Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 465
Alerts This Week
Warning Icon 1 465

SUSE: 2021:1895-1 Critical: QEMU Out-Of-Bounds Access Fix

suse
Calendar Grey June 8, 2021
Scroller Suse
SUSE rolls out critical patch for qemu, addressing 11 vulnerabilities, including risks of data leakage due to improper bounds checking.
An update that fixes 11 vulnerabilities is now available

Summary

This update for qemu fixes the following issues: - Fix OOB access during mmio operations (CVE-2020-13754, bsc#1172382) - Fix out-of-bounds read information disclosure in icmp6_send_echoreply (CVE-2020-10756, bsc#1172380) - For the record, these issues are fixed in this package already. Most are alternate references to previously mentioned issues: (CVE-2019-15890, bsc#1149813, CVE-2020-8608, bsc#1163019, CVE-2020-14364, bsc#1175534, CVE-2020-25707, bsc#1178683, CVE-2020-25723, bsc#1178935, CVE-2020-29130, bsc#1179477, CVE-2020-29129, bsc#1179484, CVE-2021-20257, bsc#1182846, CVE-2021-3419, bsc#1182975) Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

Topics%20covered

Topics Covered

security advisory software update patch important out-of-bounds access qemu SUSE Linux Enterprise

References

#1149813 #1163019 #1172380 #1172382 #1175534

#1178683 #1178935 #1179477 #1179484 #1182846

#1182975

Cross- CVE-2019-15890 CVE-2020-10756 CVE-2020-13754

CVE-2020-14364 CVE-2020-25707 CVE-2020-25723

CVE-2020-29129 CVE-2020-29130 CVE-2020-8608

CVE-2021-20257 CVE-2021-3419

CVSS scores:

CVE-2019-15890 (SUSE): 5.8 CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H

CVE-2020-10756 (NVD) : 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

CVE-2020-10756 (SUSE): 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

CVE-2020-13754 (NVD) : 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CVE-2020-13754 (SUSE): 3.9 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:L

CVE-2020-14364 (NVD) : 5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2021:1895-1
Rating: important

Topics%20covered

Topics Covered

security advisory software update patch important out-of-bounds access qemu SUSE Linux Enterprise

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.