CVE-2018-16867

A flaw was found in qemu Media Transfer Protocol (MTP) before version 3.1.0. A path traversal in the in usb_mtp_write_data function in hw/usb/dev-mtp.c due to an improper filename sanitization. When the guest device is mounted in read-write mode, this allows to read/write arbitrary files which may lead do DoS scenario OR possibly lead to code execution on the host.

Link	Resource
https://www.openwall.com/lists/oss-security/2018/12/06/1	Mailing List Patch
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16867	Issue Tracking Patch
http://www.securityfocus.com/bid/106195	Third Party Advisory VDB Entry
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CGCFIFSIWUREEQQOZDZFBYKWZHXCWBZN/	Mailing List Release Notes
https://usn.ubuntu.com/3923-1/	Third Party Advisory

Configuration 1

cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:* cpe:2.3:a:qemu:qemu:3.1.0:rc1:*:*:*:*:*:* cpe:2.3:a:qemu:qemu:3.1.0:rc2:*:*:*:*:*:* cpe:2.3:a:qemu:qemu:3.1.0:rc0:*:*:*:*:*:* cpe:2.3:a:qemu:qemu:3.1.0:rc3:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:* cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:* cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*

---

Published : 2018-12-12 01:29

Updated : 2020-05-14 03:24

---

NVD link : CVE-2018-16867

Mitre link : CVE-2018-16867

No products.

CWE-362