CVE-2019-12155HIGH
New! CVE Severity Now Using CVSS v3
The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.
Description
interface_release_resource in hw/display/qxl.c in QEMU 3.1.x through 4.0.0 has a NULL pointer dereference.
References
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00000.html
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00008.html
http://www.openwall.com/lists/oss-security/2019/05/22/1
https://access.redhat.com/errata/RHBA-2019:3723
https://access.redhat.com/errata/RHSA-2019:2607
https://access.redhat.com/errata/RHSA-2019:2892
https://access.redhat.com/errata/RHSA-2019:3179
https://access.redhat.com/errata/RHSA-2019:3345
https://access.redhat.com/errata/RHSA-2019:3742
https://access.redhat.com/errata/RHSA-2019:3787
https://access.redhat.com/errata/RHSA-2019:4344
https://git.qemu.org/?p=qemu.git;a=commit;h=3be7eb2f47bf71db5f80fcf8750ea395dd5ffdd2
https://lists.debian.org/debian-lts-announce/2019/09/msg00021.html
https://lists.gnu.org/archive/html/qemu-devel/2019-05/msg01321.html
https://seclists.org/bugtraq/2019/May/76
https://usn.ubuntu.com/4191-1/
Details
Source: MITRE
Published: 2019-05-24
Updated: 2020-12-30
Type: CWE-476
Risk Information
CVSS v2
Base Score: 5
Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Impact Score: 2.9
Exploitability Score: 10
Severity: MEDIUM
CVSS v3
Base Score: 7.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Impact Score: 3.6
Exploitability Score: 3.9
Severity: HIGH
Vulnerable Software
Configuration 1
OR
Tenable Plugins
| ID | Name | Product | Family | Severity |
|---|---|---|---|---|
| 150648 | SUSE SLES11 Security Update : kvm (SUSE-SU-2019:14151-1) | Nessus | SuSE Local Security Checks | high |
| 150593 | SUSE SLES11 Security Update : xen (SUSE-SU-2019:14199-1) | Nessus | SuSE Local Security Checks | high |
| 145576 | CentOS 8 : virt:rhel (CESA-2019:3345) | Nessus | CentOS Local Security Checks | high |
| 144829 | EulerOS Virtualization 3.0.2.6 : qemu (EulerOS-SA-2021-1057) | Nessus | Huawei Local Security Checks | critical |
| 139983 | EulerOS 2.0 SP8 : qemu (EulerOS-SA-2020-1880) | Nessus | Huawei Local Security Checks | high |
| 138009 | EulerOS Virtualization 3.0.6.0 : qemu-kvm (EulerOS-SA-2020-1790) | Nessus | Huawei Local Security Checks | critical |
| 135033 | RHEL 7 : qemu-kvm-rhev (RHSA-2020:1216) | Nessus | Red Hat Local Security Checks | high |
| 134319 | NewStart CGSL MAIN 4.05 : qemu-kvm Multiple Vulnerabilities (NS-SA-2020-0019) | Nessus | NewStart CGSL Local Security Checks | high |
| 133763 | SUSE SLES12 Security Update : xen (SUSE-SU-2020:0388-1) | Nessus | SuSE Local Security Checks | critical |
| 131771 | NewStart CGSL MAIN 4.06 : qemu-kvm Multiple Vulnerabilities (NS-SA-2019-0211) | Nessus | NewStart CGSL Local Security Checks | high |
| 131017 | Ubuntu 16.04 LTS / 18.04 LTS / 19.04 / 19.10 : QEMU vulnerabilities (USN-4191-1) | Nessus | Ubuntu Local Security Checks | high |
| 130717 | EulerOS 2.0 SP3 : qemu-kvm (EulerOS-SA-2019-2255) | Nessus | Huawei Local Security Checks | medium |
| 130689 | EulerOS 2.0 SP5 : qemu-kvm (EulerOS-SA-2019-2227) | Nessus | Huawei Local Security Checks | critical |
| 130529 | RHEL 8 : virt:rhel (RHSA-2019:3345) | Nessus | Red Hat Local Security Checks | high |
| 130188 | RHEL 7 : Virtualization Manager (RHSA-2019:3179) | Nessus | Red Hat Local Security Checks | high |
| 129473 | CentOS 6 : qemu-kvm (CESA-2019:2892) | Nessus | CentOS Local Security Checks | high |
| 129370 | OracleVM 3.4 : qemu-kvm (OVMSA-2019-0045) | Nessus | OracleVM Local Security Checks | high |
| 129334 | Scientific Linux Security Update : qemu-kvm on SL6.x i386/x86_64 (20190924) | Nessus | Scientific Linux Local Security Checks | high |
| 129332 | RHEL 6 : qemu-kvm (RHSA-2019:2892) | Nessus | Red Hat Local Security Checks | high |
| 129329 | Oracle Linux 6 : qemu-kvm (ELSA-2019-2892) | Nessus | Oracle Linux Local Security Checks | high |
| 129105 | Debian DLA-1927-1 : qemu security update | Nessus | Debian Local Security Checks | high |
| 129022 | CentOS 7 : qemu-kvm (CESA-2019:2607) | Nessus | CentOS Local Security Checks | high |
| 128753 | SUSE SLED12 / SLES12 Security Update : qemu (SUSE-SU-2019:2353-1) | Nessus | SuSE Local Security Checks | high |
| 128609 | SUSE SLES12 Security Update : qemu (SUSE-SU-2019:2157-1) | Nessus | SuSE Local Security Checks | high |
| 128514 | Oracle Linux 7 : qemu-kvm (ELSA-2019-2607) | Nessus | Oracle Linux Local Security Checks | high |
| 128502 | Scientific Linux Security Update : qemu-kvm on SL7.x x86_64 (20190903) | Nessus | Scientific Linux Local Security Checks | high |
| 128497 | RHEL 7 : qemu-kvm (RHSA-2019:2607) | Nessus | Red Hat Local Security Checks | high |
| 128465 | openSUSE Security Update : qemu (openSUSE-2019-2059) | Nessus | SuSE Local Security Checks | high |
| 128457 | openSUSE Security Update : qemu (openSUSE-2019-2041) | Nessus | SuSE Local Security Checks | high |
| 128318 | SUSE SLED15 / SLES15 Security Update : qemu (SUSE-SU-2019:2246-1) | Nessus | SuSE Local Security Checks | high |
| 128301 | SUSE SLES12 Security Update : qemu (SUSE-SU-2019:2221-1) | Nessus | SuSE Local Security Checks | high |
| 128074 | SUSE SLED15 / SLES15 Security Update : qemu (SUSE-SU-2019:2192-1) | Nessus | SuSE Local Security Checks | high |
| 126960 | Amazon Linux 2 : qemu (ALAS-2019-1248) | Nessus | Amazon Linux Local Security Checks | critical |
| 126673 | Oracle Linux 7 : qemu (ELSA-2019-4713) (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout) | Nessus | Oracle Linux Local Security Checks | high |
| 126533 | Fedora 29 : 2:qemu (2019-e9de40d53f) | Nessus | Fedora Local Security Checks | critical |
| 126530 | Fedora 30 : 2:qemu (2019-52a8f5468e) | Nessus | Fedora Local Security Checks | critical |
| 125609 | Debian DSA-4454-1 : qemu - security update | Nessus | Debian Local Security Checks | high |