{"id":"CVE-2020-7039","details":"tcp_emu in tcp_subr.c in libslirp 4.1.0, as used in QEMU 4.2.0, mismanages memory, as demonstrated by IRC DCC commands in EMU_IRC. This can cause a heap-based buffer overflow or other out-of-bounds access which can lead to a DoS or potential execute arbitrary code.","modified":"2026-08-07T15:13:48.189647Z","published":"2020-01-16T23:15:12.190Z","related":["ALSA-2020:0348","ALSA-2020:1358","ALSA-2020:1360","SUSE-SU-2020:0844-1","SUSE-SU-2020:0845-1","SUSE-SU-2020:14396-1","SUSE-SU-2020:1501-1","SUSE-SU-2020:1514-1","SUSE-SU-2020:1523-1","SUSE-SU-2020:1526-1","SUSE-SU-2020:1538-1","SUSE-SU-2021:14706-1","openSUSE-SU-2020:0468-1","openSUSE-SU-2024:11287-1"],"database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*","cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"8.0"},{"last_affected":"8.0"},{"introduced":"9.0"},{"last_affected":"9.0"}],"source":"CPE_STRING","vendor_product":"debian:debian_linux"},{"source":"CPE_STRING","vendor_product":"opensuse:leap","cpes":["cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"15.1"},{"last_affected":"15.1"}]}]},"references":[{"type":"ADVISORY","url":"http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00007.html"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2020:0348"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2020:0775"},{"type":"ADVISORY","url":"https://lists.debian.org/debian-lts-announce/2020/01/msg00022.html"},{"type":"ADVISORY","url":"https://lists.debian.org/debian-lts-announce/2020/01/msg00036.html"},{"type":"ADVISORY","url":"https://lists.debian.org/debian-lts-announce/2021/02/msg00012.html"},{"type":"ADVISORY","url":"https://seclists.org/bugtraq/2020/Feb/0"},{"type":"ADVISORY","url":"https://security.gentoo.org/glsa/202005-02"},{"type":"ADVISORY","url":"https://usn.ubuntu.com/4283-1/"},{"type":"ADVISORY","url":"https://www.debian.org/security/2020/dsa-4616"},{"type":"FIX","url":"http://www.openwall.com/lists/oss-security/2020/01/16/2"},{"type":"FIX","url":"https://gitlab.freedesktop.org/slirp/libslirp/commit/2655fffed7a9e765bcb4701dd876e9dab975f289"},{"type":"FIX","url":"https://gitlab.freedesktop.org/slirp/libslirp/commit/82ebe9c370a0e2970fb5695aa19aa5214a6a1c80"},{"type":"FIX","url":"https://gitlab.freedesktop.org/slirp/libslirp/commit/ce131029d6d4a405cb7d3ac6716d03e58fb4a5d9"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/qemu/qemu","events":[{"introduced":"b0ca999a43a22b38158a222233d3f5881648bb4f"},{"last_affected":"b0ca999a43a22b38158a222233d3f5881648bb4f"}],"database_specific":{"extracted_events":[{"introduced":"4.2.0"},{"last_affected":"4.2.0"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:qemu:qemu:4.2.0:*:*:*:*:*:*:*"}}],"versions":["4.2.0","v4.2.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-7039.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/spring-projects/spring-framework","events":[{"introduced":"8d2fd1163309e659c7411b7e5557eddb912ec684"},{"last_affected":"8d2fd1163309e659c7411b7e5557eddb912ec684"}],"database_specific":{"cpe":"cpe:2.3:a:libslirp_project:libslirp:4.1.0:*:*:*:*:*:*:*","extracted_events":[{"introduced":"4.1.0"},{"last_affected":"4.1.0"}],"source":"CPE_STRING"}}],"versions":["4.1.0","v4.1.0.RELEASE"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-7039.json"}},{"ranges":[{"type":"GIT","repo":"https://gitlab.com/qemu-project/qemu","events":[{"introduced":"b0ca999a43a22b38158a222233d3f5881648bb4f"},{"last_affected":"b0ca999a43a22b38158a222233d3f5881648bb4f"}],"database_specific":{"cpe":"cpe:2.3:a:qemu:qemu:4.2.0:*:*:*:*:*:*:*","extracted_events":[{"introduced":"4.2.0"},{"last_affected":"4.2.0"}],"source":"CPE_STRING"}}],"versions":["4.2.0","v4.2.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-7039.json"}},{"ranges":[{"type":"GIT","repo":"https://gitlab.freedesktop.org/slirp/libslirp","events":[{"introduced":"6651ba26c4e94f64d6448a2db4991269ce553bd9"},{"last_affected":"6651ba26c4e94f64d6448a2db4991269ce553bd9"},{"fixed":"2655fffed7a9e765bcb4701dd876e9dab975f289"},{"fixed":"82ebe9c370a0e2970fb5695aa19aa5214a6a1c80"},{"fixed":"ce131029d6d4a405cb7d3ac6716d03e58fb4a5d9"}],"database_specific":{"extracted_events":[{"introduced":"4.1.0"},{"last_affected":"4.1.0"}],"source":["CPE_STRING","REFERENCES"],"cpe":"cpe:2.3:a:libslirp_project:libslirp:4.1.0:*:*:*:*:*:*:*"}}],"versions":["4.1.0","v4.1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-7039.json","vanir_signatures_modified":"2026-08-07T15:13:48Z","vanir_signatures":[{"target":{"file":"src/tcp_subr.c","function":"tcp_emu"},"deprecated":false,"digest":{"length":6641,"function_hash":"16394558136358550035582286927942919055"},"id":"CVE-2020-7039-6b9a8895","signature_type":"Function","signature_version":"v1","source":"https://gitlab.freedesktop.org/slirp/libslirp@82ebe9c370a0e2970fb5695aa19aa5214a6a1c80"},{"target":{"file":"src/tcp_subr.c","function":"tcp_emu"},"deprecated":false,"digest":{"length":6508,"function_hash":"140651076775259481436786107058209110775"},"id":"CVE-2020-7039-ab5b2a67","signature_type":"Function","signature_version":"v1","source":"https://gitlab.freedesktop.org/slirp/libslirp@2655fffed7a9e765bcb4701dd876e9dab975f289"},{"signature_type":"Line","signature_version":"v1","source":"https://gitlab.freedesktop.org/slirp/libslirp@2655fffed7a9e765bcb4701dd876e9dab975f289","target":{"file":"src/tcp_subr.c"},"deprecated":false,"digest":{"line_hashes":["15140320714121997435057219044735030567","156375986140405105978356906120087512541","316338764136262695171768734962189969112","244401903337416974613622709277191320620","241036784587630143944011798907199304443","142282155878608727980020123582809939206","32139479471153033922636960518668746078"],"threshold":0.9},"id":"CVE-2020-7039-b7d4660f"}]}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"}]}