libMirage 3.2.2 in CDemu has a NULL pointer dereference in the NRG parser in parser.c.

According to the versions of the libmirage package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - libMirage 3.2.2 in CDemu has a NULL pointer dereference     in the NRG parser in parser.c.(CVE-2019-15757)

  - filters/filter-cso/filter-stream.c in the CSO filter in     libMirage 3.2.2 in CDemu does not validate the part     size, triggering a heap-based buffer overflow that can     lead to root access by a local Linux     user.(CVE-2019-15540)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libmirage fixes the following issues :

Security issues fixed :

  - CVE-2019-15757: Fixed NULL pointer dereference in the     NRG parser (boo#1148728).

ID	Name	Product	Family	Severity
136268	EulerOS Virtualization for ARM 64 3.0.2.0 : libmirage (EulerOS-SA-2020-1565)	Nessus	Huawei Local Security Checks	high
132844	EulerOS Virtualization for ARM 64 3.0.5.0 : libmirage (EulerOS-SA-2020-1090)	Nessus	Huawei Local Security Checks	high
128608	openSUSE Security Update : libmirage (openSUSE-2019-2096)	Nessus	SuSE Local Security Checks	medium
128607	openSUSE Security Update : libmirage (openSUSE-2019-2095)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2019-15757

medium

Tenable Plugins

high

high

medium

medium