suse/qemu&distro=SUSE Enterprise Storage 4

Vulnerabilities (25)

• CVE-2019-14378Jul 29, 2019
  affected < 2.6.2-41.55.1fixed 2.6.2-41.55.1

  ip_reass in ip_input.c in libslirp 4.0.0 has a heap-based buffer overflow via a large packet because it mishandles a case involving the first fragment.

• CVE-2019-13164Jul 3, 2019
  affected < 2.6.2-41.55.1fixed 2.6.2-41.55.1

  qemu-bridge-helper.c in QEMU 3.1 and 4.0.0 does not ensure that a network interface name (obtained from bridge.conf or a --br=bridge option) is limited to the IFNAMSIZ size, which can lead to an ACL bypass.

• CVE-2019-9824Jun 3, 2019
  affected < 2.6.2-41.52.1fixed 2.6.2-41.52.1

  tcp_emu in slirp/tcp_subr.c (aka slirp/src/tcp_subr.c) in QEMU 3.0.0 uses uninitialized data in an snprintf call, leading to Information disclosure.

• CVE-2018-20815May 31, 2019
  affected < 2.6.2-41.52.1fixed 2.6.2-41.52.1

  In QEMU 3.1.0, load_device_tree in device_tree.c calls the deprecated load_image function, which has a buffer overflow risk.

• CVE-2018-12130May 30, 2019
  affected < 2.6.2-41.52.1fixed 2.6.2-41.52.1

  Microarchitectural Fill Buffer Data Sampling (MFBDS): Fill buffers on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found h

• CVE-2018-12127May 30, 2019
  affected < 2.6.2-41.52.1fixed 2.6.2-41.52.1

  Microarchitectural Load Port Data Sampling (MLPDS): Load ports on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here:

• CVE-2018-12126May 30, 2019
  affected < 2.6.2-41.52.1fixed 2.6.2-41.52.1

  Microarchitectural Store Buffer Data Sampling (MSBDS): Store buffers on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found

• CVE-2019-11091May 30, 2019
  affected < 2.6.2-41.52.1fixed 2.6.2-41.52.1

  Microarchitectural Data Sampling Uncacheable Memory (MDSUM): Uncacheable memory on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products c

• CVE-2019-12155May 24, 2019
  affected < 2.6.2-41.55.1fixed 2.6.2-41.55.1

  interface_release_resource in hw/display/qxl.c in QEMU 3.1.x through 4.0.0 has a NULL pointer dereference.

• CVE-2018-18849Mar 17, 2019
  affected < 2.6.2-41.46.2fixed 2.6.2-41.46.2

  In Qemu 3.0.0, lsi_do_msgin in hw/scsi/lsi53c895a.c allows out-of-bounds access by triggering an invalid msg_len value.

• CVE-2019-6778Mar 17, 2019
  affected < 2.6.2-41.49.1fixed 2.6.2-41.49.1

  In QEMU 3.0.0, tcp_emu in slirp/tcp_subr.c has a heap-based buffer overflow.

• CVE-2018-16872Dec 13, 2018
  affected < 2.6.2-41.49.1fixed 2.6.2-41.49.1

  A flaw was found in qemu Media Transfer Protocol (MTP). The code opening files in usb_mtp_get_object and usb_mtp_get_partial_object and directories in usb_mtp_object_readdir doesn't consider that the underlying filesystem may have changed since the time lstat(2) was called in usb

• CVE-2018-19489Dec 13, 2018
  affected < 2.6.2-41.49.1fixed 2.6.2-41.49.1

  v9fs_wstat in hw/9pfs/9p.c in QEMU allows guest OS users to cause a denial of service (crash) because of a race condition during file renaming.

• CVE-2018-19364Dec 13, 2018
  affected < 2.6.2-41.49.1fixed 2.6.2-41.49.1

  hw/9pfs/cofile.c and hw/9pfs/9p.c in QEMU can modify an fid path while it is being accessed by a second thread, leading to (for example) a use-after-free outcome.

• CVE-2018-10839Oct 16, 2018
  affected < 2.6.2-41.46.2fixed 2.6.2-41.46.2

  Qemu emulator <= 3.0.0 built with the NE2000 NIC emulation support is vulnerable to an integer overflow, which could lead to buffer overflow issue. It could occur when receiving packets over the network. A user inside guest could use this flaw to crash the Qemu process resulting

• CVE-2018-17958HigOct 9, 2018
  affected < 2.6.2-41.46.2fixed 2.6.2-41.46.2

  Qemu has a Buffer Overflow in rtl8139_do_receive in hw/net/rtl8139.c because an incorrect integer data type is used.

• CVE-2018-17963Oct 9, 2018
  affected < 2.6.2-41.46.2fixed 2.6.2-41.46.2

  qemu_deliver_packet_iov in net/net.c in Qemu accepts packet sizes greater than INT_MAX, which allows attackers to cause a denial of service or possibly have unspecified other impact.

• CVE-2018-17962Oct 9, 2018
  affected < 2.6.2-41.46.2fixed 2.6.2-41.46.2

  Qemu has a Buffer Overflow in pcnet_receive in hw/net/pcnet.c because an incorrect integer data type is used.

• CVE-2018-15746Aug 29, 2018
  affected < 2.6.2-41.46.2fixed 2.6.2-41.46.2

  qemu-seccomp.c in QEMU might allow local OS guest users to cause a denial of service (guest crash) by leveraging mishandling of the seccomp policy for threads other than the main thread.

• CVE-2018-12617Jun 21, 2018
  affected < 2.6.2-41.43.3fixed 2.6.2-41.43.3

  qmp_guest_file_read in qga/commands-posix.c and qga/commands-win32.c in qemu-ga (aka QEMU Guest Agent) in QEMU 2.12.50 has an integer overflow causing a g_malloc0() call to trigger a segmentation fault when trying to allocate a large memory chunk. The vulnerability can be exploit