{"id":"CVE-2020-25085","published":"2020-09-25T04:09:43Z","modified":"2024-08-04T15:26:09Z","title":"QEMU 5.0.0 has a heap-based Buffer Overflow in flatview_read_continue in exec.c because hw/sd/sdhci.c mishandles a…","vendor":null,"product":null,"tier":"tail","description":{"text":"QEMU 5.0.0 has a heap-based Buffer Overflow in flatview_read_continue in exec.c because hw/sd/sdhci.c mishandles a write operation in the SDHC_BLKSIZE case.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.00633,"percentile":0.50207,"provenance":"source"},"cwes":[],"references":[{"url":"https://lists.nongnu.org/archive/html/qemu-devel/2020-09/msg00733.html","tags":["x_refsource_MISC"]},{"url":"https://bugs.launchpad.net/qemu/+bug/1892960","tags":["x_refsource_MISC"]},{"url":"http://www.openwall.com/lists/oss-security/2020/09/16/6","tags":["x_refsource_CONFIRM"]},{"url":"https://security.netapp.com/advisory/ntap-20201009-0005/","tags":["x_refsource_CONFIRM"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/11/msg00047.html","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://www.openwall.com/lists/oss-security/2021/03/09/1","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html","tags":["mailing-list","x_refsource_MLIST"]}],"priority":{"score":10.0,"factors":[{"name":"EPSS percentile","points":10.04}]},"euvd":{"id":"EUVD-2020-17777","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-cve-2020-25085-family-cve-2020-25085","children":[{"from":"CVE-2020-25085","to":"CVE-2021-3409","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"The patch for CVE-2020-17380/CVE-2020-25085 was found to be ineffective, thus making QEMU vulnerable to the out-of-bounds read/write access issues previously found in the SDHCI controller emulation code.","from":"CVE.org","in":"CVE-2021-3409"}]}]}}