rpm package
suse/qemu&distro=SUSE Linux Enterprise Module for Server Applications 15 SP1
pkg:rpm/suse/qemu&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Server%20Applications%2015%20SP1
Vulnerabilities (16)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2020-1983 | — | < 3.1.1.1-9.21.4 | 3.1.1.1-9.21.4 | Apr 22, 2020 | A use after free vulnerability in ip_reass() in ip_input.c of libslirp 4.2.0 and prior releases allows crafted packets to cause a denial of service. | ||
| CVE-2019-15034 | — | < 3.1.1.1-9.14.1 | 3.1.1.1-9.14.1 | Mar 10, 2020 | hw/display/bochs-display.c in QEMU 4.0.0 does not ensure a sufficient PCI config space allocation, leading to a buffer overflow involving the PCIe extended config space. | ||
| CVE-2019-20382 | — | < 3.1.1.1-9.14.1 | 3.1.1.1-9.14.1 | Mar 5, 2020 | QEMU 4.1.0 has a memory leak in zrle_compress_data in ui/vnc-enc-zrle.c during a VNC disconnect operation because libz is misused, resulting in a situation where memory allocated in deflateInit2 is not freed in deflateEnd. | ||
| CVE-2020-1711 | — | < 3.1.1.1-9.14.1 | 3.1.1.1-9.14.1 | Feb 11, 2020 | An out-of-bounds heap buffer access flaw was found in the way the iSCSI Block driver in QEMU versions 2.12.0 before 4.2.1 handled a response coming from an iSCSI server while checking the status of a Logical Address Block (LBA) in an iscsi_co_block_status() routine. A remote user | ||
| CVE-2020-8608 | — | < 3.1.1.1-9.14.1 | 3.1.1.1-9.14.1 | Feb 6, 2020 | In libslirp 4.1.0, as used in QEMU 4.2.0, tcp_subr.c misuses snprintf return values, leading to a buffer overflow in later code. | ||
| CVE-2020-7039 | — | < 3.1.1.1-9.14.1 | 3.1.1.1-9.14.1 | Jan 16, 2020 | tcp_emu in tcp_subr.c in libslirp 4.1.0, as used in QEMU 4.2.0, mismanages memory, as demonstrated by IRC DCC commands in EMU_IRC. This can cause a heap-based buffer overflow or other out-of-bounds access which can lead to a DoS or potential execute arbitrary code. | ||
| CVE-2019-11135 | Med | 6.5 | < 3.1.1.1-9.6.2 | 3.1.1.1-9.6.2 | Nov 14, 2019 | TSX Asynchronous Abort condition on some CPUs utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. | |
| CVE-2018-12207 | — | < 3.1.1.1-9.6.2 | 3.1.1.1-9.6.2 | Nov 14, 2019 | Improper invalidation for page table updates by a virtual guest operating system for multiple Intel(R) Processors may allow an authenticated user to potentially enable denial of service of the host system via local access. | ||
| CVE-2019-12068 | — | < 3.1.1.1-9.6.2 | 3.1.1.1-9.6.2 | Sep 24, 2019 | In QEMU 1:4.1-1, 1:2.1+dfsg-12+deb8u6, 1:2.8+dfsg-6+deb9u8, 1:3.1+dfsg-8~deb10u1, 1:3.1+dfsg-8+deb10u2, and 1:2.1+dfsg-12+deb8u12 (fixed), when executing script in lsi_execute_script(), the LSI scsi adapter emulator advances 's->dsp' index to read next opcode. This can lead to an | ||
| CVE-2019-15890 | — | < 3.1.1.1-9.6.2 | 3.1.1.1-9.6.2 | Sep 6, 2019 | libslirp 4.0.0, as used in QEMU 4.1.0, has a use-after-free in ip_reass in ip_input.c. | ||
| CVE-2019-14378 | — | < 3.1.1-9.3.3 | 3.1.1-9.3.3 | Jul 29, 2019 | ip_reass in ip_input.c in libslirp 4.0.0 has a heap-based buffer overflow via a large packet because it mishandles a case involving the first fragment. | ||
| CVE-2019-13164 | — | < 3.1.1-9.3.3 | 3.1.1-9.3.3 | Jul 3, 2019 | qemu-bridge-helper.c in QEMU 3.1 and 4.0.0 does not ensure that a network interface name (obtained from bridge.conf or a --br=bridge option) is limited to the IFNAMSIZ size, which can lead to an ACL bypass. | ||
| CVE-2019-12155 | — | < 3.1.1-9.3.3 | 3.1.1-9.3.3 | May 24, 2019 | interface_release_resource in hw/display/qxl.c in QEMU 3.1.x through 4.0.0 has a NULL pointer dereference. | ||
| CVE-2019-5008 | — | < 3.1.1-9.3.3 | 3.1.1-9.3.3 | Apr 19, 2019 | hw/sparc64/sun4u.c in QEMU 3.1.50 is vulnerable to a NULL pointer dereference, which allows the attacker to cause a denial of service via a device driver. | ||
| CVE-2019-6778 | — | < 3.1.1.1-9.14.1 | 3.1.1.1-9.14.1 | Mar 17, 2019 | In QEMU 3.0.0, tcp_emu in slirp/tcp_subr.c has a heap-based buffer overflow. | ||
| CVE-2018-20126 | — | < 3.1.1.1-9.6.2 | 3.1.1.1-9.6.2 | Dec 20, 2018 | hw/rdma/vmw/pvrdma_cmd.c in QEMU allows create_cq and create_qp memory leaks because errors are mishandled. |
- CVE-2020-1983Apr 22, 2020affected < 3.1.1.1-9.21.4fixed 3.1.1.1-9.21.4
A use after free vulnerability in ip_reass() in ip_input.c of libslirp 4.2.0 and prior releases allows crafted packets to cause a denial of service.
- CVE-2019-15034Mar 10, 2020affected < 3.1.1.1-9.14.1fixed 3.1.1.1-9.14.1
hw/display/bochs-display.c in QEMU 4.0.0 does not ensure a sufficient PCI config space allocation, leading to a buffer overflow involving the PCIe extended config space.
- CVE-2019-20382Mar 5, 2020affected < 3.1.1.1-9.14.1fixed 3.1.1.1-9.14.1
QEMU 4.1.0 has a memory leak in zrle_compress_data in ui/vnc-enc-zrle.c during a VNC disconnect operation because libz is misused, resulting in a situation where memory allocated in deflateInit2 is not freed in deflateEnd.
- CVE-2020-1711Feb 11, 2020affected < 3.1.1.1-9.14.1fixed 3.1.1.1-9.14.1
An out-of-bounds heap buffer access flaw was found in the way the iSCSI Block driver in QEMU versions 2.12.0 before 4.2.1 handled a response coming from an iSCSI server while checking the status of a Logical Address Block (LBA) in an iscsi_co_block_status() routine. A remote user
- CVE-2020-8608Feb 6, 2020affected < 3.1.1.1-9.14.1fixed 3.1.1.1-9.14.1
In libslirp 4.1.0, as used in QEMU 4.2.0, tcp_subr.c misuses snprintf return values, leading to a buffer overflow in later code.
- CVE-2020-7039Jan 16, 2020affected < 3.1.1.1-9.14.1fixed 3.1.1.1-9.14.1
tcp_emu in tcp_subr.c in libslirp 4.1.0, as used in QEMU 4.2.0, mismanages memory, as demonstrated by IRC DCC commands in EMU_IRC. This can cause a heap-based buffer overflow or other out-of-bounds access which can lead to a DoS or potential execute arbitrary code.
- affected < 3.1.1.1-9.6.2fixed 3.1.1.1-9.6.2
TSX Asynchronous Abort condition on some CPUs utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access.
- CVE-2018-12207Nov 14, 2019affected < 3.1.1.1-9.6.2fixed 3.1.1.1-9.6.2
Improper invalidation for page table updates by a virtual guest operating system for multiple Intel(R) Processors may allow an authenticated user to potentially enable denial of service of the host system via local access.
- CVE-2019-12068Sep 24, 2019affected < 3.1.1.1-9.6.2fixed 3.1.1.1-9.6.2
In QEMU 1:4.1-1, 1:2.1+dfsg-12+deb8u6, 1:2.8+dfsg-6+deb9u8, 1:3.1+dfsg-8~deb10u1, 1:3.1+dfsg-8+deb10u2, and 1:2.1+dfsg-12+deb8u12 (fixed), when executing script in lsi_execute_script(), the LSI scsi adapter emulator advances 's->dsp' index to read next opcode. This can lead to an
- CVE-2019-15890Sep 6, 2019affected < 3.1.1.1-9.6.2fixed 3.1.1.1-9.6.2
libslirp 4.0.0, as used in QEMU 4.1.0, has a use-after-free in ip_reass in ip_input.c.
- CVE-2019-14378Jul 29, 2019affected < 3.1.1-9.3.3fixed 3.1.1-9.3.3
ip_reass in ip_input.c in libslirp 4.0.0 has a heap-based buffer overflow via a large packet because it mishandles a case involving the first fragment.
- CVE-2019-13164Jul 3, 2019affected < 3.1.1-9.3.3fixed 3.1.1-9.3.3
qemu-bridge-helper.c in QEMU 3.1 and 4.0.0 does not ensure that a network interface name (obtained from bridge.conf or a --br=bridge option) is limited to the IFNAMSIZ size, which can lead to an ACL bypass.
- CVE-2019-12155May 24, 2019affected < 3.1.1-9.3.3fixed 3.1.1-9.3.3
interface_release_resource in hw/display/qxl.c in QEMU 3.1.x through 4.0.0 has a NULL pointer dereference.
- CVE-2019-5008Apr 19, 2019affected < 3.1.1-9.3.3fixed 3.1.1-9.3.3
hw/sparc64/sun4u.c in QEMU 3.1.50 is vulnerable to a NULL pointer dereference, which allows the attacker to cause a denial of service via a device driver.
- CVE-2019-6778Mar 17, 2019affected < 3.1.1.1-9.14.1fixed 3.1.1.1-9.14.1
In QEMU 3.0.0, tcp_emu in slirp/tcp_subr.c has a heap-based buffer overflow.
- CVE-2018-20126Dec 20, 2018affected < 3.1.1.1-9.6.2fixed 3.1.1.1-9.6.2
hw/rdma/vmw/pvrdma_cmd.c in QEMU allows create_cq and create_qp memory leaks because errors are mishandled.