allows guest OS users to trigger an assertion failure. A guest can crash the QEMU process via packet data that lacks a valid Layer 3 protocol. | ||
| CVE-2020-27616 | — | < 4.2.1-11.16.3 | 4.2.1-11.16.3 | Nov 6, 2020 | ati_2d_blt in hw/display/ati_2d.c in QEMU 4.2.1 can encounter an outside-limits situation in a calculation. A guest can crash the QEMU process. | ||
| CVE-2020-24352 | — | < 4.2.1-11.10.1 | 4.2.1-11.10.1 | Oct 16, 2020 | An issue was discovered in QEMU through 5.1.0. An out-of-bounds memory access was found in the ATI VGA device implementation. This flaw occurs in the ati_2d_blt() routine in hw/display/ati_2d.c while handling MMIO write operations through the ati_mm_write() callback. A malicious | ||
| CVE-2020-25625 | — | < 4.2.1-11.16.3 | 4.2.1-11.16.3 | Sep 25, 2020 | hw/usb/hcd-ohci.c in QEMU 5.0.0 has an infinite loop when a TD list has a loop. | ||
| CVE-2020-25085 | — | < 4.2.1-11.19.2 | 4.2.1-11.19.2 | Sep 25, 2020 | QEMU 5.0.0 has a heap-based Buffer Overflow in flatview_read_continue in exec.c because hw/sd/sdhci.c mishandles a write operation in the SDHC_BLKSIZE case. | ||
| CVE-2020-25084 | — | < 4.2.1-11.16.3 | 4.2.1-11.16.3 | Sep 25, 2020 | QEMU 5.0.0 has a use-after-free in hw/usb/hcd-xhci.c because the usb_packet_map return value is not checked. | ||
| CVE-2020-14364 | — | < 4.2.1-11.10.1 | 4.2.1-11.10.1 | Aug 31, 2020 | An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU in versions before 5.2.0. This issue occurs while processing USB packets from a guest when USBDevice 'setup_len' exceeds its 'data_buf[4096]' in the do_token_in, do_token_out routines. This flaw all |
- CVE-2021-20221May 13, 2021affected < 4.2.1-11.13.1fixed 4.2.1-11.13.1
An out-of-bounds heap buffer access issue was found in the ARM Generic Interrupt Controller emulator of QEMU up to and including qemu 4.2.0on aarch64 platform. The issue occurs because while writing an interrupt ID to the controller memory area, it is not masked to be 4 bits wide
- CVE-2021-20181May 13, 2021affected < 4.2.1-11.13.1fixed 4.2.1-11.13.1
A race condition flaw was found in the 9pfs server implementation of QEMU up to and including 5.2.0. This flaw allows a malicious 9p client to cause a use-after-free error, potentially escalating their privileges on the system. The highest threat from this vulnerability is to con
- CVE-2021-3416Mar 18, 2021affected < 4.2.1-11.16.3fixed 4.2.1-11.16.3
A potential stack overflow via infinite loop issue was found in various NIC emulators of QEMU in versions up to and including 5.2.0. The issue occurs in loopback mode of a NIC wherein reentrant DMA checks get bypassed. A guest user/process may use this flaw to consume CPU cycles
- CVE-2021-20255Mar 9, 2021affected < 4.2.1-11.28.1fixed 4.2.1-11.28.1
A stack overflow via an infinite recursion vulnerability was found in the eepro100 i8255x device emulator of QEMU. This issue occurs while processing controller commands due to a DMA reentry issue. This flaw allows a guest user or process to consume CPU cycles or crash the QEMU p
- CVE-2021-20203Feb 25, 2021affected < 4.2.1-11.13.1fixed 4.2.1-11.13.1
An integer overflow issue was found in the vmxnet3 NIC emulator of the QEMU for versions up to v5.2.0. It may occur if a guest was to supply invalid values for rx/tx queue size or other NIC parameters. A privileged guest user may use this flaw to crash the QEMU process on the hos
- CVE-2020-29443Jan 22, 2021affected < 4.2.1-11.16.3fixed 4.2.1-11.16.3
ide_atapi_cmd_reply_end in hw/ide/atapi.c in QEMU 5.1.0 allows out-of-bounds read access because a buffer index is not validated.
- CVE-2020-11947Dec 31, 2020affected < 4.2.1-11.13.1fixed 4.2.1-11.13.1
iscsi_aio_ioctl_cb in block/iscsi.c in QEMU 4.1.0 has a heap-based buffer over-read that may disclose unrelated information from process memory to an attacker.
- CVE-2020-27821Dec 8, 2020affected < 4.2.1-11.16.3fixed 4.2.1-11.16.3
A flaw was found in the memory management API of QEMU during the initialization of a memory region cache. This issue could lead to an out-of-bounds write access to the MSI-X table while performing MMIO operations. A guest user may abuse this flaw to crash the QEMU process on the
- CVE-2020-28916Dec 4, 2020affected < 4.2.1-11.16.3fixed 4.2.1-11.16.3
hw/net/e1000e_core.c in QEMU 5.0.0 has an infinite loop via an RX descriptor with a NULL buffer address.
- CVE-2020-25723Dec 2, 2020affected < 4.2.1-11.16.3fixed 4.2.1-11.16.3
A reachable assertion issue was found in the USB EHCI emulation code of QEMU. It could occur while processing USB requests due to missing handling of DMA memory map failure. A malicious privileged user within the guest may abuse this flaw to send bogus USB requests and crash the
- CVE-2020-25624Nov 30, 2020affected < 4.2.1-11.16.3fixed 4.2.1-11.16.3
hw/usb/hcd-ohci.c in QEMU 5.0.0 has a stack-based buffer over-read via values obtained from the host controller driver.
- CVE-2020-29129Nov 26, 2020affected < 4.2.1-11.16.3fixed 4.2.1-11.16.3
ncsi.c in libslirp through 4.3.1 has a buffer over-read because it tries to read a certain amount of header data even if that exceeds the total packet length.
- CVE-2020-29130Nov 26, 2020affected < 4.2.1-11.16.3fixed 4.2.1-11.16.3
slirp.c in libslirp through 4.3.1 has a buffer over-read because it tries to read a certain amount of header data even if that exceeds the total packet length.
- CVE-2020-27617Nov 6, 2020affected < 4.2.1-11.16.3fixed 4.2.1-11.16.3
eth_get_gso_type in net/eth.c in QEMU 4.2.1 allows guest OS users to trigger an assertion failure. A guest can crash the QEMU process via packet data that lacks a valid Layer 3 protocol.
- CVE-2020-27616Nov 6, 2020affected < 4.2.1-11.16.3fixed 4.2.1-11.16.3
ati_2d_blt in hw/display/ati_2d.c in QEMU 4.2.1 can encounter an outside-limits situation in a calculation. A guest can crash the QEMU process.
- CVE-2020-24352Oct 16, 2020affected < 4.2.1-11.10.1fixed 4.2.1-11.10.1
An issue was discovered in QEMU through 5.1.0. An out-of-bounds memory access was found in the ATI VGA device implementation. This flaw occurs in the ati_2d_blt() routine in hw/display/ati_2d.c while handling MMIO write operations through the ati_mm_write() callback. A malicious
- CVE-2020-25625Sep 25, 2020affected < 4.2.1-11.16.3fixed 4.2.1-11.16.3
hw/usb/hcd-ohci.c in QEMU 5.0.0 has an infinite loop when a TD list has a loop.
- CVE-2020-25085Sep 25, 2020affected < 4.2.1-11.19.2fixed 4.2.1-11.19.2
QEMU 5.0.0 has a heap-based Buffer Overflow in flatview_read_continue in exec.c because hw/sd/sdhci.c mishandles a write operation in the SDHC_BLKSIZE case.
- CVE-2020-25084Sep 25, 2020affected < 4.2.1-11.16.3fixed 4.2.1-11.16.3
QEMU 5.0.0 has a use-after-free in hw/usb/hcd-xhci.c because the usb_packet_map return value is not checked.
- CVE-2020-14364Aug 31, 2020affected < 4.2.1-11.10.1fixed 4.2.1-11.10.1
An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU in versions before 5.2.0. This issue occurs while processing USB packets from a guest when USBDevice 'setup_len' exceeds its 'data_buf[4096]' in the do_token_in, do_token_out routines. This flaw all
Page 2 of 3