CVE-2019-14378: libslirp_project libslirp
Vulnerability summary
CVE-2019-14378 is a high (CVSS 8.8) vulnerability in libslirp_project libslirp. EPSS estimates a 16.66% chance of exploitation in the next 30 days, higher than 97% of scored vulnerabilities. 1 public exploit is recorded.
Public exploit (exploit-database, 20-08-2019)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 34 · Related 19Timeline
- 29-07-2019PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
ip_reass in ip_input.c in libslirp 4.0.0 has a heap-based buffer overflow via a large packet because it mishandles a case involving the first fragment.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · Red hatEcosystem advisory · calculated7.0HighCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:HDiffers
- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
16.66%
Chance of exploitation in the next 30 days
Percentile
97%
Versus all other CVEs
30-day change
No change 0.00 pp
From 16.66% on 04-10-2026
Known exploited
Compare KEV catalogsNot in the CISA KEV catalog.
Not in the ENISA CNW catalog.
Not in the CIRCL catalog.
Public exploits
1 foundQEMU - Denial of Service
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Redhat188 products
- hivex< 0:1.3.15-7.module+el8.0.0+4084+cceb9f44
- hivex-debuginfo< 0:1.3.15-7.module+el8.0.0+4084+cceb9f44
- hivex-debugsource< 0:1.3.15-7.module+el8.0.0+4084+cceb9f44
- hivex-devel< 0:1.3.15-7.module+el8.0.0+4084+cceb9f44
- libguestfs< 1:1.38.4-11.1.module+el8.0.0+4084+cceb9f44
Ubuntu7 products
- androidAll versions (No fix recorded)
- basilisk2All versions (No fix recorded)
- bochsAll versions (No fix recorded)
- fs-uaeAll versions (No fix recorded)
- qemu< 2.0.0+dfsg-2ubuntu1.47 | < 1:2.5+dfsg-5ubuntu10.42 | < 1:2.11+dfsg-1ubuntu7.20 | < 1:4.2-1ubuntu1
Debian2 products
- qemu< 1:4.1-1
- slirp4netns< 0.3.2-1
Libslirp_project1 product
- libslirp4.0.0
4 vendors · 198 products
References
45 links- gitlab.freedesktop.org/slirp/libslirp/commit/126c04acbabd7ad32c2b018fe10dfac2a3bc1210X Refsource MISCPatchThird Party AdvisoryREPORT
- news.ycombinator.com/item?id=20799010X Refsource MISC
- packetstormsecurity.com/files/154269/QEMU-Denial-Of-Service.htmlX Refsource MISC
Show all 45 references
- support.f5.com/csp/article/K25423748X Refsource CONFIRM