This update for qemu fixes the following issues :

  - CVE-2020-12829: Fix OOB access in sm501 device emulation     (bsc#1172385)

  - CVE-2020-25723: Fix use-after-free in usb xhci packet     handling (bsc#1178934)

  - CVE-2020-25084: Fix use-after-free in usb ehci packet     handling (bsc#1176673)

  - CVE-2020-25625: Fix infinite loop (DoS) in usb hcd-ohci     emulation (bsc#1176684)

  - CVE-2020-25624: Fix OOB access in usb hcd-ohci emulation     (bsc#1176682)

  - CVE-2020-27617: Fix guest triggerable assert in shared     network handling code (bsc#1178174)

  - CVE-2020-28916: Fix infinite loop (DoS) in e1000e device     emulation (bsc#1179468)

  - CVE-2020-29443: Fix OOB access in atapi emulation     (bsc#1181108)

  - CVE-2020-27821: Fix heap overflow in MSIx emulation     (bsc#1179686)

  - CVE-2020-15469: Fix NULL pointer deref. (DoS) in mmio     ops (bsc#1173612)

  - CVE-2021-20257: Fix infinite loop (DoS) in e1000 device     emulation (bsc#1182577)

  - CVE-2021-3416: Fix OOB access (stack overflow) in     rtl8139 NIC emulation (bsc#1182968)

  - CVE-2021-3416: Fix OOB access (stack overflow) in other     NIC emulations (bsc#1182968)

  - CVE-2020-27616: Fix OOB access in ati-vga emulation     (bsc#1178400)

  - CVE-2020-29129: Fix OOB access in SLIRP ARP/NCSI packet     processing (bsc#1179466, CVE-2020-29130, bsc#1179467)

  - Fix package scripts to not use hard coded paths for     temporary working directories and log files     (bsc#1182425)

  - Add split-provides through forsplits/13 to cover updates     of SLE15-SP2 to SLE15-SP3, and openSUSE equivalents     (bsc#1184064)

  - Added a few more usability improvements for our git     packaging workflow

This update was imported from the SUSE:SLE-15-SP2:Update update project.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3099 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3099-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                          Abhijith PA     September 05, 2022                            https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : qemu     Version        : 1:3.1+dfsg-8+deb10u9     CVE ID         : CVE-2020-13253 CVE-2020-15469 CVE-2020-15859 CVE-2020-25084                      CVE-2020-25085 CVE-2020-25624 CVE-2020-25625 CVE-2020-25723                      CVE-2020-27617 CVE-2020-27821 CVE-2020-28916 CVE-2020-29129                      CVE-2020-29443 CVE-2020-35504 CVE-2020-35505 CVE-2021-3392                      CVE-2021-3416 CVE-2021-3507 CVE-2021-3527 CVE-2021-3582                      CVE-2021-3607 CVE-2021-3608 CVE-2021-3682 CVE-2021-3713                      CVE-2021-3748 CVE-2021-3930 CVE-2021-4206 CVE-2021-4207                      CVE-2021-20181 CVE-2021-20196 CVE-2021-20203 CVE-2021-20221                      CVE-2021-20257 CVE-2022-26354 CVE-2022-35414

    Multiple security issues were discovered in QEMU, a fast processor     emulator, which could result in denial of service or the the execution     of arbitrary code.

    For Debian 10 buster, these problems have been fixed in version     1:3.1+dfsg-8+deb10u9.

    We recommend that you upgrade your qemu packages.

    For the detailed security status of qemu please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/qemu

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - QEMU 5.0.0 has a use-after-free in hw/usb/hcd-xhci.c because the usb_packet_map return value is not     checked. (CVE-2020-25084)

Note that Nessus relies on the presence of the package as reported by the vendor.

This update for qemu fixes the following issues :

Fix OOB access in sm501 device emulation (CVE-2020-12829, bsc#1172385)

Fix OOB access possibility in MegaRAID SAS 8708EM2 emulation (CVE-2020-13362 bsc#1172383)

Fix use-after-free in usb xhci packet handling (CVE-2020-25723, bsc#1178934)

Fix use-after-free in usb ehci packet handling (CVE-2020-25084, bsc#1176673)

Fix OOB access in usb hcd-ohci emulation (CVE-2020-25624, bsc#1176682)

Fix infinite loop (DoS) in usb hcd-ohci emulation (CVE-2020-25625, bsc#1176684)

Fix guest triggerable assert in shared network handling code (CVE-2020-27617, bsc#1178174)

Fix infinite loop (DoS) in e1000e device emulation (CVE-2020-28916, bsc#1179468)

Fix OOB access in atapi emulation (CVE-2020-29443, bsc#1181108)

Fix NULL pointer deref. (DoS) in mmio ops (CVE-2020-15469, bsc#1173612)

Fix infinite loop (DoS) in e1000 device emulation (CVE-2021-20257, bsc#1182577)

Fix OOB access (stack overflow) in rtl8139 NIC emulation (CVE-2021-3416, bsc#1182968)

Fix OOB access (stack overflow) in other NIC emulations (CVE-2021-3416)

Fix OOB access in SLIRP ARP packet processing (CVE-2020-29130, bsc#1179467)

Fix NULL pointer dereference possibility (DoS) in MegaRAID SAS 8708EM2 emulation (CVE-2020-13659 bsc#1172386

Fix OOB access in iscsi (CVE-2020-11947 bsc#1180523)

Fix OOB access in vmxnet3 emulation (CVE-2021-20203 bsc#1181639)

Fix buffer overflow in the XGMAC device (CVE-2020-15863, bsc#1174386)

Fix DoS in packet processing of various emulated NICs (CVE-2020-16092 bsc#1174641)

Fix OOB access while processing USB packets (CVE-2020-14364 bsc#1175441)

Fix package scripts to not use hard-coded paths for temporary working directories and log files (bsc#1182425)

Fix potential privilege escalation in virtfs (CVE-2021-20181 bsc#1182137)

Fix OOB access possibility in ES1370 audio device emulation (CVE-2020-13361 bsc#1172384)

Fix OOB access in ROM loading (CVE-2020-13765 bsc#1172478)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
149640	openSUSE Security Update : qemu (openSUSE-2021-600)	Nessus	SuSE Local Security Checks	5/18/2021	1/1/2024	medium
164678	Debian dla-3099 : qemu - security update	Nessus	Debian Local Security Checks	9/5/2022	1/22/2025	high
229894	Linux Distros Unpatched Vulnerability : CVE-2020-25084	Nessus	Misc.	3/5/2025	6/27/2026	low
148758	SUSE SLES12 Security Update : qemu (SUSE-SU-2021:1240-1)	Nessus	SuSE Local Security Checks	4/19/2021	1/3/2024	high

Detections

Analytics

Plugins Search

medium

high

low

high