[SECURITY] [DLA 2076-1] slirp security update

2020-01-2621:43:12

lists.debian.org

5.6 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.004 Low

EPSS

Percentile

71.9%

JSON

Package : slirp
Version : 1:1.0.17-7+deb8u1
CVE ID : CVE-2020-7039
Debian Bug : 949085

An issue has been found in slirp, a SLIP/PPP emulator using a dial up
shell account.
Due to bad memory handling in slirp a heap-based buffer overflow or other
out-of-bounds access could happen, which can lead to a DoS or potential
execute arbitrary code.

For Debian 8 "Jessie", this problem has been fixed in version
1:1.0.17-7+deb8u1.

We recommend that you upgrade your slirp packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

OSVersionArchitecturePackageVersionFilename
Debian10mips64elqemu-system-gui-dbgsym< 1:3.1+dfsg-8+deb10u4qemu-system-gui-dbgsym_1:3.1+dfsg-8+deb10u4_mips64el.deb
Debian9amd64qemu-user-static-dbgsym< 1:2.8+dfsg-6+deb9u9qemu-user-static-dbgsym_1:2.8+dfsg-6+deb9u9_amd64.deb
Debian10s390xqemu-system-ppc< 1:3.1+dfsg-8+deb10u4qemu-system-ppc_1:3.1+dfsg-8+deb10u4_s390x.deb
Debian9s390xqemu-utils< 1:2.8+dfsg-6+deb9u9qemu-utils_1:2.8+dfsg-6+deb9u9_s390x.deb
Debian10armelqemu-system-arm< 1:3.1+dfsg-8+deb10u4qemu-system-arm_1:3.1+dfsg-8+deb10u4_armel.deb
Debian10amd64slirp-dbgsym< 1:1.0.17-8+deb10u1slirp-dbgsym_1:1.0.17-8+deb10u1_amd64.deb
Debian9i386qemu-system-arm-dbgsym< 1:2.8+dfsg-6+deb9u9qemu-system-arm-dbgsym_1:2.8+dfsg-6+deb9u9_i386.deb
Debian10mipsqemu-system-misc< 1:3.1+dfsg-8+deb10u4qemu-system-misc_1:3.1+dfsg-8+deb10u4_mips.deb
Debian9ppc64elqemu-system-misc-dbgsym< 1:2.8+dfsg-6+deb9u9qemu-system-misc-dbgsym_1:2.8+dfsg-6+deb9u9_ppc64el.deb
Debian10armelqemu-utils< 1:3.1+dfsg-8+deb10u4qemu-utils_1:3.1+dfsg-8+deb10u4_armel.deb

OS	Version	Architecture	Package	Version	Filename
Debian	10	mips64el	qemu-system-gui-dbgsym	< 1:3.1+dfsg-8+deb10u4	qemu-system-gui-dbgsym_1:3.1+dfsg-8+deb10u4_mips64el.deb
Debian	9	amd64	qemu-user-static-dbgsym	< 1:2.8+dfsg-6+deb9u9	qemu-user-static-dbgsym_1:2.8+dfsg-6+deb9u9_amd64.deb
Debian	10	s390x	qemu-system-ppc	< 1:3.1+dfsg-8+deb10u4	qemu-system-ppc_1:3.1+dfsg-8+deb10u4_s390x.deb
Debian	9	s390x	qemu-utils	< 1:2.8+dfsg-6+deb9u9	qemu-utils_1:2.8+dfsg-6+deb9u9_s390x.deb
Debian	10	armel	qemu-system-arm	< 1:3.1+dfsg-8+deb10u4	qemu-system-arm_1:3.1+dfsg-8+deb10u4_armel.deb
Debian	10	amd64	slirp-dbgsym	< 1:1.0.17-8+deb10u1	slirp-dbgsym_1:1.0.17-8+deb10u1_amd64.deb
Debian	9	i386	qemu-system-arm-dbgsym	< 1:2.8+dfsg-6+deb9u9	qemu-system-arm-dbgsym_1:2.8+dfsg-6+deb9u9_i386.deb
Debian	10	mips	qemu-system-misc	< 1:3.1+dfsg-8+deb10u4	qemu-system-misc_1:3.1+dfsg-8+deb10u4_mips.deb
Debian	9	ppc64el	qemu-system-misc-dbgsym	< 1:2.8+dfsg-6+deb9u9	qemu-system-misc-dbgsym_1:2.8+dfsg-6+deb9u9_ppc64el.deb
Debian	10	armel	qemu-utils	< 1:3.1+dfsg-8+deb10u4	qemu-utils_1:3.1+dfsg-8+deb10u4_armel.deb