QEMU: Slirp: potential OOB access due to unsafe snprintf() usages

An out-of-bounds heap buffer access flaw was found in the SLiRP networking implementation of the QEMU emulator. This flaw occurs in tcpemu routine while emulating IRC and other protocols due to unsafe usage of the snprintf3 function. A user or process could use this flaw to crash the QEMU process...

Debian DLA-2142-1 : slirp security update

It was discovered that there was a buffer overflow vulnerability in slirp, a SLIP/PPP emulator for using a dial up shell account. This was caused by the incorrect usage of return values from snprintf3. For Debian 8 'Jessie', this issue has been fixed in slirp version 1:1.0.17-7+deb8u2. We recomme...

[SECURITY] [DLA 2142-1] slirp security update

Package : slirp Version : 1:1.0.17-7+deb8u2 CVE ID : CVE-2020-8608 It was discovered that there was a buffer overflow vulnerability in slirp, a SLIP/PPP emulator for using a dial up shell account. This was caused by the incorrect usage of return values from snprintf3. For Debian 8 "Jessie", this...

DLA-2142-1 slirp - security update

Bulletin has no description...

CentOS 6 : qemu-kvm (RHSA-2020:0775)

The remote CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:0775 advisory. - ipreass in ipinput.c in libslirp 4.0.0 has a heap-based buffer overflow via a large packet because it mishandles a case involving the first fragment...

qemu security update

CentOS Errata and Security Advisory CESA-2020:0775 An update for qemu-kvm is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severit...

Important: Red Hat Security Advisory: qemu-kvm security update

An update for qemu-kvm is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

QEMU: Slirp: use-after-free during packet reassembly

A use-after-free issue was found in the SLiRP networking implementation of the QEMU emulator. The issue occurs in ipreass routine while reassembling incoming packets, if the first fragment is bigger than the m-mdat buffer. A user or process could use this flaw to crash the QEMU process on the hos...

QEMU: slirp: OOB buffer access while emulating tcp protocols in tcp_emu()

A heap buffer overflow issue was found in the SLiRP networking implementation of the QEMU emulator. This flaw occurs in the tcpemu routine while emulating IRC and other protocols. An attacker could use this flaw to crash the QEMU process on the host, resulting in a denial of service or potential...

QEMU: slirp: heap buffer overflow during packet reassembly

A heap buffer overflow issue was found in the SLiRP networking implementation of the QEMU emulator. This flaw occurs in the ipreass routine while reassembling incoming packets if the first fragment is bigger than the m-mdat buffer. An attacker could use this flaw to crash the QEMU process on the...

qemu-kvm security update

0.12.1.2-2.506.el610.6 - kvm-Fix-heap-overflow-in-ipreass-on-big-packet-input.patch bz1734747 - kvm-Using-ipdeq-after-mfree-might-read-pointers-from-a.patch bz1749731 - kvm-tcpemu-Fix-oob-access.patch bz1791558 - kvm-slirp-use-correct-size-while-emulating-IRC-commands.patch bz1791558 -...

The vulnerability of the TCP/IP emulator tcp_emu(), Slirp emulator, and the hardware emulation software QEMU allows a hacker to induce a service failure.

The vulnerability of the tcpemu function slirp/tcpsubr.c of the Slirp TCP/IP emulator and the QEMU hardware emulation software is related to the execution of operations outside the data buffer “scrcv-sbdata”. Exploiting this vulnerability can allow an attacker to cause a service failure...

QEMU: Slirp: potential OOB access due to unsafe snprintf() usages

An out-of-bounds heap buffer access flaw was found in the SLiRP networking implementation of the QEMU emulator. This flaw occurs in tcpemu routine while emulating IRC and other protocols due to unsafe usage of the snprintf3 function. A user or process could use this flaw to crash the QEMU process...

QEMU: Slirp: potential directory traversal using relative paths via tftp server on Windows host

A potential directory traversal issue was found in the tftp server of the SLiRP user-mode networking implementation used by QEMU. It could occur on a Windows host, as it allows the use of both forward '/' and backward slash'' tokens as separators in a file path. A user able to access the tftp...

QEMU: slirp: OOB buffer access while emulating tcp protocols in tcp_emu()

A heap buffer overflow issue was found in the SLiRP networking implementation of the QEMU emulator. This flaw occurs in the tcpemu routine while emulating IRC and other protocols. An attacker could use this flaw to crash the QEMU process on the host, resulting in a denial of service or potential...

qemu security update

CentOS Errata and Security Advisory CESA-2020:0366 An update for qemu-kvm is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severit...

RHEL 8 : container-tools:rhel8 (RHSA-2020:0348)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:0348 advisory. The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Security Fixes: QEMU: slir...

QEMU: slirp: heap buffer overflow during packet reassembly

A heap buffer overflow issue was found in the SLiRP networking implementation of the QEMU emulator. This flaw occurs in the ipreass routine while reassembling incoming packets if the first fragment is bigger than the m-mdat buffer. An attacker could use this flaw to crash the QEMU process on the...

Important: Red Hat Security Advisory: container-tools:rhel8 security, bug fix, and enhancement update

An update for the container-tools:rhel8 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

QEMU: Slirp: use-after-free during packet reassembly

A use-after-free issue was found in the SLiRP networking implementation of the QEMU emulator. The issue occurs in ipreass routine while reassembling incoming packets, if the first fragment is bigger than the m-mdat buffer. A user or process could use this flaw to crash the QEMU process on the hos...