This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2020-10761 →

DEBIAN-CVE-2020-10761

An assertion failure issue was found in the Network Block Device(NBD) Server in all QEMU versions before QEMU 5.0.1. This flaw occurs when an nbd-clie...

Original description

The description as published by the source.

An assertion failure issue was found in the Network Block Device(NBD) Server in all QEMU versions before QEMU 5.0.1. This flaw occurs when an nbd-client sends a spec-compliant request that is near the boundary of maximum permitted request length. A remote nbd-client could use this flaw to crash the qemu-nbd server resulting in a denial of service.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 qemu

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.0-6"}]}]

Debian:13 qemu

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.0-6"}]}]

Debian:14 qemu

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.0-6"}]}]

References

advisory security-tracker.debian.org