CVE-2020-7039: libslirp project libslirp +3 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2020-7039

CVSS 5.6 · Medium EPSS 3,6%

Kerentanan Out-of-bounds Write pada libslirp project libslirp, qemu +2 lainnya. Skor CVSS 3.1 5.6 (Medium) menurut NVD.

Deskripsi (NVD)

tcp_emu in tcp_subr.c in libslirp 4.1.0, as used in QEMU 4.2.0, mismanages memory, as demonstrated by IRC DCC commands in EMU_IRC. This can cause a heap-based buffer overflow or other out-of-bounds access which can lead to a DoS or potential execute arbitrary code.

Rincian

Terbit di NVD: 16 Januari 2020
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 5.6 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-787: Out-of-bounds Write
EPSS (30 hari): 3,6% peluang dieksploitasi; lebih tinggi dari 89,0% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
libslirp project	libslirp	Versi 4.1.0
qemu	qemu	Versi 4.2.0
debian	debian linux	Versi 8.0
debian	debian linux	Versi 9.0
opensuse	leap	Versi 15.1

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

http://www.openwall.com/lists/oss-security/2020/01/16/2 mailing list · patch · advisory pihak ketiga
https://gitlab.freedesktop.org/slirp/libslirp/commit/2655fffed7a9e765bcb4701dd876e9dab975f289 patch · advisory pihak ketiga
https://gitlab.freedesktop.org/slirp/libslirp/commit/82ebe9c370a0e2970fb5695aa19aa5214a6a1c80 patch · advisory pihak ketiga
https://gitlab.freedesktop.org/slirp/libslirp/commit/ce131029d6d4a405cb7d3ac6716d03e58fb4a5d9 patch · advisory pihak ketiga
http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00007.html advisory pihak ketiga
https://access.redhat.com/errata/RHSA-2020:0348 advisory pihak ketiga
https://access.redhat.com/errata/RHSA-2020:0775 advisory pihak ketiga
https://lists.debian.org/debian-lts-announce/2020/01/msg00022.html mailing list · advisory pihak ketiga
https://lists.debian.org/debian-lts-announce/2020/01/msg00036.html mailing list · advisory pihak ketiga
https://lists.debian.org/debian-lts-announce/2021/02/msg00012.html mailing list · advisory pihak ketiga
https://seclists.org/bugtraq/2020/Feb/0 mailing list · advisory pihak ketiga
https://security.gentoo.org/glsa/202005-02 advisory pihak ketiga
https://usn.ubuntu.com/4283-1/ advisory pihak ketiga
https://www.debian.org/security/2020/dsa-4616 advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.