Name: CVE-2018-18849: Out-of-bounds Read
Creator: Rapid7
Published: 2019-03-17T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2018-18849, CWE-125, CVSS 6.4, EPSS 0.00561

In Qemu 3.0.0, lsi_do_msgin in hw/scsi/lsi53c895a.c allows out-of-bounds access by triggering an invalid msg_len value.

CVSS Details

CVSS 3.1 Base Score: 6.4
CVSS 3.0 Base Score: 5.5
CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Debian	—	Upgrade qemu	May 10, 2019	Mar 21, 2019
Oracle_linux	—	Upgrade qemu-imgUpgrade qemu-commonUpgrade qemu-block-glusterUpgrade qemuUpgrade qemu-block-rbdUpgrade qemu-kvm-coreUpgrade qemu-system-aarch64Upgrade qemu-system-x86Upgrade qemu-system-x86-coreUpgrade qemu-kvmUpgrade qemu-block-iscsiUpgrade ivshmem-toolsUpgrade qemu-system-aarch64-core	Dec 23, 2018	Oct 25, 2018
Redhat_linux	—	No solution exists	Jul 9, 2025	Mar 21, 2019
Suse	—	Upgrade qemu-ui-gtkUpgrade qemu-langUpgrade xen-toolsUpgrade qemu-seabiosUpgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade qemu-guest-agentUpgrade xenUpgrade qemu-block-sshUpgrade qemu-s390Upgrade qemu-vgabiosUpgrade qemu-hw-usb-redirectUpgrade qemu-extraUpgrade qemu-ppcUpgrade qemu-linux-userUpgrade qemu-chardev-baumUpgrade qemu-testsuiteUpgrade qemu-ui-spice-coreUpgrade qemu-skibootUpgrade qemu-ksmUpgrade qemu-microvmUpgrade qemu-block-rbdUpgrade xen-kmp-paeUpgrade qemu-block-iscsiUpgrade qemu-block-curlUpgrade qemu-kvmUpgrade qemu-audio-paUpgrade qemu-audio-alsaUpgrade qemu-ui-cursesUpgrade xen-doc-htmlUpgrade qemu-ipxeUpgrade qemu-chardev-spiceUpgrade qemu-hw-display-qxlUpgrade qemu-block-glusterUpgrade qemu-block-dmgUpgrade qemu-sgabiosUpgrade qemu-ui-spice-appUpgrade qemu-audio-spiceUpgrade xen-develUpgrade xen-tools-domUUpgrade xen-libsUpgrade xen-libs-32bitUpgrade xen-kmp-defaultUpgrade qemu-hw-display-virtio-gpu-pciUpgrade qemu-hw-display-virtio-vgaUpgrade qemu-audio-ossUpgrade kvmUpgrade qemu-x86Upgrade qemu-s390xUpgrade qemu-ui-openglUpgrade qemu-armUpgrade qemu-hw-display-virtio-gpuUpgrade qemuUpgrade qemu-tools	Nov 27, 2018	Nov 26, 2018
Ubuntu	—	Upgrade qemu-system-sparcUpgrade qemu-system-aarch64Upgrade qemu-system-mipsUpgrade qemu-system-x86Upgrade qemu-system-ppcUpgrade qemu-system-miscUpgrade qemu-system-s390xUpgrade qemu-system-armUpgrade qemu-system	Nov 30, 2018	Nov 26, 2018

Prioritize with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business