CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 0CVE-2020-25625
https://notcve.org/view.php?id=CVE-2020-25625
hw/usb/hcd-ohci.c in QEMU 5.0.0 has an infinite loop when a TD list has a loop. En el archivo hw/usb/hcd-ohci.c en QEMU versión 5.0.0, presenta un bucle infinito cuando una lista TD presenta un bucle • http://www.openwall.com/lists/oss-security/2020/09/17/1 https://lists.debian.org/debian-lts-announce/2020/11/msg00047.html https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html https://lists.nongnu.org/archive/html/qemu-devel/2020-09/msg05905.html https://security.netapp.com/advisory/ntap-20201009-0005 • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 5.0EPSS: 0%CPEs: 3EXPL: 1CVE-2020-25085
https://notcve.org/view.php?id=CVE-2020-25085
QEMU 5.0.0 has a heap-based Buffer Overflow in flatview_read_continue in exec.c because hw/sd/sdhci.c mishandles a write operation in the SDHC_BLKSIZE case. QEMU versión 5.0.0, presenta un desbordamiento de búfer en la región heap de la memoria en la función flatview_read_continue en el archivo exec.c porque el archivo hw/sd/sdhci.c maneja inapropiadamente una operación de escritura en el caso SDHC_BLKSIZE • http://www.openwall.com/lists/oss-security/2020/09/16/6 http://www.openwall.com/lists/oss-security/2021/03/09/1 https://bugs.launchpad.net/qemu/+bug/1892960 https://lists.debian.org/debian-lts-announce/2020/11/msg00047.html https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html https://lists.nongnu.org/archive/html/qemu-devel/2020-09/msg00733.html https://security.netapp.com/advisory/ntap-20201009-0005 • CWE-787: Out-of-bounds Write •
CVSS: 3.2EPSS: 0%CPEs: 3EXPL: 0CVE-2020-25084
https://notcve.org/view.php?id=CVE-2020-25084
QEMU 5.0.0 has a use-after-free in hw/usb/hcd-xhci.c because the usb_packet_map return value is not checked. QEMU versión 5.0.0, presenta un uso de la memoria previamente liberada en el archivo hw/usb/hcd-xhci.c porque el valor de retorno de la función usb_packet_map no está marcado • http://www.openwall.com/lists/oss-security/2020/09/16/5 https://lists.debian.org/debian-lts-announce/2021/02/msg00024.html https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html https://lists.nongnu.org/archive/html/qemu-devel/2020-08/msg08050.html https://security.netapp.com/advisory/ntap-20201009-0005 • CWE-416: Use After Free •
CVSS: 5.0EPSS: 0%CPEs: 15EXPL: 2CVE-2020-14364 – QEMU: usb: out-of-bounds r/w access issue while processing usb packets
https://notcve.org/view.php?id=CVE-2020-14364
An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU in versions before 5.2.0. This issue occurs while processing USB packets from a guest when USBDevice 'setup_len' exceeds its 'data_buf[4096]' in the do_token_in, do_token_out routines. This flaw allows a guest user to crash the QEMU process, resulting in a denial of service, or the potential execution of arbitrary code with the privileges of the QEMU process on the host. Se encontró un fallo de acceso de lectura/escritura fuera de límites en el emulador USB de QEMU en versiones anteriores a la 5.2.0. Este problema ocurre mientras se procesan paquetes USB de un invitado cuando USBDevice "setup_len" excede su "data_buf [4096]" en las rutinas do_token_in, do_token_out. • https://github.com/gejian-iscas/CVE-2020-14364 https://github.com/y-f00l/CVE-2020-14364 http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00024.html https://bugzilla.redhat.com/show_bug.cgi?id=1869201 https://lists.debian.org/debian-lts-announce/2020/09/msg00013.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JTZQUQ6ZBPMFMNAUQBVJFELYNMUZLL6P https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M52WIRMZL6T • CWE-125: Out-of-bounds Read CWE-787: Out-of-bounds Write •
CVSS: 3.8EPSS: 0%CPEs: 5EXPL: 0CVE-2020-12829
https://notcve.org/view.php?id=CVE-2020-12829
In QEMU through 5.0.0, an integer overflow was found in the SM501 display driver implementation. This flaw occurs in the COPY_AREA macro while handling MMIO write operations through the sm501_2d_engine_write() callback. A local attacker could abuse this flaw to crash the QEMU process in sm501_2d_operation() in hw/display/sm501.c on the host, resulting in a denial of service. En QEMU versiones hasta 5.0.0, se encontró un desbordamiento de enteros en la implementación del controlador de pantalla SM501. Este fallo ocurre en la macro COPY_AREA al manejar operaciones de escritura MMIO por medio de la devolución de llamada de sm501_2d_engine_write(). • https://bugzilla.redhat.com/show_bug.cgi?id=1808510 https://usn.ubuntu.com/4467-1 https://www.debian.org/security/2020/dsa-4760 • CWE-190: Integer Overflow or Wraparound •