CVE-2020-1983 · cross-distro fix matrix

CVE-2020-1983: A use after free vulnerability in ip_reass() in ip_input.c of libslirp 4.2.0 and prior releases allows crafted packets to cause a denial of service.

Affects 8 Linux releases across 14 (distro × package) combinations.

Fix per ecosystem

Each block below is a distro release where CVE-2020-1983 has a known fix. Run the listed command on that distro to remediate.

Source: Debian Security Tracker

libslirp→ fixed in4.2.0-2urgency: not yet assigned
```
sudo apt-get install --only-upgrade -y libslirp
```
qemu→ fixed in1:4.1-2urgency: not yet assigned
```
sudo apt-get install --only-upgrade -y qemu
```
slirp4netns→ fixed in1.0.1-1urgency: not yet assigned
```
sudo apt-get install --only-upgrade -y slirp4netns
```

Source: Debian Security Tracker

libslirp→ fixed in4.2.0-2urgency: not yet assigned
```
sudo apt-get install --only-upgrade -y libslirp
```
qemu→ fixed in1:4.1-2urgency: not yet assigned
```
sudo apt-get install --only-upgrade -y qemu
```
slirp4netns→ fixed in1.0.1-1urgency: not yet assigned
```
sudo apt-get install --only-upgrade -y slirp4netns
```

Source: Debian Security Tracker

libslirp→ fixed in4.2.0-2urgency: not yet assigned
```
sudo apt-get install --only-upgrade -y libslirp
```
qemu→ fixed in1:4.1-2urgency: not yet assigned
```
sudo apt-get install --only-upgrade -y qemu
```
slirp4netns→ fixed in1.0.1-1urgency: not yet assigned
```
sudo apt-get install --only-upgrade -y slirp4netns
```