CVE-2020-13765
- State
- Published
- Severity
- Not scored
- Published
- Jun 4, 2020
- Updated
- Aug 4, 2024
- Reserved
- Jun 2, 2020
Description
rom_copy() in hw/core/loader.c in QEMU 4.0 and 4.1.0 does not validate the relationship between two addresses, which allows attackers to trigger an invalid memory copy operation.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- https://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=e423455c4f23a1a828901c78fe6d03b7dde79319
- https://www.openwall.com/lists/oss-security/2020/06/03/6
- https://security.netapp.com/advisory/ntap-20200619-0006/
- [debian-lts-announce] 20200629 [SECURITY] [DLA 2262-1] qemu security updatemailing-list
- [debian-lts-announce] 20200726 [SECURITY] [DLA 2288-1] qemu security updatemailing-list
- USN-4467-1vendor-advisory
- https://github.com/qemu/qemu/commit/4f1c6cb2f9afafda05eab150fd2bd284edce6676
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.