FlawAtlas
Search the atlas
SUSE-SU-2021:3635-1 Not scored

Security update for qemu

This update for qemu fixes the following issues: Security issues fixed: - Fix heap use-after-free in virtio_net_receive_rcu (bsc#1189938, CVE-2021-3748) - Fix out-of-bounds write in UAS (USB Attached SCSI) device emulation (bsc#1189702, CVE-2021-3713) - usbredir: free call on invalid pointer in bufp_alloc (bsc#1189145, CVE-2021-3682) - NULL pointer dereference in ESP (bsc#1180433, CVE-2020-35504) (bsc#1180434, CVE-2020-35505) (bsc#1180435, CVE-2020-35506) - NULL pointer dereference issue in megasas-gen2 host bus adapter (bsc#1180432, CVE-2020-35503) - eepro100: stack overflow via infinite recursion (bsc#1182651, CVE-2021-20255) - usb: unbounded stack allocation in usbredir (bsc#1186012, CVE-2021-3527)

Exploit probability Not scored
Published November 9, 2021
Required by Not available
Last source change February 4, 2026

02 / AFFECTED SOFTWARE

Affected packages

SUSE:Linux Enterprise Server 12 SP4-LTSS qemu
SUSE:Linux Enterprise Server for SAP Applications 12 SP4 qemu
SUSE:OpenStack Cloud 9 qemu
SUSE:OpenStack Cloud Crowbar 9 qemu

03 / CONNECTIONS

Connected vulnerabilities

04 / EVIDENCE

Source records

Open Source Vulnerabilities SUSE-SU-2021:3635-1

This update for qemu fixes the following issues: Security issues fixed: - Fix heap use-after-free in virtio_net_receive_rcu (bsc#1189938, CVE-2021-3748) - Fix out-of-bounds write in UAS (USB Attached SCSI) device emulation (bsc#1189702, CVE-2021-3713) - usbredir: free call on invalid pointer in bufp_alloc (bsc#1189145, CVE-2021-3682) - NULL pointer dereference in ESP (bsc#1180433, CVE-2020-35504) (bsc#1180434, CVE-2020-35505) (bsc#1180435, CVE-2020-35506) - NULL pointer dereference issue in megasas-gen2 host bus adapter (bsc#1180432, CVE-2020-35503) - eepro100: stack overflow via infinite recursion (bsc#1182651, CVE-2021-20255) - usb: unbounded stack allocation in usbredir (bsc#1186012, CVE-2021-3527)

View original source

05 / REFERENCES

Further evidence