Amazon Linux 2 : qemu (ALAS-2023-2061)

The version of qemu installed on the remote host is prior to 3.1.0-8. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2061 advisory. A NULL pointer dereference flaw was found in the floppy disk emulator of QEMU. This issue occurs while processing read/write...

spice-usbredir:usbredirparserfuzz: Heap-use-after-free in usbredirparser_serialize

Project: https://gitlab.freedesktop.org/spice/usbredir.git Detailed Report: https://oss-fuzz.com/testcase?key=6119613912973312 Project: spice-usbredir Fuzzing Engine: libFuzzer Fuzz Target: usbredirparserfuzz Job Type: libfuzzerasanspice-usbredir Platform Id: linux Crash Type: Heap-use-after-free...

CVE-2021-3527

A flaw was found in the USB redirector device usb-redir of QEMU. Small USB packets are combined into a single, large transfer request, to reduce the overhead and improve performance. The combined size of the bulk transfer is used to dynamically allocate a variable length array VLA on the stack...

CVE-2021-3527: Allocation of Resources Without Limits or Throttling

A flaw was found in the USB redirector device usb-redir of QEMU. Small USB packets are combined into a single, large transfer request, to reduce the overhead and improve performance. The combined size of the bulk transfer is used to dynamically allocate a variable length array VLA on the stack...