Skip to content
OpenAdvisories
Medium ALAS2-2020-1485 1 CVE

Moderate: qemu security update (Amazon Linux 2)

Published Sep 1, 2020 · Updated Sep 2, 2020

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-1983: A use after free vulnerability in ip_reass() in ip_input.c of libslirp 4.2.0 and prior releases allows crafted packets to cause a denial of service. 1829825: CVE-2020-1983 QEMU: slirp: use-after-free in ip_reass() function in ip_input.c

Fixed packages 28

ReleasePackageFixed in
Amazon Linux · 2 ivshmem-tools 10:3.1.0-8.amzn2.0.4
Amazon Linux · 2 qemu 10:3.1.0-8.amzn2.0.4
Amazon Linux · 2 qemu-audio-alsa 10:3.1.0-8.amzn2.0.4
Amazon Linux · 2 qemu-audio-oss 10:3.1.0-8.amzn2.0.4
Amazon Linux · 2 qemu-audio-pa 10:3.1.0-8.amzn2.0.4
Amazon Linux · 2 qemu-audio-sdl 10:3.1.0-8.amzn2.0.4
Amazon Linux · 2 qemu-block-curl 10:3.1.0-8.amzn2.0.4
Amazon Linux · 2 qemu-block-dmg 10:3.1.0-8.amzn2.0.4
Amazon Linux · 2 qemu-block-iscsi 10:3.1.0-8.amzn2.0.4
Amazon Linux · 2 qemu-block-nfs 10:3.1.0-8.amzn2.0.4
Amazon Linux · 2 qemu-block-rbd 10:3.1.0-8.amzn2.0.4
Amazon Linux · 2 qemu-block-ssh 10:3.1.0-8.amzn2.0.4
Amazon Linux · 2 qemu-common 10:3.1.0-8.amzn2.0.4
Amazon Linux · 2 qemu-debuginfo 10:3.1.0-8.amzn2.0.4
Amazon Linux · 2 qemu-guest-agent 10:3.1.0-8.amzn2.0.4
Amazon Linux · 2 qemu-img 10:3.1.0-8.amzn2.0.4
Amazon Linux · 2 qemu-kvm 10:3.1.0-8.amzn2.0.4
Amazon Linux · 2 qemu-kvm-core 10:3.1.0-8.amzn2.0.4
Amazon Linux · 2 qemu-system-aarch64 10:3.1.0-8.amzn2.0.4
Amazon Linux · 2 qemu-system-aarch64-core 10:3.1.0-8.amzn2.0.4
Amazon Linux · 2 qemu-system-x86 10:3.1.0-8.amzn2.0.4
Amazon Linux · 2 qemu-system-x86-core 10:3.1.0-8.amzn2.0.4
Amazon Linux · 2 qemu-ui-curses 10:3.1.0-8.amzn2.0.4
Amazon Linux · 2 qemu-ui-gtk 10:3.1.0-8.amzn2.0.4
Amazon Linux · 2 qemu-ui-sdl 10:3.1.0-8.amzn2.0.4
Amazon Linux · 2 qemu-user 10:3.1.0-8.amzn2.0.4
Amazon Linux · 2 qemu-user-binfmt 10:3.1.0-8.amzn2.0.4
Amazon Linux · 2 qemu-user-static 10:3.1.0-8.amzn2.0.4

Vulnerabilities 1

  • High 7.5
    CVE-2020-1983

    libslirp: use after free vulnerability cause a denial of service.

    A use after free vulnerability in ip_reass() in ip_input.c of libslirp 4.2.0 and prior releases allows crafted packets to cause a denial of service.

    slirp libslirp qemu qemu Debian Ubuntu Alpine

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-1983.html