suse/qemu&distro=SUSE Linux Enterprise Server 12 SP5

Vulnerabilities (75)

• CVE-2021-20255Mar 9, 2021
  affected < 3.1.1.1-57.2fixed 3.1.1.1-57.2

  A stack overflow via an infinite recursion vulnerability was found in the eepro100 i8255x device emulator of QEMU. This issue occurs while processing controller commands due to a DMA reentry issue. This flaw allows a guest user or process to consume CPU cycles or crash the QEMU p

• CVE-2021-20203Feb 25, 2021
  affected < 3.1.1.1-48.2fixed 3.1.1.1-48.2

  An integer overflow issue was found in the vmxnet3 NIC emulator of the QEMU for versions up to v5.2.0. It may occur if a guest was to supply invalid values for rx/tx queue size or other NIC parameters. A privileged guest user may use this flaw to crash the QEMU process on the hos

• CVE-2020-17380Jan 30, 2021
  affected < 3.1.1.1-66.1fixed 3.1.1.1-66.1

  A heap-based buffer overflow was found in QEMU through 5.0.0 in the SDHCI device emulation support. It could occur while doing a multi block SDMA transfer via the sdhci_sdma_transfer_multi_blocks() routine in hw/sd/sdhci.c. A guest user or process could use this flaw to crash the

• CVE-2020-29443Jan 22, 2021
  affected < 3.1.1.1-48.2fixed 3.1.1.1-48.2

  ide_atapi_cmd_reply_end in hw/ide/atapi.c in QEMU 5.1.0 allows out-of-bounds read access because a buffer index is not validated.

• CVE-2020-11947Dec 31, 2020
  affected < 3.1.1.1-48.2fixed 3.1.1.1-48.2

  iscsi_aio_ioctl_cb in block/iscsi.c in QEMU 4.1.0 has a heap-based buffer over-read that may disclose unrelated information from process memory to an attacker.

• CVE-2020-27821Dec 8, 2020
  affected < 3.1.1.1-48.2fixed 3.1.1.1-48.2

  A flaw was found in the memory management API of QEMU during the initialization of a memory region cache. This issue could lead to an out-of-bounds write access to the MSI-X table while performing MMIO operations. A guest user may abuse this flaw to crash the QEMU process on the

• CVE-2020-28916Dec 4, 2020
  affected < 3.1.1.1-48.2fixed 3.1.1.1-48.2

  hw/net/e1000e_core.c in QEMU 5.0.0 has an infinite loop via an RX descriptor with a NULL buffer address.

• CVE-2020-25723Dec 2, 2020
  affected < 3.1.1.1-48.2fixed 3.1.1.1-48.2

  A reachable assertion issue was found in the USB EHCI emulation code of QEMU. It could occur while processing USB requests due to missing handling of DMA memory map failure. A malicious privileged user within the guest may abuse this flaw to send bogus USB requests and crash the

• CVE-2020-25624Nov 30, 2020
  affected < 3.1.1.1-48.2fixed 3.1.1.1-48.2

  hw/usb/hcd-ohci.c in QEMU 5.0.0 has a stack-based buffer over-read via values obtained from the host controller driver.

• CVE-2020-29129Nov 26, 2020
  affected < 3.1.1.1-48.2fixed 3.1.1.1-48.2

  ncsi.c in libslirp through 4.3.1 has a buffer over-read because it tries to read a certain amount of header data even if that exceeds the total packet length.

• CVE-2020-29130Nov 26, 2020
  affected < 3.1.1.1-48.2fixed 3.1.1.1-48.2

  slirp.c in libslirp through 4.3.1 has a buffer over-read because it tries to read a certain amount of header data even if that exceeds the total packet length.

• CVE-2020-27617Nov 6, 2020
  affected < 3.1.1.1-48.2fixed 3.1.1.1-48.2

  eth_get_gso_type in net/eth.c in QEMU 4.2.1 allows guest OS users to trigger an assertion failure. A guest can crash the QEMU process via packet data that lacks a valid Layer 3 protocol.

• CVE-2020-25625Sep 25, 2020
  affected < 3.1.1.1-48.2fixed 3.1.1.1-48.2

  hw/usb/hcd-ohci.c in QEMU 5.0.0 has an infinite loop when a TD list has a loop.

• CVE-2020-25085Sep 25, 2020
  affected < 3.1.1.1-51.1fixed 3.1.1.1-51.1

  QEMU 5.0.0 has a heap-based Buffer Overflow in flatview_read_continue in exec.c because hw/sd/sdhci.c mishandles a write operation in the SDHC_BLKSIZE case.

• CVE-2020-25084Sep 25, 2020
  affected < 3.1.1.1-48.2fixed 3.1.1.1-48.2

  QEMU 5.0.0 has a use-after-free in hw/usb/hcd-xhci.c because the usb_packet_map return value is not checked.

• CVE-2020-14364Aug 31, 2020
  affected < 3.1.1.1-45.1fixed 3.1.1.1-45.1

  An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU in versions before 5.2.0. This issue occurs while processing USB packets from a guest when USBDevice 'setup_len' exceeds its 'data_buf[4096]' in the do_token_in, do_token_out routines. This flaw all

• CVE-2020-12829Aug 31, 2020
  affected < 3.1.1.1-48.2fixed 3.1.1.1-48.2

  In QEMU through 5.0.0, an integer overflow was found in the SM501 display driver implementation. This flaw occurs in the COPY_AREA macro while handling MMIO write operations through the sm501_2d_engine_write() callback. A local attacker could abuse this flaw to crash the QEMU pro

• CVE-2020-16092Aug 11, 2020
  affected < 3.1.1.1-45.1fixed 3.1.1.1-45.1

  In QEMU through 5.0.0, an assertion failure can occur in the network packet processing. This issue affects the e1000e and vmxnet3 network devices. A malicious guest user/process could use this flaw to abort the QEMU process on the host, resulting in a denial of service condition

• CVE-2020-15863Jul 28, 2020
  affected < 3.1.1.1-45.1fixed 3.1.1.1-45.1

  hw/net/xgmac.c in the XGMAC Ethernet controller in QEMU before 07-20-2020 has a buffer overflow. This occurs during packet transmission and affects the highbank and midway emulated machines. A guest user or process could use this flaw to crash the QEMU process on the host, result

• CVE-2020-10756Jul 9, 2020
  affected < 3.1.1.1-51.1fixed 3.1.1.1-51.1

  An out-of-bounds read vulnerability was found in the SLiRP networking implementation of the QEMU emulator. This flaw occurs in the icmp6_send_echoreply() routine while replying to an ICMP echo request, also known as ping. This flaw allows a malicious guest to leak the contents of