CVE-2020-15859
QEMU 4.2.0 has a use-after-free in hw/net/e1000e_core.c because a guest OS user can trigger an e1000e packet with the data's address set to the e1000e's MMIO address.
- Actualiza a 1:2.11+dfsg-1ubuntu7.35
Publicación Actualización
PatchFirst · Vulnerabilidades recientes
Vulnerabilidades de qemu · Página 3
Vulnerabilidades publicadas para qemu en los últimos 30 días: 0. Incluidas en el catálogo KEV: 0.
Vulnerabilidades: 86
CVE-2020-10756
An out-of-bounds read vulnerability was found in the SLiRP networking implementation of the QEMU emulator. This flaw occurs in the icmp6_send_echoreply() routine while replying to an ICMP echo request, also known as ping. This flaw allows a malicious guest to leak the contents of the host memory, resulting in possible information disclosure. This flaw affects versions of libslirp before 4.3.1.
- Actualiza a 1:2.11+dfsg-1ubuntu7.31
Publicación ActualizaciónCVE-2020-15469
In QEMU 4.2.0, a MemoryRegionOps object may lack read/write callback methods, leading to a NULL pointer dereference.
- Actualiza a 1:2.11+dfsg-1ubuntu7.37
Publicación ActualizaciónCVE-2020-13765
rom_copy() in hw/core/loader.c in QEMU 4.0 and 4.1.0 does not validate the relationship between two addresses, which allows attackers to trigger an invalid memory copy operation.
- Actualiza a 1:2.11+dfsg-1ubuntu7.31
Publicación ActualizaciónCVE-2020-13754
hw/pci/msix.c in QEMU 4.2.0 allows guest OS users to trigger an out-of-bounds access via a crafted address in an msi-x mmio operation.
- Actualiza a 1:2.11+dfsg-1ubuntu7.31
Publicación ActualizaciónCVE-2020-13659
address_space_map in exec.c in QEMU 4.2.0 can trigger a NULL pointer dereference related to BounceBuffer.
- Actualiza a 1:2.11+dfsg-1ubuntu7.31
Publicación ActualizaciónCVE-2020-13362
In QEMU 5.0.0 and earlier, megasas_lookup_frame in hw/scsi/megasas.c has an out-of-bounds read via a crafted reply_queue_head field from a guest OS user.
- Actualiza a 1:2.11+dfsg-1ubuntu7.31
Publicación ActualizaciónCVE-2020-13361
In QEMU 5.0.0 and earlier, es1370_transfer_audio in hw/audio/es1370.c does not properly validate the frame count, which allows guest OS users to trigger an out-of-bounds access during an es1370_write() operation.
- Actualiza a 1:2.11+dfsg-1ubuntu7.31
Publicación ActualizaciónCVE-2020-13253
sd_wp_addr in hw/sd/sd.c in QEMU 4.2.0 uses an unvalidated address, which leads to an out-of-bounds read during sdhci_write() operations. A guest OS user can crash the QEMU process.
- Actualiza a 1:2.11+dfsg-1ubuntu7.31
Publicación Actualizaciónlibslirp: use after free vulnerability cause a denial of service.
A use after free vulnerability in ip_reass() in ip_input.c of libslirp 4.2.0 and prior releases allows crafted packets to cause a denial of service.
- Actualiza a 1:2.11+dfsg-1ubuntu7.26
Publicación ActualizaciónCVE-2019-20382
QEMU 4.1.0 has a memory leak in zrle_compress_data in ui/vnc-enc-zrle.c during a VNC disconnect operation because libz is misused, resulting in a situation where memory allocated in deflateInit2 is not freed in deflateEnd.
- Actualiza a 1:2.11+dfsg-1ubuntu7.26
Publicación ActualizaciónCVE-2020-1711
An out-of-bounds heap buffer access flaw was found in the way the iSCSI Block driver in QEMU versions 2.12.0 before 4.2.1 handled a response coming from an iSCSI server while checking the status of a Logical Address Block (LBA) in an iscsi_co_block_status() routine. A remote user could use this flaw to crash the QEMU process, resulting in a denial of service or potential execution of arbitrary code with privileges of the QEMU process on the host.
- Actualiza a 1:2.11+dfsg-1ubuntu7.23
Publicación ActualizaciónCVE-2020-8608
In libslirp 4.1.0, as used in QEMU 4.2.0, tcp_subr.c misuses snprintf return values, leading to a buffer overflow in later code.
- Actualiza a 1:2.11+dfsg-1ubuntu7.23
Publicación ActualizaciónCVE-2020-7039
tcp_emu in tcp_subr.c in libslirp 4.1.0, as used in QEMU 4.2.0, mismanages memory, as demonstrated by IRC DCC commands in EMU_IRC. This can cause a heap-based buffer overflow or other out-of-bounds access which can lead to a DoS or potential execute arbitrary code.
- Actualiza a 1:2.11+dfsg-1ubuntu7.23
Publicación ActualizaciónCVE-2019-12068
In QEMU 1:4.1-1, 1:2.1+dfsg-12+deb8u6, 1:2.8+dfsg-6+deb9u8, 1:3.1+dfsg-8~deb10u1, 1:3.1+dfsg-8+deb10u2, and 1:2.1+dfsg-12+deb8u12 (fixed), when executing script in lsi_execute_script(), the LSI scsi adapter emulator advances 's->dsp' index to read next opcode. This can lead to an infinite loop if the next opcode is empty. Move the existing loop exit after 10k iterations so that it covers no-op opcodes as well.
- Actualiza a 1:2.11+dfsg-1ubuntu7.20
Publicación ActualizaciónCVE-2019-15890
libslirp 4.0.0, as used in QEMU 4.1.0, has a use-after-free in ip_reass in ip_input.c.
- Actualiza a 1:2.11+dfsg-1ubuntu7.20
Publicación ActualizaciónCVE-2019-14378
ip_reass in ip_input.c in libslirp 4.0.0 has a heap-based buffer overflow via a large packet because it mishandles a case involving the first fragment.
- Actualiza a 1:2.11+dfsg-1ubuntu7.20
Publicación ActualizaciónCVE-2019-13164
qemu-bridge-helper.c in QEMU 3.1 and 4.0.0 does not ensure that a network interface name (obtained from bridge.conf or a --br=bridge option) is limited to the IFNAMSIZ size, which can lead to an ACL bypass.
- Actualiza a 1:2.11+dfsg-1ubuntu7.20
Publicación ActualizaciónCVE-2019-9824
tcp_emu in slirp/tcp_subr.c (aka slirp/src/tcp_subr.c) in QEMU 3.0.0 uses uninitialized data in an snprintf call, leading to Information disclosure.
- Actualiza a 1:2.11+dfsg-1ubuntu7.13
Publicación ActualizaciónCVE-2018-20815
In QEMU 3.1.0, load_device_tree in device_tree.c calls the deprecated load_image function, which has a buffer overflow risk.
- Actualiza a 1:2.11+dfsg-1ubuntu7.13
Publicación Actualización
Comprueba tu servidor
Compara tu pila y las versiones instaladas con las bases actuales de vulnerabilidades.