csaf_suse - suse-su-2021:14704-1

suse-su-2021:14704-1

Vulnerability from csaf_suse

Published

2021-04-20 12:35

Modified

2021-04-20 12:35

Summary

Security update for kvm

Notes

Title of the patch

Security update for kvm

Description of the patch

This update for kvm fixes the following issues: - Fix OOB read and write due to integer overflow in sm501_2d_operation() in hw/display/sm501.c (CVE-2020-12829, bsc#1172385) - Fix OOB access possibility in MegaRAID SAS 8708EM2 emulation (CVE-2020-13362 bsc#1172383) - Fix use-after-free in usb xhci packet handling (CVE-2020-25723, bsc#1178934) - Fix use-after-free in usb ehci packet handling (CVE-2020-25084, bsc#1176673) - Fix OOB access in usb hcd-ohci emulation (CVE-2020-25624, bsc#1176682) - Fix infinite loop (DoS) in usb hcd-ohci emulation (CVE-2020-25625, bsc#1176684) - Fix OOB access in atapi emulation (CVE-2020-29443, bsc#1181108) - Fix DoS in e1000 emulated device (CVE-2021-20257 bsc#1182577) - Fix OOB access in SLIRP ARP packet processing (CVE-2020-29130, bsc#1179467) - Fix OOB access while processing USB packets (CVE-2020-14364 bsc#1175441) - Fix potential privilege escalation in virtfs (CVE-2021-20181 bsc#1182137) - Fix package scripts to not use hard coded paths for temporary working directories and log files (bsc#1182425) - Fix OOB access possibility in ES1370 audio device emulation (CVE-2020-13361 bsc#1172384) - Fix OOB access in ROM loading (CVE-2020-13765 bsc#1172478)

Patchnames

slessp4-kvm-14704

CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for kvm",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for kvm fixes the following issues:\n\n- Fix OOB read and write due to integer overflow in sm501_2d_operation() in hw/display/sm501.c (CVE-2020-12829, bsc#1172385)\n- Fix OOB access possibility in MegaRAID SAS 8708EM2 emulation (CVE-2020-13362 bsc#1172383)\n- Fix use-after-free in usb xhci packet handling (CVE-2020-25723, bsc#1178934)\n- Fix use-after-free in usb ehci packet handling (CVE-2020-25084, bsc#1176673)\n- Fix OOB access in usb hcd-ohci emulation (CVE-2020-25624, bsc#1176682)\n- Fix infinite loop (DoS) in usb hcd-ohci emulation (CVE-2020-25625, bsc#1176684)\n- Fix OOB access in atapi emulation (CVE-2020-29443, bsc#1181108)\n- Fix DoS in e1000 emulated device (CVE-2021-20257 bsc#1182577)\n- Fix OOB access in SLIRP ARP packet processing (CVE-2020-29130, bsc#1179467)\n- Fix OOB access while processing USB packets (CVE-2020-14364 bsc#1175441)\n- Fix potential privilege escalation in virtfs (CVE-2021-20181 bsc#1182137)\n- Fix package scripts to not use hard coded paths for temporary working directories and log files (bsc#1182425)\n- Fix OOB access possibility in ES1370 audio device emulation (CVE-2020-13361 bsc#1172384)\n- Fix OOB access in ROM loading (CVE-2020-13765 bsc#1172478)\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "slessp4-kvm-14704",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2021_14704-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2021:14704-1",
        "url": "https://www.suse.com/support/update/announcement/2021/suse-su-202114704-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2021:14704-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2021-April/008660.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1172383",
        "url": "https://bugzilla.suse.com/1172383"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1172384",
        "url": "https://bugzilla.suse.com/1172384"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1172385",
        "url": "https://bugzilla.suse.com/1172385"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1172478",
        "url": "https://bugzilla.suse.com/1172478"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1175441",
        "url": "https://bugzilla.suse.com/1175441"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1176673",
        "url": "https://bugzilla.suse.com/1176673"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1176682",
        "url": "https://bugzilla.suse.com/1176682"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1176684",
        "url": "https://bugzilla.suse.com/1176684"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1178934",
        "url": "https://bugzilla.suse.com/1178934"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1179467",
        "url": "https://bugzilla.suse.com/1179467"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1181108",
        "url": "https://bugzilla.suse.com/1181108"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1182137",
        "url": "https://bugzilla.suse.com/1182137"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1182425",
        "url": "https://bugzilla.suse.com/1182425"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1182577",
        "url": "https://bugzilla.suse.com/1182577"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2014-3689 page",
        "url": "https://www.suse.com/security/cve/CVE-2014-3689/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2015-1779 page",
        "url": "https://www.suse.com/security/cve/CVE-2015-1779/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-12829 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-12829/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-13361 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-13361/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-13362 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-13362/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-13765 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-13765/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-14364 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-14364/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-25084 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-25084/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-25624 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-25624/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-25625 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-25625/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-25723 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-25723/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-29130 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-29130/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-29443 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-29443/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-20181 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-20181/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-20257 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-20257/"
      }
    ],
    "title": "Security update for kvm",
    "tracking": {
      "current_release_date": "2021-04-20T12:35:06Z",
      "generator": {
        "date": "2021-04-20T12:35:06Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2021:14704-1",
      "initial_release_date": "2021-04-20T12:35:06Z",
      "revision_history": [
        {
          "date": "2021-04-20T12:35:06Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "kvm-1.4.2-60.34.1.i586",
                "product": {
                  "name": "kvm-1.4.2-60.34.1.i586",
                  "product_id": "kvm-1.4.2-60.34.1.i586"
                }
              }
            ],
            "category": "architecture",
            "name": "i586"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "kvm-1.4.2-60.34.1.s390x",
                "product": {
                  "name": "kvm-1.4.2-60.34.1.s390x",
                  "product_id": "kvm-1.4.2-60.34.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "kvm-1.4.2-60.34.1.x86_64",
                "product": {
                  "name": "kvm-1.4.2-60.34.1.x86_64",
                  "product_id": "kvm-1.4.2-60.34.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 11 SP4-LTSS",
                "product": {
                  "name": "SUSE Linux Enterprise Server 11 SP4-LTSS",
                  "product_id": "SUSE Linux Enterprise Server 11 SP4-LTSS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:suse_sles:11:sp4"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kvm-1.4.2-60.34.1.i586 as component of SUSE Linux Enterprise Server 11 SP4-LTSS",
          "product_id": "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.i586"
        },
        "product_reference": "kvm-1.4.2-60.34.1.i586",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP4-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kvm-1.4.2-60.34.1.s390x as component of SUSE Linux Enterprise Server 11 SP4-LTSS",
          "product_id": "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.s390x"
        },
        "product_reference": "kvm-1.4.2-60.34.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP4-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kvm-1.4.2-60.34.1.x86_64 as component of SUSE Linux Enterprise Server 11 SP4-LTSS",
          "product_id": "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.x86_64"
        },
        "product_reference": "kvm-1.4.2-60.34.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP4-LTSS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2014-3689",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2014-3689"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The vmware-vga driver (hw/display/vmware_vga.c) in QEMU allows local guest users to write to qemu memory locations and gain privileges via unspecified parameters related to rectangle handling.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.i586",
          "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.s390x",
          "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2014-3689",
          "url": "https://www.suse.com/security/cve/CVE-2014-3689"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1072223 for CVE-2014-3689",
          "url": "https://bugzilla.suse.com/1072223"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1189862 for CVE-2014-3689",
          "url": "https://bugzilla.suse.com/1189862"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 901508 for CVE-2014-3689",
          "url": "https://bugzilla.suse.com/901508"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 962611 for CVE-2014-3689",
          "url": "https://bugzilla.suse.com/962611"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.i586",
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.s390x",
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-04-20T12:35:06Z",
          "details": "important"
        }
      ],
      "title": "CVE-2014-3689"
    },
    {
      "cve": "CVE-2015-1779",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2015-1779"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The VNC websocket frame decoder in QEMU allows remote attackers to cause a denial of service (memory and CPU consumption) via a large (1) websocket payload or (2) HTTP headers section.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.i586",
          "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.s390x",
          "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2015-1779",
          "url": "https://www.suse.com/security/cve/CVE-2015-1779"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 924018 for CVE-2015-1779",
          "url": "https://bugzilla.suse.com/924018"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 962632 for CVE-2015-1779",
          "url": "https://bugzilla.suse.com/962632"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.i586",
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.s390x",
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.i586",
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.s390x",
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-04-20T12:35:06Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2015-1779"
    },
    {
      "cve": "CVE-2020-12829",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-12829"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In QEMU through 5.0.0, an integer overflow was found in the SM501 display driver implementation. This flaw occurs in the COPY_AREA macro while handling MMIO write operations through the sm501_2d_engine_write() callback. A local attacker could abuse this flaw to crash the QEMU process in sm501_2d_operation() in hw/display/sm501.c on the host, resulting in a denial of service.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.i586",
          "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.s390x",
          "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-12829",
          "url": "https://www.suse.com/security/cve/CVE-2020-12829"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1172385 for CVE-2020-12829",
          "url": "https://bugzilla.suse.com/1172385"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.i586",
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.s390x",
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.i586",
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.s390x",
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-04-20T12:35:06Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2020-12829"
    },
    {
      "cve": "CVE-2020-13361",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-13361"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In QEMU 5.0.0 and earlier, es1370_transfer_audio in hw/audio/es1370.c does not properly validate the frame count, which allows guest OS users to trigger an out-of-bounds access during an es1370_write() operation.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.i586",
          "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.s390x",
          "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-13361",
          "url": "https://www.suse.com/security/cve/CVE-2020-13361"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1172384 for CVE-2020-13361",
          "url": "https://bugzilla.suse.com/1172384"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.i586",
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.s390x",
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.9,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.i586",
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.s390x",
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-04-20T12:35:06Z",
          "details": "low"
        }
      ],
      "title": "CVE-2020-13361"
    },
    {
      "cve": "CVE-2020-13362",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-13362"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In QEMU 5.0.0 and earlier, megasas_lookup_frame in hw/scsi/megasas.c has an out-of-bounds read via a crafted reply_queue_head field from a guest OS user.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.i586",
          "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.s390x",
          "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-13362",
          "url": "https://www.suse.com/security/cve/CVE-2020-13362"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1172383 for CVE-2020-13362",
          "url": "https://bugzilla.suse.com/1172383"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.i586",
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.s390x",
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.2,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.i586",
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.s390x",
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-04-20T12:35:06Z",
          "details": "low"
        }
      ],
      "title": "CVE-2020-13362"
    },
    {
      "cve": "CVE-2020-13765",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-13765"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "rom_copy() in hw/core/loader.c in QEMU 4.0 and 4.1.0 does not validate the relationship between two addresses, which allows attackers to trigger an invalid memory copy operation.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.i586",
          "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.s390x",
          "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-13765",
          "url": "https://www.suse.com/security/cve/CVE-2020-13765"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1172478 for CVE-2020-13765",
          "url": "https://bugzilla.suse.com/1172478"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.i586",
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.s390x",
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.i586",
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.s390x",
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-04-20T12:35:06Z",
          "details": "important"
        }
      ],
      "title": "CVE-2020-13765"
    },
    {
      "cve": "CVE-2020-14364",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-14364"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU in versions before 5.2.0. This issue occurs while processing USB packets from a guest when USBDevice \u0027setup_len\u0027 exceeds its \u0027data_buf[4096]\u0027 in the do_token_in, do_token_out routines. This flaw allows a guest user to crash the QEMU process, resulting in a denial of service, or the potential execution of arbitrary code with the privileges of the QEMU process on the host.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.i586",
          "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.s390x",
          "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-14364",
          "url": "https://www.suse.com/security/cve/CVE-2020-14364"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1175441 for CVE-2020-14364",
          "url": "https://bugzilla.suse.com/1175441"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1175534 for CVE-2020-14364",
          "url": "https://bugzilla.suse.com/1175534"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1176494 for CVE-2020-14364",
          "url": "https://bugzilla.suse.com/1176494"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1177130 for CVE-2020-14364",
          "url": "https://bugzilla.suse.com/1177130"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.i586",
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.s390x",
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.i586",
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.s390x",
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-04-20T12:35:06Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2020-14364"
    },
    {
      "cve": "CVE-2020-25084",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-25084"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "QEMU 5.0.0 has a use-after-free in hw/usb/hcd-xhci.c because the usb_packet_map return value is not checked.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.i586",
          "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.s390x",
          "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-25084",
          "url": "https://www.suse.com/security/cve/CVE-2020-25084"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1176673 for CVE-2020-25084",
          "url": "https://bugzilla.suse.com/1176673"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.i586",
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.s390x",
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.i586",
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.s390x",
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-04-20T12:35:06Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2020-25084"
    },
    {
      "cve": "CVE-2020-25624",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-25624"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "hw/usb/hcd-ohci.c in QEMU 5.0.0 has a stack-based buffer over-read via values obtained from the host controller driver.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.i586",
          "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.s390x",
          "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-25624",
          "url": "https://www.suse.com/security/cve/CVE-2020-25624"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1176682 for CVE-2020-25624",
          "url": "https://bugzilla.suse.com/1176682"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.i586",
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.s390x",
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.i586",
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.s390x",
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-04-20T12:35:06Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2020-25624"
    },
    {
      "cve": "CVE-2020-25625",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-25625"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "hw/usb/hcd-ohci.c in QEMU 5.0.0 has an infinite loop when a TD list has a loop.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.i586",
          "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.s390x",
          "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-25625",
          "url": "https://www.suse.com/security/cve/CVE-2020-25625"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1176684 for CVE-2020-25625",
          "url": "https://bugzilla.suse.com/1176684"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.i586",
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.s390x",
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 2.5,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.i586",
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.s390x",
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-04-20T12:35:06Z",
          "details": "low"
        }
      ],
      "title": "CVE-2020-25625"
    },
    {
      "cve": "CVE-2020-25723",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-25723"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A reachable assertion issue was found in the USB EHCI emulation code of QEMU. It could occur while processing USB requests due to missing handling of DMA memory map failure. A malicious privileged user within the guest may abuse this flaw to send bogus USB requests and crash the QEMU process on the host, resulting in a denial of service.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.i586",
          "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.s390x",
          "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-25723",
          "url": "https://www.suse.com/security/cve/CVE-2020-25723"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1178934 for CVE-2020-25723",
          "url": "https://bugzilla.suse.com/1178934"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1178935 for CVE-2020-25723",
          "url": "https://bugzilla.suse.com/1178935"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.i586",
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.s390x",
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.2,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.i586",
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.s390x",
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-04-20T12:35:06Z",
          "details": "low"
        }
      ],
      "title": "CVE-2020-25723"
    },
    {
      "cve": "CVE-2020-29130",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-29130"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "slirp.c in libslirp through 4.3.1 has a buffer over-read because it tries to read a certain amount of header data even if that exceeds the total packet length.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.i586",
          "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.s390x",
          "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-29130",
          "url": "https://www.suse.com/security/cve/CVE-2020-29130"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1178658 for CVE-2020-29130",
          "url": "https://bugzilla.suse.com/1178658"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1179467 for CVE-2020-29130",
          "url": "https://bugzilla.suse.com/1179467"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1179477 for CVE-2020-29130",
          "url": "https://bugzilla.suse.com/1179477"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.i586",
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.s390x",
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.i586",
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.s390x",
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-04-20T12:35:06Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2020-29130"
    },
    {
      "cve": "CVE-2020-29443",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-29443"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "ide_atapi_cmd_reply_end in hw/ide/atapi.c in QEMU 5.1.0 allows out-of-bounds read access because a buffer index is not validated.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.i586",
          "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.s390x",
          "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-29443",
          "url": "https://www.suse.com/security/cve/CVE-2020-29443"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1181108 for CVE-2020-29443",
          "url": "https://bugzilla.suse.com/1181108"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.i586",
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.s390x",
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.9,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.i586",
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.s390x",
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-04-20T12:35:06Z",
          "details": "low"
        }
      ],
      "title": "CVE-2020-29443"
    },
    {
      "cve": "CVE-2021-20181",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-20181"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A race condition flaw was found in the 9pfs server implementation of QEMU up to and including 5.2.0. This flaw allows a malicious 9p client to cause a use-after-free error, potentially escalating their privileges on the system. The highest threat from this vulnerability is to confidentiality, integrity as well as system availability.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.i586",
          "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.s390x",
          "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-20181",
          "url": "https://www.suse.com/security/cve/CVE-2021-20181"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1182137 for CVE-2021-20181",
          "url": "https://bugzilla.suse.com/1182137"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.i586",
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.s390x",
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.i586",
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.s390x",
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-04-20T12:35:06Z",
          "details": "important"
        }
      ],
      "title": "CVE-2021-20181"
    },
    {
      "cve": "CVE-2021-20257",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-20257"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An infinite loop flaw was found in the e1000 NIC emulator of the QEMU. This issue occurs while processing transmits (tx) descriptors in process_tx_desc if various descriptor fields are initialized with invalid values. This flaw allows a guest to consume CPU cycles on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.i586",
          "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.s390x",
          "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-20257",
          "url": "https://www.suse.com/security/cve/CVE-2021-20257"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1182577 for CVE-2021-20257",
          "url": "https://bugzilla.suse.com/1182577"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1182846 for CVE-2021-20257",
          "url": "https://bugzilla.suse.com/1182846"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.i586",
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.s390x",
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.2,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.i586",
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.s390x",
            "SUSE Linux Enterprise Server 11 SP4-LTSS:kvm-1.4.2-60.34.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-04-20T12:35:06Z",
          "details": "low"
        }
      ],
      "title": "CVE-2021-20257"
    }
  ]
}

CVE-2020-12829 (GCVE-0-2020-12829)

Vulnerability from cvelistv5

Published

2020-08-31 14:41

Modified

2024-08-04 12:04

Severity ?

CWE

Summary

In QEMU through 5.0.0, an integer overflow was found in the SM501 display driver implementation. This flaw occurs in the COPY_AREA macro while handling MMIO write operations through the sm501_2d_engine_write() callback. A local attacker could abuse this flaw to crash the QEMU process in sm501_2d_operation() in hw/display/sm501.c on the host, resulting in a denial of service.

References

URL

Tags

	https://usn.ubuntu.com/4467-1/	vendor-advisory, x_refsource_UBUNTU
	https://bugzilla.redhat.com/show_bug.cgi?id=1808510	x_refsource_MISC
	https://www.debian.org/security/2020/dsa-4760	vendor-advisory, x_refsource_DEBIAN

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T12:04:22.879Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "USN-4467-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4467-1/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1808510"
          },
          {
            "name": "DSA-4760",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2020/dsa-4760"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In QEMU through 5.0.0, an integer overflow was found in the SM501 display driver implementation. This flaw occurs in the COPY_AREA macro while handling MMIO write operations through the sm501_2d_engine_write() callback. A local attacker could abuse this flaw to crash the QEMU process in sm501_2d_operation() in hw/display/sm501.c on the host, resulting in a denial of service."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-09-07T11:06:06",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "USN-4467-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4467-1/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1808510"
        },
        {
          "name": "DSA-4760",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2020/dsa-4760"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-12829",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In QEMU through 5.0.0, an integer overflow was found in the SM501 display driver implementation. This flaw occurs in the COPY_AREA macro while handling MMIO write operations through the sm501_2d_engine_write() callback. A local attacker could abuse this flaw to crash the QEMU process in sm501_2d_operation() in hw/display/sm501.c on the host, resulting in a denial of service."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "USN-4467-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4467-1/"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1808510",
              "refsource": "MISC",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1808510"
            },
            {
              "name": "DSA-4760",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2020/dsa-4760"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-12829",
    "datePublished": "2020-08-31T14:41:14",
    "dateReserved": "2020-05-13T00:00:00",
    "dateUpdated": "2024-08-04T12:04:22.879Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2015-1779 (GCVE-0-2015-1779)

Vulnerability from cvelistv5

Published

2016-01-12 19:00

Modified

2024-08-06 04:54

Severity ?

CWE

Summary

The VNC websocket frame decoder in QEMU allows remote attackers to cause a denial of service (memory and CPU consumption) via a large (1) websocket payload or (2) HTTP headers section.

References

URL

Tags

	http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00033.html	vendor-advisory, x_refsource_SUSE
	https://lists.gnu.org/archive/html/qemu-devel/2015-03/msg04896.html	mailing-list, x_refsource_MLIST
	http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155196.html	vendor-advisory, x_refsource_FEDORA
	http://www.debian.org/security/2015/dsa-3259	vendor-advisory, x_refsource_DEBIAN
	http://www.openwall.com/lists/oss-security/2015/04/09/6	mailing-list, x_refsource_MLIST
	http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00042.html	vendor-advisory, x_refsource_SUSE
	http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154656.html	vendor-advisory, x_refsource_FEDORA
	https://lists.gnu.org/archive/html/qemu-devel/2015-03/msg04894.html	mailing-list, x_refsource_MLIST
	http://rhn.redhat.com/errata/RHSA-2015-1931.html	vendor-advisory, x_refsource_REDHAT
	http://www.openwall.com/lists/oss-security/2015/03/24/9	mailing-list, x_refsource_MLIST
	http://www.securitytracker.com/id/1033975	vdb-entry, x_refsource_SECTRACK
	http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html	x_refsource_CONFIRM
	http://rhn.redhat.com/errata/RHSA-2015-1943.html	vendor-advisory, x_refsource_REDHAT
	http://www.ubuntu.com/usn/USN-2608-1	vendor-advisory, x_refsource_UBUNTU
	https://lists.gnu.org/archive/html/qemu-devel/2015-03/msg04895.html	mailing-list, x_refsource_MLIST
	http://www.securityfocus.com/bid/73303	vdb-entry, x_refsource_BID
	https://security.gentoo.org/glsa/201602-01	vendor-advisory, x_refsource_GENTOO

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T04:54:15.943Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "SUSE-SU-2015:0870",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00033.html"
          },
          {
            "name": "[Qemu-devel] 20150323 [PATCH 1/2] CVE-2015-1779: incrementally decode websocket frames",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.gnu.org/archive/html/qemu-devel/2015-03/msg04896.html"
          },
          {
            "name": "FEDORA-2015-5541",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155196.html"
          },
          {
            "name": "DSA-3259",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2015/dsa-3259"
          },
          {
            "name": "[oss-security] 20150409 Re: CVE-2015-1779 qemu: vnc: insufficient resource limiting in VNC websockets decoder",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2015/04/09/6"
          },
          {
            "name": "SUSE-SU-2015:0896",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00042.html"
          },
          {
            "name": "FEDORA-2015-5482",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154656.html"
          },
          {
            "name": "[Qemu-devel] 20150323 [PATCH 0/2] CVE-2015-1779: fix denial of service in VNC websockets",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.gnu.org/archive/html/qemu-devel/2015-03/msg04894.html"
          },
          {
            "name": "RHSA-2015:1931",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2015-1931.html"
          },
          {
            "name": "[oss-security] 20150324 CVE-2015-1779 qemu: vnc: insufficient resource limiting in VNC websockets decoder",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2015/03/24/9"
          },
          {
            "name": "1033975",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1033975"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html"
          },
          {
            "name": "RHSA-2015:1943",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2015-1943.html"
          },
          {
            "name": "USN-2608-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-2608-1"
          },
          {
            "name": "[Qemu-devel] 20150323 [PATCH 2/2] CVE-2015-1779: limit size of HTTP headers from websockets clients",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.gnu.org/archive/html/qemu-devel/2015-03/msg04895.html"
          },
          {
            "name": "73303",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/73303"
          },
          {
            "name": "GLSA-201602-01",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201602-01"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-03-23T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The VNC websocket frame decoder in QEMU allows remote attackers to cause a denial of service (memory and CPU consumption) via a large (1) websocket payload or (2) HTTP headers section."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-06-30T16:57:01",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "SUSE-SU-2015:0870",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00033.html"
        },
        {
          "name": "[Qemu-devel] 20150323 [PATCH 1/2] CVE-2015-1779: incrementally decode websocket frames",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.gnu.org/archive/html/qemu-devel/2015-03/msg04896.html"
        },
        {
          "name": "FEDORA-2015-5541",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155196.html"
        },
        {
          "name": "DSA-3259",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2015/dsa-3259"
        },
        {
          "name": "[oss-security] 20150409 Re: CVE-2015-1779 qemu: vnc: insufficient resource limiting in VNC websockets decoder",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2015/04/09/6"
        },
        {
          "name": "SUSE-SU-2015:0896",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00042.html"
        },
        {
          "name": "FEDORA-2015-5482",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154656.html"
        },
        {
          "name": "[Qemu-devel] 20150323 [PATCH 0/2] CVE-2015-1779: fix denial of service in VNC websockets",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.gnu.org/archive/html/qemu-devel/2015-03/msg04894.html"
        },
        {
          "name": "RHSA-2015:1931",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2015-1931.html"
        },
        {
          "name": "[oss-security] 20150324 CVE-2015-1779 qemu: vnc: insufficient resource limiting in VNC websockets decoder",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2015/03/24/9"
        },
        {
          "name": "1033975",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1033975"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html"
        },
        {
          "name": "RHSA-2015:1943",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2015-1943.html"
        },
        {
          "name": "USN-2608-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-2608-1"
        },
        {
          "name": "[Qemu-devel] 20150323 [PATCH 2/2] CVE-2015-1779: limit size of HTTP headers from websockets clients",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.gnu.org/archive/html/qemu-devel/2015-03/msg04895.html"
        },
        {
          "name": "73303",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/73303"
        },
        {
          "name": "GLSA-201602-01",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201602-01"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2015-1779",
    "datePublished": "2016-01-12T19:00:00",
    "dateReserved": "2015-02-17T00:00:00",
    "dateUpdated": "2024-08-06T04:54:15.943Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-29130 (GCVE-0-2020-29130)

Vulnerability from cvelistv5

Published

2020-11-26 00:00

Modified

2024-08-04 16:48

Severity ?

CWE

Summary

slirp.c in libslirp through 4.3.1 has a buffer over-read because it tries to read a certain amount of header data even if that exceeds the total packet length.

References

URL

Tags

	https://lists.freedesktop.org/archives/slirp/2020-November/000115.html
	http://www.openwall.com/lists/oss-security/2020/11/27/1	mailing-list
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OPCOHDEONMHH6QPJZKRLLCNRGRYODG7X/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/45S5IHSWYITJKMRT23HCHJQDI674AMTQ/	vendor-advisory
	https://lists.debian.org/debian-lts-announce/2021/02/msg00024.html	mailing-list
	https://lists.debian.org/debian-lts-announce/2023/03/msg00013.html	mailing-list

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T16:48:01.400Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.freedesktop.org/archives/slirp/2020-November/000115.html"
          },
          {
            "name": "[oss-security] 20201127 CVE-2020-29129 CVE-2020-29130 QEMU: slirp: out-of-bounds access while processing ARP/NCSI packets",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2020/11/27/1"
          },
          {
            "name": "FEDORA-2020-77f93f41be",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OPCOHDEONMHH6QPJZKRLLCNRGRYODG7X/"
          },
          {
            "name": "FEDORA-2020-331e1318dd",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/45S5IHSWYITJKMRT23HCHJQDI674AMTQ/"
          },
          {
            "name": "[debian-lts-announce] 20210218 [SECURITY] [DLA 2560-1] qemu security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/02/msg00024.html"
          },
          {
            "name": "[debian-lts-announce] 20230314 [SECURITY] [DLA 3362-1] qemu security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/03/msg00013.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "slirp.c in libslirp through 4.3.1 has a buffer over-read because it tries to read a certain amount of header data even if that exceeds the total packet length."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-03-14T00:00:00",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://lists.freedesktop.org/archives/slirp/2020-November/000115.html"
        },
        {
          "name": "[oss-security] 20201127 CVE-2020-29129 CVE-2020-29130 QEMU: slirp: out-of-bounds access while processing ARP/NCSI packets",
          "tags": [
            "mailing-list"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2020/11/27/1"
        },
        {
          "name": "FEDORA-2020-77f93f41be",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OPCOHDEONMHH6QPJZKRLLCNRGRYODG7X/"
        },
        {
          "name": "FEDORA-2020-331e1318dd",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/45S5IHSWYITJKMRT23HCHJQDI674AMTQ/"
        },
        {
          "name": "[debian-lts-announce] 20210218 [SECURITY] [DLA 2560-1] qemu security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/02/msg00024.html"
        },
        {
          "name": "[debian-lts-announce] 20230314 [SECURITY] [DLA 3362-1] qemu security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2023/03/msg00013.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-29130",
    "datePublished": "2020-11-26T00:00:00",
    "dateReserved": "2020-11-26T00:00:00",
    "dateUpdated": "2024-08-04T16:48:01.400Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-25723 (GCVE-0-2020-25723)

Vulnerability from cvelistv5

Published

2020-12-02 00:52

Modified

2024-08-04 15:40

Severity ?

CWE

CWE-617

Summary

A reachable assertion issue was found in the USB EHCI emulation code of QEMU. It could occur while processing USB requests due to missing handling of DMA memory map failure. A malicious privileged user within the guest may abuse this flaw to send bogus USB requests and crash the QEMU process on the host, resulting in a denial of service.

References

URL

Tags

	https://bugzilla.redhat.com/show_bug.cgi?id=1898579	x_refsource_MISC
	https://security.netapp.com/advisory/ntap-20201218-0004/	x_refsource_CONFIRM
	http://www.openwall.com/lists/oss-security/2020/12/22/1	mailing-list, x_refsource_MLIST
	https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html	mailing-list, x_refsource_MLIST

Impacted products

	Vendor	Product	Version
	n/a	QEMU	Version: qemu 5.2.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T15:40:36.594Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1898579"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20201218-0004/"
          },
          {
            "name": "[oss-security] 20201222 CVE-2020-25723 QEMU: assertion failure through usb_packet_unmap() in hw/usb/hcd-ehci.c",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2020/12/22/1"
          },
          {
            "name": "[debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "QEMU",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "qemu 5.2.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A reachable assertion issue was found in the USB EHCI emulation code of QEMU. It could occur while processing USB requests due to missing handling of DMA memory map failure. A malicious privileged user within the guest may abuse this flaw to send bogus USB requests and crash the QEMU process on the host, resulting in a denial of service."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-617",
              "description": "CWE-617",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-09-05T05:06:34",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1898579"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20201218-0004/"
        },
        {
          "name": "[oss-security] 20201222 CVE-2020-25723 QEMU: assertion failure through usb_packet_unmap() in hw/usb/hcd-ehci.c",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2020/12/22/1"
        },
        {
          "name": "[debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2020-25723",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "QEMU",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "qemu 5.2.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A reachable assertion issue was found in the USB EHCI emulation code of QEMU. It could occur while processing USB requests due to missing handling of DMA memory map failure. A malicious privileged user within the guest may abuse this flaw to send bogus USB requests and crash the QEMU process on the host, resulting in a denial of service."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-617"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1898579",
              "refsource": "MISC",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1898579"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20201218-0004/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20201218-0004/"
            },
            {
              "name": "[oss-security] 20201222 CVE-2020-25723 QEMU: assertion failure through usb_packet_unmap() in hw/usb/hcd-ehci.c",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2020/12/22/1"
            },
            {
              "name": "[debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2020-25723",
    "datePublished": "2020-12-02T00:52:10",
    "dateReserved": "2020-09-16T00:00:00",
    "dateUpdated": "2024-08-04T15:40:36.594Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-20257 (GCVE-0-2021-20257)

Vulnerability from cvelistv5

Published

2022-03-16 14:12

Modified

2024-08-03 17:37

Severity ?

CWE

CWE-835

Summary

An infinite loop flaw was found in the e1000 NIC emulator of the QEMU. This issue occurs while processing transmits (tx) descriptors in process_tx_desc if various descriptor fields are initialized with invalid values. This flaw allows a guest to consume CPU cycles on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability.

References

URL

Tags

	https://www.openwall.com/lists/oss-security/2021/02/25/2	x_refsource_MISC
	https://lists.gnu.org/archive/html/qemu-devel/2021-02/msg07428.html	x_refsource_MISC
	https://github.com/qemu/qemu/commit/3de46e6fc489c52c9431a8a832ad8170a7569bd8	x_refsource_MISC
	https://bugzilla.redhat.com/show_bug.cgi?id=1930087	x_refsource_MISC
	https://security.netapp.com/advisory/ntap-20220425-0003/	x_refsource_CONFIRM
	https://security.gentoo.org/glsa/202208-27	vendor-advisory, x_refsource_GENTOO
	https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html	mailing-list, x_refsource_MLIST

Impacted products

	Vendor	Product	Version
	n/a	QEMU	Version: Fixed-In v6.2.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:37:23.120Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.openwall.com/lists/oss-security/2021/02/25/2"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://lists.gnu.org/archive/html/qemu-devel/2021-02/msg07428.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/qemu/qemu/commit/3de46e6fc489c52c9431a8a832ad8170a7569bd8"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1930087"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20220425-0003/"
          },
          {
            "name": "GLSA-202208-27",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202208-27"
          },
          {
            "name": "[debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "QEMU",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Fixed-In v6.2.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An infinite loop flaw was found in the e1000 NIC emulator of the QEMU. This issue occurs while processing transmits (tx) descriptors in process_tx_desc if various descriptor fields are initialized with invalid values. This flaw allows a guest to consume CPU cycles on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-835",
              "description": "CWE-835",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-09-05T05:06:44",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.openwall.com/lists/oss-security/2021/02/25/2"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://lists.gnu.org/archive/html/qemu-devel/2021-02/msg07428.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/qemu/qemu/commit/3de46e6fc489c52c9431a8a832ad8170a7569bd8"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1930087"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20220425-0003/"
        },
        {
          "name": "GLSA-202208-27",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202208-27"
        },
        {
          "name": "[debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2021-20257",
    "datePublished": "2022-03-16T14:12:26",
    "dateReserved": "2020-12-17T00:00:00",
    "dateUpdated": "2024-08-03T17:37:23.120Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-25084 (GCVE-0-2020-25084)

Vulnerability from cvelistv5

Published

2020-09-25 04:06

Modified

2024-08-04 15:26

Severity ?

CWE

Summary

QEMU 5.0.0 has a use-after-free in hw/usb/hcd-xhci.c because the usb_packet_map return value is not checked.

References

URL

Tags

	https://lists.nongnu.org/archive/html/qemu-devel/2020-08/msg08050.html	x_refsource_MISC
	http://www.openwall.com/lists/oss-security/2020/09/16/5	x_refsource_CONFIRM
	https://security.netapp.com/advisory/ntap-20201009-0005/	x_refsource_CONFIRM
	https://lists.debian.org/debian-lts-announce/2021/02/msg00024.html	mailing-list, x_refsource_MLIST
	https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html	mailing-list, x_refsource_MLIST

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T15:26:09.638Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://lists.nongnu.org/archive/html/qemu-devel/2020-08/msg08050.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2020/09/16/5"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20201009-0005/"
          },
          {
            "name": "[debian-lts-announce] 20210218 [SECURITY] [DLA 2560-1] qemu security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/02/msg00024.html"
          },
          {
            "name": "[debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "QEMU 5.0.0 has a use-after-free in hw/usb/hcd-xhci.c because the usb_packet_map return value is not checked."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-09-05T05:06:23",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://lists.nongnu.org/archive/html/qemu-devel/2020-08/msg08050.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2020/09/16/5"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20201009-0005/"
        },
        {
          "name": "[debian-lts-announce] 20210218 [SECURITY] [DLA 2560-1] qemu security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/02/msg00024.html"
        },
        {
          "name": "[debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-25084",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "QEMU 5.0.0 has a use-after-free in hw/usb/hcd-xhci.c because the usb_packet_map return value is not checked."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://lists.nongnu.org/archive/html/qemu-devel/2020-08/msg08050.html",
              "refsource": "MISC",
              "url": "https://lists.nongnu.org/archive/html/qemu-devel/2020-08/msg08050.html"
            },
            {
              "name": "http://www.openwall.com/lists/oss-security/2020/09/16/5",
              "refsource": "CONFIRM",
              "url": "http://www.openwall.com/lists/oss-security/2020/09/16/5"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20201009-0005/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20201009-0005/"
            },
            {
              "name": "[debian-lts-announce] 20210218 [SECURITY] [DLA 2560-1] qemu security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2021/02/msg00024.html"
            },
            {
              "name": "[debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-25084",
    "datePublished": "2020-09-25T04:06:51",
    "dateReserved": "2020-09-02T00:00:00",
    "dateUpdated": "2024-08-04T15:26:09.638Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-13765 (GCVE-0-2020-13765)

Vulnerability from cvelistv5

Published

2020-06-04 15:26

Modified

2024-08-04 12:25

Severity ?

CWE

Summary

rom_copy() in hw/core/loader.c in QEMU 4.0 and 4.1.0 does not validate the relationship between two addresses, which allows attackers to trigger an invalid memory copy operation.

References

URL

Tags

	https://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=e423455c4f23a1a828901c78fe6d03b7dde79319	x_refsource_MISC
	https://www.openwall.com/lists/oss-security/2020/06/03/6	x_refsource_CONFIRM
	https://security.netapp.com/advisory/ntap-20200619-0006/	x_refsource_CONFIRM
	https://lists.debian.org/debian-lts-announce/2020/06/msg00032.html	mailing-list, x_refsource_MLIST
	https://lists.debian.org/debian-lts-announce/2020/07/msg00020.html	mailing-list, x_refsource_MLIST
	https://usn.ubuntu.com/4467-1/	vendor-advisory, x_refsource_UBUNTU
	https://github.com/qemu/qemu/commit/4f1c6cb2f9afafda05eab150fd2bd284edce6676	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T12:25:16.492Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=e423455c4f23a1a828901c78fe6d03b7dde79319"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.openwall.com/lists/oss-security/2020/06/03/6"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20200619-0006/"
          },
          {
            "name": "[debian-lts-announce] 20200629 [SECURITY] [DLA 2262-1] qemu security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/06/msg00032.html"
          },
          {
            "name": "[debian-lts-announce] 20200726 [SECURITY] [DLA 2288-1] qemu security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/07/msg00020.html"
          },
          {
            "name": "USN-4467-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4467-1/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/qemu/qemu/commit/4f1c6cb2f9afafda05eab150fd2bd284edce6676"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "rom_copy() in hw/core/loader.c in QEMU 4.0 and 4.1.0 does not validate the relationship between two addresses, which allows attackers to trigger an invalid memory copy operation."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-01-04T19:58:03",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=e423455c4f23a1a828901c78fe6d03b7dde79319"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.openwall.com/lists/oss-security/2020/06/03/6"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20200619-0006/"
        },
        {
          "name": "[debian-lts-announce] 20200629 [SECURITY] [DLA 2262-1] qemu security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/06/msg00032.html"
        },
        {
          "name": "[debian-lts-announce] 20200726 [SECURITY] [DLA 2288-1] qemu security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/07/msg00020.html"
        },
        {
          "name": "USN-4467-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4467-1/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/qemu/qemu/commit/4f1c6cb2f9afafda05eab150fd2bd284edce6676"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-13765",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "rom_copy() in hw/core/loader.c in QEMU 4.0 and 4.1.0 does not validate the relationship between two addresses, which allows attackers to trigger an invalid memory copy operation."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://git.qemu.org/?p=qemu.git;a=commit;h=e423455c4f23a1a828901c78fe6d03b7dde79319",
              "refsource": "MISC",
              "url": "https://git.qemu.org/?p=qemu.git;a=commit;h=e423455c4f23a1a828901c78fe6d03b7dde79319"
            },
            {
              "name": "https://www.openwall.com/lists/oss-security/2020/06/03/6",
              "refsource": "CONFIRM",
              "url": "https://www.openwall.com/lists/oss-security/2020/06/03/6"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20200619-0006/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20200619-0006/"
            },
            {
              "name": "[debian-lts-announce] 20200629 [SECURITY] [DLA 2262-1] qemu security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/06/msg00032.html"
            },
            {
              "name": "[debian-lts-announce] 20200726 [SECURITY] [DLA 2288-1] qemu security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/07/msg00020.html"
            },
            {
              "name": "USN-4467-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4467-1/"
            },
            {
              "name": "https://github.com/qemu/qemu/commit/4f1c6cb2f9afafda05eab150fd2bd284edce6676",
              "refsource": "MISC",
              "url": "https://github.com/qemu/qemu/commit/4f1c6cb2f9afafda05eab150fd2bd284edce6676"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-13765",
    "datePublished": "2020-06-04T15:26:17",
    "dateReserved": "2020-06-02T00:00:00",
    "dateUpdated": "2024-08-04T12:25:16.492Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2014-3689 (GCVE-0-2014-3689)

Vulnerability from cvelistv5

Published

2014-11-14 15:00

Modified

2024-08-06 10:50

Severity ?

CWE

Summary

The vmware-vga driver (hw/display/vmware_vga.c) in QEMU allows local guest users to write to qemu memory locations and gain privileges via unspecified parameters related to rectangle handling.

References

URL

Tags

	http://secunia.com/advisories/62144	third-party-advisory, x_refsource_SECUNIA
	http://secunia.com/advisories/62143	third-party-advisory, x_refsource_SECUNIA
	http://www.debian.org/security/2014/dsa-3067	vendor-advisory, x_refsource_DEBIAN
	https://www.mail-archive.com/qemu-devel%40nongnu.org/msg261580.html	mailing-list, x_refsource_MLIST
	http://www.ubuntu.com/usn/USN-2409-1	vendor-advisory, x_refsource_UBUNTU
	http://secunia.com/advisories/60923	third-party-advisory, x_refsource_SECUNIA
	http://www.debian.org/security/2014/dsa-3066	vendor-advisory, x_refsource_DEBIAN
	http://www.osvdb.org/114397	vdb-entry, x_refsource_OSVDB

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T10:50:17.953Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "62144",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/62144"
          },
          {
            "name": "62143",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/62143"
          },
          {
            "name": "DSA-3067",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2014/dsa-3067"
          },
          {
            "name": "[Qemu-devel] 20141015 [PATCH v2 0/5] vmware-vga: fix CVE-2014-3689",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://www.mail-archive.com/qemu-devel%40nongnu.org/msg261580.html"
          },
          {
            "name": "USN-2409-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-2409-1"
          },
          {
            "name": "60923",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/60923"
          },
          {
            "name": "DSA-3066",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2014/dsa-3066"
          },
          {
            "name": "114397",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/114397"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2014-10-15T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The vmware-vga driver (hw/display/vmware_vga.c) in QEMU allows local guest users to write to qemu memory locations and gain privileges via unspecified parameters related to rectangle handling."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2014-11-14T14:57:00",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "62144",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/62144"
        },
        {
          "name": "62143",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/62143"
        },
        {
          "name": "DSA-3067",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2014/dsa-3067"
        },
        {
          "name": "[Qemu-devel] 20141015 [PATCH v2 0/5] vmware-vga: fix CVE-2014-3689",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://www.mail-archive.com/qemu-devel%40nongnu.org/msg261580.html"
        },
        {
          "name": "USN-2409-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-2409-1"
        },
        {
          "name": "60923",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/60923"
        },
        {
          "name": "DSA-3066",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2014/dsa-3066"
        },
        {
          "name": "114397",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/114397"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2014-3689",
    "datePublished": "2014-11-14T15:00:00",
    "dateReserved": "2014-05-14T00:00:00",
    "dateUpdated": "2024-08-06T10:50:17.953Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-29443 (GCVE-0-2020-29443)

Vulnerability from cvelistv5

Published

2021-01-22 07:05

Modified

2024-08-04 16:55

Severity ?

CWE

Summary

ide_atapi_cmd_reply_end in hw/ide/atapi.c in QEMU 5.1.0 allows out-of-bounds read access because a buffer index is not validated.

References

URL

Tags

	https://lists.nongnu.org/archive/html/qemu-devel/2020-11/msg04685.html	x_refsource_MISC
	http://www.openwall.com/lists/oss-security/2021/01/18/2	x_refsource_MISC
	https://lists.debian.org/debian-lts-announce/2021/02/msg00024.html	mailing-list, x_refsource_MLIST
	https://security.netapp.com/advisory/ntap-20210304-0003/	x_refsource_CONFIRM
	https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html	mailing-list, x_refsource_MLIST

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T16:55:09.673Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://lists.nongnu.org/archive/html/qemu-devel/2020-11/msg04685.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2021/01/18/2"
          },
          {
            "name": "[debian-lts-announce] 20210218 [SECURITY] [DLA 2560-1] qemu security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/02/msg00024.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20210304-0003/"
          },
          {
            "name": "[debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ide_atapi_cmd_reply_end in hw/ide/atapi.c in QEMU 5.1.0 allows out-of-bounds read access because a buffer index is not validated."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-09-05T05:06:35",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://lists.nongnu.org/archive/html/qemu-devel/2020-11/msg04685.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2021/01/18/2"
        },
        {
          "name": "[debian-lts-announce] 20210218 [SECURITY] [DLA 2560-1] qemu security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/02/msg00024.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20210304-0003/"
        },
        {
          "name": "[debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-29443",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "ide_atapi_cmd_reply_end in hw/ide/atapi.c in QEMU 5.1.0 allows out-of-bounds read access because a buffer index is not validated."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://lists.nongnu.org/archive/html/qemu-devel/2020-11/msg04685.html",
              "refsource": "MISC",
              "url": "https://lists.nongnu.org/archive/html/qemu-devel/2020-11/msg04685.html"
            },
            {
              "name": "http://www.openwall.com/lists/oss-security/2021/01/18/2",
              "refsource": "MISC",
              "url": "http://www.openwall.com/lists/oss-security/2021/01/18/2"
            },
            {
              "name": "[debian-lts-announce] 20210218 [SECURITY] [DLA 2560-1] qemu security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2021/02/msg00024.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20210304-0003/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20210304-0003/"
            },
            {
              "name": "[debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-29443",
    "datePublished": "2021-01-22T07:05:46",
    "dateReserved": "2020-12-01T00:00:00",
    "dateUpdated": "2024-08-04T16:55:09.673Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-13361 (GCVE-0-2020-13361)

Vulnerability from cvelistv5

Published

2020-05-28 13:42

Modified

2024-08-04 12:18

Severity ?

CWE

Summary

In QEMU 5.0.0 and earlier, es1370_transfer_audio in hw/audio/es1370.c does not properly validate the frame count, which allows guest OS users to trigger an out-of-bounds access during an es1370_write() operation.

References

URL

Tags

	https://lists.gnu.org/archive/html/qemu-devel/2020-05/msg03983.html	x_refsource_MISC
	http://www.openwall.com/lists/oss-security/2020/05/28/1	x_refsource_CONFIRM
	https://security-tracker.debian.org/tracker/CVE-2020-13361	x_refsource_MISC
	https://security.netapp.com/advisory/ntap-20200608-0003/	x_refsource_CONFIRM
	https://lists.debian.org/debian-lts-announce/2020/06/msg00032.html	mailing-list, x_refsource_MLIST
	https://www.debian.org/security/2020/dsa-4728	vendor-advisory, x_refsource_DEBIAN
	https://lists.debian.org/debian-lts-announce/2020/07/msg00020.html	mailing-list, x_refsource_MLIST
	http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00086.html	vendor-advisory, x_refsource_SUSE
	https://usn.ubuntu.com/4467-1/	vendor-advisory, x_refsource_UBUNTU
	https://security.gentoo.org/glsa/202011-09	vendor-advisory, x_refsource_GENTOO

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T12:18:17.617Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://lists.gnu.org/archive/html/qemu-devel/2020-05/msg03983.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2020/05/28/1"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://security-tracker.debian.org/tracker/CVE-2020-13361"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20200608-0003/"
          },
          {
            "name": "[debian-lts-announce] 20200629 [SECURITY] [DLA 2262-1] qemu security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/06/msg00032.html"
          },
          {
            "name": "DSA-4728",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2020/dsa-4728"
          },
          {
            "name": "[debian-lts-announce] 20200726 [SECURITY] [DLA 2288-1] qemu security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/07/msg00020.html"
          },
          {
            "name": "openSUSE-SU-2020:1108",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00086.html"
          },
          {
            "name": "USN-4467-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4467-1/"
          },
          {
            "name": "GLSA-202011-09",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202011-09"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2020-05-28T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "In QEMU 5.0.0 and earlier, es1370_transfer_audio in hw/audio/es1370.c does not properly validate the frame count, which allows guest OS users to trigger an out-of-bounds access during an es1370_write() operation."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-11-11T05:06:17",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://lists.gnu.org/archive/html/qemu-devel/2020-05/msg03983.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2020/05/28/1"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://security-tracker.debian.org/tracker/CVE-2020-13361"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20200608-0003/"
        },
        {
          "name": "[debian-lts-announce] 20200629 [SECURITY] [DLA 2262-1] qemu security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/06/msg00032.html"
        },
        {
          "name": "DSA-4728",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2020/dsa-4728"
        },
        {
          "name": "[debian-lts-announce] 20200726 [SECURITY] [DLA 2288-1] qemu security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/07/msg00020.html"
        },
        {
          "name": "openSUSE-SU-2020:1108",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00086.html"
        },
        {
          "name": "USN-4467-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4467-1/"
        },
        {
          "name": "GLSA-202011-09",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202011-09"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-13361",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In QEMU 5.0.0 and earlier, es1370_transfer_audio in hw/audio/es1370.c does not properly validate the frame count, which allows guest OS users to trigger an out-of-bounds access during an es1370_write() operation."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://lists.gnu.org/archive/html/qemu-devel/2020-05/msg03983.html",
              "refsource": "MISC",
              "url": "https://lists.gnu.org/archive/html/qemu-devel/2020-05/msg03983.html"
            },
            {
              "name": "http://www.openwall.com/lists/oss-security/2020/05/28/1",
              "refsource": "CONFIRM",
              "url": "http://www.openwall.com/lists/oss-security/2020/05/28/1"
            },
            {
              "name": "https://security-tracker.debian.org/tracker/CVE-2020-13361",
              "refsource": "MISC",
              "url": "https://security-tracker.debian.org/tracker/CVE-2020-13361"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20200608-0003/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20200608-0003/"
            },
            {
              "name": "[debian-lts-announce] 20200629 [SECURITY] [DLA 2262-1] qemu security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/06/msg00032.html"
            },
            {
              "name": "DSA-4728",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2020/dsa-4728"
            },
            {
              "name": "[debian-lts-announce] 20200726 [SECURITY] [DLA 2288-1] qemu security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/07/msg00020.html"
            },
            {
              "name": "openSUSE-SU-2020:1108",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00086.html"
            },
            {
              "name": "USN-4467-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4467-1/"
            },
            {
              "name": "GLSA-202011-09",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202011-09"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-13361",
    "datePublished": "2020-05-28T13:42:06",
    "dateReserved": "2020-05-21T00:00:00",
    "dateUpdated": "2024-08-04T12:18:17.617Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-20181 (GCVE-0-2021-20181)

Vulnerability from cvelistv5

Published

2021-05-13 15:24

Modified

2024-08-03 17:30

Severity ?

CWE

CWE-367 - ->CWE-416

Summary

A race condition flaw was found in the 9pfs server implementation of QEMU up to and including 5.2.0. This flaw allows a malicious 9p client to cause a use-after-free error, potentially escalating their privileges on the system. The highest threat from this vulnerability is to confidentiality, integrity as well as system availability.

References

URL

Tags

	https://www.zerodayinitiative.com/advisories/ZDI-21-159/	x_refsource_MISC
	https://lists.debian.org/debian-lts-announce/2021/02/msg00024.html	mailing-list, x_refsource_MLIST
	https://bugzilla.redhat.com/show_bug.cgi?id=1927007	x_refsource_MISC
	https://security.netapp.com/advisory/ntap-20210720-0009/	x_refsource_CONFIRM
	https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html	mailing-list, x_refsource_MLIST

Impacted products

	Vendor	Product	Version
	n/a	qemu	Version: up to, including 5.2.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:30:07.767Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.zerodayinitiative.com/advisories/ZDI-21-159/"
          },
          {
            "name": "[debian-lts-announce] 20210218 [SECURITY] [DLA 2560-1] qemu security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/02/msg00024.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1927007"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20210720-0009/"
          },
          {
            "name": "[debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "qemu",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "up to, including 5.2.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A race condition flaw was found in the 9pfs server implementation of QEMU up to and including 5.2.0. This flaw allows a malicious 9p client to cause a use-after-free error, potentially escalating their privileges on the system. The highest threat from this vulnerability is to confidentiality, integrity as well as system availability."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-367",
              "description": "CWE-367-\u003eCWE-416",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-09-05T05:06:09",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-21-159/"
        },
        {
          "name": "[debian-lts-announce] 20210218 [SECURITY] [DLA 2560-1] qemu security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/02/msg00024.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1927007"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20210720-0009/"
        },
        {
          "name": "[debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2021-20181",
    "datePublished": "2021-05-13T15:24:15",
    "dateReserved": "2020-12-17T00:00:00",
    "dateUpdated": "2024-08-03T17:30:07.767Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-25625 (GCVE-0-2020-25625)

Vulnerability from cvelistv5

Published

2020-09-25 04:12

Modified

2024-08-04 15:40

Severity ?

CWE

Summary

hw/usb/hcd-ohci.c in QEMU 5.0.0 has an infinite loop when a TD list has a loop.

References

URL

Tags

	https://lists.nongnu.org/archive/html/qemu-devel/2020-09/msg05905.html	x_refsource_MISC
	http://www.openwall.com/lists/oss-security/2020/09/17/1	x_refsource_CONFIRM
	https://security.netapp.com/advisory/ntap-20201009-0005/	x_refsource_CONFIRM
	https://lists.debian.org/debian-lts-announce/2020/11/msg00047.html	mailing-list, x_refsource_MLIST
	https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html	mailing-list, x_refsource_MLIST

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T15:40:35.441Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://lists.nongnu.org/archive/html/qemu-devel/2020-09/msg05905.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2020/09/17/1"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20201009-0005/"
          },
          {
            "name": "[debian-lts-announce] 20201129 [SECURITY] [DLA 2469-1] qemu security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/11/msg00047.html"
          },
          {
            "name": "[debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "hw/usb/hcd-ohci.c in QEMU 5.0.0 has an infinite loop when a TD list has a loop."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-09-05T05:06:38",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://lists.nongnu.org/archive/html/qemu-devel/2020-09/msg05905.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2020/09/17/1"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20201009-0005/"
        },
        {
          "name": "[debian-lts-announce] 20201129 [SECURITY] [DLA 2469-1] qemu security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/11/msg00047.html"
        },
        {
          "name": "[debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-25625",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "hw/usb/hcd-ohci.c in QEMU 5.0.0 has an infinite loop when a TD list has a loop."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://lists.nongnu.org/archive/html/qemu-devel/2020-09/msg05905.html",
              "refsource": "MISC",
              "url": "https://lists.nongnu.org/archive/html/qemu-devel/2020-09/msg05905.html"
            },
            {
              "name": "http://www.openwall.com/lists/oss-security/2020/09/17/1",
              "refsource": "CONFIRM",
              "url": "http://www.openwall.com/lists/oss-security/2020/09/17/1"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20201009-0005/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20201009-0005/"
            },
            {
              "name": "[debian-lts-announce] 20201129 [SECURITY] [DLA 2469-1] qemu security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/11/msg00047.html"
            },
            {
              "name": "[debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-25625",
    "datePublished": "2020-09-25T04:12:07",
    "dateReserved": "2020-09-16T00:00:00",
    "dateUpdated": "2024-08-04T15:40:35.441Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-14364 (GCVE-0-2020-14364)

Vulnerability from cvelistv5

Published

2020-08-31 17:11

Modified

2024-08-04 12:46

Severity ?

CWE

CWE-125 - leads to CWE-787

Summary

An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU in versions before 5.2.0. This issue occurs while processing USB packets from a guest when USBDevice 'setup_len' exceeds its 'data_buf[4096]' in the do_token_in, do_token_out routines. This flaw allows a guest user to crash the QEMU process, resulting in a denial of service, or the potential execution of arbitrary code with the privileges of the QEMU process on the host.

References

URL

Tags

	https://bugzilla.redhat.com/show_bug.cgi?id=1869201	x_refsource_MISC
	https://www.openwall.com/lists/oss-security/2020/08/24/3	x_refsource_MISC
	https://www.openwall.com/lists/oss-security/2020/08/24/2	x_refsource_MISC
	https://www.debian.org/security/2020/dsa-4760	vendor-advisory, x_refsource_DEBIAN
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JTZQUQ6ZBPMFMNAUQBVJFELYNMUZLL6P/	vendor-advisory, x_refsource_FEDORA
	https://lists.debian.org/debian-lts-announce/2020/09/msg00013.html	mailing-list, x_refsource_MLIST
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M52WIRMZL6TZRYZ65N6OAYNNFHV62O2N/	vendor-advisory, x_refsource_FEDORA
	https://usn.ubuntu.com/4511-1/	vendor-advisory, x_refsource_UBUNTU
	https://security.netapp.com/advisory/ntap-20200924-0006/	x_refsource_CONFIRM
	https://security.gentoo.org/glsa/202009-14	vendor-advisory, x_refsource_GENTOO
	http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00024.html	vendor-advisory, x_refsource_SUSE
	https://security.gentoo.org/glsa/202011-09	vendor-advisory, x_refsource_GENTOO

Impacted products

	Vendor	Product	Version
	n/a	QEMU	Version: QEMU versions before 5.2.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T12:46:34.192Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1869201"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.openwall.com/lists/oss-security/2020/08/24/3"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.openwall.com/lists/oss-security/2020/08/24/2"
          },
          {
            "name": "DSA-4760",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2020/dsa-4760"
          },
          {
            "name": "FEDORA-2020-3689b67b53",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JTZQUQ6ZBPMFMNAUQBVJFELYNMUZLL6P/"
          },
          {
            "name": "[debian-lts-announce] 20200913 [SECURITY] [DLA 2373-1] qemu security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/09/msg00013.html"
          },
          {
            "name": "FEDORA-2020-eeb29955ed",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M52WIRMZL6TZRYZ65N6OAYNNFHV62O2N/"
          },
          {
            "name": "USN-4511-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4511-1/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20200924-0006/"
          },
          {
            "name": "GLSA-202009-14",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202009-14"
          },
          {
            "name": "openSUSE-SU-2020:1664",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00024.html"
          },
          {
            "name": "GLSA-202011-09",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202011-09"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "QEMU",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "QEMU versions before 5.2.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU in versions before 5.2.0. This issue occurs while processing USB packets from a guest when USBDevice \u0027setup_len\u0027 exceeds its \u0027data_buf[4096]\u0027 in the do_token_in, do_token_out routines. This flaw allows a guest user to crash the QEMU process, resulting in a denial of service, or the potential execution of arbitrary code with the privileges of the QEMU process on the host."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125 leads to CWE-787",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-11-11T05:06:21",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1869201"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.openwall.com/lists/oss-security/2020/08/24/3"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.openwall.com/lists/oss-security/2020/08/24/2"
        },
        {
          "name": "DSA-4760",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2020/dsa-4760"
        },
        {
          "name": "FEDORA-2020-3689b67b53",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JTZQUQ6ZBPMFMNAUQBVJFELYNMUZLL6P/"
        },
        {
          "name": "[debian-lts-announce] 20200913 [SECURITY] [DLA 2373-1] qemu security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/09/msg00013.html"
        },
        {
          "name": "FEDORA-2020-eeb29955ed",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M52WIRMZL6TZRYZ65N6OAYNNFHV62O2N/"
        },
        {
          "name": "USN-4511-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4511-1/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20200924-0006/"
        },
        {
          "name": "GLSA-202009-14",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202009-14"
        },
        {
          "name": "openSUSE-SU-2020:1664",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00024.html"
        },
        {
          "name": "GLSA-202011-09",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202011-09"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2020-14364",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "QEMU",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "QEMU versions before 5.2.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU in versions before 5.2.0. This issue occurs while processing USB packets from a guest when USBDevice \u0027setup_len\u0027 exceeds its \u0027data_buf[4096]\u0027 in the do_token_in, do_token_out routines. This flaw allows a guest user to crash the QEMU process, resulting in a denial of service, or the potential execution of arbitrary code with the privileges of the QEMU process on the host."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-125 leads to CWE-787"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1869201",
              "refsource": "MISC",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1869201"
            },
            {
              "name": "https://www.openwall.com/lists/oss-security/2020/08/24/3",
              "refsource": "MISC",
              "url": "https://www.openwall.com/lists/oss-security/2020/08/24/3"
            },
            {
              "name": "https://www.openwall.com/lists/oss-security/2020/08/24/2",
              "refsource": "MISC",
              "url": "https://www.openwall.com/lists/oss-security/2020/08/24/2"
            },
            {
              "name": "DSA-4760",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2020/dsa-4760"
            },
            {
              "name": "FEDORA-2020-3689b67b53",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JTZQUQ6ZBPMFMNAUQBVJFELYNMUZLL6P/"
            },
            {
              "name": "[debian-lts-announce] 20200913 [SECURITY] [DLA 2373-1] qemu security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/09/msg00013.html"
            },
            {
              "name": "FEDORA-2020-eeb29955ed",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M52WIRMZL6TZRYZ65N6OAYNNFHV62O2N/"
            },
            {
              "name": "USN-4511-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4511-1/"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20200924-0006/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20200924-0006/"
            },
            {
              "name": "GLSA-202009-14",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202009-14"
            },
            {
              "name": "openSUSE-SU-2020:1664",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00024.html"
            },
            {
              "name": "GLSA-202011-09",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202011-09"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2020-14364",
    "datePublished": "2020-08-31T17:11:52",
    "dateReserved": "2020-06-17T00:00:00",
    "dateUpdated": "2024-08-04T12:46:34.192Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-13362 (GCVE-0-2020-13362)

Vulnerability from cvelistv5

Published

2020-05-28 14:35

Modified

2024-08-04 12:18

Severity ?

CWE

Summary

In QEMU 5.0.0 and earlier, megasas_lookup_frame in hw/scsi/megasas.c has an out-of-bounds read via a crafted reply_queue_head field from a guest OS user.

References

URL

Tags

	https://lists.gnu.org/archive/html/qemu-devel/2020-05/msg06250.html	x_refsource_MISC
	https://lists.gnu.org/archive/html/qemu-devel/2020-05/msg03131.html	x_refsource_MISC
	http://www.openwall.com/lists/oss-security/2020/05/28/2	x_refsource_CONFIRM
	https://security-tracker.debian.org/tracker/CVE-2020-13362	x_refsource_MISC
	https://security.netapp.com/advisory/ntap-20200608-0003/	x_refsource_CONFIRM
	https://lists.debian.org/debian-lts-announce/2020/06/msg00032.html	mailing-list, x_refsource_MLIST
	https://www.debian.org/security/2020/dsa-4728	vendor-advisory, x_refsource_DEBIAN
	https://lists.debian.org/debian-lts-announce/2020/07/msg00020.html	mailing-list, x_refsource_MLIST
	http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00086.html	vendor-advisory, x_refsource_SUSE
	https://usn.ubuntu.com/4467-1/	vendor-advisory, x_refsource_UBUNTU
	https://security.gentoo.org/glsa/202011-09	vendor-advisory, x_refsource_GENTOO

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T12:18:18.087Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://lists.gnu.org/archive/html/qemu-devel/2020-05/msg06250.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://lists.gnu.org/archive/html/qemu-devel/2020-05/msg03131.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2020/05/28/2"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://security-tracker.debian.org/tracker/CVE-2020-13362"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20200608-0003/"
          },
          {
            "name": "[debian-lts-announce] 20200629 [SECURITY] [DLA 2262-1] qemu security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/06/msg00032.html"
          },
          {
            "name": "DSA-4728",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2020/dsa-4728"
          },
          {
            "name": "[debian-lts-announce] 20200726 [SECURITY] [DLA 2288-1] qemu security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/07/msg00020.html"
          },
          {
            "name": "openSUSE-SU-2020:1108",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00086.html"
          },
          {
            "name": "USN-4467-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4467-1/"
          },
          {
            "name": "GLSA-202011-09",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202011-09"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2020-05-28T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "In QEMU 5.0.0 and earlier, megasas_lookup_frame in hw/scsi/megasas.c has an out-of-bounds read via a crafted reply_queue_head field from a guest OS user."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-11-11T05:06:16",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://lists.gnu.org/archive/html/qemu-devel/2020-05/msg06250.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://lists.gnu.org/archive/html/qemu-devel/2020-05/msg03131.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2020/05/28/2"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://security-tracker.debian.org/tracker/CVE-2020-13362"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20200608-0003/"
        },
        {
          "name": "[debian-lts-announce] 20200629 [SECURITY] [DLA 2262-1] qemu security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/06/msg00032.html"
        },
        {
          "name": "DSA-4728",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2020/dsa-4728"
        },
        {
          "name": "[debian-lts-announce] 20200726 [SECURITY] [DLA 2288-1] qemu security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/07/msg00020.html"
        },
        {
          "name": "openSUSE-SU-2020:1108",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00086.html"
        },
        {
          "name": "USN-4467-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4467-1/"
        },
        {
          "name": "GLSA-202011-09",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202011-09"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-13362",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In QEMU 5.0.0 and earlier, megasas_lookup_frame in hw/scsi/megasas.c has an out-of-bounds read via a crafted reply_queue_head field from a guest OS user."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://lists.gnu.org/archive/html/qemu-devel/2020-05/msg06250.html",
              "refsource": "MISC",
              "url": "https://lists.gnu.org/archive/html/qemu-devel/2020-05/msg06250.html"
            },
            {
              "name": "https://lists.gnu.org/archive/html/qemu-devel/2020-05/msg03131.html",
              "refsource": "MISC",
              "url": "https://lists.gnu.org/archive/html/qemu-devel/2020-05/msg03131.html"
            },
            {
              "name": "http://www.openwall.com/lists/oss-security/2020/05/28/2",
              "refsource": "CONFIRM",
              "url": "http://www.openwall.com/lists/oss-security/2020/05/28/2"
            },
            {
              "name": "https://security-tracker.debian.org/tracker/CVE-2020-13362",
              "refsource": "MISC",
              "url": "https://security-tracker.debian.org/tracker/CVE-2020-13362"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20200608-0003/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20200608-0003/"
            },
            {
              "name": "[debian-lts-announce] 20200629 [SECURITY] [DLA 2262-1] qemu security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/06/msg00032.html"
            },
            {
              "name": "DSA-4728",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2020/dsa-4728"
            },
            {
              "name": "[debian-lts-announce] 20200726 [SECURITY] [DLA 2288-1] qemu security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/07/msg00020.html"
            },
            {
              "name": "openSUSE-SU-2020:1108",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00086.html"
            },
            {
              "name": "USN-4467-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4467-1/"
            },
            {
              "name": "GLSA-202011-09",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202011-09"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-13362",
    "datePublished": "2020-05-28T14:35:24",
    "dateReserved": "2020-05-21T00:00:00",
    "dateUpdated": "2024-08-04T12:18:18.087Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-25624 (GCVE-0-2020-25624)

Vulnerability from cvelistv5

Published

2020-11-30 06:28

Modified

2024-08-04 15:40

Severity ?

CWE

Summary

hw/usb/hcd-ohci.c in QEMU 5.0.0 has a stack-based buffer over-read via values obtained from the host controller driver.

References

URL

Tags

	https://lists.nongnu.org/archive/html/qemu-devel/2020-09/msg05492.html	x_refsource_MISC
	https://security.netapp.com/advisory/ntap-20201210-0005/	x_refsource_CONFIRM
	https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html	mailing-list, x_refsource_MLIST

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T15:40:35.411Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://lists.nongnu.org/archive/html/qemu-devel/2020-09/msg05492.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20201210-0005/"
          },
          {
            "name": "[debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "hw/usb/hcd-ohci.c in QEMU 5.0.0 has a stack-based buffer over-read via values obtained from the host controller driver."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-09-05T05:06:14",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://lists.nongnu.org/archive/html/qemu-devel/2020-09/msg05492.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20201210-0005/"
        },
        {
          "name": "[debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-25624",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "hw/usb/hcd-ohci.c in QEMU 5.0.0 has a stack-based buffer over-read via values obtained from the host controller driver."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://lists.nongnu.org/archive/html/qemu-devel/2020-09/msg05492.html",
              "refsource": "MISC",
              "url": "https://lists.nongnu.org/archive/html/qemu-devel/2020-09/msg05492.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20201210-0005/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20201210-0005/"
            },
            {
              "name": "[debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-25624",
    "datePublished": "2020-11-30T06:28:17",
    "dateReserved": "2020-09-16T00:00:00",
    "dateUpdated": "2024-08-04T15:40:35.411Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

suse-su-2021:14704-1

Vulnerability from csaf_suse

CVE-2020-12829 (GCVE-0-2020-12829)

Vulnerability from cvelistv5

CVE-2015-1779 (GCVE-0-2015-1779)

Vulnerability from cvelistv5

CVE-2020-29130 (GCVE-0-2020-29130)

Vulnerability from cvelistv5

CVE-2020-25723 (GCVE-0-2020-25723)

Vulnerability from cvelistv5

CVE-2021-20257 (GCVE-0-2021-20257)

Vulnerability from cvelistv5

CVE-2020-25084 (GCVE-0-2020-25084)

Vulnerability from cvelistv5

CVE-2020-13765 (GCVE-0-2020-13765)

Vulnerability from cvelistv5

CVE-2014-3689 (GCVE-0-2014-3689)

Vulnerability from cvelistv5

CVE-2020-29443 (GCVE-0-2020-29443)

Vulnerability from cvelistv5

CVE-2020-13361 (GCVE-0-2020-13361)

Vulnerability from cvelistv5

CVE-2021-20181 (GCVE-0-2021-20181)

Vulnerability from cvelistv5

CVE-2020-25625 (GCVE-0-2020-25625)

Vulnerability from cvelistv5

CVE-2020-14364 (GCVE-0-2020-14364)

Vulnerability from cvelistv5

CVE-2020-13362 (GCVE-0-2020-13362)

Vulnerability from cvelistv5

CVE-2020-25624 (GCVE-0-2020-25624)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature