CVE-2020-1711

An out-of-bounds heap buffer access flaw was found in the way the iSCSI
Block driver in QEMU versions 2.12.0 before 4.2.1 handled a response coming
from an iSCSI server while checking the status of a Logical Address Block
(LBA) in an iscsi_co_block_status() routine. A remote user could use this
flaw to crash the QEMU process, resulting in a denial of service or
potential execution of arbitrary code with privileges of the QEMU process
on the host.

Bugs

• <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=949731&gt;