CVE-2019-9824

Publication date 19 March 2019

Last updated 25 August 2025

Ubuntu priority

Low

Why this priority?

Cvss 3 Severity Score

5.5 · Medium

Score breakdown

Description

tcp_emu in slirp/tcp_subr.c (aka slirp/src/tcp_subr.c) in QEMU 3.0.0 uses uninitialized data in an snprintf call, leading to Information disclosure.

From the Ubuntu Security Team

William Bowling discovered that an information leak existed in the SLiRP networking implementation of QEMU. An attacker could use this to expose sensitive information.

Status

Package Ubuntu Release Status
qemu 21.04 hirsute
Fixed in 1:3.1+dfsg-2ubuntu4
20.10 groovy
Fixed in 1:3.1+dfsg-2ubuntu4
20.04 LTS focal
Fixed in 1:3.1+dfsg-2ubuntu4
19.10 eoan
Fixed in 1:3.1+dfsg-2ubuntu4
19.04 disco
Fixed in 1:3.1+dfsg-2ubuntu3.1
18.10 cosmic
Fixed in 1:2.12+dfsg-3ubuntu8.7
18.04 LTS bionic
Fixed in 1:2.11+dfsg-1ubuntu7.13
16.04 LTS xenial
Fixed in 1:2.5+dfsg-5ubuntu10.38
14.04 LTS trusty
Fixed in 2.0.0+dfsg-2ubuntu1.46
qemu-kvm 21.04 hirsute Not in release
20.10 groovy Not in release
20.04 LTS focal Not in release
19.10 eoan Not in release
19.04 disco Not in release
18.10 cosmic Not in release
18.04 LTS bionic Not in release
16.04 LTS xenial Not in release
14.04 LTS trusty Not in release

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
qemu

Severity score breakdown

CVSS version: CVSS v3.0

Base score 5.5 · Medium

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

Related Ubuntu Security Notices (USN)

Other references

Access our resources on patching vulnerabilities