{"id":"CVE-2019-15034","aliases":["DEBIAN-CVE-2019-15034","DSA-4665-1","EUVD-2019-6121","GHSA-7pcg-64mr-xg9c","SUSE-SU-2020:0844-1","SUSE-SU-2020:0845-1","UBUNTU-CVE-2019-15034","USN-4372-1","openSUSE-SU-2020:0468-1"],"status":"published","title":"hw/display/bochs-display.c in QEMU 4.0.0 does not ensure a sufficient PCI config space allocation...","description":"hw/display/bochs-display.c in QEMU 4.0.0 does not ensure a sufficient PCI config space allocation, leading to a buffer overflow involving the PCIe extended config space.","severity":{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00372,"percentile":0.31403,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-120"],"published":"2020-03-10T17:19:02Z","modified":"2026-10-24T10:30:58Z","fixes":[{"ecosystem":"Debian:12","package":"qemu","fixed_in":["1:4.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"qemu","fixed_in":["1:4.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"qemu","fixed_in":["1:4.1-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.1-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1+dfsg-8+deb10u5"}]}],"versions":["1:3.1+dfsg-8","1:3.1+dfsg-8+deb10u2","1:3.1+dfsg-8+deb10u3","1:3.1+dfsg-8+deb10u4","1:3.1+dfsg-8~deb10u1"],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP1","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1.1-9.14.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP1","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1.1-9.14.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1.1-3.9.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1.1-3.9.1"}]}],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.5+dfsg-5ubuntu10.44"}]}],"versions":["1:2.3+dfsg-5ubuntu9","1:2.3+dfsg-5ubuntu10","1:2.4+dfsg-4ubuntu1","1:2.4+dfsg-4ubuntu2","1:2.4+dfsg-4ubuntu3","1:2.4+dfsg-5ubuntu3","1:2.5+dfsg-1ubuntu2","1:2.5+dfsg-1ubuntu3","1:2.5+dfsg-1ubuntu4","1:2.5+dfsg-1ubuntu5","1:2.5+dfsg-5ubuntu1","1:2.5+dfsg-5ubuntu2","1:2.5+dfsg-5ubuntu4","1:2.5+dfsg-5ubuntu6","1:2.5+dfsg-5ubuntu7","1:2.5+dfsg-5ubuntu10","1:2.5+dfsg-5ubuntu10.1","1:2.5+dfsg-5ubuntu10.2","1:2.5+dfsg-5ubuntu10.3","1:2.5+dfsg-5ubuntu10.4","1:2.5+dfsg-5ubuntu10.5","1:2.5+dfsg-5ubuntu10.6","1:2.5+dfsg-5ubuntu10.7","1:2.5+dfsg-5ubuntu10.8","1:2.5+dfsg-5ubuntu10.9","1:2.5+dfsg-5ubuntu10.10","1:2.5+dfsg-5ubuntu10.11","1:2.5+dfsg-5ubuntu10.13","1:2.5+dfsg-5ubuntu10.14","1:2.5+dfsg-5ubuntu10.15","1:2.5+dfsg-5ubuntu10.16","1:2.5+dfsg-5ubuntu10.20","1:2.5+dfsg-5ubuntu10.21","1:2.5+dfsg-5ubuntu10.22","1:2.5+dfsg-5ubuntu10.24","1:2.5+dfsg-5ubuntu10.25","1:2.5+dfsg-5ubuntu10.26","1:2.5+dfsg-5ubuntu10.28","1:2.5+dfsg-5ubuntu10.29","1:2.5+dfsg-5ubuntu10.30","1:2.5+dfsg-5ubuntu10.31","1:2.5+dfsg-5ubuntu10.32","1:2.5+dfsg-5ubuntu10.33","1:2.5+dfsg-5ubuntu10.34","1:2.5+dfsg-5ubuntu10.35","1:2.5+dfsg-5ubuntu10.36","1:2.5+dfsg-5ubuntu10.37","1:2.5+dfsg-5ubuntu10.38","1:2.5+dfsg-5ubuntu10.39","1:2.5+dfsg-5ubuntu10.40","1:2.5+dfsg-5ubuntu10.41","1:2.5+dfsg-5ubuntu10.42","1:2.5+dfsg-5ubuntu10.43"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.11+dfsg-1ubuntu7.26"}]}],"versions":["1:2.10+dfsg-0ubuntu3","1:2.10+dfsg-0ubuntu4","1:2.10+dfsg-0ubuntu5","1:2.11+dfsg-1ubuntu1","1:2.11+dfsg-1ubuntu2","1:2.11+dfsg-1ubuntu4","1:2.11+dfsg-1ubuntu5","1:2.11+dfsg-1ubuntu6","1:2.11+dfsg-1ubuntu7","1:2.11+dfsg-1ubuntu7.1","1:2.11+dfsg-1ubuntu7.2","1:2.11+dfsg-1ubuntu7.3","1:2.11+dfsg-1ubuntu7.4","1:2.11+dfsg-1ubuntu7.5","1:2.11+dfsg-1ubuntu7.6","1:2.11+dfsg-1ubuntu7.7","1:2.11+dfsg-1ubuntu7.8","1:2.11+dfsg-1ubuntu7.9","1:2.11+dfsg-1ubuntu7.10","1:2.11+dfsg-1ubuntu7.12","1:2.11+dfsg-1ubuntu7.13","1:2.11+dfsg-1ubuntu7.14","1:2.11+dfsg-1ubuntu7.15","1:2.11+dfsg-1ubuntu7.17","1:2.11+dfsg-1ubuntu7.18","1:2.11+dfsg-1ubuntu7.19","1:2.11+dfsg-1ubuntu7.20","1:2.11+dfsg-1ubuntu7.21","1:2.11+dfsg-1ubuntu7.22","1:2.11+dfsg-1ubuntu7.23","1:2.11+dfsg-1ubuntu7.25"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.2-3ubuntu6.1"}]}],"versions":["1:4.0+dfsg-0ubuntu9","1:4.0+dfsg-0ubuntu10","1:4.2-1ubuntu1","1:4.2-1ubuntu2","1:4.2-3ubuntu1","1:4.2-3ubuntu2","1:4.2-3ubuntu3","1:4.2-3ubuntu4","1:4.2-3ubuntu5","1:4.2-3ubuntu6"],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1.1-lp151.7.12.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"qemu-linux-user","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1.1-lp151.7.12.1"}]}],"bundled":6}],"products":[{"vendor":"qemu","product":"qemu"}],"references":[{"url":"https://lists.gnu.org/archive/html/qemu-devel/2019-08/msg01959.html","tags":["x_refsource_MISC","x_transferred","Mailing List","Patch","Third Party Advisory","fix","report"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00007.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://www.debian.org/security/2020/dsa-4665","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"https://usn.ubuntu.com/4372-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-15034"},{"url":"https://usn.ubuntu.com/4372-1"},{"url":"https://github.com/advisories/GHSA-7pcg-64mr-xg9c"},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-15034","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20200844-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1123156","tags":["report"]},{"url":"https://bugzilla.suse.com/1154790","tags":["report"]},{"url":"https://bugzilla.suse.com/1161066","tags":["report"]},{"url":"https://bugzilla.suse.com/1162729","tags":["report"]},{"url":"https://bugzilla.suse.com/1163018","tags":["report"]},{"url":"https://bugzilla.suse.com/1165776","tags":["report"]},{"url":"https://bugzilla.suse.com/1166240","tags":["report"]},{"url":"https://bugzilla.suse.com/1166379","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-15034","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-20382","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-6778","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-1711","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-7039","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8608","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20200845-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1156642","tags":["report"]},{"url":"https://bugzilla.suse.com/1156794","tags":["report"]},{"url":"https://bugzilla.suse.com/1158880","tags":["report"]},{"url":"https://bugzilla.suse.com/1162161","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-15034","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4372-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-15034","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-20382","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-1983","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-10702","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-11869","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/S5VG234WOT345KSVGE32CW6SK7I55AZP/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2019-15034","description":"hw/display/bochs-display.c in QEMU 4.0.0 does not ensure a sufficient PCI config space allocation, leading to a buffer overflow involving the PCIe extended config space.","status":"published","published":"2020-03-10T17:19:02Z","modified":"2024-08-05T00:34:53.171Z","updated_at":"2026-11-02T14:20:21.059499Z"}],"euvd":[{"id":"EUVD-2019-6121","description":"hw/display/bochs-display.c in QEMU 4.0.0 does not ensure a sufficient PCI config space allocation, leading to a buffer overflow involving the PCIe extended config space.","status":"published","published":"2020-03-10T17:19:02Z","modified":"2024-08-05T00:34:53Z","updated_at":"2026-11-03T02:40:37.624691Z"}],"ghsa":[{"id":"GHSA-7pcg-64mr-xg9c","title":"hw/display/bochs-display.c in QEMU 4.0.0 does not ensure a sufficient PCI config space allocation...","description":"hw/display/bochs-display.c in QEMU 4.0.0 does not ensure a sufficient PCI config space allocation, leading to a buffer overflow involving the PCIe extended config space.","status":"published","published":"2022-05-24T17:10:35Z","modified":"2024-04-04T02:48:34Z","cvss":[{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H","level":"medium"}],"cwes":["CWE-120"],"updated_at":"2026-11-02T14:56:12.154453Z"}],"nvd":[{"id":"CVE-2019-15034","description":"hw/display/bochs-display.c in QEMU 4.0.0 does not ensure a sufficient PCI config space allocation, leading to a buffer overflow involving the PCIe extended config space.","status":"published","published":"2020-03-10T18:15:11.857Z","modified":"2026-06-17T02:19:34.497Z","cvss":[{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.4,"vector":"AV:L/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-120"],"updated_at":"2026-11-02T14:05:45.254119Z"}],"osv":[{"id":"CVE-2019-15034","description":"hw/display/bochs-display.c in QEMU 4.0.0 does not ensure a sufficient PCI config space allocation, leading to a buffer overflow involving the PCIe extended config space.","status":"published","published":"2020-03-10T18:15:11.857Z","modified":"2026-10-24T10:30:58.064872355Z","cvss":[{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:11.361782Z"},{"id":"DEBIAN-CVE-2019-15034","description":"hw/display/bochs-display.c in QEMU 4.0.0 does not ensure a sufficient PCI config space allocation, leading to a buffer overflow involving the PCIe extended config space.","status":"published","published":"2020-03-10T18:15:11.857Z","modified":"2026-09-21T07:01:53.49211648Z","cvss":[{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:31.867036Z"},{"id":"UBUNTU-CVE-2019-15034","description":"hw/display/bochs-display.c in QEMU 4.0.0 does not ensure a sufficient PCI config space allocation, leading to a buffer overflow involving the PCIe extended config space.","status":"withdrawn","published":"2020-03-10T18:15:00Z","modified":"2026-02-04T04:39:06.165793Z","cvss":[{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:19.6877Z"},{"id":"DSA-4665-1","title":"qemu - security update","status":"published","published":"2020-04-27T00:00:00Z","modified":"2026-03-09T02:09:21.473715Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"openSUSE-SU-2020:0468-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\n- CVE-2020-7039: Fixed a heap buffer overflow in tcp_emu() routine while emulating IRC and\n  other protocols (bsc#1161066).\n- CVE-2019-15034: Fixed a buffer overflow in hw/display/bochs-display.c due to improper PCI \n  config space allocation (bsc#1166379).\n- CVE-2020-1711: Fixed an out of bounds heap buffer access iscsi_co_block_status() routine\n  which could have allowed a remote denial of service or arbitrary code with privileges \n  of the QEMU process on the host (bsc#1166240).\n- CVE-2019-6778: Fixed a heap buffer overflow in tcp_emu() routine while emulating \n  the identification protocol and copying message data to a socket buffer (bsc#1123156).\n- CVE-2020-8608: Fixed a heap buffer overflow in tcp_emu() routine while emulating IRC and\n  other protocols (bsc#1163018).\n- CVE-2019-20382: Fixed a memory leak in the VNC display driver which could have led to \n  exhaustion of the host memory leading to a potential Denial of service (bsc#1165776).\n- Fixed a live migration error (bsc#1154790).\n- Fixed an issue where migrating VMs on KVM gets missing features:ospke error (bsc#1162729).\n\nThis update was imported from the SUSE:SLE-15-SP1:Update update project.","status":"published","published":"2020-04-06T22:21:00Z","modified":"2026-02-04T03:44:39.681607Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"SUSE-SU-2020:0844-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\n- CVE-2020-7039: Fixed a heap buffer overflow in tcp_emu() routine while emulating IRC and\n  other protocols (bsc#1161066).\n- CVE-2019-15034: Fixed a buffer overflow in hw/display/bochs-display.c due to improper PCI \n  config space allocation (bsc#1166379).\n- CVE-2020-1711: Fixed an out of bounds heap buffer access iscsi_co_block_status() routine\n  which could have allowed a remote denial of service or arbitrary code with privileges \n  of the QEMU process on the host (bsc#1166240).\n- CVE-2019-6778: Fixed a heap buffer overflow in tcp_emu() routine while emulating \n  the identification protocol and copying message data to a socket buffer (bsc#1123156).\n- CVE-2020-8608: Fixed a heap buffer overflow in tcp_emu() routine while emulating IRC and\n  other protocols (bsc#1163018).\n- CVE-2019-20382: Fixed a memory leak in the VNC display driver which could have led to \n  exhaustion of the host memory leading to a potential Denial of service (bsc#1165776).\n- Fixed a live migration error (bsc#1154790).\n- Fixed an issue where migrating VMs on KVM gets missing features:ospke error (bsc#1162729).\n","status":"published","published":"2020-04-01T14:19:10Z","modified":"2026-02-04T04:25:49.919654Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"SUSE-SU-2020:0845-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\n- CVE-2020-7039: Fixed a heap buffer overflow in tcp_emu() routine while emulating IRC and\n  other protocols (bsc#1161066).\n- CVE-2019-15034: Fixed a buffer overflow in hw/display/bochs-display.c due to improper PCI \n  config space allocation (bsc#1166379).\n- CVE-2020-1711: Fixed an out of bounds heap buffer access iscsi_co_block_status() routine\n  which could have allowed a remote denial of service or arbitrary code with privileges \n  of the QEMU process on the host (bsc#1166240).\n- CVE-2019-6778: Fixed a heap buffer overflow in tcp_emu() routine while emulating \n  the identification protocol and copying message data to a socket buffer (bsc#1123156).\n- CVE-2020-8608: Fixed a heap buffer overflow in tcp_emu() routine while emulating IRC and\n  other protocols (bsc#1163018).\n- CVE-2019-20382: Fixed a memory leak in the VNC display driver which could have led to \n  exhaustion of the host memory leading to a potential Denial of service (bsc#1165776).\n- Fixed live migration errors (bsc#1154790, bsc#1156794, bsc#1156642).\n- Fixed an issue where migrating VMs on KVM gets missing features:ospke error (bsc#1162729).\n- Fixed an issue where booting up a guest system with mdev passthrough device as installation\n  device was failing (bsc#1158880).\n ","status":"published","published":"2020-04-01T14:19:43Z","modified":"2026-02-04T04:37:11.833722Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"USN-4372-1","title":"qemu vulnerabilities","description":"It was discovered that QEMU incorrectly handled bochs-display devices. A\nlocal attacker in a guest could use this to cause a denial of service or\npossibly execute arbitrary code in the host. This issue only affected\nUbuntu 19.10. (CVE-2019-15034)\n\nIt was discovered that QEMU incorrectly handled memory during certain VNC\noperations. A remote attacker could possibly use this issue to cause QEMU\nto consume resources, resulting in a denial of service. This issue only\naffected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 19.10.\n(CVE-2019-20382)\n\nIt was discovered that QEMU incorrectly generated QEMU Pointer\nAuthentication signatures on ARM. A local attacker could possibly use this\nissue to bypass PAuth. This issue only affected Ubuntu 19.10.\n(CVE-2020-10702)\n\nZiming Zhang discovered that QEMU incorrectly handled ATI VGA emulation. A\nlocal attacker in a guest could use this issue to cause QEMU to crash,\nresulting in a denial of service. This issue only affected Ubuntu 20.04\nLTS. (CVE-2020-11869)\n\nAviv Sasson discovered that QEMU incorrectly handled Slirp networking. A\nremote attacker could use this issue to cause QEMU to crash, resulting in a\ndenial of service, or possibly execute arbitrary code. This issue only\naffected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 19.10.\n(CVE-2020-1983)\n","status":"published","published":"2020-05-21T17:08:15Z","modified":"2026-04-27T15:48:44.199208977Z","updated_at":"2026-11-02T16:58:14.547547Z"}]}}