openSUSE-SU-2021:3614-1
See a problem?- Import Source
- https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2021:3614-1.json
- JSON Data
- https://api.osv.dev/v1/vulns/openSUSE-SU-2021:3614-1
- Related
- Published
- 2021-11-04T11:27:20Z
- Modified
- 2021-11-04T11:27:20Z
- Summary
- Security update for qemu
- Details
-
This update for qemu fixes the following issues:
Security issues fixed:
- Fix out-of-bounds write in UAS (USB Attached SCSI) device emulation (bsc#1189702, CVE-2021-3713)
- Fix heap use-after-free in virtionetreceive_rcu (bsc#1189938, CVE-2021-3748)
- usbredir: free call on invalid pointer in bufp_alloc (bsc#1189145, CVE-2021-3682)
- NULL pointer dereference in ESP (bsc#1180433, CVE-2020-35504) (bsc#1180434, CVE-2020-35505) (bsc#1180435, CVE-2020-35506)
- NULL pointer dereference issue in megasas-gen2 host bus adapter (bsc#1180432, CVE-2020-35503)
- eepro100: stack overflow via infinite recursion (bsc#1182651, CVE-2021-20255)
- usb: unbounded stack allocation in usbredir (bsc#1186012, CVE-2021-3527)
Non-security issues fixed:
- Use max host physical address if -cpu max is used (bsc#1188299)
- References
-
- https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/26KPX43RJBRTCX3JER7CN7MAT4QEGAED/
- https://bugzilla.suse.com/1180432
- https://bugzilla.suse.com/1180433
- https://bugzilla.suse.com/1180434
- https://bugzilla.suse.com/1180435
- https://bugzilla.suse.com/1182651
- https://bugzilla.suse.com/1186012
- https://bugzilla.suse.com/1189145
- https://bugzilla.suse.com/1189702
- https://bugzilla.suse.com/1189938
- https://www.suse.com/security/cve/CVE-2020-35503
- https://www.suse.com/security/cve/CVE-2020-35504
- https://www.suse.com/security/cve/CVE-2020-35505
- https://www.suse.com/security/cve/CVE-2020-35506
- https://www.suse.com/security/cve/CVE-2021-20255
- https://www.suse.com/security/cve/CVE-2021-3527
- https://www.suse.com/security/cve/CVE-2021-3682
- https://www.suse.com/security/cve/CVE-2021-3713
- https://www.suse.com/security/cve/CVE-2021-3748