CVE-2018-10839

State: Published
Severity: 6.5 Medium
Published: Oct 16, 2018
Updated: Aug 5, 2024
Reserved: May 9, 2018

Description

Qemu emulator <= 3.0.0 built with the NE2000 NIC emulation support is vulnerable to an integer overflow, which could lead to buffer overflow issue. It could occur when receiving packets over the network. A user inside guest could use this flaw to crash the Qemu process resulting in DoS.

Scores

CVSS	Score	Vector	Source
3.0	6.5 Medium	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H	redhat

Weaknesses

CWE-121

Affected Products

Product	Versions
Qemu-kvmThe QEMU Project	<= 3.0.0Affected

References

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10839
DSA-4338vendor-advisory
USN-3826-1vendor-advisory
[oss-security] 20181008 Qemu: integer overflow issuesmailing-list
[debian-lts-announce] 20181130 [SECURITY] [DLA 1599-1] qemu security updatemailing-list
[qemu-devel] 20180926 [PULL 21/25] ne2000: fix possible out of bound access in ne2000_receivemailing-list
RHSA-2019:2892vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.