ALT-PU-2024-3359-3

Package update qemu in branch sisyphus

Version8.2.1-alt1

Published2026-03-07

Max severityMEDIUM

Severity:

Closed issues (4)

MEDIUM6.0

Уязвимость компонента lsi53c895a.c эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании

Published: 2023-08-21Modified: 2024-11-14

CVSS 3.xMEDIUM 6.0

CVSS:3.x/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H

CVSS 2.0MEDIUM 4.3

CVSS:2.0/AV:L/AC:L/Au:M/C:N/I:N/A:C

References

CVE-2023-0330

MEDIUM6.5

Уязвимость функции qemu_clipboard_request() встроенного сервера VNC эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании

Published: 2024-01-17Modified: 2025-08-19

CVSS 3.xMEDIUM 6.5

CVSS:3.x/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CVSS 2.0MEDIUM 6.8

CVSS:2.0/AV:N/AC:L/Au:S/C:N/I:N/A:C

References

CVE-2023-6683

MEDIUM6.0

A vulnerability in the lsi53c895a device affects the latest version of qemu. A DMA-MMIO reentrancy problem may lead to memory corruption bugs like stack overflow or use-after-free.

Published: 2023-03-06Modified: 2024-11-21

CVSS 3.xMEDIUM 6.0

CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H

References

MEDIUM6.5

A flaw was found in the QEMU built-in VNC server while processing ClientCutText messages. The qemu_clipboard_request() function can be reached before vnc_server_cut_text_caps() was called and had the chance to initialize the clipboard peer, leading to a NULL pointer dereference. This could allow a malicious authenticated VNC client to crash QEMU and trigger a denial of service.

Published: 2024-01-12Modified: 2025-05-02

CVSS 3.xMEDIUM 6.5

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References