CVE-2019-12247

2019-05-2215:29:03

Debian Security Bug Tracker

security-tracker.debian.org

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

0.003 Low

EPSS

Percentile

69.1%

JSON

QEMU 3.0.0 has an Integer Overflow because the qga/commands*.c files do not check the length of the argument list or the number of environment variables. NOTE: This has been disputed as not exploitable

OSVersionArchitecturePackageVersionFilename
Debian12allqemu<= 1:7.2+dfsg-7+deb12u6qemu_1:7.2+dfsg-7+deb12u6_all.deb
Debian11allqemu<= 1:5.2+dfsg-11+deb11u3qemu_1:5.2+dfsg-11+deb11u3_all.deb
Debian999allqemu<= 1:8.2.5+ds-2qemu_1:8.2.5+ds-2_all.deb
Debian13allqemu<= 1:8.2.4+ds-1qemu_1:8.2.4+ds-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	qemu	<= 1:7.2+dfsg-7+deb12u6	qemu_1:7.2+dfsg-7+deb12u6_all.deb
Debian	11	all	qemu	<= 1:5.2+dfsg-11+deb11u3	qemu_1:5.2+dfsg-11+deb11u3_all.deb
Debian	999	all	qemu	<= 1:8.2.5+ds-2	qemu_1:8.2.5+ds-2_all.deb
Debian	13	all	qemu	<= 1:8.2.4+ds-1	qemu_1:8.2.4+ds-1_all.deb