SB2020072430 - Debian update for qemu

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2020072430

SB2020072430 - Debian update for qemu

Published: July 24, 2020

Security Bulletin ID SB2020072430
Severity
Medium
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Adjecent network
Highest impact Code execution

Breakdown by Severity

Medium 50% Low 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Out-of-bounds write (CVE-ID: CVE-2020-13754)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted input in hw/pci/msix.c. A local user on the guest operating system can send specially crafted address in an msi-x mmio operation, trick the victim into opening it using the affected software, trigger out-of-bounds write and execute arbitrary code.


2) Buffer overflow (CVE-ID: CVE-2020-8608)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error within tcp_subr.c file in libslirp. A local user can pass specially crafted data to the application that is using the affected version of library, trigger memory corruption and execute arbitrary code on the system.


Remediation

Install update from vendor's website.

References