huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2019-13012: glib2: insecure permissions for files and directories
Component: glib2
Severity: Low
CWE: CWE-732 (Incorrect Permission Assignment for Critical Resource)
CVSS v3: 4.4 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)
Public date: 2019-06-28T00:00:00+00:00

The keyfile settings backend in GNOME GLib (aka glib2.0) before 2.60.0 creates directories using g_file_make_directory_with_parents (kfsb->dir, NULL, NULL) and files using g_file_replace_contents (kfsb->file, contents, length, NULL, FALSE, G_FILE_CREATE_REPLACE_DESTINATION, NULL, NULL, NULL). Consequently, it does not properly restrict directory (and file) permissions. Instead, for directories, 0777 permissions are used; for files, default file permissions are used. This is similar to CVE-2019-12450.

Statement: This issue affects glib2 as shipped with Red Hat Enterprise Linux 6, 7 and 8 and was rated as having a Low security impact by Red Hat Product Security team.

Although Red Hat Enterprise Linux versions above ships the vulnerable code the flaw itself is not currently exploitable due to the presence of another glib2 bug (rhbz#1728896).
This bug avoid glib's 'keyfile' module to be loaded at glib2 initialization, thus the vulnerable code is currently unreachable.

Red Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. This has been rated as having a security impact of Low, and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Affected upstream versions: n/a
Fixed upstream versions: 2.60.0
Upstream repository: https://gitlab.gnome.org/GNOME/glib
Upstream fix commit: 5e4da714f00f6bfb2ccd6d73d61329c6f3a08429
CVE-2019-13045: irssi: use after free when sending SASL login to server
Component: irssi
Severity: Low
CWE: CWE-416 (Use After Free)
CVSS v3: 3.7 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2019-06-29T00:00:00+00:00

Irssi before 1.0.8, 1.1.x before 1.1.3, and 1.2.x before 1.2.1, when SASL is enabled, has a use after free when sending SASL login to the server.


Affected upstream versions: n/a
Fixed upstream versions: 1.4.1
Upstream repository: https://github.com/irssi/irssi
Upstream fix commit: d23b0d22cc611e43c88d99192a59f413f951a955
CVE-2019-13133: ImageMagick: a memory leak vulnerability in the function ReadBMPImage in coders/bmp.c
Component: ImageMagick
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 3.3 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Public date: 2019-06-19T00:00:00+00:00

ImageMagick before 7.0.8-50 has a memory leak vulnerability in the function ReadBMPImage in coders/bmp.c.


Affected upstream versions: n/a
Fixed upstream versions: 7.0.8-50
Upstream repository: https://github.com/ImageMagick/ImageMagick
Upstream fix commit: fe3066122ef72c82415811d25e9e3fad622c0a99
CVE-2019-13134: ImageMagick: a memory leak vulnerability in the function ReadVIFFImage in coders/viff.c
Component: ImageMagick
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 3.3 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Public date: 2019-06-19T00:00:00+00:00

ImageMagick before 7.0.8-50 has a memory leak vulnerability in the function ReadVIFFImage in coders/viff.c.


Affected upstream versions: n/a
Fixed upstream versions: 7.0.8-50
Upstream repository: https://github.com/ImageMagick/ImageMagick
Upstream fix commit: fe3066122ef72c82415811d25e9e3fad622c0a99
CVE-2019-13135: ImageMagick: a "use of uninitialized value" vulnerability in the function ReadCUTImage leading to a crash and DoS
Component: ImageMagick
Severity: Moderate
CWE: CWE-456 (Missing Initialization of a Variable)
CVSS v3: 7.4 (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2019-06-19T00:00:00+00:00

ImageMagick before 7.0.8-50 has a "use of uninitialized value" vulnerability in the function ReadCUTImage in coders/cut.c.


Affected upstream versions: n/a
Fixed upstream versions: 6.9.10-50
Upstream repository: https://github.com/ImageMagick/ImageMagick6
Upstream fix commit: 1e59b29e520d2beab73e8c78aacd5f1c0d76196d
CVE-2019-13224: oniguruma: Use-after-free in onig_new_deluxe() in regext.c
Component: oniguruma
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 6.8 (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H)
Public date: 2019-06-27T00:00:00+00:00

A use-after-free in onig_new_deluxe() in regext.c in Oniguruma 6.9.2 allows attackers to potentially cause information disclosure, denial of service, or possibly code execution by providing a crafted regular expression. The attacker provides a pair of a regex pattern and a string, with a multi-byte encoding that gets handled by onig_new_deluxe(). Oniguruma issues often affect Ruby, as well as common optional libraries for PHP and Rust.

Statement: Ruby versions are not affected as they used Onigmo, which is a fork of Oniguruma, instead. The Onigmo library doesn't includes the source code containing the related bug.

Affected upstream versions: n/a
Fixed upstream versions: v6.9.3
Upstream repository: https://github.com/kkos/oniguruma
Upstream fix commit: 0f7f61ed1b7b697e283e37bd2d731d0bd57adb55
CVE-2019-13225: oniguruma: NULL pointer dereference in match_at() in regexec.c
Component: oniguruma
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.3 (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H)
Public date: 2019-06-27T00:00:00+00:00

A NULL Pointer Dereference in match_at() in regexec.c in Oniguruma 6.9.2 allows attackers to potentially cause denial of service by providing a crafted regular expression. Oniguruma issues often affect Ruby, as well as common optional libraries for PHP and Rust.

Statement: The version of Oniguruma package as shipped with Red Hat Enterprise Linux 6 is not affected by this issue. The issue resides on the way 'If/Else' statements are handled by Oniguruma which is not supported by Red Hat Enterprise Linux 6.

Affected upstream versions: n/a
Fixed upstream versions: v6.9.3
Upstream repository: https://github.com/kkos/oniguruma
Upstream fix commit: c509265c5f6ae7264f7b8a8aae1cfa5fc59d108c
CVE-2019-13233: kernel: use-after-free in arch/x86/lib/insn-eval.c
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 5.1 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
Public date: 2019-07-04T00:00:00+00:00

A vulnerability was found in the arch/x86/lib/insn-eval.c function in the Linux kernel. An attacker could corrupt the memory due to a flaw in use-after-free access to an LDT entry caused by a race condition between modify_ldt() and a #BR exception for an MPX bounds violation.


Affected upstream versions: n/a
Fixed upstream versions: v5.2
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: de9f869616dd95e95c00bdd6b0fcd3421e8a4323
CVE-2019-13272: kernel: broken permission and object lifetime handling for PTRACE_TRACEME
Component: kernel
Severity: Important
CWE: CWE-271 (Privilege Dropping / Lowering Errors)
CVSS v3: 7.8 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H)
Public date: 2019-07-16T00:00:00+00:00

A flaw was found in the way PTRACE_TRACEME functionality was handled in the Linux kernel. The kernel's implementation of ptrace can inadvertently grant elevated permissions to an attacker who can then abuse the relationship between the tracer and the process being traced. This flaw could allow a local, unprivileged user to increase their privileges on the system or cause a denial of service.

Statement: Red Hat Product Security is aware of this issue. Updates will be released as they become available. For additional information, please refer to the Red Hat Knowledgebase article:  https://access.redhat.com/articles/4292201

Affected upstream versions: n/a
Fixed upstream versions: v5.2
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 6994eefb0053799d2e07cd140df6c2ea106c41ee
CVE-2019-13295: ImageMagick: heap-based buffer over-read at MagickCore/threshold.c in AdaptiveThresholdImage because a width of zero is mishandled
Component: ImageMagick
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 5.4 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L)
Public date: 2019-07-17T00:00:00+00:00

A heap-based buffer over-read was discovered in ImageMagick in the way it selects an individual threshold for each pixel based on the range of intensity values in its local neighborhood due to a width of zero mishandle error. Applications compiled against ImageMagick libraries that accept untrustworthy images may be vulnerable to this flaw. An attacker could abuse this flaw by providing a specially crafted image to make the application crash or leak application data.


Affected upstream versions: n/a
Fixed upstream versions: 7.0.8-50
Upstream repository: https://github.com/ImageMagick/ImageMagick
Upstream fix commit: a7759f410b773a1dd57b0e1fb28112e1cd8b97bc
CVE-2019-13297: ImageMagick: heap-based buffer over-read at MagickCore/threshold.c in AdaptiveThresholdImage because a height of zero is mishandled
Component: ImageMagick
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 5.4 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L)
Public date: 2019-07-17T00:00:00+00:00

A heap-based buffer over-read was discovered in ImageMagick in the way it selects an individual threshold for each pixel based on the range of intensity values in its local neighborhood due to a height of zero mishandle error. Applications compiled against ImageMagick libraries that accept untrustworthy images may be vulnerable to this flaw. An attacker could abuse this flaw by providing a specially crafted image to make the application crash or leak application data.


Affected upstream versions: n/a
Fixed upstream versions: 6.9.10-50
Upstream repository: https://github.com/ImageMagick/ImageMagick6
Upstream fix commit: 35c7032723d85eee7318ff6c82f031fa2666b773
CVE-2019-13300: ImageMagick: heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages because of mishandling columns
Component: ImageMagick
Severity: Moderate
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
CVSS v3: 8.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2019-07-17T00:00:00+00:00

A heap-based buffer overflow was discovered in ImageMagick in the way it applies a value with arithmetic, relational, or logical operators to an image due to mishandling columns. Applications compiled against ImageMagick libraries that accept untrustworthy images and use the evaluate-sequence option or function EvaluateImages may be vulnerable to this flaw. An attacker could abuse this flaw by providing a specially crafted image to make the application crash or potentially execute code.


Affected upstream versions: n/a
Fixed upstream versions: 6.9.10-50
Upstream repository: https://github.com/ImageMagick/ImageMagick6
Upstream fix commit: 5e409ae7a389cdf2ed17469303be3f3f21cec450
CVE-2019-13301: ImageMagick: memory leaks in AcquireMagickMemory
Component: ImageMagick
Severity: Moderate
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 6.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Public date: 2019-07-17T00:00:00+00:00

ImageMagick 7.0.8-50 Q16 has memory leaks in AcquireMagickMemory because of an AnnotateImage error.


Affected upstream versions: n/a
Fixed upstream versions: 7.0.8-50
Upstream repository: https://github.com/ImageMagick/ImageMagick
Upstream fix commit: f595a1985233c399a05c0c37cc41de16a90dd025
CVE-2019-13304: ImageMagick: stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a misplaced assignment
Component: ImageMagick
Severity: Moderate
CWE: CWE-193 (Off-by-one Error)
CVSS v3: 8.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2019-07-16T00:00:00+00:00

A stack-based buffer overflow was discovered in ImageMagick in the way it writes PNM images due to a misplaced assignment. Applications compiled against ImageMagick libraries that accept untrustworthy images or write PNM images may be vulnerable to this flaw. An attacker could abuse this flaw by providing a specially crafted image to make the application crash or potentially execute code.


Affected upstream versions: n/a
Fixed upstream versions: 6.9.10-50
Upstream repository: https://github.com/ImageMagick/ImageMagick6
Upstream fix commit: bfa3b9610c83227894c92b0d312ad327fceb6241
CVE-2019-13305: ImageMagick: stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a misplaced strncpy and an off-by-one error
Component: ImageMagick
Severity: Moderate
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
CVSS v3: 8.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2019-07-16T00:00:00+00:00

A stack-based buffer overflow was discovered in ImageMagick in the way it writes PNM images due to a misplaced strncpy and off-by-one errors. Applications compiled against ImageMagick libraries that accept untrustworthy images or write PNM images may be vulnerable to this flaw. An attacker could abuse this flaw by providing a specially crafted image to make the application crash or potentially execute code.


Affected upstream versions: n/a
Fixed upstream versions: 6.9.10-50
Upstream repository: https://github.com/ImageMagick/ImageMagick6
Upstream fix commit: 5c7fbf9a14fb83c9685ad69d48899f490a37609d
CVE-2019-13306: ImageMagick: stack-based buffer overflow at coders/pnm.c in WritePNMImage because of off-by-one errors
Component: ImageMagick
Severity: Moderate
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
CVSS v3: 8.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2019-07-16T00:00:00+00:00

A stack-based buffer overflow was discovered in ImageMagick in the way it writes PNM images due to off-by-one errors. Applications compiled against ImageMagick libraries that accept untrustworthy images or write PNM images may be vulnerable to this flaw. An attacker could abuse this flaw by providing a specially crafted image to make the application crash or potentially execute code.


Affected upstream versions: n/a
Fixed upstream versions: 6.9.10-50
Upstream repository: https://github.com/ImageMagick/ImageMagick6
Upstream fix commit: cb5ec7d98195aa74d5ed299b38eff2a68122f3fa
CVE-2019-13307: ImageMagick: heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages because of mishandling rows
Component: ImageMagick
Severity: Moderate
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
CVSS v3: 7.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2019-07-16T00:00:00+00:00

A heap-based buffer overflow was discovered in ImageMagick in the way it parses images when using the evaluate-sequence option. Applications compiled against ImageMagick libraries that accept untrustworthy images and use the evaluate-sequence option or function EvaluateImages may be vulnerable to this flaw. An attacker could abuse this flaw by providing a specially crafted image to make the application crash or potentially execute code.


Affected upstream versions: n/a
Fixed upstream versions: 6.9.10-50
Upstream repository: https://github.com/ImageMagick/ImageMagick6
Upstream fix commit: 91e58d967a92250439ede038ccfb0913a81e59fe
CVE-2019-13309: ImageMagick: memory leaks at AcquireMagickMemory due to mishandling the NoSuchImage error in CLIListOperatorImages
Component: ImageMagick
Severity: Low
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2019-07-16T00:00:00+00:00

A flaw was found in ImageMagick version 7.0.8-50 Q16, containing memory leaks of AcquireMagickMemory due to the mishandling of the NoSuchImage error in CLIListOperatorImages in MagickWand/operation.c. It was discovered that ImageMagick does not properly release acquired memory in function MogrifyImageList() when some error conditions are met, or the "compare" option is used. Applications compiled against ImageMagick libraries that accept untrustworthy images may be exploited to use all available memory and make them crash. An attacker could abuse this flaw by providing a specially crafted image and cause a Denial of Service by using all available memory.


Affected upstream versions: n/a
Fixed upstream versions: 7.0.8-50
Upstream repository: https://github.com/ImageMagick/ImageMagick
Upstream fix commit: 5f21230b657ccd65452dd3d94c5b5401ba691a2d
CVE-2019-13310: ImageMagick: memory leaks at AcquireMagickMemory because of an error in MagickWand/mogrify.c
Component: ImageMagick
Severity: Low
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2019-07-16T00:00:00+00:00

A flaw was found in ImageMagick version 7.0.8-50 Q16, containing memory leaks of AcquireMagickMemory due to an error found in MagickWand/mogrify.c. It was discovered that ImageMagick does not properly release acquired memory when some error conditions occur in the function MogrifyImageList(). Applications compiled against ImageMagick libraries that accept untrustworthy images may be exploited to use all available memory and make them crash. An attacker could abuse this flaw by providing a specially crafted image and cause a Denial of Service by using all available memory.


Affected upstream versions: n/a
Fixed upstream versions: 7.0.8-50
Upstream repository: https://github.com/ImageMagick/ImageMagick
Upstream fix commit: 5f21230b657ccd65452dd3d94c5b5401ba691a2d
CVE-2019-13311: ImageMagick: memory leaks at AcquireMagickMemory because of a wand/mogrify.c error
Component: ImageMagick
Severity: Low
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 3.3 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Public date: 2019-07-16T00:00:00+00:00

A flaw was found in ImageMagick, containing memory leaks of AcquireMagickMemory due to a wand/mogrify.c error. It was discovered that ImageMagick does not properly release acquired memory when some error conditions occur in the function MogrifyImageList(). An attacker could abuse this flaw by providing a specially crafted image and cause a Denial of Service by using all available memory. Applications compiled against ImageMagick libraries that accept untrustworthy images may be exploited to use all available memory and make them crash.


Affected upstream versions: n/a
Fixed upstream versions: 6.9.10-52
Upstream repository: https://github.com/ImageMagick/ImageMagick6
Upstream fix commit: bb812022d0bc12107db215c981cab0b1ccd73d91
CVE-2019-13454: ImageMagick: division by zero in RemoveDuplicateLayers in MagickCore/layer.c
Component: ImageMagick
Severity: Low
CWE: CWE-369 (Divide By Zero)
CVSS v3: 3.3 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Public date: 2019-07-09T00:00:00+00:00

ImageMagick 7.0.1-0 to 7.0.8-54 Q16 allows Division by Zero in RemoveDuplicateLayers in MagickCore/layer.c.


Affected upstream versions: n/a
Fixed upstream versions: 7.0.8-54
Upstream repository: https://github.com/ImageMagick/ImageMagick
Upstream fix commit: 1ddcf2e4f28029a888cadef2e757509ef5047ad8
CVE-2019-13456: freeradius: eap-pwd: Information leak due to aborting when needing more than 10 iterations
Component: freeradius
Severity: Moderate
CWE: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
CVSS v3: 5.3 (CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
Public date: 2019-08-03T00:00:00+00:00

An information leak was discovered in the implementation of EAP-pwd in freeradius. An attacker could initiate several EAP-pwd handshakes to leak information, which can then be used to recover the user's WiFi password by performing dictionary and brute-force attacks.

Statement: This issue did not affect the versions of freeradius as shipped with Red Hat Enterprise Linux 5, and 6 as they did not include support for EAP-pwd.

Affected upstream versions: n/a
Fixed upstream versions: release_3_0_20
Upstream repository: https://github.com/FreeRADIUS/freeradius-server
Upstream fix commit: 3ea2a5a026e73d81cd9a3e9bbd4300c433004bfa
CVE-2019-13636: patch: the following of symlinks in inp.c and util.c is mishandled in cases other than input files
Component: patch
Severity: Moderate
CWE: CWE-59 (Improper Link Resolution Before File Access ('Link Following'))
CVSS v3: 5.9 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)
Public date: 2019-07-24T00:00:00+00:00

In GNU patch through 2.7.6, the following of symlinks is mishandled in certain cases other than input files. This affects inp.c and util.c.


Affected upstream versions: n/a
Upstream repository: https://git.savannah.gnu.org/cgit/patch.git
Upstream fix commit: dce4683cbbe107a95f1f0d45fabc304acfb5d71a
CVE-2019-13638: patch: OS shell command injection when processing crafted patch files
Component: patch
Severity: Important
CWE: CWE-78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'))
CVSS v3: 7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2019-07-29T00:00:00+00:00

A flaw was found in GNU patch through version 2.7.6. An ed-style diff payload patch file with shell metacharacters can be used to inject OS shell commands into a system. The ed editor does not need to be present on the vulnerable system for this attack to function. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Statement: Red Hat Enterprise Linux 6 is not affected by this vulnerability as the shipped version of patch did not carry the code that introduced this flaw.

Affected upstream versions: n/a
Upstream repository: https://git.savannah.gnu.org/cgit/patch.git
Upstream fix commit: 3fcd042d26d70856e826a42b5f93dc4854d80bf0
CVE-2019-14283: kernel: integer overflow and OOB read in drivers/block/floppy.c
Component: kernel
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 5.6 (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H)
Public date: 2019-07-26T00:00:00+00:00

A vulnerability was found in the Linux kernel’s floppy disk driver implementation. A local attacker with access to the floppy device could call set_geometry in drivers/block/floppy.c, which does not validate the sect and head fields, causing an integer overflow and out-of-bounds read. This flaw may crash the system or allow an attacker to gather information causing subsequent successful attacks.


Affected upstream versions: n/a
Fixed upstream versions: v5.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: da99466ac243f15fbba65bd261bfc75ffa1532b6
CVE-2019-14378: QEMU: slirp: heap buffer overflow during packet reassembly
Component: QEMU
Severity: Important
CWE: CWE-122 (Heap-based Buffer Overflow)
CVSS v3: 7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H)
Public date: 2019-07-28T00:00:00+00:00

A heap buffer overflow issue was found in the SLiRP networking implementation of the QEMU emulator. This flaw occurs in the ip_reass() routine while reassembling incoming packets if the first fragment is bigger than the m->m_dat[] buffer. An attacker could use this flaw to crash the QEMU process on the host, resulting in a Denial of Service or potentially executing arbitrary code with privileges of the QEMU process.

Statement: Red Hat OpenStack Platform:                                                                                                                 
* This flaw impacts KVM user-mode or SLIRP networking, which is not used in Red Hat OpenStack Platform. Although updating is recommended for affected versions (see below), Red Hat OpenStack Platform environments are not vulnerable.
* Because the flaw's impact is Low, it will not be fixed in Red Hat OpenStack Platform 9 which is retiring within a few weeks of the flaw's public date.

Affected upstream versions: n/a
Fixed upstream versions: v4.1.0
Upstream repository: https://gitlab.freedesktop.org/slirp/libslirp
Upstream fix commit: 126c04acbabd7ad32c2b018fe10dfac2a3bc1210