← Vulnerability feed

Vulnerability record · CVE-2019-14378 · published 29 July 2019

CVE-2019-14378: Libslirp project libslirp out-of-bounds write vulnerability

LLibslirp Project · Libslirp

ip_reass in ip_input.c in libslirp 4.0.0 has a heap-based buffer overflow via a large packet because it mishandles a case involving the first fragment.

8.8 CVSS 3.0 High EPSS 17% · top 3.1% CWE-755 · CWE-755CWE-787 · Out-of-bounds write
8.8CVSS 3.0 base score, v2 6.5
17%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
54References
17 Jun 2026Last modified by NVD

Description

ip_reass in ip_input.c in libslirp 4.0.0 has a heap-based buffer overflow via a large packet because it mishandles a case involving the first fragment.

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00000.html
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00008.html
http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00034.html
http://packetstormsecurity.com/files/154269/QEMU-Denial-Of-Service.html
http://www.openwall.com/lists/oss-security/2019/08/01/2 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3179
https://access.redhat.com/errata/RHSA-2019:3403
https://access.redhat.com/errata/RHSA-2019:3494
https://access.redhat.com/errata/RHSA-2019:3742
https://access.redhat.com/errata/RHSA-2019:3787
https://access.redhat.com/errata/RHSA-2019:3968
https://access.redhat.com/errata/RHSA-2019:4344
https://access.redhat.com/errata/RHSA-2020:0366
https://access.redhat.com/errata/RHSA-2020:0775
https://blog.bi0s.in/2019/08/24/Pwn/VM-Escape/2019-07-29-qemu-vm-escape-cve-2019-14378/
https://gitlab.freedesktop.org/slirp/libslirp/commit/126c04acbabd7ad32c2b018fe10dfac2a3bc1210 PatchThird Party Advisory
https://lists.debian.org/debian-lts-announce/2019/09/msg00021.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UPLHB2AN663OXAWUQURF7J2
https://news.ycombinator.com/item?id=20799010
https://seclists.org/bugtraq/2019/Aug/41
https://seclists.org/bugtraq/2019/Sep/3
https://support.f5.com/csp/article/K25423748
https://support.f5.com/csp/article/K25423748?utm_source=f5support&amp%3Butm_medium=RSS
https://usn.ubuntu.com/4191-1/
https://usn.ubuntu.com/4191-2/
https://www.debian.org/security/2019/dsa-4506
https://www.debian.org/security/2019/dsa-4512
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00000.html
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00008.html
http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00034.html
http://packetstormsecurity.com/files/154269/QEMU-Denial-Of-Service.html
http://www.openwall.com/lists/oss-security/2019/08/01/2 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3179
https://access.redhat.com/errata/RHSA-2019:3403
https://access.redhat.com/errata/RHSA-2019:3494
https://access.redhat.com/errata/RHSA-2019:3742
https://access.redhat.com/errata/RHSA-2019:3787
https://access.redhat.com/errata/RHSA-2019:3968
https://access.redhat.com/errata/RHSA-2019:4344
https://access.redhat.com/errata/RHSA-2020:0366

Track CVE-2019-14378 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2020-7211Libslirp project libslirp path traversal vulnerabilitytftp.c in libslirp 4.1.0, as used in QEMU 4.2.0, does not prevent ..\ directory traversal on Windows.EPSS 4.3%7.5CVE-2019-15890Libslirp project libslirp use after free vulnerabilitylibslirp 4.0.0, as used in QEMU 4.1.0, has a use-after-free in ip_reass in ip_input.c.EPSS 4.0%6.5CVE-2020-10756Libslirp project libslirp out-of-bounds read vulnerabilityAn out-of-bounds read vulnerability was found in the SLiRP networking implementation of the QEMU emulator. This flaw occurs in the icmp6_send_echorep…EPSS 0.51%6.5CVE-2020-1983Libslirp project libslirp use after free vulnerabilityA use after free vulnerability in ip_reass() in ip_input.c of libslirp 4.2.0 and prior releases allows crafted packets to cause a denial of service.EPSS 2.4%5.6CVE-2020-8608Libslirp project libslirp classic buffer overflow vulnerabilityIn libslirp 4.1.0, as used in QEMU 4.2.0, tcp_subr.c misuses snprintf return values, leading to a buffer overflow in later code.EPSS 2.5%5.6CVE-2020-7039Libslirp project libslirp out-of-bounds write vulnerabilitytcp_emu in tcp_subr.c in libslirp 4.1.0, as used in QEMU 4.2.0, mismanages memory, as demonstrated by IRC DCC commands in EMU_IRC. This can cause a h…EPSS 3.6%4.3CVE-2020-29129Libslirp project libslirp out-of-bounds read vulnerabilityncsi.c in libslirp through 4.3.1 has a buffer over-read because it tries to read a certain amount of header data even if that exceeds the total packe…EPSS 1.5%4.3CVE-2020-29130Libslirp project libslirp out-of-bounds read vulnerabilityslirp.c in libslirp through 4.3.1 has a buffer over-read because it tries to read a certain amount of header data even if that exceeds the total pack…EPSS 1.9%

Source: NIST National Vulnerability Database (record CVE-2019-14378), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.