rpm package
suse/qemu&distro=SUSE Linux Enterprise Module for Basesystem 15
pkg:rpm/suse/qemu&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015
Vulnerabilities (31)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2019-11135 | Med | 6.5 | < 2.11.2-9.33.1 | 2.11.2-9.33.1 | Nov 14, 2019 | TSX Asynchronous Abort condition on some CPUs utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. | |
| CVE-2018-12207 | — | < 2.11.2-9.33.1 | 2.11.2-9.33.1 | Nov 14, 2019 | Improper invalidation for page table updates by a virtual guest operating system for multiple Intel(R) Processors may allow an authenticated user to potentially enable denial of service of the host system via local access. | ||
| CVE-2019-12068 | — | < 2.11.2-9.33.1 | 2.11.2-9.33.1 | Sep 24, 2019 | In QEMU 1:4.1-1, 1:2.1+dfsg-12+deb8u6, 1:2.8+dfsg-6+deb9u8, 1:3.1+dfsg-8~deb10u1, 1:3.1+dfsg-8+deb10u2, and 1:2.1+dfsg-12+deb8u12 (fixed), when executing script in lsi_execute_script(), the LSI scsi adapter emulator advances 's->dsp' index to read next opcode. This can lead to an | ||
| CVE-2019-14378 | — | < 2.11.2-9.28.3 | 2.11.2-9.28.3 | Jul 29, 2019 | ip_reass in ip_input.c in libslirp 4.0.0 has a heap-based buffer overflow via a large packet because it mishandles a case involving the first fragment. | ||
| CVE-2019-13164 | — | < 2.11.2-9.28.3 | 2.11.2-9.28.3 | Jul 3, 2019 | qemu-bridge-helper.c in QEMU 3.1 and 4.0.0 does not ensure that a network interface name (obtained from bridge.conf or a --br=bridge option) is limited to the IFNAMSIZ size, which can lead to an ACL bypass. | ||
| CVE-2019-9824 | — | < 2.11.2-9.25.1 | 2.11.2-9.25.1 | Jun 3, 2019 | tcp_emu in slirp/tcp_subr.c (aka slirp/src/tcp_subr.c) in QEMU 3.0.0 uses uninitialized data in an snprintf call, leading to Information disclosure. | ||
| CVE-2018-20815 | — | < 2.11.2-9.25.1 | 2.11.2-9.25.1 | May 31, 2019 | In QEMU 3.1.0, load_device_tree in device_tree.c calls the deprecated load_image function, which has a buffer overflow risk. | ||
| CVE-2019-11091 | Med | 5.6 | < 2.11.2-9.25.1 | 2.11.2-9.25.1 | May 30, 2019 | Microarchitectural Data Sampling Uncacheable Memory (MDSUM): Uncacheable memory on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products c | |
| CVE-2018-12130 | Med | 5.9 | < 2.11.2-9.25.1 | 2.11.2-9.25.1 | May 30, 2019 | Microarchitectural Fill Buffer Data Sampling (MFBDS): Fill buffers on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found h | |
| CVE-2018-12127 | Med | 5.6 | < 2.11.2-9.25.1 | 2.11.2-9.25.1 | May 30, 2019 | Microarchitectural Load Port Data Sampling (MLPDS): Load ports on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here: | |
| CVE-2018-12126 | Med | 5.6 | < 2.11.2-9.25.1 | 2.11.2-9.25.1 | May 30, 2019 | Microarchitectural Store Buffer Data Sampling (MSBDS): Store buffers on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found | |
| CVE-2019-12155 | — | < 2.11.2-9.28.3 | 2.11.2-9.28.3 | May 24, 2019 | interface_release_resource in hw/display/qxl.c in QEMU 3.1.x through 4.0.0 has a NULL pointer dereference. | ||
| CVE-2018-18849 | — | < 2.11.2-9.12.2 | 2.11.2-9.12.2 | Mar 17, 2019 | In Qemu 3.0.0, lsi_do_msgin in hw/scsi/lsi53c895a.c allows out-of-bounds access by triggering an invalid msg_len value. | ||
| CVE-2019-8934 | — | < 2.11.2-9.25.1 | 2.11.2-9.25.1 | Mar 17, 2019 | hw/ppc/spapr.c in QEMU through 3.1.0 allows Information Exposure because the hypervisor shares the /proc/device-tree/system-id and /proc/device-tree/model system attributes with a guest. | ||
| CVE-2019-6778 | — | < 2.11.2-9.20.1 | 2.11.2-9.20.1 | Mar 17, 2019 | In QEMU 3.0.0, tcp_emu in slirp/tcp_subr.c has a heap-based buffer overflow. | ||
| CVE-2019-3812 | — | < 2.11.2-9.25.1 | 2.11.2-9.25.1 | Feb 19, 2019 | QEMU, through version 2.10 and through version 3.1.0, is vulnerable to an out-of-bounds read of up to 128 bytes in the hw/i2c/i2c-ddc.c:i2c_ddc() function. A local attacker with permission to execute i2c commands could exploit this to read stack memory of the qemu process on the | ||
| CVE-2018-20126 | — | < 2.11.2-9.33.1 | 2.11.2-9.33.1 | Dec 20, 2018 | hw/rdma/vmw/pvrdma_cmd.c in QEMU allows create_cq and create_qp memory leaks because errors are mishandled. | ||
| CVE-2018-16872 | — | < 2.11.2-9.20.1 | 2.11.2-9.20.1 | Dec 13, 2018 | A flaw was found in qemu Media Transfer Protocol (MTP). The code opening files in usb_mtp_get_object and usb_mtp_get_partial_object and directories in usb_mtp_object_readdir doesn't consider that the underlying filesystem may have changed since the time lstat(2) was called in usb | ||
| CVE-2018-19489 | — | < 2.11.2-9.20.1 | 2.11.2-9.20.1 | Dec 13, 2018 | v9fs_wstat in hw/9pfs/9p.c in QEMU allows guest OS users to cause a denial of service (crash) because of a race condition during file renaming. | ||
| CVE-2018-19364 | — | < 2.11.2-9.20.1 | 2.11.2-9.20.1 | Dec 13, 2018 | hw/9pfs/cofile.c and hw/9pfs/9p.c in QEMU can modify an fid path while it is being accessed by a second thread, leading to (for example) a use-after-free outcome. |
- affected < 2.11.2-9.33.1fixed 2.11.2-9.33.1
TSX Asynchronous Abort condition on some CPUs utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access.
- CVE-2018-12207Nov 14, 2019affected < 2.11.2-9.33.1fixed 2.11.2-9.33.1
Improper invalidation for page table updates by a virtual guest operating system for multiple Intel(R) Processors may allow an authenticated user to potentially enable denial of service of the host system via local access.
- CVE-2019-12068Sep 24, 2019affected < 2.11.2-9.33.1fixed 2.11.2-9.33.1
In QEMU 1:4.1-1, 1:2.1+dfsg-12+deb8u6, 1:2.8+dfsg-6+deb9u8, 1:3.1+dfsg-8~deb10u1, 1:3.1+dfsg-8+deb10u2, and 1:2.1+dfsg-12+deb8u12 (fixed), when executing script in lsi_execute_script(), the LSI scsi adapter emulator advances 's->dsp' index to read next opcode. This can lead to an
- CVE-2019-14378Jul 29, 2019affected < 2.11.2-9.28.3fixed 2.11.2-9.28.3
ip_reass in ip_input.c in libslirp 4.0.0 has a heap-based buffer overflow via a large packet because it mishandles a case involving the first fragment.
- CVE-2019-13164Jul 3, 2019affected < 2.11.2-9.28.3fixed 2.11.2-9.28.3
qemu-bridge-helper.c in QEMU 3.1 and 4.0.0 does not ensure that a network interface name (obtained from bridge.conf or a --br=bridge option) is limited to the IFNAMSIZ size, which can lead to an ACL bypass.
- CVE-2019-9824Jun 3, 2019affected < 2.11.2-9.25.1fixed 2.11.2-9.25.1
tcp_emu in slirp/tcp_subr.c (aka slirp/src/tcp_subr.c) in QEMU 3.0.0 uses uninitialized data in an snprintf call, leading to Information disclosure.
- CVE-2018-20815May 31, 2019affected < 2.11.2-9.25.1fixed 2.11.2-9.25.1
In QEMU 3.1.0, load_device_tree in device_tree.c calls the deprecated load_image function, which has a buffer overflow risk.
- affected < 2.11.2-9.25.1fixed 2.11.2-9.25.1
Microarchitectural Data Sampling Uncacheable Memory (MDSUM): Uncacheable memory on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products c
- affected < 2.11.2-9.25.1fixed 2.11.2-9.25.1
Microarchitectural Fill Buffer Data Sampling (MFBDS): Fill buffers on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found h
- affected < 2.11.2-9.25.1fixed 2.11.2-9.25.1
Microarchitectural Load Port Data Sampling (MLPDS): Load ports on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here:
- affected < 2.11.2-9.25.1fixed 2.11.2-9.25.1
Microarchitectural Store Buffer Data Sampling (MSBDS): Store buffers on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found
- CVE-2019-12155May 24, 2019affected < 2.11.2-9.28.3fixed 2.11.2-9.28.3
interface_release_resource in hw/display/qxl.c in QEMU 3.1.x through 4.0.0 has a NULL pointer dereference.
- CVE-2018-18849Mar 17, 2019affected < 2.11.2-9.12.2fixed 2.11.2-9.12.2
In Qemu 3.0.0, lsi_do_msgin in hw/scsi/lsi53c895a.c allows out-of-bounds access by triggering an invalid msg_len value.
- CVE-2019-8934Mar 17, 2019affected < 2.11.2-9.25.1fixed 2.11.2-9.25.1
hw/ppc/spapr.c in QEMU through 3.1.0 allows Information Exposure because the hypervisor shares the /proc/device-tree/system-id and /proc/device-tree/model system attributes with a guest.
- CVE-2019-6778Mar 17, 2019affected < 2.11.2-9.20.1fixed 2.11.2-9.20.1
In QEMU 3.0.0, tcp_emu in slirp/tcp_subr.c has a heap-based buffer overflow.
- CVE-2019-3812Feb 19, 2019affected < 2.11.2-9.25.1fixed 2.11.2-9.25.1
QEMU, through version 2.10 and through version 3.1.0, is vulnerable to an out-of-bounds read of up to 128 bytes in the hw/i2c/i2c-ddc.c:i2c_ddc() function. A local attacker with permission to execute i2c commands could exploit this to read stack memory of the qemu process on the
- CVE-2018-20126Dec 20, 2018affected < 2.11.2-9.33.1fixed 2.11.2-9.33.1
hw/rdma/vmw/pvrdma_cmd.c in QEMU allows create_cq and create_qp memory leaks because errors are mishandled.
- CVE-2018-16872Dec 13, 2018affected < 2.11.2-9.20.1fixed 2.11.2-9.20.1
A flaw was found in qemu Media Transfer Protocol (MTP). The code opening files in usb_mtp_get_object and usb_mtp_get_partial_object and directories in usb_mtp_object_readdir doesn't consider that the underlying filesystem may have changed since the time lstat(2) was called in usb
- CVE-2018-19489Dec 13, 2018affected < 2.11.2-9.20.1fixed 2.11.2-9.20.1
v9fs_wstat in hw/9pfs/9p.c in QEMU allows guest OS users to cause a denial of service (crash) because of a race condition during file renaming.
- CVE-2018-19364Dec 13, 2018affected < 2.11.2-9.20.1fixed 2.11.2-9.20.1
hw/9pfs/cofile.c and hw/9pfs/9p.c in QEMU can modify an fid path while it is being accessed by a second thread, leading to (for example) a use-after-free outcome.
Page 1 of 2