CVE-2020-10756

CVE-2020-10756 is a concrete vulnerability in the QEMU SLiRP networking (libslirp) implementation. The issue is an out-of-bounds read in icmp6_send_echoreply() when replying to ICMP echo requests, enabling a guest to leak host memory and cause information disclosure. Affected component/version: l...

CVE-2020-1983

CVE-2020-1983 is a use-after-free in SLiRP’s ip_reass() (ip_input.c) affecting libslirp 4.2.0 and earlier, exploitable via crafted IP fragments to crash the QEMU host process (DoS). Connected advisories confirm this in QEMU SLiRP, with remediation by upgrading QEMU/libslirp to fixed releases (e.g...

CVE-2020-7039

CVE-2020-7039 affects SLiRP’s tcp_emu in libslirp (used by QEMU 4.2.0); memory mismanagement can cause a heap-based buffer overflow leading to DoS or potential arbitrary code execution. Public advisories confirm fixes are shipped in updated qemu-kvm/qemu releases (e.g., Debian: 1:1.0.17-8+deb9u1;...

CVE-2021-3593

CVE-2021-3593 (libslirp) : A flaw in the SLiRP networking implementation of QEMU exists in the udp6_input() path, where processing a UDP packet smaller than the size of the udphdr can cause an out-of-bounds read or indirect host memory disclosure to the guest. Affected versions are libslirp prior...

CVE-2019-14378

CVE-2019-14378 is a heap-based buffer overflow in SLiRP (ip_reass in libslirp 4.0.0) used by QEMU’s networking, triggered by reassembling large first fragments. The issue can allow a QEMU process crash and, depending on context, may lead to code execution with the host/QEMU process privileges. Co...

CVE-2019-15890

CVE-2019-15890 affects libslirp 4.0.0 (used in QEMU 4.1.0). A use-after-free in ip_reass() within ip_input.c can crash the process, leading to a potential denial of service. The vulnerability is exploitable over the network, with no authentication or user interaction required per the CVSS: AV:N/A...

CVE-2020-8608

In libslirp 4.1.0 (as used in QEMU 4.2.0), tcp_subr.c misuses snprintf return values, causing a buffer overflow in later code. Debian advisories state this can lead to denial of service or potentially arbitrary code execution; upstream and distribution advisories (e.g., Debian DSA-4733-1, ALAS-20...

CVE-2021-3592

CVE-2021-3592 describes an invalid pointer initialization in the SLiRP networking implementation of QEMU, specifically in the bootp_input() function. A malicious guest could process a UDP packet smaller than the bootp_t structure and leak 10 bytes of uninitialized host heap memory, impacting data...

CVE-2020-29130

CVE-2020-29130 is a buffer over-read in libslirp’s SLiRP networking code (through 4.3.1). Several advisories document that slirp.c reads header data beyond the packet length, enabling potential leakage of host information bytes to a privileged guest. Public sources consistently classify the impac...

CVE-2021-3595

CVE-2021-3595 describes an invalid pointer initialization in the SLiRP networking code of QEMU (tftp_input()), which can trigger when processing UDP packets smaller than the tftp_t structure. The vulnerability may cause an out-of-bounds read or indirect host memory disclosure to the guest, compro...

CVE-2021-3594

CVE-2021-3594 affects the SLiRP networking in QEMU, specifically the udp_input() path. The issue is an invalid pointer initialization that can occur when processing a UDP packet smaller than the udphdr size, leading to out-of-bounds reads or indirect host memory disclosure to the guest. The highe...

CVE-2020-29129

CVE-2020-29129 concerns libslirp’s SLiRP user networking implementation. The issue is a buffer over-read in ncsi.c (and related ARP/NCSI processing) present in libslirp up to version 4.3.1, where the code reads header data beyond the actual packet length. Reported impact in multiple advisories in...

CVE-2020-7211

CVE-2020-7211 affects tftp.c in libslirp 4.1.0 (used by QEMU 4.2.0), which does not prevent a ..\ directory traversal on Windows. This vulnerability allows accessing unintended files via crafted paths. Connected docs list the same CVE in various advisories, but do not provide a published patch/mi...