QEMU is vulnerable to denial of service. A use after free vulnerability in ip_reass()
in ip_input.c
of libslirp allows an attacker to crash the application using malicious packets.
lists.opensuse.org/opensuse-security-announce/2020-05/msg00022.html
lists.opensuse.org/opensuse-security-announce/2020-06/msg00001.html
gitlab.freedesktop.org/slirp/libslirp/-/commit/9ac0371bb8c0a40f5d9f82a1c25129660e81df04
gitlab.freedesktop.org/slirp/libslirp/-/issues/20
lists.debian.org/debian-lts-announce/2020/06/msg00032.html
lists.debian.org/debian-lts-announce/2020/07/msg00020.html
lists.fedoraproject.org/archives/list/[email protected]/message/HWFD4MWV3YWIHVHSA2F7FKOLJFL4PHOX/
lists.fedoraproject.org/archives/list/[email protected]/message/NKT2MTSINE4NUPG5L6BYH6N23NBNITOL/
usn.ubuntu.com/4372-1/
www.debian.org/security/2020/dsa-4665