Launchpad CVE tracker

CVE 2020-15859

QEMU 4.2.0 has a use-after-free in hw/net/e1000e_core.c because a guest OS user can trigger an e1000e packet with the data's address set to the e1000e's MMIO address.

Related bugs and status

CVE-2020-15859 (Candidate) is related to these bugs:

Bug #1907656: [UBUNTU 21.04] s390x/s390-virtio-ccw: Reset PCI devices during subsystem reset

		In	Importance	Status
1907656	[UBUNTU 21.04] s390x/s390-virtio-ccw: Reset PCI devices during subsystem reset	qemu (Ubuntu)	Undecided	Fix Released
1907656	[UBUNTU 21.04] s390x/s390-virtio-ccw: Reset PCI devices during subsystem reset	Ubuntu on IBM z Systems	High	Fix Released
1907656	[UBUNTU 21.04] s390x/s390-virtio-ccw: Reset PCI devices during subsystem reset	qemu (Ubuntu Groovy)	Undecided	Fix Released
1907656	[UBUNTU 21.04] s390x/s390-virtio-ccw: Reset PCI devices during subsystem reset	qemu (Ubuntu Hirsute)	Undecided	Fix Released
1907656	[UBUNTU 21.04] s390x/s390-virtio-ccw: Reset PCI devices during subsystem reset	qemu (Ubuntu Focal)	Undecided	Fix Released

Bug #1907789: 2.35.50 breaks ld -no-pie

		In	Importance	Status
1907789	2.35.50 breaks ld -no-pie	binutils (Ubuntu)	Undecided	Fix Released
1907789	2.35.50 breaks ld -no-pie	binutils	Medium	Fix Released
1907789	2.35.50 breaks ld -no-pie	qemu (Ubuntu)	High	Fix Released
1907789	2.35.50 breaks ld -no-pie	s390-tools (Ubuntu)	Undecided	Fix Released
1907789	2.35.50 breaks ld -no-pie	Ubuntu on IBM z Systems	Undecided	Fix Released

See the

CVE page on Mitre.org for more details.

Launchpad.net

CVE 2020-15859

References