CVE-2020-13754

MediumCVSS 6.7/10Last modified Jun 17, 2026

Description

hw/pci/msix.c in QEMU 4.2.0 allows guest OS users to trigger an out-of-bounds access via a crafted address in an msi-x mmio operation.

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.openwall.com/lists/oss-security/2020/06/01/6Mailing List, Patch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2020/06/15/8Mailing List, Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/07/msg00020.htmlMailing List, Third Party Advisory
https://lists.gnu.org/archive/html/qemu-devel/2020-06/msg00004.htmlIssue Tracking, Patch, Third Party Advisory
https://security.gentoo.org/glsa/202011-09Third Party Advisory
https://security.netapp.com/advisory/ntap-20200608-0007/Third Party Advisory
https://usn.ubuntu.com/4467-1/Third Party Advisory
https://www.debian.org/security/2020/dsa-4728Third Party Advisory
http://www.openwall.com/lists/oss-security/2020/06/01/6Mailing List, Patch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2020/06/15/8Mailing List, Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/07/msg00020.htmlMailing List, Third Party Advisory
https://lists.gnu.org/archive/html/qemu-devel/2020-06/msg00004.htmlIssue Tracking, Patch, Third Party Advisory
https://security.gentoo.org/glsa/202011-09Third Party Advisory
https://security.netapp.com/advisory/ntap-20200608-0007/Third Party Advisory
https://usn.ubuntu.com/4467-1/Third Party Advisory
https://www.debian.org/security/2020/dsa-4728Third Party Advisory

Timeline

Published: Jun 2, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-137569.8Sabberworm PHP CSS Parser before 8.3.1 calls eval on uncontrolled data, possibly leading to remote code execution if the function allSelecto CVE-2020-137577.5Python-RSA before 4.1 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.CVE-2020-137586.1modules/security/classes/general.post_filter.php/post_filter.php in the Web Application Firewall in Bitrix24 through 20.0.950 allows XSS by CVE-2020-137597.5rust-vmm vm-memory before 0.1.1 and 0.2.x before 0.2.1 allows attackers to cause a denial of service (loss of IP networking) because read_ob CVE-2020-13767.8<p>An elevation of privilege vulnerability exists in the way that fdSSDP.dll handles objects in memory. An attacker who successfully exploit CVE-2020-137608.8In Joomla! before 3.9.19, missing token checks in com_postinstall lead to CSRF.CVE-2020-137616.1In Joomla! before 3.9.19, lack of input validation in the heading tag option of the "Articles - Newsflash" and "Articles - Categories" modul CVE-2020-137626.1In Joomla! before 3.9.19, incorrect input validation of the module tag option in com_modules allows XSS.CVE-2020-137637.5In Joomla! before 3.9.19, the default settings of the global textfilter configuration do not block HTML inputs for Guest users.CVE-2020-137647.5common.php in the Gravity Forms plugin before 2.4.9 for WordPress can leak hashed passwords because user_pass is not considered a special ca CVE-2020-137655.6rom_copy() in hw/core/loader.c in QEMU 4.0 and 4.1.0 does not validate the relationship between two addresses, which allows attackers to tri CVE-2020-137675.9The Mitel MiCollab application before 9.1.332 for iOS could allow an unauthorized user to access restricted files and folders due to insuffi