The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4191-1 advisory.

    It was discovered that the LSI SCSI adapter emulator implementation in QEMU did not properly validate     executed scripts. A local attacker could use this to cause a denial of service. (CVE-2019-12068)

    Sergej Schumilo, Cornelius Aschermann and Simon Wrner discovered that the qxl paravirtual graphics     driver implementation in QEMU contained a null pointer dereference. A local attacker in a guest could use     this to cause a denial of service. (CVE-2019-12155)

    Riccardo Schirone discovered that the QEMU bridge helper did not properly validate network interface     names. A local attacker could possibly use this to bypass ACL restrictions. (CVE-2019-13164)

    It was discovered that a heap-based buffer overflow existed in the SLiRP networking implementation of     QEMU. A local attacker in a guest could use this to cause a denial of service or possibly execute     arbitrary code in the host. (CVE-2019-14378)

    It was discovered that a use-after-free vulnerability existed in the SLiRP networking implementation of     QEMU. A local attacker in a guest could use this to cause a denial of service. (CVE-2019-15890)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Ubuntu 16.04 LTS / 18.04 LTS : QEMU vulnerabilities (USN-4191-1)

high Nessus Plugin ID 131017

Version 1.7

Version 1.6

Version 1.7 Aug 28, 2024, 7:43 PM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202408281943
Version 1.6 Oct 21, 2023, 9:06 AM CVSSv2 score source (set to "CVE-2019-14378") Detection Plugin metadata Plugin Feed: 202310210906