Libslirp Project Libslirp — known CVE vulnerabilities
Every CVE whose affected-product data names Libslirp Project Libslirp, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.
CVEs (13)
CVE-2019-14378 — CVSS 8.8 (high): ip_reass in ip_input.c in libslirp 4.0.0 has a heap-based buffer overflow via a large packet because it mishandles a case involving the…
CVE-2020-1983 — CVSS 7.5 (high): A use after free vulnerability in ip_reass() in ip_input.c of libslirp 4.2.0 and prior releases allows crafted packets to cause a denial of…
CVE-2020-7211 — CVSS 7.5 (high): tftp.c in libslirp 4.1.0, as used in QEMU 4.2.0, does not prevent ..\ directory traversal on Windows.
CVE-2020-10756 — CVSS 6.5 (medium): An out-of-bounds read vulnerability was found in the SLiRP networking implementation of the QEMU emulator. This flaw occurs in the…
CVE-2020-7039 — CVSS 5.6 (medium): tcp_emu in tcp_subr.c in libslirp 4.1.0, as used in QEMU 4.2.0, mismanages memory, as demonstrated by IRC DCC commands in EMU_IRC. This can…
CVE-2020-8608 — CVSS 5.6 (medium): In libslirp 4.1.0, as used in QEMU 4.2.0, tcp_subr.c misuses snprintf return values, leading to a buffer overflow in later code.
CVE-2020-29129 — CVSS 4.3 (medium): ncsi.c in libslirp through 4.3.1 has a buffer over-read because it tries to read a certain amount of header data even if that exceeds the…
CVE-2020-29130 — CVSS 4.3 (medium): slirp.c in libslirp through 4.3.1 has a buffer over-read because it tries to read a certain amount of header data even if that exceeds the…
CVE-2021-3595 — CVSS 3.8 (low): An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the tftp_input()…
CVE-2021-3592 — CVSS 3.8 (low): An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the bootp_input()…
CVE-2021-3593 — CVSS 3.8 (low): An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the udp6_input()…
CVE-2021-3594 — CVSS 3.8 (low): An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the udp_input()…