Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 461
Alerts This Week
Warning Icon 1 461

SUSE: 2021:1837-1 Critical: Qemu Out-of-Bounds Security Fixes

suse
Calendar Grey June 2, 2021
Scroller Suse
A significant announcement concerning qemu addresses 11 issues and security flaws within SUSE Linux Enterprise Server 12-SP5.
An update that solves 11 vulnerabilities and has two fixes is now available

Summary

This update for qemu fixes the following issues: - Fix out-of-bounds access issue while doing multi block SDMA (CVE-2020-25085, bsc#1176681) - Fix out-of-bounds read information disclosure in icmp6_send_echoreply (CVE-2020-10756, bsc#1172380) - QEMU BIOS fails to read stage2 loader on s390x (bsc#1186290) - Change dependency from CONFIG_VFIO back to CONFIG_LINUX (bsc#1179725) - For the record, these issues are fixed in this package already. Most are alternate references to previously mentioned issues: (CVE-2019-15890, bsc#1149813, CVE-2020-8608, bsc#1163019, CVE-2020-14364, bsc#1175534, CVE-2020-25707, bsc#1178683, CVE-2020-25723, bsc#1178935, CVE-2020-29130, bsc#1179477, CVE-2020-29129, bsc#1179484, CVE-2021-20257, bsc#1182846, CVE-2021-3419, bsc#1182975) Patch Instructions:

Topics%20covered

Topics Covered

security advisory security fix important information disclosure out-of-bounds qemu SUSE Linux Enterprise Server

References

#1149813 #1163019 #1172380 #1175534 #1176681

#1178683 #1178935 #1179477 #1179484 #1179725

#1182846 #1182975 #1186290

Cross- CVE-2019-15890 CVE-2020-10756 CVE-2020-14364

CVE-2020-25085 CVE-2020-25707 CVE-2020-25723

CVE-2020-29129 CVE-2020-29130 CVE-2020-8608

CVE-2021-20257 CVE-2021-3419

CVSS scores:

CVE-2019-15890 (SUSE): 5.8 CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H

CVE-2020-10756 (NVD) : 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

CVE-2020-10756 (SUSE): 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

CVE-2020-14364 (NVD) : 5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L

CVE-2020-14364 (SUSE): 5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L

CVE-2020-25085 (NVD) : 5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2021:1837-1
Rating: important

Topics%20covered

Topics Covered

security advisory security fix important information disclosure out-of-bounds qemu SUSE Linux Enterprise Server

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.