Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 717154 (CVE-2020-7039) - <app-emulation/qemu-4.2.0-r4: DOS Vulnerability (CVE-2020-7039)
Summary: <app-emulation/qemu-4.2.0-r4: DOS Vulnerability (CVE-2020-7039)
Status: RESOLVED FIXED
Alias: CVE-2020-7039
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
URL:
Whiteboard: B2 [glsa+ cve]
Keywords:
Depends on:
Blocks:
 
Reported: 2020-04-11 22:17 UTC by GLSAMaker/CVETool Bot
Modified: 2020-05-12 23:33 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description GLSAMaker/CVETool Bot gentoo-dev 2020-04-11 22:17:07 UTC 
CVE-2020-7039 (https://nvd.nist.gov/vuln/detail/CVE-2020-7039):
  tcp_emu in tcp_subr.c in libslirp 4.1.0, as used in QEMU 4.2.0, mismanages
  memory, as demonstrated by IRC DCC commands in EMU_IRC. This can cause a
  heap-based buffer overflow or other out-of-bounds access which can lead to a
  DoS or potential execute arbitrary code.
Comment 1 Yury German Gentoo Infrastructure gentoo-dev 2020-04-11 22:19:03 UTC 
This is probably already fixed, but wanted to file to make sure that we put a fix in place. 

Maintainers please confirm.
Comment 2 Matthias Maier gentoo-dev 2020-04-18 20:16:05 UTC 
commit 91b9bba62a5dd73e32bd43434bdaebf8914579ff
Author: Matthias Maier <tamiko@gentoo.org>
Date:   Fri Mar 13 13:21:03 2020 -0500

    app-emulation/qemu: update slirp to current master
    
    Bug: https://bugs.gentoo.org/709490
    Package-Manager: Portage-2.3.93, Repoman-2.3.20
    Signed-off-by: Matthias Maier <tamiko@gentoo.org>
Comment 3 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2020-04-19 08:23:34 UTC 
@maintainer(s), please advise if ready for stabilisation, or call yourself.
Comment 4 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2020-04-19 08:27:26 UTC 
(In reply to Sam James (sec padawan) from comment #3)
> @maintainer(s), please advise if ready for stabilisation, or call yourself.

Ignore this!
Comment 5 GLSAMaker/CVETool Bot gentoo-dev 2020-05-12 23:33:46 UTC 
This issue was resolved and addressed in
 GLSA 202005-02 at https://security.gentoo.org/glsa/202005-02
by GLSA coordinator Thomas Deutschmann (whissi).