In QEMU 5.0.0 and earlier, es1370_transfer_audio in hw/audio/es1370.c does not properly validate the frame count, which allows guest OS users to trigger an out-of-bounds access during an es1370_write() operation.
CVSS Details
- CVSS 3.1 Base Score: 3.9
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade qemu | Aug 22, 2024 | May 28, 2020 |
| Debian | — | Upgrade qemu | Jul 2, 2020 | May 28, 2020 |
| Gentoo Linux | — | Upgrade app-emulation/qemu. | Nov 12, 2020 | May 28, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade qemu-img | Nov 3, 2020 | May 28, 2020 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 28, 2020 |
| Suse | — | Upgrade qemu-chardev-spiceUpgrade qemu-skibootUpgrade qemu-toolsUpgrade qemu-hw-display-qxlUpgrade qemu-hw-display-virtio-gpu-pciUpgrade qemu-ui-openglUpgrade qemu-ui-cursesUpgrade qemu-ui-spice-appUpgrade qemu-audio-paUpgrade qemu-hw-display-virtio-vgaUpgrade qemu-audio-ossUpgrade qemu-ppcUpgrade qemu-block-nfsUpgrade qemu-ui-sdlUpgrade qemu-guest-agentUpgrade qemu-block-sshUpgrade qemu-block-glusterUpgrade qemu-linux-userUpgrade qemuUpgrade qemu-armUpgrade qemu-ipxeUpgrade qemu-hw-display-virtio-gpuUpgrade qemu-sgabiosUpgrade kvmUpgrade qemu-block-curlUpgrade qemu-vgabiosUpgrade qemu-ksmUpgrade qemu-ui-gtkUpgrade qemu-block-rbdUpgrade qemu-chardev-baumUpgrade qemu-audio-spiceUpgrade qemu-vhost-user-gpuUpgrade qemu-audio-alsaUpgrade qemu-extraUpgrade qemu-testsuiteUpgrade qemu-microvmUpgrade qemu-s390Upgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade qemu-seabiosUpgrade qemu-hw-usb-redirectUpgrade qemu-ui-spice-coreUpgrade qemu-audio-sdlUpgrade qemu-block-iscsiUpgrade qemu-block-dmgUpgrade qemu-s390xUpgrade qemu-langUpgrade qemu-kvmUpgrade qemu-x86 | Jul 29, 2020 | May 28, 2020 |
| Ubuntu | — | Upgrade qemu-system-sparcUpgrade qemu-system-mips (Ubuntu Pro)Upgrade qemu-system-ppc (Ubuntu Pro)Upgrade qemu-system-misc (Ubuntu Pro)Upgrade qemu-system-arm (Ubuntu Pro)Upgrade qemu-system-ppcUpgrade qemuUpgrade qemu-system-sparc (Ubuntu Pro)Upgrade qemu-system-mipsUpgrade qemu-systemUpgrade qemu-system-x86Upgrade qemu-system (Ubuntu Pro)Upgrade qemu-system-aarch64Upgrade qemu-system-aarch64 (Ubuntu Pro)Upgrade qemu-system-x86 (Ubuntu Pro)Upgrade qemu-system-x86-xenUpgrade qemu-system-x86-microvmUpgrade qemu (Ubuntu Pro)Upgrade qemu-system-s390xUpgrade qemu-system-arm | Aug 20, 2020 | May 28, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub