Homepage

Stack-based Buffer Overflow Affecting qemu-block-ssh package, versions <2.11.2-9.12.2

Severity

 Recommended
0.0
medium
0
10

Based on SUSE Linux Enterprise Server security rating.

Threat Intelligence

EPSS
0.22% (60th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-SLES150-QEMUBLOCKSSH-2756808
  • published14 Apr 2022
  • disclosed27 Nov 2018
Report a new vulnerability Found a mistake?

Introduced: 27 Nov 2018

CVE-2018-10839  (opens in a new tab)
CWE-121  (opens in a new tab)

How to fix?

Upgrade SLES:15.0 qemu-block-ssh to version 2.11.2-9.12.2 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream qemu-block-ssh package and not the qemu-block-ssh package as distributed by SLES. See How to fix? for SLES:15.0 relevant fixed versions and status.

Qemu emulator <= 3.0.0 built with the NE2000 NIC emulation support is vulnerable to an integer overflow, which could lead to buffer overflow issue. It could occur when receiving packets over the network. A user inside guest could use this flaw to crash the Qemu process resulting in DoS.