{"id":"CVE-2020-7039","details":"tcp_emu in tcp_subr.c in libslirp 4.1.0, as used in QEMU 4.2.0, mismanages memory, as demonstrated by IRC DCC commands in EMU_IRC. This can cause a heap-based buffer overflow or other out-of-bounds access which can lead to a DoS or potential execute arbitrary code.","modified":"2026-05-14T13:09:34.920719Z","published":"2020-01-16T23:15:12.190Z","related":["ALSA-2020:0348","ALSA-2020:1358","ALSA-2020:1360","SUSE-SU-2020:0844-1","SUSE-SU-2020:0845-1","SUSE-SU-2020:14396-1","SUSE-SU-2020:1501-1","SUSE-SU-2020:1514-1","SUSE-SU-2020:1523-1","SUSE-SU-2020:1526-1","SUSE-SU-2020:1538-1","SUSE-SU-2021:14706-1","openSUSE-SU-2020:0468-1","openSUSE-SU-2024:11287-1"],"database_specific":{"unresolved_ranges":[{"extracted_events":[{"last_affected":"15.1"}],"source":"CPE_FIELD","cpe":"cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*"}]},"references":[{"type":"ADVISORY","url":"http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00007.html"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2020:0348"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2020:0775"},{"type":"ADVISORY","url":"https://lists.debian.org/debian-lts-announce/2020/01/msg00022.html"},{"type":"ADVISORY","url":"https://lists.debian.org/debian-lts-announce/2020/01/msg00036.html"},{"type":"ADVISORY","url":"https://lists.debian.org/debian-lts-announce/2021/02/msg00012.html"},{"type":"ADVISORY","url":"https://seclists.org/bugtraq/2020/Feb/0"},{"type":"ADVISORY","url":"https://security.gentoo.org/glsa/202005-02"},{"type":"ADVISORY","url":"https://usn.ubuntu.com/4283-1/"},{"type":"ADVISORY","url":"https://www.debian.org/security/2020/dsa-4616"},{"type":"FIX","url":"http://www.openwall.com/lists/oss-security/2020/01/16/2"},{"type":"FIX","url":"https://gitlab.freedesktop.org/slirp/libslirp/commit/2655fffed7a9e765bcb4701dd876e9dab975f289"},{"type":"FIX","url":"https://gitlab.freedesktop.org/slirp/libslirp/commit/82ebe9c370a0e2970fb5695aa19aa5214a6a1c80"},{"type":"FIX","url":"https://gitlab.freedesktop.org/slirp/libslirp/commit/ce131029d6d4a405cb7d3ac6716d03e58fb4a5d9"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/qemu/qemu","events":[{"introduced":"0"},{"last_affected":"9e06029aea3b2eca1d5261352e695edc1e7d7b8b"},{"last_affected":"b0ca999a43a22b38158a222233d3f5881648bb4f"},{"last_affected":"c1eb2ddf0f8075faddc5f7c3d39feae3e8e9d6b4"},{"last_affected":"c25df57ae8f9fe1c72eee2dab37d76d904ac382e"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"last_affected":"4.1.0"},{"last_affected":"4.2.0"},{"last_affected":"8.0"},{"last_affected":"9.0"}],"source":"CPE_FIELD","cpe":["cpe:2.3:a:libslirp_project:libslirp:4.1.0:*:*:*:*:*:*:*","cpe:2.3:a:qemu:qemu:4.2.0:*:*:*:*:*:*:*","cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*","cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"]}}],"versions":["v9.0.0","v9.0.0-rc4","v9.0.0-rc3","v9.0.0-rc2","v9.0.0-rc1","v9.0.0-rc0","v8.2.0","v8.2.0-rc4","v8.2.0-rc3","v8.2.0-rc2","v8.2.0-rc1","v8.2.0-rc0","v8.1.0","v8.1.0-rc4","v8.1.0-rc3","v8.1.0-rc2","v8.1.0-rc1","v8.1.0-rc0","v8.0.0","v8.0.0-rc4","v8.0.0-rc3","v8.0.0-rc2","v7.2.0","v8.0.0-rc1","v8.0.0-rc0","v7.2.0-rc4","v7.2.0-rc3","v7.2.0-rc2","v7.2.0-rc1","v7.2.0-rc0","v7.1.0","v7.1.0-rc4","v7.1.0-rc3","v7.1.0-rc2","v7.1.0-rc1","v7.1.0-rc0","v7.0.0","v7.0.0-rc4","v7.0.0-rc3","v7.0.0-rc2","v7.0.0-rc1","v7.0.0-rc0","v6.2.0","v6.2.0-rc4","v6.1.0","v6.2.0-rc3","v6.2.0-rc1","v6.2.0-rc0","v6.0.0","v6.1.0-rc4","v6.1.0-rc3","v6.1.0-rc2","v6.1.0-rc1","v6.1.0-rc0","v6.0.0-rc5","v6.0.0-rc4","v6.0.0-rc3","v6.0.0-rc2","v6.0.0-rc1","v6.0.0-rc0","v5.2.0","v5.2.0-rc4","v5.2.0-rc3","v5.2.0-rc2","v5.2.0-rc1","v5.2.0-rc0","v5.0.0","v5.1.0","v5.1.0-rc3","v5.1.0-rc2","v5.1.0-rc1","v5.1.0-rc0","v4.2.0","v5.0.0-rc4","v5.0.0-rc3","v5.0.0-rc2","v5.0.0-rc1","v5.0.0-rc0","v4.2.0-rc5","v4.2.0-rc4","v4.2.0-rc3","v4.2.0-rc2","v4.2.0-rc1","v4.2.0-rc0","v4.1.0","v4.0.0","v4.1.0-rc5","v4.1.0-rc4","v4.1.0-rc3","v4.1.0-rc2","v4.1.0-rc1","v4.1.0-rc0","v4.0.0-rc4","v4.0.0-rc3","v4.0.0-rc2","v4.0.0-rc1","v3.1.0","v4.0.0-rc0","v3.0.0","v3.1.0-rc5","v3.1.0-rc4","v3.1.0-rc3","v3.1.0-rc2","v3.1.0-rc1","v3.1.0-rc0","v3.0.0-rc4","v3.0.0-rc3","v3.0.0-rc2","v3.0.0-rc1","v3.0.0-rc0","v2.12.0","v2.12.0-rc4","v2.12.0-rc3","v2.12.0-rc2","v2.12.0-rc1","v2.12.0-rc0","v2.11.0","v2.11.0-rc5","v2.11.0-rc4","v2.11.0-rc3","v2.11.0-rc2","v2.11.0-rc1","v2.11.0-rc0","v2.10.0","v2.10.0-rc4","v2.10.0-rc3","v2.10.0-rc2","v2.10.0-rc1","v2.9.0","v2.10.0-rc0","v2.9.0-rc5","v2.9.0-rc4","v2.9.0-rc3","v2.9.0-rc2","v2.9.0-rc1","v2.8.0","v2.9.0-rc0","v2.8.0-rc4","v2.8.0-rc3","v2.8.0-rc2","v2.8.0-rc1","v2.8.0-rc0","v2.7.0","v2.7.0-rc5","v2.7.0-rc4","v2.7.0-rc3","v2.7.0-rc2","v2.6.0","v2.7.0-rc1","v2.7.0-rc0","v2.6.0-rc5","v2.6.0-rc4","v2.6.0-rc3","v2.6.0-rc2","v2.6.0-rc1","v2.6.0-rc0","v2.5.0","v2.5.0-rc4","v2.5.0-rc3","v2.5.0-rc2","v2.5.0-rc1","v2.5.0-rc0","v2.4.0","v2.4.0-rc4","v2.4.0-rc3","v2.3.0","v2.4.0-rc2","v2.4.0-rc1","v2.4.0-rc0","v2.3.0-rc4","v2.3.0-rc3","v2.3.0-rc2","v2.3.0-rc1","v2.3.0-rc0","v2.2.0","v2.2.0-rc3","v2.2.0-rc5","v2.2.0-rc4","v2.2.0-rc2","v2.2.0-rc1","v2.2.0-rc0","v2.1.0","v2.1.0-rc5","v2.1.0-rc4","v2.1.0-rc2","v2.1.0-rc3","v2.0.0","v2.1.0-rc1","v2.1.0-rc0","v2.0.0-rc3","v2.0.0-rc2","v2.0.0-rc1","v2.0.0-rc0","v1.7.0","v1.7.0-rc2","v1.7.0-rc1","v1.7.0-rc0","v1.6.0","v1.6.0-rc3","v1.6.0-rc2","v1.6.0-rc1","v1.6.0-rc0","v1.5.0","v1.5.0-rc3","v1.5.0-rc2","v1.5.0-rc1","v1.5.0-rc0","v1.4.0","v1.4.0-rc2","v1.4.0-rc1","v1.4.0-rc0","v1.3.0","v1.3.0-rc2","v1.3.0-rc1","v1.3.0-rc0","v1.2.0","v1.2.0-rc3","v1.2.0-rc2","v1.2.0-rc1","v1.2.0-rc0","v1.1.0","v1.1.0-rc4","v1.1.0-rc3","v1.1.0-rc2","v1.1-rc2","v1.1-rc1","v1.1-rc0","v1.0","v1.0-rc4","v1.0-rc3","v1.0-rc2","v1.0-rc1","v1.0-rc0","v0.14.0-rc0","v0.13.0-rc0","v0.12.0-rc0","v0.11.0-rc0","v0.5.0","v0.4.4","v0.4.3","v0.4.2","v0.4.1","v0.4.0","v0.3.0","v0.2.0","v0.1.6","v0.1.5","v0.1.4","v0.1.3","v0.1.1","v0.1.0"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2020-7039.json"}},{"ranges":[{"type":"GIT","repo":"https://gitlab.freedesktop.org/slirp/libslirp","events":[{"introduced":"0"},{"fixed":"2655fffed7a9e765bcb4701dd876e9dab975f289"},{"fixed":"82ebe9c370a0e2970fb5695aa19aa5214a6a1c80"},{"fixed":"ce131029d6d4a405cb7d3ac6716d03e58fb4a5d9"}],"database_specific":{"source":"REFERENCES"}}],"versions":["v4.1.0","v4.0.0","v4.0.0-rc0","v3.1.0-rc5","v3.1.0-rc4","v3.1.0-rc3","v3.1.0-rc2","v3.1.0-rc1","v3.1.0","v3.1.0-rc0","v3.0.0-rc4","v3.0.0","v3.0.0-rc3","v3.0.0-rc2","v3.0.0-rc1","v3.0.0-rc0","v2.12.1","v2.12.0-rc4","v2.12.0-rc3","v2.12.0-rc2","v2.12.0-rc1","v2.12.0-rc0","v2.12.0","v2.11.2","v2.11.1","v2.11.0-rc5","v2.11.0-rc4","v2.11.0-rc3","v2.11.0-rc2","v2.11.0-rc1","v2.11.0","v2.11.0-rc0","v2.10.0-rc4","v2.10.0-rc3","v2.10.0-rc2","v2.10.0","v2.10.0-rc1","v2.10.0-rc0","v2.9.0-rc5","v2.9.0-rc4","v2.9.0-rc3","v2.9.0","v2.9.0-rc2","v2.9.0-rc1","v2.9.0-rc0","v2.8.1.1","v2.8.1","v2.8.0-rc4","v2.8.0-rc3","v2.8.0-rc2","v2.8.0-rc1","v2.8.0-rc0","v2.8.0","v2.7.0-rc5","v2.7.0-rc4","v2.7.0-rc3","v2.7.0","v2.7.0-rc2","v2.7.0-rc1","v2.7.0-rc0","v2.6.0-rc5","v2.6.0-rc4","v2.6.0","v2.6.0-rc3","v2.6.0-rc2","v2.6.0-rc1","v2.6.0-rc0","v2.5.1.1","v2.5.1","v2.5.0-rc4","v2.5.0-rc3","v2.5.0-rc2","v2.5.0-rc1","v2.5.0-rc0","v2.5.0","v2.4.0.1","v2.4.0-rc4","v2.4.0-rc3","v2.4.0-rc2","v2.4.0-rc1","v2.4.0-rc0","v2.4.0","v2.3.1","v2.3.0-rc4","v2.3.0-rc3","v2.3.0-rc2","v2.3.0-rc1","v2.3.0-rc0","v2.3.0","v2.2.1","v2.2.0-rc5","v2.2.0-rc4","v2.2.0-rc3","v2.2.0-rc2","v2.2.0-rc1","v2.2.0-rc0","v2.2.0","v2.1.1","v2.1.0-rc5","v2.1.0-rc4","v2.1.0-rc3","v2.1.0-rc2","v2.1.0-rc1","v2.1.0-rc0","v2.1.0","v2.0.2","v2.0.1","v2.0.0-rc3","v2.0.0-rc2","v2.0.0-rc1","v2.0.0","v2.0.0-rc0","v1.7.2","v1.7.1","v1.7.0-rc2","v1.7.0-rc1","v1.7.0-rc0","v1.7.0","v1.6.2","v1.6.1","v1.6.0-rc3","v1.6.0-rc2","v1.6.0-rc1","v1.6.0-rc0","v1.6.0","v1.5.3","v1.5.2","v1.5.1","v1.5.0-rc3","v1.5.0-rc2","v1.5.0-rc1","v1.5.0-rc0","v1.5.0","v1.4.0-rc2","v1.4.0-rc1","v1.4.0-rc0","v1.4.0","v1.3.1","v1.3.0-rc2","v1.3.0-rc1","v1.3.0-rc0","v1.3.0","v1.2.0-rc3","v1.2.0-rc2","v1.2.0-rc1","v1.2.0-rc0","v1.2.0","v1.1.2","v1.1.1","v1.1.0-rc4","v1.1.0","v1.1.0-rc3","v1.1.0-rc2","v1.1-rc2","v1.1-rc1","v1.1-rc0","v1.0.1","v1.0-rc4","v1.0-rc3","v1.0-rc2","v1.0-rc1","v1.0-rc0","v1.0","v0.15.1","v0.15.0-rc2","v0.15.0-rc1","v0.15.0","v0.15.0-rc0","v0.14.0-rc1","v0.14.0-rc0","v0.13.0-rc3","v0.13.0-rc2","v0.13.0-rc1","v0.13.0-rc0","v0.13.0","v0.12.1","v0.12.0-rc2","v0.12.0-rc1","v0.12.0-rc0","v0.12.0","v0.11.0-rc0","v0.10.6","v0.10.5","v0.10.4","v0.10.3","v0.10.2","v0.10.1","v0.10.0","release_0_10_2","release_0_10_1","release_0_10_0","v0.9.1","release_0_9_1","v0.9.0","release_0_9_0","v0.8.2","release_0_8_2","v0.8.1","release_0_8_1","v0.7.1","release_0_7_1","v0.7.0","release_0_7_0","v0.6.1","release_0_6_1","v0.6.0","release_0_6_0"],"database_specific":{"vanir_signatures_modified":"2026-05-14T13:09:34Z","vanir_signatures":[{"target":{"file":"src/tcp_subr.c"},"signature_version":"v1","source":"https://gitlab.freedesktop.org/slirp/libslirp@ce131029d6d4a405cb7d3ac6716d03e58fb4a5d9","signature_type":"Line","digest":{"line_hashes":["241284285325634071912458277399824585701","101024470289889841703992026745821739860","46610385591659169243295099148013167523","132650339709434889629960677488439439114","3207942234795332521456043419559591854","95411540399998749707763516469279061285","319218515594435546624940427699079978353","204887157760773484595687427919028940019","95904249482584446495943420617708760582","3207942234795332521456043419559591854","209517937668929253962348685190549018146","40802723628150449286468541765947464847","134894284404824705336579519351776315941","111803825195004922490986731124225859938"],"threshold":0.9},"id":"CVE-2020-7039-66dd0ac8","deprecated":false},{"target":{"function":"tcp_emu","file":"src/tcp_subr.c"},"signature_version":"v1","source":"https://gitlab.freedesktop.org/slirp/libslirp@ce131029d6d4a405cb7d3ac6716d03e58fb4a5d9","signature_type":"Function","digest":{"length":6632,"function_hash":"221627384635618976683759339920942865720"},"id":"CVE-2020-7039-8a519e5a","deprecated":false},{"target":{"function":"tcp_emu","file":"src/tcp_subr.c"},"signature_version":"v1","source":"https://gitlab.freedesktop.org/slirp/libslirp@2655fffed7a9e765bcb4701dd876e9dab975f289","signature_type":"Function","digest":{"length":6508,"function_hash":"140651076775259481436786107058209110775"},"id":"CVE-2020-7039-ab5b2a67","deprecated":false},{"target":{"file":"src/tcp_subr.c"},"signature_version":"v1","source":"https://gitlab.freedesktop.org/slirp/libslirp@2655fffed7a9e765bcb4701dd876e9dab975f289","signature_type":"Line","digest":{"line_hashes":["15140320714121997435057219044735030567","156375986140405105978356906120087512541","316338764136262695171768734962189969112","244401903337416974613622709277191320620","241036784587630143944011798907199304443","142282155878608727980020123582809939206","32139479471153033922636960518668746078"],"threshold":0.9},"id":"CVE-2020-7039-b7d4660f","deprecated":false}],"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2020-7039.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"}]}