Integer overflow in QEMU - CVE-2018-10839

Vulnerability identifier: #VU15995

CSH Severity: Low

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-10839

CWE-ID: CWE-190

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The vulnerability exists due to integer overflow when built with the NE2000 NIC emulation support. A remote attacker can supply specially crafted packets over the network, trigger memory corruption and crash the Qemu process.

QEMU
Debian Linux
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power
Opensuse
Fedora
qemu

Update to version 3.0.0.

QEMU - update to 3.0.0
qemu - update to 3.0.0-2.fc29

• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10839

• Debian update for qemu
• OpenSUSE Linux update for qemu
• OpenSUSE Linux update for qemu
• Red Hat update for zsh
• Red Hat update for qemu-kvm
• Fedora 29 update for qemu