SB2019092421 - Red Hat update for qemu-kvm
Published: September 24, 2019
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 5 secuirty vulnerabilities.
1) Integer overflow (CVE-ID: CVE-2018-10839)
The vulnerability allows a remote attacker to cause DoS condition on the target system.
The vulnerability exists due to integer overflow when built with the NE2000 NIC emulation support. A remote attacker can supply specially crafted packets over the network, trigger memory corruption and crash the Qemu process.
2) Heap-based buffer overflow (CVE-ID: CVE-2018-11806)
The vulnerability allows a remote authenticated attacker to cause DoS condition on the target system.
The vulnerability exists due to heap-based buffer overflow when insufficient input and validation checking of Slirp networking back-end processes by the m_cat function, as defined in the slirp/mbuf.c source code file. A remote attacker can send malformed, fragmented packets, trigger memory corruption and cause the QEMU process to crash.
3) Buffer overflow (CVE-ID: CVE-2018-17962)
The vulnerability allows a remote attacker to cause DoS condition on the target system.
The vulnerability exists due to buffer overflow in pcnet_receive in hw/net/pcnet.c when an incorrect integer data type is used. A remote attacker can supply specially crafted packets over the network, trigger memory corruption and crash the Qemu process.
4) Heap-based buffer overflow (CVE-ID: CVE-2019-6778)
The vulnerability allows a local user to perform denial of service (DoS) attack.
The vulnerability exists due to a boundary error within the tcp_emu() function in slirp/tcp_subr.c. A local user can send specially crafted networking packets, trigger heap-based buffer overflow and crash the affected system.
5) NULL pointer dereference (CVE-ID: CVE-2019-12155)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error in "hw/display/qxl.c". A remote attacker can perform a denial of service (DoS) attack.
Remediation
Install update from vendor's website.