Red Hat Security AdvisoryRHSA-2020:1216
qemu-kvm-rhev security, bug fix, and enhancement update
Released 2020-03-31 · Red Hat rating Important · View on Red Hat →
Fixed in
- RHV-M 4.3 qemu-img-rhev-10:2.12.0-44.el7, qemu-kvm-common-rhev-10:2.12.0-44.el7, qemu-kvm-rhev-10:2.12.0-44.el7 +1
- Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts qemu-img-rhev-10:2.12.0-44.el7, qemu-kvm-common-rhev-10:2.12.0-44.el7, qemu-kvm-rhev-10:2.12.0-44.el7 +1
Fixes 3 records
Priority MEDIUM 55
ip_reass in ip_input.c in libslirp 4.0.0 has a heap-based buffer overflow via a large packet because it mishandles a case involving the first fragment.
CVSS 3.0HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.16658 · Published 2019-07-29 · Partial fix CWE-755
Priority MEDIUM 41
interface_release_resource in hw/display/qxl.c in QEMU 3.1.x through 4.0.0 has a NULL pointer dereference.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.05546 · Published 2019-05-24 · Partial fix CWE-476
Priority MEDIUM 40
An out-of-bounds heap buffer access flaw was found in the way the iSCSI Block driver in QEMU versions 2.12.0 before 4.2.1 handled a response coming from an iSCSI server while checking the status of a Logical Address Bloc…
CVSS 3.1HIGH 7.7· Network · Low privileges · No interaction · EPSS 0.04018 · Published 2020-02-11 · Partial fix · 4.2.1 CWE-122
THREATIST.IORead the docs