CVE-2019-12155: Null Pointer Dereference
A null pointer dereference issue was found the QXL VGA card emulator of QEMU. It could occur while releasing resources allocated for a SPICE server thread in interfacereleaseresources().
A guest user could use this flaw to crash the QEMU process resulting in DoS scenario.
Upstream patch: --------------- -> https://git.qemu.org/?p=qemu.git;a=commit;h=d52680fc932efb8a2f334cc6993e705ed1e31e99
Reference: ---------- -> https://www.openwall.com/lists/oss-security/2019/05/22/1
Other sources
interfacereleaseresource in hw/display/qxl.c in QEMU 3.1.x through 4.0.0 has a NULL pointer dereference.
Affected Software
Remediation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID is CVE-2019-12155.
What is the severity level of CVE-2019-12155?
The severity level of CVE-2019-12155 is high with a score of 7.5.
Which software versions are affected by CVE-2019-12155?
QEMU versions 3.1.x through 4.0.0 are affected.
How can I fix the vulnerability in QEMU?
You can fix the vulnerability by updating QEMU to version 4.0.1 or later.
Where can I find more information about CVE-2019-12155?
You can find more information about CVE-2019-12155 at the following references: [Link1](https://git.qemu.org/?p=qemu.git;a=commit;h=d52680fc932efb8a2f334cc6993e705ed1e31e99), [Link2](https://www.openwall.com/lists/oss-security/2019/05/22/1), [Link3](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1712727).