Source: qemu Version: 1:8.0.4+dfsg-1 Severity: important Tags: security upstream X-Debbugs-Cc: car...@debian.org, Debian Security Team <t...@security.debian.org>
Hi, The following vulnerability was published for qemu. CVE-2023-4135[0]: | A heap out-of-bounds memory read flaw was found in the virtual nvme | device in QEMU. The QEMU process does not validate an offset | provided by the guest before computing a host heap pointer, which is | used for copying data back to the guest. Arbitrary heap memory | relative to an allocated buffer can be disclosed. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2023-4135 https://www.cve.org/CVERecord?id=CVE-2023-4135 [1] https://www.zerodayinitiative.com/advisories/ZDI-CAN-21521 [2] https://gitlab.com/qemu-project/qemu/-/commit/ecb1b7b082d3b7dceff0e486a114502fc52c0fdf Regards, Salvatore
