Published: 19/02/2019 Updated: 12/02/2023

CVSS v2 Base Score: 2.1 | Impact Score: 2.9 | Exploitability Score: 3.9

CVSS v3 Base Score: 5.5 | Impact Score: 3.6 | Exploitability Score: 1.8

VMScore: 187

Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N

QEMU, through version 2.10 and through version 3.1.0, is vulnerable to an out-of-bounds read of up to 128 bytes in the hw/i2c/i2c-ddc.c:i2c_ddc() function. A local attacker with permission to execute i2c commands could exploit this to read stack memory of the qemu process on the host.

Vulnerable Product	Search on Vulmon	Subscribe to Product
qemu qemu
fedoraproject fedora 29
fedoraproject fedora 30
canonical ubuntu linux 18.04
canonical ubuntu linux 18.10
opensuse leap 42.3

Several security issues were fixed in QEMU ...

Multiple security issues were discovered in QEMU, a fast processor emulator, which could result in denial of service, the execution of arbitrary code or information disclosure In addition this update backports support to passthrough the new md-clear CPU flag added in the intel-microcode update shipped in DSA 4447 to x86-based guests For the stabl ...

Debian Bug report logs - #922635 qemu: CVE-2019-3812 Package: src:qemu; Maintainer for src:qemu is Debian QEMU Team <pkg-qemu-devel@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Mon, 18 Feb 2019 17:12:01 UTC Severity: important Tags: security, upstream Found in versions qemu/1 ...

Debian Bug report logs - #929353 qemu: CVE-2019-12155: qxl: null pointer dereference while releasing speice resources Package: src:qemu; Maintainer for src:qemu is Debian QEMU Team <pkg-qemu-devel@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Wed, 22 May 2019 08:03:02 UTC Sever ...

Debian Bug report logs - #901017 qemu: CVE-2018-11806: slirp: heap buffer overflow while reassembling fragmented datagrams Package: src:qemu; Maintainer for src:qemu is Debian QEMU Team <pkg-qemu-devel@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Fri, 8 Jun 2018 03:42:01 UTC ...

Impact: Moderate Public Date: 2019-02-18 CWE: CWE-119 Bugzilla: 1665792: CVE-2019-3812 qemu: Out-of-bou ...

QEMU, through version 210 and through version 310, is vulnerable to an out-of-bounds read of up to 128 bytes in the hw/i2c/i2c-ddcc:i2c_ddc() function A local attacker with permission to execute i2c commands could exploit this to read stack memory of the qemu process on the host ...

CWE-119 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3812 http://www.securityfocus.com/bid/107059 https://usn.ubuntu.com/3923-1/http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00094.html http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00040.html https://www.debian.org/security/2019/dsa-4454 https://seclists.org/bugtraq/2019/May/76 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KJMTVGDLA654HNCDGLCUEIP36SNJEKK7/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CGCFIFSIWUREEQQOZDZFBYKWZHXCWBZN/https://usn.ubuntu.com/3923-1/https://nvd.nist.gov https://access.redhat.com/security/cve/cve-2019-3812

CVE-2019-3812

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect