Detections
Analytics
Alpine: multiple qemu packages: security update to 5.0.0-r0
medium Tenable Cloud Security Plugin ID 426092
Description
There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:- hw/pci/msix.c in QEMU 4.2.0 allows guest OS users to trigger an out-of-bounds access via a crafted address
in an msi-x mmio operation. (CVE-2020-13754)
- address_space_map in exec.c in QEMU 4.2.0 can trigger a NULL pointer dereference related to BounceBuffer.
(CVE-2020-13659)
- hw/pci/pci.c in QEMU 4.2.0 allows guest OS users to trigger an out-of-bounds access by providing an
address near the end of the PCI configuration space. (CVE-2020-13791)
- ati-vga in hw/display/ati.c in QEMU 4.2.0 allows guest OS users to trigger infinite recursion via a
crafted mm_index value during an ati_mm_read or ati_mm_write call. (CVE-2020-13800)
See Also
https://security.alpinelinux.org/vuln/CVE-2020-13659
https://security.alpinelinux.org/vuln/CVE-2020-13754
https://security.alpinelinux.org/vuln/CVE-2020-13791
https://security.alpinelinux.org/vuln/CVE-2020-13800
https://security.alpinelinux.org/vuln/CVE-2020-14415
https://security.alpinelinux.org/vuln/CVE-2020-15469
https://security.alpinelinux.org/vuln/CVE-2020-15859
https://security.alpinelinux.org/vuln/CVE-2020-27616
Plugin Details
Severity: Medium
ID: 426092
Version: Revision 1.3
Type: Local
Published: 5/16/2025
Updated: 12/4/2025
Supported Sensors: Agentless Assessment
Risk Information
VPR
Risk Factor: Medium
Score: 4.9
Percentile: 57.12
CVSS v2
Risk Factor: Medium
Base Score: 4.6
Temporal Score: 3.6
Vector: CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:P
CVSS Score Source: CVE-2020-13754
CVSS v3
Risk Factor: Medium
Base Score: 6.7
Temporal Score: 6
Vector: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Vulnerability Publication Date: 6/2/2020
Reference Information
CVE: CVE-2020-13659, CVE-2020-13754, CVE-2020-13791, CVE-2020-13800, CVE-2020-14415, CVE-2020-15469, CVE-2020-15859, CVE-2020-27616, CVE-2020-27617, CVE-2021-20221
IAVB: 2020-B-0041-S, 2020-B-0063-S, 2020-B-0075-S