Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 14

Export CSV
CVE-2026-95507

libslirp: libslirp: out-of-bounds read in NC-SI OEM response handler discloses host memory to guest

An out-of-bounds read was found in the NC-SI OEM response handler of libslirp. A truncated NC-SI OEM Ethernet frame causes ncsi_rsp_handler_oem() to read up to 4 bytes beyond the supplied packet length and reflect the value into the response sent to the guest, resulting in guest-observable disclosure of adjacent host process memory.

CVSS 3.1 · 4.3 Medium EPSS n/a KEV · Not listed
Vendors
Libslirp Project
Products
Libslirp
CVE-2021-3595

QEMU: slirp: invalid pointer initialization may lead to information disclosure (tftp)

An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the tftp_input() function and could occur while processing a udp packet that is smaller than the size of the 'tftp_t' structure. This issue may lead to out-of-bounds read access or indirect host memory disclosure to the guest. The highest threat from this vulnerability is to data confidentiality. This flaw affects libslirp versions prior to 4.6.0.

CVSS 3.1 · 3.8 Low EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Libslirp Project and 1 more
Products
Debian Linux Fedora Libslirp and 1 more
CVE-2021-3594

QEMU: slirp: invalid pointer initialization may lead to information disclosure (udp)

An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the udp_input() function and could occur while processing a udp packet that is smaller than the size of the 'udphdr' structure. This issue may lead to out-of-bounds read access or indirect host memory disclosure to the guest. The highest threat from this vulnerability is to data confidentiality. This flaw affects libslirp versions prior to 4.6.0.

CVSS 3.1 · 3.8 Low EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Libslirp Project and 1 more
Products
Debian Linux Fedora Libslirp and 1 more
CVE-2021-3593

QEMU: slirp: invalid pointer initialization may lead to information disclosure (udp6)

An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the udp6_input() function and could occur while processing a udp packet that is smaller than the size of the 'udphdr' structure. This issue may lead to out-of-bounds read access or indirect host memory disclosure to the guest. The highest threat from this vulnerability is to data confidentiality. This flaw affects libslirp versions prior to 4.6.0.

CVSS 3.1 · 3.8 Low EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Libslirp Project and 1 more
Products
Debian Linux Fedora Libslirp and 1 more
CVE-2021-3592

QEMU: slirp: invalid pointer initialization may lead to information disclosure (bootp)

An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the bootp_input() function and could occur while processing a udp packet that is smaller than the size of the 'bootp_t' structure. A malicious guest could use this flaw to leak 10 bytes of uninitialized heap memory from the host. The highest threat from this vulnerability is to data confidentiality. This flaw affects libslirp versions prior to 4.6.0.

CVSS 3.1 · 3.8 Low EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Libslirp Project and 1 more
Products
Debian Linux Fedora Libslirp and 1 more
CVE-2020-8608

QEMU: Slirp: potential OOB access due to unsafe snprintf() usages

In libslirp 4.1.0, as used in QEMU 4.2.0, tcp_subr.c misuses snprintf return values, leading to a buffer overflow in later code.

CVSS 3.1 · 5.6 Medium EPSS 2.5% KEV · Not listed
Vendors
Debian Libslirp Project Opensuse and 1 more
Products
Debian Linux Libslirp Leap and 8 more
CVE-2020-7211

QEMU: Slirp: potential directory traversal using relative paths via tftp server on Windows host

tftp.c in libslirp 4.1.0, as used in QEMU 4.2.0, does not prevent ..\ directory traversal on Windows.

CVSS 3.1 · 7.5 High EPSS 4.2% KEV · Not listed
Vendors
Libslirp Project Microsoft Qemu and 1 more
Products
Libslirp Windows Qemu and 1 more
CVE-2020-7039

QEMU: slirp: OOB buffer access while emulating tcp protocols in tcp_emu()

tcp_emu in tcp_subr.c in libslirp 4.1.0, as used in QEMU 4.2.0, mismanages memory, as demonstrated by IRC DCC commands in EMU_IRC. This can cause a heap-based buffer overflow or other out-of-bounds access which can lead to a DoS or potential execute arbitrary code.

CVSS 3.1 · 5.6 Medium EPSS 3.6% KEV · Not listed
Vendors
Debian Libslirp Project Opensuse and 2 more
Products
Debian Linux Libslirp Leap and 9 more
CVE-2020-29130

QEMU: slirp: out-of-bounds access while processing ARP/NCSI packets

slirp.c in libslirp through 4.3.1 has a buffer over-read because it tries to read a certain amount of header data even if that exceeds the total packet length.

CVSS 3.1 · 4.3 Medium EPSS 1.9% KEV · Not listed
Vendors
Debian Fedoraproject Libslirp Project and 1 more
Products
Debian Linux Fedora Libslirp and 1 more
CVE-2020-29129

QEMU: slirp: out-of-bounds access while processing ARP/NCSI packets

ncsi.c in libslirp through 4.3.1 has a buffer over-read because it tries to read a certain amount of header data even if that exceeds the total packet length.

CVSS 3.1 · 4.3 Medium EPSS 1.5% KEV · Not listed
Vendors
Debian Fedoraproject Libslirp Project and 1 more
Products
Debian Linux Fedora Libslirp and 1 more
CVE-2020-1983

libslirp: use after free vulnerability cause a denial of service.

A use after free vulnerability in ip_reass() in ip_input.c of libslirp 4.2.0 and prior releases allows crafted packets to cause a denial of service.

CVSS 3.1 · 7.5 High EPSS 2.4% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 3 more
Products
Ubuntu Linux Debian Linux Fedora and 6 more
CVE-2020-10756

QEMU: slirp: networking out-of-bounds read information disclosure vulnerability

An out-of-bounds read vulnerability was found in the SLiRP networking implementation of the QEMU emulator. This flaw occurs in the icmp6_send_echoreply() routine while replying to an ICMP echo request, also known as ping. This flaw allows a malicious guest to leak the contents of the host memory, resulting in possible information disclosure. This flaw affects versions of libslirp before 4.3.1.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Libslirp Project and 2 more
Products
Ubuntu Linux Debian Linux Libslirp and 4 more