PT-2013-4982 · Qemu · Qemu

Sibiao Luo · Publicado 2013-10-11 · Atualizado 2014-03-06 · CVE-2013-4377

Positive Technologies (AI Summary)

CVSS v2.0

2.3

Baixa

Vetor base

AV:A/AC:M/Au:S/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Qemu versions 1.4.0 through 1.6.0

Description A use-after-free issue in the virtio-pci implementation allows local users to cause a denial of service by "hot-unplugging" a virtio device, resulting in a daemon crash.

Recommendations For Qemu versions 1.4.0 through 1.6.0, consider disabling the hot-unplug feature for virtio devices until a patch is available.

Correção

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

CVE-2013-4377

MGASA-2014-0060

Produtos afetados

Qemu

Referências · 14

• http://ubuntu.com/usn/USN-2092-1 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=1012633 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-4377 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2013-4377 · Aviso do Fabricante
• http://lists.nongnu.org/archive/html/qemu-devel/2013-09/msg03347.html · Correção
• https://osv.dev/vulnerability/MGASA-2014-0060 · Aviso do Fabricante
• https://bugs.mageia.org/show_bug.cgi?id=12494 · Nota
• http://lists.nongnu.org/archive/html/qemu-stable/2013-12/msg00148.html · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-4377 · Aviso do Fabricante
• https://advisories.mageia.org/MGASA-2014-0060.html · Nota de Segurança
• http://openwall.com/lists/oss-security/2013/09/26/5 · Nota
• http://secunia.com/advisories/55015 · Aviso do Fabricante
• http://ubuntu.com/usn/usn-2092-1 · Nota
• https://security-tracker.debian.org/tracker/CVE-2013-4377 · Aviso do Fabricante