7.7
High
CVE-2020-1711 An out-of-bounds heap buffer access flaw was found in the way the iSCSI Block driver in QEMU versions 2.12.0 before…
Description
An out-of-bounds heap buffer access flaw was found in the way the iSCSI Block driver in QEMU versions 2.12.0 before 4.2.1 handled a response coming from an iSCSI server while checking the status of a Logical Address Block (LBA) in an iscsi_co_block_status() routine. A remote user could use this flaw to crash the QEMU process, resulting in a denial of service or potential execution of arbitrary code with privileges of the QEMU process on the host.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| QEMU | Versions not published |
References
- bugzilla.redhat.com bugzilla.redhat.com
- lists.gnu.org lists.gnu.org
- www.openwall.com www.openwall.com
- USN-4283-1 usn.ubuntu.com
- RHSA-2020:0669 access.redhat.com
- RHSA-2020:0773 access.redhat.com
- RHSA-2020:0730 access.redhat.com
- RHSA-2020:0731 access.redhat.com
- [debian-lts-announce] 20200316 [SECURITY] [DLA 2144-1] qemu security update lists.debian.org
- openSUSE-SU-2020:0468 lists.opensuse.org
- GLSA-202005-02 security.gentoo.org
- [debian-lts-announce] 20200913 [SECURITY] [DLA 2373-1] qemu security update lists.debian.org
Timeline
- Published
- Last modified