SB2020093039 - Red Hat Enterprise Linux 7 update for qemu-kvm 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2020093039

SB2020093039 - Red Hat Enterprise Linux 7 update for qemu-kvm

Published: September 30, 2020

Security Bulletin ID SB2020093039
Severity
Medium
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 50% Low 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Improper input validation (CVE-ID: CVE-2018-15746)

The vulnerability allows an adjacent attacker to cause DoS condition on the target system.

The vulnerability exists in qemu-seccomp.c due to an error when processing malicious input. An adjacent attacker can leverage mishandling of the seccomp policy for threads other than the main thread and cause the service to crash.


2) Memory leak (CVE-ID: CVE-2019-20382)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the zrle_compress_data() function in ui/vnc-enc-zrle.c during a VNC disconnect operation because libz is misused, resulting in a situation where memory allocated in deflateInit2 is not freed in deflateEnd. A remote attacker can perform a denial of service attack.


Remediation

Install update from vendor's website.

References