CVE-2020-15859
QEMU 4.2.0 has a use-after-free in hw/net/e1000e_core.c because a guest OS user can trigger an e1000e packet with the data's address set to the e1000e's MMIO address.
- Mettez à jour vers 1:2.11+dfsg-1ubuntu7.35
Publication Mise à jour
PatchFirst · Vulnérabilités récentes
Vulnérabilités de qemu · Page n° 3
Vulnérabilité publiée pour qemu au cours des 30 derniers jours : 0. Dans le catalogue KEV : 0.
Vulnérabilités : 86
CVE-2020-10756
An out-of-bounds read vulnerability was found in the SLiRP networking implementation of the QEMU emulator. This flaw occurs in the icmp6_send_echoreply() routine while replying to an ICMP echo request, also known as ping. This flaw allows a malicious guest to leak the contents of the host memory, resulting in possible information disclosure. This flaw affects versions of libslirp before 4.3.1.
- Mettez à jour vers 1:2.11+dfsg-1ubuntu7.31
Publication Mise à jourCVE-2020-15469
In QEMU 4.2.0, a MemoryRegionOps object may lack read/write callback methods, leading to a NULL pointer dereference.
- Mettez à jour vers 1:2.11+dfsg-1ubuntu7.37
Publication Mise à jourCVE-2020-13765
rom_copy() in hw/core/loader.c in QEMU 4.0 and 4.1.0 does not validate the relationship between two addresses, which allows attackers to trigger an invalid memory copy operation.
- Mettez à jour vers 1:2.11+dfsg-1ubuntu7.31
Publication Mise à jourCVE-2020-13754
hw/pci/msix.c in QEMU 4.2.0 allows guest OS users to trigger an out-of-bounds access via a crafted address in an msi-x mmio operation.
- Mettez à jour vers 1:2.11+dfsg-1ubuntu7.31
Publication Mise à jourCVE-2020-13659
address_space_map in exec.c in QEMU 4.2.0 can trigger a NULL pointer dereference related to BounceBuffer.
- Mettez à jour vers 1:2.11+dfsg-1ubuntu7.31
Publication Mise à jourCVE-2020-13362
In QEMU 5.0.0 and earlier, megasas_lookup_frame in hw/scsi/megasas.c has an out-of-bounds read via a crafted reply_queue_head field from a guest OS user.
- Mettez à jour vers 1:2.11+dfsg-1ubuntu7.31
Publication Mise à jourCVE-2020-13361
In QEMU 5.0.0 and earlier, es1370_transfer_audio in hw/audio/es1370.c does not properly validate the frame count, which allows guest OS users to trigger an out-of-bounds access during an es1370_write() operation.
- Mettez à jour vers 1:2.11+dfsg-1ubuntu7.31
Publication Mise à jourCVE-2020-13253
sd_wp_addr in hw/sd/sd.c in QEMU 4.2.0 uses an unvalidated address, which leads to an out-of-bounds read during sdhci_write() operations. A guest OS user can crash the QEMU process.
- Mettez à jour vers 1:2.11+dfsg-1ubuntu7.31
Publication Mise à jourlibslirp: use after free vulnerability cause a denial of service.
A use after free vulnerability in ip_reass() in ip_input.c of libslirp 4.2.0 and prior releases allows crafted packets to cause a denial of service.
- Mettez à jour vers 1:2.11+dfsg-1ubuntu7.26
Publication Mise à jourCVE-2019-20382
QEMU 4.1.0 has a memory leak in zrle_compress_data in ui/vnc-enc-zrle.c during a VNC disconnect operation because libz is misused, resulting in a situation where memory allocated in deflateInit2 is not freed in deflateEnd.
- Mettez à jour vers 1:2.11+dfsg-1ubuntu7.26
Publication Mise à jourCVE-2020-1711
An out-of-bounds heap buffer access flaw was found in the way the iSCSI Block driver in QEMU versions 2.12.0 before 4.2.1 handled a response coming from an iSCSI server while checking the status of a Logical Address Block (LBA) in an iscsi_co_block_status() routine. A remote user could use this flaw to crash the QEMU process, resulting in a denial of service or potential execution of arbitrary code with privileges of the QEMU process on the host.
- Mettez à jour vers 1:2.11+dfsg-1ubuntu7.23
Publication Mise à jourCVE-2020-8608
In libslirp 4.1.0, as used in QEMU 4.2.0, tcp_subr.c misuses snprintf return values, leading to a buffer overflow in later code.
- Mettez à jour vers 1:2.11+dfsg-1ubuntu7.23
Publication Mise à jourCVE-2020-7039
tcp_emu in tcp_subr.c in libslirp 4.1.0, as used in QEMU 4.2.0, mismanages memory, as demonstrated by IRC DCC commands in EMU_IRC. This can cause a heap-based buffer overflow or other out-of-bounds access which can lead to a DoS or potential execute arbitrary code.
- Mettez à jour vers 1:2.11+dfsg-1ubuntu7.23
Publication Mise à jourCVE-2019-12068
In QEMU 1:4.1-1, 1:2.1+dfsg-12+deb8u6, 1:2.8+dfsg-6+deb9u8, 1:3.1+dfsg-8~deb10u1, 1:3.1+dfsg-8+deb10u2, and 1:2.1+dfsg-12+deb8u12 (fixed), when executing script in lsi_execute_script(), the LSI scsi adapter emulator advances 's->dsp' index to read next opcode. This can lead to an infinite loop if the next opcode is empty. Move the existing loop exit after 10k iterations so that it covers no-op opcodes as well.
- Mettez à jour vers 1:2.11+dfsg-1ubuntu7.20
Publication Mise à jourCVE-2019-15890
libslirp 4.0.0, as used in QEMU 4.1.0, has a use-after-free in ip_reass in ip_input.c.
- Mettez à jour vers 1:2.11+dfsg-1ubuntu7.20
Publication Mise à jourCVE-2019-14378
ip_reass in ip_input.c in libslirp 4.0.0 has a heap-based buffer overflow via a large packet because it mishandles a case involving the first fragment.
- Mettez à jour vers 1:2.11+dfsg-1ubuntu7.20
Publication Mise à jourCVE-2019-13164
qemu-bridge-helper.c in QEMU 3.1 and 4.0.0 does not ensure that a network interface name (obtained from bridge.conf or a --br=bridge option) is limited to the IFNAMSIZ size, which can lead to an ACL bypass.
- Mettez à jour vers 1:2.11+dfsg-1ubuntu7.20
Publication Mise à jourCVE-2019-9824
tcp_emu in slirp/tcp_subr.c (aka slirp/src/tcp_subr.c) in QEMU 3.0.0 uses uninitialized data in an snprintf call, leading to Information disclosure.
- Mettez à jour vers 1:2.11+dfsg-1ubuntu7.13
Publication Mise à jourCVE-2018-20815
In QEMU 3.1.0, load_device_tree in device_tree.c calls the deprecated load_image function, which has a buffer overflow risk.
- Mettez à jour vers 1:2.11+dfsg-1ubuntu7.13
Publication Mise à jour
Vérifiez votre serveur
Comparez votre pile et les versions installées aux bases de vulnérabilités actuelles.