GitLab

Bugzilla ID	121
Alias(es)	CVE-2018-10839, CVE-2018-16867, CVE-2018-17958, CVE-2018-17962, CVE-2018-17963, CVE-2018-18849, CVE-2018-18954, CVE-2018-20815, CVE-2019-12067, CVE-2019-12068, CVE-2019-12155, CVE-2019-12247, CVE-2019-12928, CVE-2019-12929, CVE-2019-13164, CVE-2019-14378, CVE-2019-15890, CVE-2019-20175, CVE-2019-20382, CVE-2019-3812, CVE-2019-5008, CVE-2019-6501, CVE-2019-6778, CVE-2019-9824, CVE-2020-1711
Reporter	Max Rees (sroracle)
Assignee	Max Rees (sroracle)
Reported	2019-07-29 03:15:14 -0500
Modified	2020-03-29 02:23:17 -0500
Status	RESOLVED FIXED
Version	1.0-BETA3
Hardware	Adélie Linux / All
Importance	--- / normal

Description

CVE-2018-10839: https://nvd.nist.gov/vuln/detail/CVE-2018-10839

Qemu emulator <= 3.0.0 built with the NE2000 NIC emulation support is
vulnerable to an integer overflow, which could lead to buffer overflow
issue. It could occur when receiving packets over the network. A user
inside guest could use this flaw to crash the Qemu process resulting
in DoS.

CVE-2018-16867: https://nvd.nist.gov/vuln/detail/CVE-2018-16867

A flaw was found in qemu Media Transfer Protocol (MTP) before version
3.1.0. A path traversal in the in usb_mtp_write_data function in
hw/usb/dev-mtp.c due to an improper filename sanitization. When the
guest device is mounted in read-write mode, this allows to read/write
arbitrary files which may lead do DoS scenario OR possibly lead to
code execution on the host.

CVE-2018-18849: https://nvd.nist.gov/vuln/detail/CVE-2018-18849

In Qemu 3.0.0, lsi_do_msgin in hw/scsi/lsi53c895a.c allows
out-of-bounds access by triggering an invalid msg_len value.

CVE-2018-18954: https://nvd.nist.gov/vuln/detail/CVE-2018-18954

The pnv_lpc_do_eccb function in hw/ppc/pnv_lpc.c in Qemu before 3.1
allows out-of-bounds write or read access to PowerNV memory.

CVE-2019-3812: https://nvd.nist.gov/vuln/detail/CVE-2019-3812

QEMU, through version 2.10 and through version 3.1.0, is vulnerable to
an out-of-bounds read of up to 128 bytes in the
hw/i2c/i2c-ddc.c:i2c_ddc() function. A local attacker with permission
to execute i2c commands could exploit this to read stack memory of the
qemu process on the host.

CVE-2019-6778: https://nvd.nist.gov/vuln/detail/CVE-2019-6778

In QEMU 3.0.0, tcp_emu in slirp/tcp_subr.c has a heap-based buffer
overflow.

CVE-2019-9824: https://nvd.nist.gov/vuln/detail/CVE-2019-9824

tcp_emu in slirp/tcp_subr.c (aka slirp/src/tcp_subr.c) in QEMU 3.0.0
uses uninitialized data in an snprintf call, leading to Information
disclosure.

CVE-2019-12247: https://nvd.nist.gov/vuln/detail/CVE-2019-12247

** DISPUTED ** QEMU 3.0.0 has an Integer Overflow because the
qga/commands*.c files do not check the length of the argument list or
the number of environment variables. NOTE: This has been disputed as
not exploitable.