CVE-2019-15890 — Use After Free in Project Libslirp

CWE-416 — Use After Free11 documents8 sources
Severity
7.5HIGHNVD
EPSS
0.6%
top 31.20%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
QemuLibslirp Project Libslirp
Timeline
PublishedSep 6
Latest updateMay 24

Description

libslirp 4.0.0, as used in QEMU 4.1.0, has a use-after-free in ip_reass in ip_input.c.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶Debianqemu/qemu< 1:4.1-2+3
▶NVDqemu/qemu4.1.0

Patches

Patch: www.openwall.com ↗Patch: gitlab.freedesktop.org ↗Patch: www.openwall.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-2237-w692-94pv: libslirp 4↗2022-05-24
▶
CVEList
CVE-2019-15890: libslirp 4↗2019-09-06
▶
OSV
CVE-2019-15890: libslirp 4↗2019-09-06
▶

📋Vendor Advisories

4
Ubuntu
QEMU vulnerabilities↗2019-11-14
▶
Ubuntu
QEMU vulnerabilities↗2019-11-14
▶
Red Hat
QEMU: Slirp: use-after-free during packet reassembly↗2019-08-25
▶
Debian
CVE-2019-15890: qemu - libslirp 4.0.0, as used in QEMU 4.1.0, has a use-after-free in ip_reass in ip_in...↗2019
▶

💬Community

3
Bugzilla
CVE-2019-15890 qemu: Slirp: use-after-free during packet reassembly [fedora-all]↗2019-09-06
▶
Bugzilla
CVE-2019-15890 qemu: Slirp: use-after-free during packet reassembly [fedora-all]↗2019-09-06
▶
Bugzilla
CVE-2019-15890 QEMU: Slirp: use-after-free during packet reassembly↗2019-09-06
▶
CVE-2019-15890 — Use After Free in Project Libslirp | cvebase