CVSS: 2.3EPSS: 0%CPEs: 3EXPL: 0CVE-2020-15469
https://notcve.org/view.php?id=CVE-2020-15469
In QEMU 4.2.0, a MemoryRegionOps object may lack read/write callback methods, leading to a NULL pointer dereference. En QEMU versión 4.2.0, un objeto MemoryRegionOps puede carecer de métodos de devolución de llamada de lectura y escritura, conllevando a una desreferencia del puntero NULL • http://www.openwall.com/lists/oss-security/2020/07/02/1 https://lists.debian.org/debian-lts-announce/2021/02/msg00024.html https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html https://lists.gnu.org/archive/html/qemu-devel/2020-06/msg09961.html • CWE-476: NULL Pointer Dereference •
CVSS: 5.0EPSS: 0%CPEs: 7EXPL: 0CVE-2020-10761
https://notcve.org/view.php?id=CVE-2020-10761
An assertion failure issue was found in the Network Block Device(NBD) Server in all QEMU versions before QEMU 5.0.1. This flaw occurs when an nbd-client sends a spec-compliant request that is near the boundary of maximum permitted request length. A remote nbd-client could use this flaw to crash the qemu-nbd server resulting in a denial of service. Se encontró un problema de fallo de aserción en el Network Block Device (NBD) en todas las versiones de QEMU anteriores a QEMU versión 5.0.1. Este fallo ocurre cuando un cliente nbd envía una petición que cumple con las especificaciones que está cerca del límite de la longitud máxima permitida de la petición. • http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00086.html https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10761 https://security.gentoo.org/glsa/202011-09 https://security.netapp.com/advisory/ntap-20200731-0001 https://usn.ubuntu.com/4467-1 https://www.openwall.com/lists/oss-security/2020/06/09/1 • CWE-617: Reachable Assertion •
CVSS: 6.8EPSS: 0%CPEs: 7EXPL: 0CVE-2020-13765 – QEMU: loader: OOB access while loading registered ROM may lead to code execution
https://notcve.org/view.php?id=CVE-2020-13765
rom_copy() in hw/core/loader.c in QEMU 4.0 and 4.1.0 does not validate the relationship between two addresses, which allows attackers to trigger an invalid memory copy operation. La función rom_copy() en el archivo hw/core/loader.c en QEMU versión 4.0 y versión 4.1.0, no comprueba la relación entre dos direcciones, lo que permite a atacantes activar una operación de copia de memoria no válida An out-of-bound write access flaw was found in the way QEMU loads ROM contents at boot time. This flaw occurs in the rom_copy() routine while loading the contents of a 32-bit -kernel image into memory. Running an untrusted -kernel image may load contents at arbitrary memory locations, potentially leading to code execution with the privileges of the QEMU process. • https://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=e423455c4f23a1a828901c78fe6d03b7dde79319 https://github.com/qemu/qemu/commit/4f1c6cb2f9afafda05eab150fd2bd284edce6676 https://lists.debian.org/debian-lts-announce/2020/06/msg00032.html https://lists.debian.org/debian-lts-announce/2020/07/msg00020.html https://security.netapp.com/advisory/ntap-20200619-0006 https://usn.ubuntu.com/4467-1 https://www.openwall.com/lists/oss-security/2020/06/03/6 https://access.redhat.com/security/cve/CVE-2020-13765 • CWE-787: Out-of-bounds Write •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-13791
https://notcve.org/view.php?id=CVE-2020-13791
hw/pci/pci.c in QEMU 4.2.0 allows guest OS users to trigger an out-of-bounds access by providing an address near the end of the PCI configuration space. El archivo hw/pci/pci.c en QEMU versión 4.2.0, permite a usuarios invitados del Sistema Operativo desencadenar un acceso fuera de límites al proporcionar una dirección cerca del final del espacio de configuración de PCI • https://lists.gnu.org/archive/html/qemu-devel/2020-06/msg00706.html https://security.gentoo.org/glsa/202011-09 https://security.netapp.com/advisory/ntap-20200717-0001 https://www.openwall.com/lists/oss-security/2020/06/04/1 • CWE-125: Out-of-bounds Read •
CVSS: 6.0EPSS: 0%CPEs: 5EXPL: 0CVE-2020-13800
https://notcve.org/view.php?id=CVE-2020-13800
ati-vga in hw/display/ati.c in QEMU 4.2.0 allows guest OS users to trigger infinite recursion via a crafted mm_index value during an ati_mm_read or ati_mm_write call. ati-vga en el archivo hw/display/ati.c en QEMU versión 4.2.0, permite a usuarios invitados del Sistema Operativo desencadenar una recursividad infinita por medio de un valor mm_index diseñado durante una llamada de ati_mm_read o ati_mm_write • http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00086.html https://cve.openeuler.org/cve#/CVEInfo/CVE-2020-13800 https://lists.gnu.org/archive/html/qemu-devel/2020-06/msg00825.html https://security.gentoo.org/glsa/202011-09 https://security.netapp.com/advisory/ntap-20200717-0001 https://usn.ubuntu.com/4467-1 https://www.openwall.com/lists/oss-security/2020/06/04/2 • CWE-674: Uncontrolled Recursion •