This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page.
View CVE-2020-13765 →
DEBIAN-CVE-2020-13765
rom_copy() in hw/core/loader.c in QEMU 4.0 and 4.1.0 does not validate the relationship between two addresses, which allows attackers to trigger an in...
Original description
The description as published by the source.
rom_copy() in hw/core/loader.c in QEMU 4.0 and 4.1.0 does not validate the relationship between two addresses, which allows attackers to trigger an invalid memory copy operation.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Debian:12
qemu
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.2-1"}]}]
Debian:13
qemu
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.2-1"}]}]
Debian:14
qemu
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.2-1"}]}]
References
- advisory security-tracker.debian.org