CVE-2020-1983

Опубликовано: 22 апр. 2020

Источник: nvd

CVSS3: 7.5

CVSS3: 6.5

CVSS2: 2.1

EPSS Низкий

Описание

A use after free vulnerability in ip_reass() in ip_input.c of libslirp 4.2.0 and prior releases allows crafted packets to cause a denial of service.

Ссылки

http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00022.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00001.html
Mailing List
Third Party Advisory
https://gitlab.freedesktop.org/slirp/libslirp/-/commit/9ac0371bb8c0a40f5d9f82a1c25129660e81df04
Patch
Third Party Advisory
https://gitlab.freedesktop.org/slirp/libslirp/-/issues/20
Exploit
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/06/msg00032.html
Mailing List
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/07/msg00020.html
Mailing List
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HWFD4MWV3YWIHVHSA2F7FKOLJFL4PHOX/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NKT2MTSINE4NUPG5L6BYH6N23NBNITOL/
https://usn.ubuntu.com/4372-1/
Third Party Advisory
https://www.debian.org/security/2020/dsa-4665
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00022.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00001.html
Mailing List
Third Party Advisory
https://gitlab.freedesktop.org/slirp/libslirp/-/commit/9ac0371bb8c0a40f5d9f82a1c25129660e81df04
Patch
Third Party Advisory
https://gitlab.freedesktop.org/slirp/libslirp/-/issues/20
Exploit
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/06/msg00032.html
Mailing List
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/07/msg00020.html
Mailing List
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HWFD4MWV3YWIHVHSA2F7FKOLJFL4PHOX/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NKT2MTSINE4NUPG5L6BYH6N23NBNITOL/
https://usn.ubuntu.com/4372-1/
Third Party Advisory
https://www.debian.org/security/2020/dsa-4665
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:libslirp_project:libslirp:*:*:*:*:*:*:*:*

Версия до 4.2.0 (включая)

Конфигурация 2

Одно из

cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

Конфигурация 4

cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*

Конфигурация 5

Одно из

cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*

EPSS

Процентиль: 35%

0.00141

Низкий

7.5 High

CVSS3

6.5 Medium

CVSS3

2.1 Low

CVSS2

Дефекты

CWE-416

Связанные уязвимости

CVE-2020-1983

CVSS3: 7.5

ubuntu

около 5 лет назад

A use after free vulnerability in ip_reass() in ip_input.c of libslirp 4.2.0 and prior releases allows crafted packets to cause a denial of service.

CVE-2020-1983

CVSS3: 6.5

redhat

около 5 лет назад

A use after free vulnerability in ip_reass() in ip_input.c of libslirp 4.2.0 and prior releases allows crafted packets to cause a denial of service.

CVE-2020-1983

CVSS3: 7.5

debian

около 5 лет назад

A use after free vulnerability in ip_reass() in ip_input.c of libslirp ...

openSUSE-SU-2020:0756-1

suse-cvrf

около 5 лет назад

Security update for qemu

openSUSE-SU-2020:0636-1

suse-cvrf

около 5 лет назад

Security update for slirp4netns

EPSS

Процентиль: 35%

0.00141

Низкий

7.5 High

CVSS3

6.5 Medium

CVSS3

2.1 Low

CVSS2

Дефекты

CWE-416