QEMU path traversal vulnerability (CNVD-2020-47039)

QEMU Quick Emulator is a set of simulation processor software by French software developer Fabrice Bellard. The software is fast, cross-platform and other characteristics. A path traversal vulnerability exists in ati2dblt in QEMU's ATI VGA devices. The vulnerability stems from the failure of a...

SUSE SLES12 Security Update : libvirt (SUSE-SU-2020:2233-1)

This update for libvirt fixes the following issues : CVE-2020-14339: Don't leak /dev/mapper/control into QEMU. Use ioctl's to obtain the dependency tree of disks and drop use of libdevmapper. - bsc1161883, bsc1174458 qemu: Setup emulator thread and cpuset.mems before exec - bsc1171946 libxl:...

SUSE-SU-2020:2233-1 Security update for libvirt

This update for libvirt fixes the following issues: - CVE-2020-14339: Don't leak /dev/mapper/control into QEMU. Use ioctl's to obtain the dependency tree of disks and drop use of libdevmapper. - bsc1161883, bsc1174458 - qemu: Setup emulator thread and cpuset.mems before exec - bsc1171946 - libxl:...

QEMU Input Validation Error Vulnerability (CNVD-2020-46814)

QEMU Quick Emulator is a set of simulation processor software by French software developer Fabrice Bellard. The software is fast, cross-platform and other characteristics. A security vulnerability exists in QEMU 5.0.0 and earlier versions. An attacker could exploit the vulnerability to cause a...

QEMU Buffer Overflow Vulnerability (CNVD-2020-44638)

QEMU Quick Emulator is a set of simulation processor software by French software developer Fabrice Bellard. The software is fast, cross-platform and other characteristics. A buffer overflow vulnerability exists in the hw/net/xgmac.c file in the XGMAC Ethernet controller in versions prior to QEMU...

Log injection in uvicorn

This affects all versions of package uvicorn. The request logger provided by the package is vulnerable to ASNI escape sequence injection. Whenever any HTTP request is received, the default behaviour of uvicorn is to log its details to either the console or a log file. When attackers request craft...

Design/Logic Flaw

This affects all versions of package uvicorn. The request logger provided by the package is vulnerable to ASNI escape sequence injection. Whenever any HTTP request is received, the default behaviour of uvicorn is to log its details to either the console or a log file. When attackers request craft...

CVE-2020-7694

This affects all versions of package uvicorn. The request logger provided by the package is vulnerable to ASNI escape sequence injection. Whenever any HTTP request is received, the default behaviour of uvicorn is to log its details to either the console or a log file. When attackers request craft...

CVE-2020-7694 Log Injection

This affects all versions of package uvicorn. The request logger provided by the package is vulnerable to ASNI escape sequence injection. Whenever any HTTP request is received, the default behaviour of uvicorn is to log its details to either the console or a log file. When attackers request craft...

CVE-2020-15863

A buffer overflow vulnerability was found in the XGMAC Ethernet controller of the QEMU emulator. This flaw occurs during packet transmission and affects the highbank and midway emulated machines. A guest user or process could use this flaw to crash the QEMU process on the host, resulting in a...

QEMU Resource Management Error Vulnerability (CNVD-2020-42658)

QEMU Quick Emulator is a set of simulation processor software by French software developer Fabrice Bellard. The software is fast, cross-platform and other characteristics. A security vulnerability exists in the hw/net/e1000ecore.c file in QEMU version 4.2.0. An attacker can exploit this...

QEMU: slirp: use-after-free in ip_reass() function in ip_input.c

A use-after-free flaw was found in the SLiRP networking implementation of the QEMU emulator. Specifically, this flaw occurs in the ipreass routine while reassembling incoming IP fragments whose combined size is bigger than 65k. This flaw allows an attacker to crash the QEMU process on the host,...

[SECURITY] Fedora 32 Update: libslirp-4.3.1-1.fc32

A general purpose TCP-IP emulator used by virtual machine hypervisors to provide virtual networking services...

QEMU libslirp Buffer Overflow Vulnerability

QEMU Quick Emulator is a suite of simulation processor software by French software developer Fabrice Bellard. The software is fast and cross-platform. libslirp is a general-purpose TCP-IP simulator for managing virtual network services in a hypervisor. A buffer overflow vulnerability exists in th...

CVE-2020-10756

An out-of-bounds read vulnerability was found in the SLiRP networking implementation of the QEMU emulator. This flaw occurs in the icmp6sendechoreply routine while replying to an ICMP echo request, also known as ping. This flaw allows a malicious guest to leak the contents of the host memory,...

DEBIAN-CVE-2020-10756

An out-of-bounds read vulnerability was found in the SLiRP networking implementation of the QEMU emulator. This flaw occurs in the icmp6sendechoreply routine while replying to an ICMP echo request, also known as ping. This flaw allows a malicious guest to leak the contents of the host memory,...

The vulnerability of the pvrdma_realize function in the PVRDMA virtual network adapter allows a hacker to induce a service failure.

The vulnerability of the pvrdmarealize function in the PVRDMA virtual network adapter emulator for hardware emulation software QEMU is related to deficiencies in resource release after the expiration of its useful lifespan. Exploiting this vulnerability can allow an attacker to cause a service...

The vulnerability of the uar_read and uar_write functions in the PVRDMA virtual network adapter emulator for hardware emulation software QEMU allows a hacker to induce a service failure.

The vulnerability of the uarread and uarwrite functions in the PVRDMA virtual network adapter emulator for hardware emulation software QEMU is related to pointer arithmetic errors. Exploiting this vulnerability can allow a remote attacker to cause a service failure...

The vulnerability of the `create_cq` and `create_qp` functions in the PVRDMA virtual network adapter emulator for hardware infrastructure emulation software QEMU allows a hacker to induce a service failure.

The vulnerability of the createcq and createqp functions in the PVRDMA virtual network adapter emulator for hardware support in QEMU is related to deficiencies in resource release after the expiration of its useful lifespan. Exploiting this vulnerability can allow an attacker to cause a service...

The vulnerability of the pvrdma_idx_ring_has_ function in the PVRDMA virtual network adapter emulator for hardware infrastructure in QEMU allows a hacker to induce a service failure.

The vulnerability of the pvrdmaidxringhas function in the PVRDMA virtual network adapter software and the QEMU hardware emulation environment is related to the execution of a loop with an unreachable exit condition. Exploiting this vulnerability can allow a remote attacker to cause a service...