The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - Qemu: display: cirrus: potential arbitrary code execution via cirrus_bitblt_cputovideo (CVE-2017-2620)

  - The (1) fw_cfg_write and (2) fw_cfg_read functions in hw/nvram/fw_cfg.c in QEMU before 2.4, when built     with the Firmware Configuration device emulation support, allow guest OS users with the CAP_SYS_RAWIO     privilege to cause a denial of service (out-of-bounds read or write access and process crash) or possibly     execute arbitrary code via an invalid current entry value in a firmware configuration. (CVE-2016-1714)

  - QEMU (aka Quick Emulator) built with the e1000 NIC emulation support is vulnerable to an infinite loop     issue. It could occur while processing data via transmit or receive descriptors, provided the initial     receive/transmit descriptor head (TDH/RDH) is set outside the allocated descriptor buffer. A privileged     user inside guest could use this flaw to crash the QEMU instance resulting in DoS. (CVE-2016-1981)

  - The ohci_bus_start function in the USB OHCI emulation support (hw/usb/hcd-ohci.c) in QEMU allows local     guest OS administrators to cause a denial of service (NULL pointer dereference and QEMU process crash) via     vectors related to multiple eof_timers. (CVE-2016-2391)

  - The ne2000_receive function in the NE2000 NIC emulation support (hw/net/ne2000.c) in QEMU before 2.5.1     allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash)     via crafted values for the PSTART and PSTOP registers, involving ring buffer control. (CVE-2016-2841)

  - The net_checksum_calculate function in net/checksum.c in QEMU allows local guest OS users to cause a     denial of service (out-of-bounds heap read and crash) via the payload length in a crafted packet.
    (CVE-2016-2857)

  - Buffer overflow in the stellaris_enet_receive function in hw/net/stellaris_enet.c in QEMU, when the     Stellaris ethernet controller is configured to accept large packets, allows remote attackers to cause a     denial of service (QEMU crash) via a large packet. (CVE-2016-4001)

  - Buffer overflow in the mipsnet_receive function in hw/net/mipsnet.c in QEMU, when the guest NIC is     configured to accept large packets, allows remote attackers to cause a denial of service (memory     corruption and QEMU crash) or possibly execute arbitrary code via a packet larger than 1514 bytes.
    (CVE-2016-4002)

  - The vmsvga_fifo_run function in hw/display/vmware_vga.c in QEMU allows local guest OS administrators to     cause a denial of service (infinite loop and QEMU process crash) via a VGA command. (CVE-2016-4453)

  - The vmsvga_fifo_read_raw function in hw/display/vmware_vga.c in QEMU allows local guest OS administrators     to obtain sensitive host memory information or cause a denial of service (QEMU process crash) by changing     FIFO registers and issuing a VGA command, which triggers an out-of-bounds read. (CVE-2016-4454)

  - The virtqueue_pop function in hw/virtio/virtio.c in QEMU allows local guest OS administrators to cause a     denial of service (memory consumption and QEMU process crash) by submitting requests without waiting for     completion. (CVE-2016-5403)

  - The vmsvga_fifo_run function in hw/display/vmware_vga.c in QEMU (aka Quick Emulator) allows local guest OS     administrators to cause a denial of service (out-of-bounds write and QEMU process crash) via vectors     related to cursor.mask[] and cursor.image[] array sizes when processing a DEFINE_CURSOR svga command.
    (CVE-2016-7170)

  - The serial_update_parameters function in hw/char/serial.c in QEMU (aka Quick Emulator) allows local guest     OS administrators to cause a denial of service (divide-by-zero error and QEMU process crash) via vectors     involving a value of divider greater than baud base. (CVE-2016-8669)

  - The rtl8139_cplus_transmit function in hw/net/rtl8139.c in QEMU (aka Quick Emulator) allows local guest OS     administrators to cause a denial of service (infinite loop and CPU consumption) by leveraging failure to     limit the ring descriptor count. (CVE-2016-8910)

  - Quick emulator (Qemu) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to a divide by     zero issue. It could occur while copying VGA data when cirrus graphics mode was set to be VGA. A     privileged user inside guest could use this flaw to crash the Qemu process instance on the host, resulting     in DoS. (CVE-2016-9921)

  - The cirrus_do_copy function in hw/display/cirrus_vga.c in QEMU (aka Quick Emulator), when cirrus graphics     mode is VGA, allows local guest OS privileged users to cause a denial of service (divide-by-zero error and     QEMU process crash) via vectors involving blit pitch values. (CVE-2016-9922)

  - The dhcp_decode function in slirp/bootp.c in QEMU (aka Quick Emulator) allows local guest OS users to     cause a denial of service (out-of-bounds read and QEMU process crash) via a crafted DHCP options string.
    (CVE-2017-11434)

  - QEMU (aka Quick Emulator), when built with the VGA display emulator support, allows local guest OS     privileged users to cause a denial of service (out-of-bounds read and QEMU process crash) via vectors     involving display update. (CVE-2017-13672)

  - The vga display update in mis-calculated the region for the dirty bitmap snapshot in case split screen     mode is used causing a denial of service (assertion failure) in the cpu_physical_memory_snapshot_get_dirty     function. (CVE-2017-13673)

  - Use-after-free vulnerability in the sofree function in slirp/socket.c in QEMU (aka Quick Emulator) allows     attackers to cause a denial of service (QEMU instance crash) by leveraging failure to properly clear     ifq_so from pending packets. (CVE-2017-13711)

  - VNC server implementation in Quick Emulator (QEMU) 2.11.0 and older was found to be vulnerable to an     unbounded memory allocation issue, as it did not throttle the framebuffer updates sent to its client. If     the client did not consume these updates, VNC server allocates growing memory to hold onto this data. A     malicious remote VNC client could use this flaw to cause DoS to the server host. (CVE-2017-15124)

  - The mode4and5 write functions in hw/display/cirrus_vga.c in Qemu allow local OS guest privileged users to     cause a denial of service (out-of-bounds write access and Qemu process crash) via vectors related to dst     calculation. (CVE-2017-15289)

  - Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-     bounds access issue. It could occur while copying VGA data via bitblt copy in backward mode. A privileged     user inside a guest could use this flaw to crash the QEMU process resulting in DoS or potentially execute     arbitrary code on the host with privileges of QEMU process on the host. (CVE-2017-2615)

  - Memory leak in hw/audio/ac97.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to     cause a denial of service (host memory consumption and QEMU process crash) via a large number of device     unplug operations. (CVE-2017-5525)

  - Memory leak in hw/audio/es1370.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to     cause a denial of service (host memory consumption and QEMU process crash) via a large number of device     unplug operations. (CVE-2017-5526)

  - Memory leak in the serial_exit_core function in hw/char/serial.c in QEMU (aka Quick Emulator) allows local     guest OS privileged users to cause a denial of service (host memory consumption and QEMU process crash)     via a large number of device unplug operations. (CVE-2017-5579)

  - The ohci_service_ed_list function in hw/usb/hcd-ohci.c in QEMU (aka Quick Emulator) before 2.9.0 allows     local guest OS users to cause a denial of service (infinite loop) via vectors involving the number of link     endpoint list descriptors, a different vulnerability than CVE-2017-9330. (CVE-2017-6505)

  - hw/display/cirrus_vga_rop.h in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a     denial of service (out-of-bounds read and QEMU process crash) via vectors related to copying VGA data via     the cirrus_bitblt_rop_fwd_transp_ and cirrus_bitblt_rop_fwd_ functions. (CVE-2017-7718)

  - Heap-based buffer overflow in Cirrus CLGD 54xx VGA Emulator in Quick Emulator (Qemu) 2.8 and earlier     allows local guest OS users to execute arbitrary code or cause a denial of service (crash) via vectors     related to a VNC client updating its display after a VGA operation. (CVE-2017-7980)

  - Memory leak in the audio/audio.c in QEMU (aka Quick Emulator) allows remote attackers to cause a denial of     service (memory consumption) by repeatedly starting and stopping audio capture. (CVE-2017-8309)

  - Memory leak in the keyboard input event handlers support in QEMU (aka Quick Emulator) allows local guest     OS privileged users to cause a denial of service (host memory consumption) by rapidly generating large     keyboard events. (CVE-2017-8379)

  - QEMU (aka Quick Emulator) before 2.9.0, when built with the USB OHCI Emulation support, allows local guest     OS users to cause a denial of service (infinite loop) by leveraging an incorrect return value, a different     vulnerability than CVE-2017-6505. (CVE-2017-9330)

  - m_cat in slirp/mbuf.c in Qemu has a heap-based buffer overflow via incoming fragmented datagrams.
    (CVE-2018-11806)

  - In Qemu 3.0.0, lsi_do_msgin in hw/scsi/lsi53c895a.c allows out-of-bounds access by triggering an invalid     msg_len value. (CVE-2018-18849)

  - The vga_draw_text function in Qemu allows local OS guest privileged users to cause a denial of service     (out-of-bounds read and QEMU process crash) by leveraging improper memory address validation.
    (CVE-2018-5683)

  - Quick Emulator (aka QEMU), when built with the Cirrus CLGD 54xx VGA Emulator support, allows local guest     OS privileged users to cause a denial of service (out-of-bounds access and QEMU process crash) by     leveraging incorrect region calculation when updating VGA display. (CVE-2018-7858)

  - In QEMU 1:4.1-1, 1:2.1+dfsg-12+deb8u6, 1:2.8+dfsg-6+deb9u8, 1:3.1+dfsg-8~deb10u1, 1:3.1+dfsg-8+deb10u2,     and 1:2.1+dfsg-12+deb8u12 (fixed), when executing script in lsi_execute_script(), the LSI scsi adapter     emulator advances 's->dsp' index to read next opcode. This can lead to an infinite loop if the next opcode     is empty. Move the existing loop exit after 10k iterations so that it covers no-op opcodes as well.
    (CVE-2019-12068)

  - interface_release_resource in hw/display/qxl.c in QEMU 3.1.x through 4.0.0 has a NULL pointer dereference.
    (CVE-2019-12155)

  - ip_reass in ip_input.c in libslirp 4.0.0 has a heap-based buffer overflow via a large packet because it     mishandles a case involving the first fragment. (CVE-2019-14378)

  - libslirp 4.0.0, as used in QEMU 4.1.0, has a use-after-free in ip_reass in ip_input.c. (CVE-2019-15890)

  - In QEMU 4.1.0, an out-of-bounds read flaw was found in the ATI VGA implementation. It occurs in the     ati_cursor_define() routine while handling MMIO write operations through the ati_mm_write() callback. A     malicious guest could abuse this flaw to crash the QEMU process, resulting in a denial of service.
    (CVE-2019-20808)

  - tcp_emu in slirp/tcp_subr.c (aka slirp/src/tcp_subr.c) in QEMU 3.0.0 uses uninitialized data in an     snprintf call, leading to Information disclosure. (CVE-2019-9824)

  - An out-of-bounds read vulnerability was found in the SLiRP networking implementation of the QEMU emulator.
    This flaw occurs in the icmp6_send_echoreply() routine while replying to an ICMP echo request, also known     as ping. This flaw allows a malicious guest to leak the contents of the host memory, resulting in possible     information disclosure. This flaw affects versions of libslirp before 4.3.1. (CVE-2020-10756)

  - An integer overflow was found in QEMU 4.0.1 through 4.2.0 in the way it implemented ATI VGA emulation.
    This flaw occurs in the ati_2d_blt() routine in hw/display/ati-2d.c while handling MMIO write operations     through the ati_mm_write() callback. A malicious guest could abuse this flaw to crash the QEMU process,     resulting in a denial of service. (CVE-2020-11869)

  - iscsi_aio_ioctl_cb in block/iscsi.c in QEMU 4.1.0 has a heap-based buffer over-read that may disclose     unrelated information from process memory to an attacker. (CVE-2020-11947)

  - In QEMU 5.0.0 and earlier, es1370_transfer_audio in hw/audio/es1370.c does not properly validate the frame     count, which allows guest OS users to trigger an out-of-bounds access during an es1370_write() operation.
    (CVE-2020-13361)

  - An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU in versions before     5.2.0. This issue occurs while processing USB packets from a guest when USBDevice 'setup_len' exceeds its     'data_buf[4096]' in the do_token_in, do_token_out routines. This flaw allows a guest user to crash the     QEMU process, resulting in a denial of service, or the potential execution of arbitrary code with the     privileges of the QEMU process on the host. (CVE-2020-14364)

  - An infinite loop flaw was found in the USB xHCI controller emulation of QEMU while computing the length of     the Transfer Request Block (TRB) Ring. This flaw allows a privileged guest user to hang the QEMU process     on the host, resulting in a denial of service. (CVE-2020-14394)

  - In QEMU through 5.0.0, an assertion failure can occur in the network packet processing. This issue affects     the e1000e and vmxnet3 network devices. A malicious guest user/process could use this flaw to abort the     QEMU process on the host, resulting in a denial of service condition in net_tx_pkt_add_raw_fragment in     hw/net/net_tx_pkt.c. (CVE-2020-16092)

  - A use after free vulnerability in ip_reass() in ip_input.c of libslirp 4.2.0 and prior releases allows     crafted packets to cause a denial of service. (CVE-2020-1983)

  - A reachable assertion issue was found in the USB EHCI emulation code of QEMU. It could occur while     processing USB requests due to missing handling of DMA memory map failure. A malicious privileged user     within the guest may abuse this flaw to send bogus USB requests and crash the QEMU process on the host,     resulting in a denial of service. (CVE-2020-25723)

  - ncsi.c in libslirp through 4.3.1 has a buffer over-read because it tries to read a certain amount of     header data even if that exceeds the total packet length. (CVE-2020-29129)

  - slirp.c in libslirp through 4.3.1 has a buffer over-read because it tries to read a certain amount of     header data even if that exceeds the total packet length. (CVE-2020-29130)

  - tcp_emu in tcp_subr.c in libslirp 4.1.0, as used in QEMU 4.2.0, mismanages memory, as demonstrated by IRC     DCC commands in EMU_IRC. This can cause a heap-based buffer overflow or other out-of-bounds access which     can lead to a DoS or potential execute arbitrary code. (CVE-2020-7039)

  - In libslirp 4.1.0, as used in QEMU 4.2.0, tcp_subr.c misuses snprintf return values, leading to a buffer     overflow in later code. (CVE-2020-8608)

  - A NULL pointer dereference flaw was found in the floppy disk emulator of QEMU. This issue occurs while     processing read/write ioport commands if the selected floppy drive is not initialized with a block device.
    This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of     service. The highest threat from this vulnerability is to system availability. (CVE-2021-20196)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

According to the versions of the qemu packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - In QEMU through 5.0.0, an integer overflow was found in     the SM501 display driver implementation. This flaw     occurs in the COPY_AREA macro while handling MMIO write     operations through the sm501_2d_engine_write()     callback. A local attacker could abuse this flaw to     crash the QEMU process in sm501_2d_operation() in     hw/display/sm501.c on the host, resulting in a denial     of service.(CVE-2020-12829)

  - slirp.c in libslirp through 4.3.1 has a buffer     over-read because it tries to read a certain amount of     header data even if that exceeds the total packet     length.(CVE-2020-29130)

  - ncsi.c in libslirp through 4.3.1 has a buffer over-read     because it tries to read a certain amount of header     data even if that exceeds the total packet     length.(CVE-2020-29129)

  - hw/net/e1000e_core.c in QEMU 5.0.0 has an infinite loop     via an RX descriptor with a NULL buffer     address.(CVE-2020-28916)

  - ati_2d_blt in hw/display/ati_2d.c in QEMU 4.2.1 can     encounter an outside-limits situation in a calculation.
    A guest can crash the QEMU process.(CVE-2020-27616)

  - eth_get_gso_type in net/eth.c in QEMU 4.2.1 allows     guest OS users to trigger an assertion failure. A guest     can crash the QEMU process via packet data that lacks a     valid Layer 3 protocol.(CVE-2020-27617)

  - A reachable assertion issue was found in the USB EHCI     emulation code of QEMU. It could occur while processing     USB requests due to missing handling of DMA memory map     failure. A malicious privileged user within the guest     may abuse this flaw to send bogus USB requests and     crash the QEMU process on the host, resulting in a     denial of service.(CVE-2020-25723)

  - hw/usb/hcd-ohci.c in QEMU 5.0.0 has a stack-based     buffer over-read via values obtained from the host     controller driver.(CVE-2020-25624)

  - hw/usb/hcd-ohci.c in QEMU 5.0.0 has an infinite loop     when a TD list has a loop.(CVE-2020-25625)

  - In libslirp 4.1.0, as used in QEMU 4.2.0, tcp_subr.c     misuses snprintf return values, leading to a buffer     overflow in later code.(CVE-2020-8608)

  - tcp_emu in tcp_subr.c in libslirp 4.1.0, as used in     QEMU 4.2.0, mismanages memory, as demonstrated by IRC     DCC commands in EMU_IRC. This can cause a heap-based     buffer overflow or other out-of-bounds access which can     lead to a DoS or potential execute arbitrary     code.(CVE-2020-7039)

  - ip_reass in ip_input.c in libslirp 4.0.0 has a     heap-based buffer overflow via a large packet because     it mishandles a case involving the first     fragment.(CVE-2019-14378)

  - A flaw was found in the memory management API of QEMU     during the initialization of a memory region cache.
    This issue could lead to an out-of-bounds write access     to the MSI-X table while performing MMIO operations. A     guest user may abuse this flaw to crash the QEMU     process on the host, resulting in a denial of service.
    This flaw affects QEMU versions prior to     5.2.0.(CVE-2020-27821)

  - QEMU: reachable assertion failure in     net_tx_pkt_add_raw_fragment() in hw/net/net_tx_pkt.c     (CVE-2020-16092)

  - hw/pci/pci.c in QEMU 4.2.0 allows guest OS users to     trigger an out-of-bounds access by providing an address     near the end of the PCI configuration     space(CVE-2020-13791)

  - qmp_guest_file_read in qga/commands-posix.c and     qga/commands-win32.c in qemu-ga (aka QEMU Guest Agent)     in QEMU 2.12.50 has an integer overflow causing a     g_malloc0() call to trigger a segmentation fault when     trying to allocate a large memory chunk. The     vulnerability can be exploited by sending a crafted QMP     command (including guest-file-read with a large count     value) to the agent via the listening     socket.(CVE-2018-12617)

  - sd_wp_addr in hw/sd/sd.c in QEMU 4.2.0 uses an     unvalidated address, which leads to an out-of-bounds     read during sdhci_write() operations. A guest OS user     can crash the QEMU process.(CVE-2020-13253)

  - QEMU 4.1.0 has a memory leak in zrle_compress_data in     ui/vnc-enc-zrle.c during a VNC disconnect operation     because libz is misused, resulting in a situation where     memory allocated in deflateInit2 is not freed in     deflateEnd.(CVE-2019-20382)

  - An integer overflow was found in QEMU 4.0.1 through     4.2.0 in the way it implemented ATI VGA emulation. This     flaw occurs in the ati_2d_blt() routine in     hw/display/ati-2d.c while handling MMIO write     operations through the ati_mm_write() callback. A     malicious guest could abuse this flaw to crash the QEMU     process, resulting in a denial of     service.(CVE-2020-11869)

  - This vulnerability has been modified since it was last     analyzed by the NVD. It is awaiting reanalysis which     may result in further changes to the information     provided.(CVE-2020-13659)

  - A flaw was found in QEMU in the implementation of the     Pointer Authentication (PAuth) support for ARM     introduced in version 4.0 and fixed in version 5.0.0. A     general failure of the signature generation process     caused every PAuth-enforced pointer to be signed with     the same signature. A local attacker could obtain the     signature of a protected pointer and abuse this flaw to     bypass PAuth protection for all programs running on     QEMU.(CVE-2020-10702)

  - hw/net/xgmac.c in the XGMAC Ethernet controller in QEMU     before 07-20-2020 has a buffer overflow. This occurs     during packet transmission and affects the highbank and     midway emulated machines. A guest user or process could     use this flaw to crash the QEMU process on the host,     resulting in a denial of service or potential     privileged code execution. This was fixed in commit     5519724a13664b43e225ca05351c60b4468e4555.(CVE-2020-1586     3)

  - In QEMU 5.0.0 and earlier, megasas_lookup_frame in     hw/scsi/megasas.c has an out-of-bounds read via a     crafted reply_queue_head field from a guest OS     user.(CVE-2020-13362)

  - ** DISPUTED ** An issue was discovered in ide_dma_cb()     in hw/ide/core.c in QEMU 2.4.0 through 4.2.0. The guest     system can crash the QEMU process in the host system     via a special SCSI_IOCTL_SEND_COMMAND. It hits an     assertion that implies that the size of successful DMA     transfers there must be a multiple of 512 (the size of     a sector). NOTE: a member of the QEMU security team     disputes the significance of this issue because a     'privileged guest user has many ways to cause similar     DoS effect, without triggering this     assert.'(CVE-2019-20175)

  - In QEMU 5.0.0 and earlier, es1370_transfer_audio in     hw/audio/es1370.c does not properly validate the frame     count, which allows guest OS users to trigger an     out-of-bounds access during an es1370_write()     operation.(CVE-2020-13361)

  - rom_copy() in hw/core/loader.c in QEMU 4.1.0 does not     validate the relationship between two addresses, which     allows attackers to trigger an invalid memory copy     operation.(CVE-2020-13765)

  - libslirp 4.0.0, as used in QEMU 4.1.0, has a     use-after-free in ip_reass in     ip_input.c.(CVE-2019-15890)

  - A use after free vulnerability in ip_reass() in     ip_input.c of libslirp 4.2.0 and prior releases allows     crafted packets to cause a denial of     service.(CVE-2020-1983)

  - ati-vga in hw/display/ati.c in QEMU 4.2.0 allows guest     OS users to trigger infinite recursion via a crafted     mm_index value during an ati_mm_read or ati_mm_write     call.(CVE-2020-13800)

  - An out-of-bounds heap buffer access flaw was found in     the way the iSCSI Block driver in QEMU versions 2.12.0     before 4.2.1 handled a response coming from an iSCSI     server while checking the status of a Logical Address     Block (LBA) in an iscsi_co_block_status() routine. A     remote user could use this flaw to crash the QEMU     process, resulting in a denial of service or potential     execution of arbitrary code with privileges of the QEMU     process on the host.(CVE-2020-1711)

  - tftp.c in libslirp 4.1.0, as used in QEMU 4.2.0, does     not prevent ..\ directory traversal on     Windows.(CVE-2020-7211)

  - An out-of-bounds read vulnerability was found in the     SLiRP networking implementation of the QEMU emulator.
    This flaw occurs in the icmp6_send_echoreply() routine     while replying to an ICMP echo request, also known as     ping. This flaw allows a malicious guest to leak the     contents of the host memory, resulting in possible     information disclosure. This flaw affects versions of     libslirp before 4.3.1.(CVE-2020-10756)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that QEMU incorrectly handled bochs-display devices.
A local attacker in a guest could use this to cause a denial of service or possibly execute arbitrary code in the host. This issue only affected Ubuntu 19.10. (CVE-2019-15034)

It was discovered that QEMU incorrectly handled memory during certain VNC operations. A remote attacker could possibly use this issue to cause QEMU to consume resources, resulting in a denial of service.
This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 19.10. (CVE-2019-20382)

It was discovered that QEMU incorrectly generated QEMU Pointer Authentication signatures on ARM. A local attacker could possibly use this issue to bypass PAuth. This issue only affected Ubuntu 19.10.
(CVE-2020-10702)

Ziming Zhang discovered that QEMU incorrectly handled ATI VGA emulation. A local attacker in a guest could use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 20.04 LTS. (CVE-2020-11869)

Aviv Sasson discovered that QEMU incorrectly handled Slirp networking.
A remote attacker could use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code.
This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 19.10. (CVE-2020-1983).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
196234	RHEL 5 : qemu (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	5/11/2024	5/11/2024	critical
147523	EulerOS Virtualization 2.9.1 : qemu (EulerOS-SA-2021-1632)	Nessus	Huawei Local Security Checks	3/10/2021	5/10/2022	high
136803	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : QEMU vulnerabilities (USN-4372-1)	Nessus	Ubuntu Local Security Checks	5/22/2020	10/20/2023	medium
147700	EulerOS Virtualization 2.9.0 : qemu (EulerOS-SA-2021-1667)	Nessus	Huawei Local Security Checks	3/11/2021	5/10/2022	high

Detections

Analytics

Plugins Search

critical

high

medium

high