CVE-2019-20382low
New! CVE Severity Now Using CVSS v3
The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.
Description
QEMU 4.1.0 has a memory leak in zrle_compress_data in ui/vnc-enc-zrle.c during a VNC disconnect operation because libz is misused, resulting in a situation where memory allocated in deflateInit2 is not freed in deflateEnd.
References
http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00007.html
http://www.openwall.com/lists/oss-security/2020/03/05/1
https://git.qemu.org/?p=qemu.git;a=commit;h=6bf21f3d83e95bcc4ba35a7a07cc6655e8b010b0
https://lists.debian.org/debian-lts-announce/2020/07/msg00020.html
Details
Source: MITRE
Published: 2020-03-05
Updated: 2020-07-26
Type: CWE-401
Risk Information
CVSS v2
Base Score: 2.7
Vector: AV:A/AC:L/Au:S/C:N/I:N/A:P
Impact Score: 2.9
Exploitability Score: 5.1
Severity: LOW
CVSS v3
Base Score: 3.5
Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Impact Score: 1.4
Exploitability Score: 2.1
Severity: LOW
Vulnerable Software
Configuration 1
OR
Configuration 2
OR
Tenable Plugins
| ID | Name | Product | Family | Severity |
|---|---|---|---|---|
| 151231 | EulerOS Virtualization 3.0.6.6 : qemu-kvm (EulerOS-SA-2021-2046) | Nessus | Huawei Local Security Checks | medium |
| 147700 | EulerOS Virtualization 2.9.0 : qemu (EulerOS-SA-2021-1667) | Nessus | Huawei Local Security Checks | medium |
| 147523 | EulerOS Virtualization 2.9.1 : qemu (EulerOS-SA-2021-1632) | Nessus | Huawei Local Security Checks | medium |
| 145861 | CentOS 8 : virt:rhel (CESA-2020:2774) | Nessus | CentOS Local Security Checks | medium |
| 142726 | Amazon Linux 2 : ivshmem-tools (ALAS-2020-1562) | Nessus | Amazon Linux Local Security Checks | medium |
| 142284 | EulerOS 2.0 SP2 : qemu-kvm (EulerOS-SA-2020-2392) | Nessus | Huawei Local Security Checks | high |
| 141601 | CentOS 7 : qemu-kvm (CESA-2020:3906) | Nessus | CentOS Local Security Checks | low |
| 141235 | Oracle Linux 7 : qemu-kvm (ELSA-2020-3906) | Nessus | Oracle Linux Local Security Checks | low |
| 141174 | RHEL 7 : qemu-kvm-rhev (RHSA-2020:4167) | Nessus | Red Hat Local Security Checks | medium |
| 141033 | RHEL 7 : qemu-kvm-ma (RHSA-2020:3907) | Nessus | Red Hat Local Security Checks | low |
| 141024 | RHEL 7 : qemu-kvm (RHSA-2020:3906) | Nessus | Red Hat Local Security Checks | low |
| 140864 | EulerOS 2.0 SP3 : qemu-kvm (EulerOS-SA-2020-2097) | Nessus | Huawei Local Security Checks | high |
| 140317 | EulerOS Virtualization for ARM 64 3.0.2.0 : qemu-kvm (EulerOS-SA-2020-1947) | Nessus | Huawei Local Security Checks | medium |
| 140017 | EulerOS Virtualization for ARM 64 3.0.6.0 : qemu-kvm (EulerOS-SA-2020-1914) | Nessus | Huawei Local Security Checks | medium |
| 138202 | Oracle Linux 8 : virt:ol (ELSA-2020-2774) | Nessus | Oracle Linux Local Security Checks | medium |
| 139285 | RHEL 7 : qemu-kvm-rhev (RHSA-2020:3267) | Nessus | Red Hat Local Security Checks | low |
| 138911 | Debian DLA-2288-1 : qemu security update | Nessus | Debian Local Security Checks | medium |
| 137892 | RHEL 8 : virt:rhel (RHSA-2020:2774) | Nessus | Red Hat Local Security Checks | medium |
| 137579 | SUSE SLES15 Security Update : qemu (SUSE-SU-2020:1523-1) | Nessus | SuSE Local Security Checks | medium |
| 137549 | SUSE SLES12 Security Update : qemu (SUSE-SU-2020:1501-1) | Nessus | SuSE Local Security Checks | medium |
| 136803 | Ubuntu 16.04 LTS / 18.04 LTS / 19.10 / 20.04 : QEMU vulnerabilities (USN-4372-1) | Nessus | Ubuntu Local Security Checks | medium |
| 136069 | Debian DSA-4665-1 : qemu - security update | Nessus | Debian Local Security Checks | medium |
| 135265 | openSUSE Security Update : qemu (openSUSE-2020-468) | Nessus | SuSE Local Security Checks | medium |
| 135169 | SUSE SLES12 Security Update : qemu (SUSE-SU-2020:0845-1) | Nessus | SuSE Local Security Checks | medium |
| 135168 | SUSE SLED15 / SLES15 Security Update : qemu (SUSE-SU-2020:0844-1) | Nessus | SuSE Local Security Checks | medium |