SB2020052505 - Ubuntu update for QEMU
Published: May 25, 2020
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 5 secuirty vulnerabilities.
1) Buffer overflow (CVE-ID: CVE-2019-15034)
The vulnerability allows a local user to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error within the hw/display/bochs-display.c in QEMU due to application does not ensure a sufficient PCI config space allocation. A local user can trigger a buffer overflow and escalate privileges on the system.
2) Memory leak (CVE-ID: CVE-2019-20382)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to memory leak within the zrle_compress_data() function in ui/vnc-enc-zrle.c during a VNC disconnect operation because libz is misused, resulting in a situation where memory allocated in deflateInit2 is not freed in deflateEnd. A remote attacker can perform a denial of service attack.
3) Improper Verification of Cryptographic Signature (CVE-ID: CVE-2020-10702)
The vulnerability allows a local user to bypass authentication.
The vulnerability exists due to usage of a weak signature algorithm within the /arm/pauth_helper.c in Pointer Authentication support for ARM. A local user can bypass PAuth and gain unauthorized access to resources on the system.
4) Integer overflow (CVE-ID: CVE-2020-11869)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to integer overflow within the implementation of ATI VGA emulation in ati_2d_blt() routine in hw/display/ati-2d.c while handling MMIO write operations through the ati_mm_write() callback.. A remote attacker on the guest operating system can abuse this flaw to crash the QEMU process, resulting in a denial of service.
5) Use-after-free (CVE-ID: CVE-2020-1983)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a use-after-free error when processing packets within the ip_reass() function in ip_input.c in libslirp. A remote attacker can send a specially crafted packet to the application, trigger a use-after-free error and crash it.
Remediation
Install update from vendor's website.