Advisory ROSA-SA-2023-2302

software: qemu 7.2.0
OS: ROSA-CHROME

package_evr_string: qemu-7.2.0-2.src.rpm

CVE-ID: CVE-2023-0330
BDU-ID: 2023-04834
CVE-Crit: MEDIUM
CVE-DESC.: A vulnerability in the lsi53c895a.c component of the QEMU hardware emulator is related to writing beyond buffer boundaries. Exploitation of the vulnerability could allow an attacker to cause a denial of service
CVE-STATUS: Fixed
CVE-REV: To close, run the command: sudo dnf update qemu

CVE-ID: CVE-2023-4135
BDU-ID: None
CVE-Crit: MEDIUM
CVE-DESC.: An error was detected in the nvme virtual device in QEMU for reading memory outside the heap. The QEMU process does not check the offset provided by the guest before calculating the host heap pointer, which is used to copy data back to the guest. An arbitrary memory heap may be exposed relative to the allocated buffer
CVE-STATUS: Fixed
CVE-REV: To close, run the command: sudo dnf update qemu