CVE-2020-11869 Integer overflow in n/a

What is CVE-2020-11869?

CVE-2020-11869 is a low-severity vulnerability in Qemu Qemu, published on 27 Apr 2020. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

An integer overflow was found in QEMU 4.0.1 through 4.2.0 in the way it implemented ATI VGA emulation. This flaw occurs in the ati_2d_blt() routine in hw/display/ati-2d.c while handling MMIO write operations through the ati_mm_write() callback. A malicious guest could abuse this flaw to crash the QEMU process, resulting in a denial of service.

Weakness: CWE-190

Which versions are affected by CVE-2020-11869?

It affects 1 product.

Products include Qemu Qemu.

How do I fix CVE-2020-11869?

Apply the vendor's patch.

Is CVE-2020-11869 being exploited?

There is no known exploitation of CVE-2020-11869 in the wild and no public exploit code.

Other vulnerabilities in Qemu Qemu

• CVE-2022-36648 Null dereference in n/a Critical 10.0
• CVE-2015-8556 Race condition in n/a Critical 10.0
• CVE-2009-3616 Use after free in n/a Critical 9.9
• CVE-2019-12928 Command injection in n/a Critical 9.8
• CVE-2019-12929 Command injection in n/a Critical 9.8

All Qemu Qemu vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2020-11869, GHSA-v28g-xr7w-fvp4, UBUNTU-CVE-2020-11869.