Security update for qemu SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2020:1514-1 Final 1 1 2020-06-02T08:14:29Z current 2020-06-02T08:14:29Z 2020-06-02T08:14:29Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for qemu This update for qemu fixes the following issues: Security issues fixed: - CVE-2020-1711: Fixed a potential OOB access in the iSCSI client code (bsc#1166240). - CVE-2019-12068: Fixed a potential DoS in the LSI SCSI controller emulation (bsc#1146873). - CVE-2020-1983: Fixed a use-after-free in the ip_reass function of slirp (bsc#1170940). - CVE-2020-8608: Fixed a potential OOB access in slirp (bsc#1163018). - CVE-2020-7039: Fixed a potential OOB access in slirp (bsc#1161066). - CVE-2019-15890: Fixed a use-after-free during packet reassembly in slirp (bsc#1149811). - Fixed multiple potential DoS issues in SLIRP, similar to CVE-2019-6778 (bsc#1123156). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2020-1514,SUSE-SLE-SAP-12-SP1-2020-1514,SUSE-SLE-SERVER-12-SP1-2020-1514 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2020/suse-su-20201514-1/ Link for SUSE-SU-2020:1514-1 https://lists.suse.com/pipermail/sle-security-updates/2020-June/006872.html E-Mail link for SUSE-SU-2020:1514-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1123156 SUSE Bug 1123156 https://bugzilla.suse.com/1146873 SUSE Bug 1146873 https://bugzilla.suse.com/1149811 SUSE Bug 1149811 https://bugzilla.suse.com/1161066 SUSE Bug 1161066 https://bugzilla.suse.com/1163018 SUSE Bug 1163018 https://bugzilla.suse.com/1166240 SUSE Bug 1166240 https://bugzilla.suse.com/1170940 SUSE Bug 1170940 https://www.suse.com/security/cve/CVE-2019-12068/ SUSE CVE CVE-2019-12068 page https://www.suse.com/security/cve/CVE-2019-15890/ SUSE CVE CVE-2019-15890 page https://www.suse.com/security/cve/CVE-2019-6778/ SUSE CVE CVE-2019-6778 page https://www.suse.com/security/cve/CVE-2020-1711/ SUSE CVE CVE-2020-1711 page https://www.suse.com/security/cve/CVE-2020-1983/ SUSE CVE CVE-2020-1983 page https://www.suse.com/security/cve/CVE-2020-7039/ SUSE CVE CVE-2020-7039 page https://www.suse.com/security/cve/CVE-2020-8608/ SUSE CVE CVE-2020-8608 page SUSE Linux Enterprise Server 12 SP1-LTSS SUSE Linux Enterprise Server for SAP Applications 12 SP1 qemu-2.3.1-33.29.1 qemu-arm-2.3.1-33.29.1 qemu-block-curl-2.3.1-33.29.1 qemu-block-rbd-2.3.1-33.29.1 qemu-extra-2.3.1-33.29.1 qemu-guest-agent-2.3.1-33.29.1 qemu-ipxe-1.0.0-33.29.1 qemu-kvm-2.3.1-33.29.1 qemu-lang-2.3.1-33.29.1 qemu-linux-user-2.3.1-33.29.1 qemu-ppc-2.3.1-33.29.1 qemu-s390-2.3.1-33.29.1 qemu-seabios-1.8.1-33.29.1 qemu-sgabios-8-33.29.1 qemu-testsuite-2.3.1-33.29.2 qemu-tools-2.3.1-33.29.1 qemu-vgabios-1.8.1-33.29.1 qemu-x86-2.3.1-33.29.1 qemu-2.3.1-33.29.1 as a component of SUSE Linux Enterprise Server 12 SP1-LTSS qemu-block-curl-2.3.1-33.29.1 as a component of SUSE Linux Enterprise Server 12 SP1-LTSS qemu-block-rbd-2.3.1-33.29.1 as a component of SUSE Linux Enterprise Server 12 SP1-LTSS qemu-guest-agent-2.3.1-33.29.1 as a component of SUSE Linux Enterprise Server 12 SP1-LTSS qemu-ipxe-1.0.0-33.29.1 as a component of SUSE Linux Enterprise Server 12 SP1-LTSS qemu-kvm-2.3.1-33.29.1 as a component of SUSE Linux Enterprise Server 12 SP1-LTSS qemu-lang-2.3.1-33.29.1 as a component of SUSE Linux Enterprise Server 12 SP1-LTSS qemu-ppc-2.3.1-33.29.1 as a component of SUSE Linux Enterprise Server 12 SP1-LTSS qemu-s390-2.3.1-33.29.1 as a component of SUSE Linux Enterprise Server 12 SP1-LTSS qemu-seabios-1.8.1-33.29.1 as a component of SUSE Linux Enterprise Server 12 SP1-LTSS qemu-sgabios-8-33.29.1 as a component of SUSE Linux Enterprise Server 12 SP1-LTSS qemu-tools-2.3.1-33.29.1 as a component of SUSE Linux Enterprise Server 12 SP1-LTSS qemu-vgabios-1.8.1-33.29.1 as a component of SUSE Linux Enterprise Server 12 SP1-LTSS qemu-x86-2.3.1-33.29.1 as a component of SUSE Linux Enterprise Server 12 SP1-LTSS qemu-2.3.1-33.29.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1 qemu-block-curl-2.3.1-33.29.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1 qemu-block-rbd-2.3.1-33.29.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1 qemu-guest-agent-2.3.1-33.29.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1 qemu-ipxe-1.0.0-33.29.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1 qemu-kvm-2.3.1-33.29.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1 qemu-lang-2.3.1-33.29.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1 qemu-seabios-1.8.1-33.29.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1 qemu-sgabios-8-33.29.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1 qemu-tools-2.3.1-33.29.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1 qemu-vgabios-1.8.1-33.29.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1 qemu-x86-2.3.1-33.29.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1 In QEMU 1:4.1-1, 1:2.1+dfsg-12+deb8u6, 1:2.8+dfsg-6+deb9u8, 1:3.1+dfsg-8~deb10u1, 1:3.1+dfsg-8+deb10u2, and 1:2.1+dfsg-12+deb8u12 (fixed), when executing script in lsi_execute_script(), the LSI scsi adapter emulator advances 's->dsp' index to read next opcode. This can lead to an infinite loop if the next opcode is empty. Move the existing loop exit after 10k iterations so that it covers no-op opcodes as well. CVE-2019-12068 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-2.3.1-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-block-curl-2.3.1-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-block-rbd-2.3.1-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-guest-agent-2.3.1-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-ipxe-1.0.0-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-kvm-2.3.1-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-lang-2.3.1-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-ppc-2.3.1-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-s390-2.3.1-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-seabios-1.8.1-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-sgabios-8-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-tools-2.3.1-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-vgabios-1.8.1-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-x86-2.3.1-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-2.3.1-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-block-curl-2.3.1-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-block-rbd-2.3.1-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-guest-agent-2.3.1-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-ipxe-1.0.0-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-kvm-2.3.1-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-lang-2.3.1-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-seabios-1.8.1-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-sgabios-8-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-tools-2.3.1-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-vgabios-1.8.1-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-x86-2.3.1-33.29.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20201514-1/ https://www.suse.com/security/cve/CVE-2019-12068.html CVE-2019-12068 https://bugzilla.suse.com/1146873 SUSE Bug 1146873 https://bugzilla.suse.com/1146874 SUSE Bug 1146874 https://bugzilla.suse.com/1178658 SUSE Bug 1178658 libslirp 4.0.0, as used in QEMU 4.1.0, has a use-after-free in ip_reass in ip_input.c. CVE-2019-15890 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-2.3.1-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-block-curl-2.3.1-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-block-rbd-2.3.1-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-guest-agent-2.3.1-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-ipxe-1.0.0-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-kvm-2.3.1-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-lang-2.3.1-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-ppc-2.3.1-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-s390-2.3.1-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-seabios-1.8.1-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-sgabios-8-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-tools-2.3.1-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-vgabios-1.8.1-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-x86-2.3.1-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-2.3.1-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-block-curl-2.3.1-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-block-rbd-2.3.1-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-guest-agent-2.3.1-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-ipxe-1.0.0-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-kvm-2.3.1-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-lang-2.3.1-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-seabios-1.8.1-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-sgabios-8-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-tools-2.3.1-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-vgabios-1.8.1-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-x86-2.3.1-33.29.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20201514-1/ https://www.suse.com/security/cve/CVE-2019-15890.html CVE-2019-15890 https://bugzilla.suse.com/1149811 SUSE Bug 1149811 https://bugzilla.suse.com/1149813 SUSE Bug 1149813 https://bugzilla.suse.com/1178658 SUSE Bug 1178658 In QEMU 3.0.0, tcp_emu in slirp/tcp_subr.c has a heap-based buffer overflow. CVE-2019-6778 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-2.3.1-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-block-curl-2.3.1-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-block-rbd-2.3.1-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-guest-agent-2.3.1-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-ipxe-1.0.0-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-kvm-2.3.1-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-lang-2.3.1-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-ppc-2.3.1-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-s390-2.3.1-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-seabios-1.8.1-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-sgabios-8-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-tools-2.3.1-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-vgabios-1.8.1-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-x86-2.3.1-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-2.3.1-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-block-curl-2.3.1-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-block-rbd-2.3.1-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-guest-agent-2.3.1-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-ipxe-1.0.0-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-kvm-2.3.1-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-lang-2.3.1-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-seabios-1.8.1-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-sgabios-8-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-tools-2.3.1-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-vgabios-1.8.1-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-x86-2.3.1-33.29.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20201514-1/ https://www.suse.com/security/cve/CVE-2019-6778.html CVE-2019-6778 https://bugzilla.suse.com/1123156 SUSE Bug 1123156 https://bugzilla.suse.com/1123157 SUSE Bug 1123157 https://bugzilla.suse.com/1178658 SUSE Bug 1178658 An out-of-bounds heap buffer access flaw was found in the way the iSCSI Block driver in QEMU versions 2.12.0 before 4.2.1 handled a response coming from an iSCSI server while checking the status of a Logical Address Block (LBA) in an iscsi_co_block_status() routine. A remote user could use this flaw to crash the QEMU process, resulting in a denial of service or potential execution of arbitrary code with privileges of the QEMU process on the host. CVE-2020-1711 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-2.3.1-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-block-curl-2.3.1-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-block-rbd-2.3.1-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-guest-agent-2.3.1-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-ipxe-1.0.0-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-kvm-2.3.1-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-lang-2.3.1-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-ppc-2.3.1-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-s390-2.3.1-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-seabios-1.8.1-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-sgabios-8-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-tools-2.3.1-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-vgabios-1.8.1-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-x86-2.3.1-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-2.3.1-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-block-curl-2.3.1-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-block-rbd-2.3.1-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-guest-agent-2.3.1-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-ipxe-1.0.0-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-kvm-2.3.1-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-lang-2.3.1-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-seabios-1.8.1-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-sgabios-8-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-tools-2.3.1-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-vgabios-1.8.1-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-x86-2.3.1-33.29.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20201514-1/ https://www.suse.com/security/cve/CVE-2020-1711.html CVE-2020-1711 https://bugzilla.suse.com/1166240 SUSE Bug 1166240 A use after free vulnerability in ip_reass() in ip_input.c of libslirp 4.2.0 and prior releases allows crafted packets to cause a denial of service. CVE-2020-1983 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-2.3.1-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-block-curl-2.3.1-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-block-rbd-2.3.1-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-guest-agent-2.3.1-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-ipxe-1.0.0-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-kvm-2.3.1-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-lang-2.3.1-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-ppc-2.3.1-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-s390-2.3.1-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-seabios-1.8.1-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-sgabios-8-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-tools-2.3.1-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-vgabios-1.8.1-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-x86-2.3.1-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-2.3.1-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-block-curl-2.3.1-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-block-rbd-2.3.1-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-guest-agent-2.3.1-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-ipxe-1.0.0-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-kvm-2.3.1-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-lang-2.3.1-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-seabios-1.8.1-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-sgabios-8-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-tools-2.3.1-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-vgabios-1.8.1-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-x86-2.3.1-33.29.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20201514-1/ https://www.suse.com/security/cve/CVE-2020-1983.html CVE-2020-1983 https://bugzilla.suse.com/1170940 SUSE Bug 1170940 tcp_emu in tcp_subr.c in libslirp 4.1.0, as used in QEMU 4.2.0, mismanages memory, as demonstrated by IRC DCC commands in EMU_IRC. This can cause a heap-based buffer overflow or other out-of-bounds access which can lead to a DoS or potential execute arbitrary code. CVE-2020-7039 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-2.3.1-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-block-curl-2.3.1-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-block-rbd-2.3.1-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-guest-agent-2.3.1-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-ipxe-1.0.0-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-kvm-2.3.1-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-lang-2.3.1-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-ppc-2.3.1-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-s390-2.3.1-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-seabios-1.8.1-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-sgabios-8-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-tools-2.3.1-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-vgabios-1.8.1-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-x86-2.3.1-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-2.3.1-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-block-curl-2.3.1-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-block-rbd-2.3.1-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-guest-agent-2.3.1-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-ipxe-1.0.0-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-kvm-2.3.1-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-lang-2.3.1-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-seabios-1.8.1-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-sgabios-8-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-tools-2.3.1-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-vgabios-1.8.1-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-x86-2.3.1-33.29.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20201514-1/ https://www.suse.com/security/cve/CVE-2020-7039.html CVE-2020-7039 https://bugzilla.suse.com/1161066 SUSE Bug 1161066 In libslirp 4.1.0, as used in QEMU 4.2.0, tcp_subr.c misuses snprintf return values, leading to a buffer overflow in later code. CVE-2020-8608 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-2.3.1-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-block-curl-2.3.1-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-block-rbd-2.3.1-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-guest-agent-2.3.1-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-ipxe-1.0.0-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-kvm-2.3.1-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-lang-2.3.1-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-ppc-2.3.1-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-s390-2.3.1-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-seabios-1.8.1-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-sgabios-8-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-tools-2.3.1-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-vgabios-1.8.1-33.29.1 SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-x86-2.3.1-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-2.3.1-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-block-curl-2.3.1-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-block-rbd-2.3.1-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-guest-agent-2.3.1-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-ipxe-1.0.0-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-kvm-2.3.1-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-lang-2.3.1-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-seabios-1.8.1-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-sgabios-8-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-tools-2.3.1-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-vgabios-1.8.1-33.29.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-x86-2.3.1-33.29.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20201514-1/ https://www.suse.com/security/cve/CVE-2020-8608.html CVE-2020-8608 https://bugzilla.suse.com/1163018 SUSE Bug 1163018 https://bugzilla.suse.com/1163019 SUSE Bug 1163019