p PatchFirst

CVE-2019-3812

CVE-2019-3812

This page contains facts from public vulnerability sources. Check the original advisory before updating.

QEMU, through version 2.10 and through version 3.1.0, is vulnerable to an out-of-bounds read of up to 128 bytes in the hw/i2c/i2c-ddc.c:i2c_ddc() function. A local attacker with permission to execute i2c commands could exploit this to read stack memory of the qemu process on the host.

CVSS 4.4 · Medium · EPSS 0.4% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • qemu

    Versions
    • through version 2.10 and through to 3.1.0: Affected

    No fix published

  • qemu Debian:12

    Affected ranges
    • ECOSYSTEM: < 1:3.1+dfsg-5

    Update to 1:3.1+dfsg-5

  • qemu Debian:13

    Affected ranges
    • ECOSYSTEM: < 1:3.1+dfsg-5

    Update to 1:3.1+dfsg-5

  • qemu Debian:14

    Affected ranges
    • ECOSYSTEM: < 1:3.1+dfsg-5

    Update to 1:3.1+dfsg-5

  • qemu Ubuntu:18.04:LTS

    Versions
    • 1:2.10+dfsg-0ubuntu3
    • 1:2.10+dfsg-0ubuntu4
    • 1:2.10+dfsg-0ubuntu5
    • 1:2.11+dfsg-1ubuntu1
    • 1:2.11+dfsg-1ubuntu2
    • 1:2.11+dfsg-1ubuntu4
    • 1:2.11+dfsg-1ubuntu5
    • 1:2.11+dfsg-1ubuntu6
    • 1:2.11+dfsg-1ubuntu7
    • 1:2.11+dfsg-1ubuntu7.1
    • 1:2.11+dfsg-1ubuntu7.2
    • 1:2.11+dfsg-1ubuntu7.3
    • 1:2.11+dfsg-1ubuntu7.4
    • 1:2.11+dfsg-1ubuntu7.5
    • 1:2.11+dfsg-1ubuntu7.6
    • 1:2.11+dfsg-1ubuntu7.7
    • 1:2.11+dfsg-1ubuntu7.8
    • 1:2.11+dfsg-1ubuntu7.9
    • 1:2.11+dfsg-1ubuntu7.10
    Affected ranges
    • ECOSYSTEM: < 1:2.11+dfsg-1ubuntu7.12

    Update to 1:2.11+dfsg-1ubuntu7.12

Original sources

Check your server →