CVE-2018-19665

Publication date 6 December 2018

Last updated 25 August 2025

Ubuntu priority

Low

Why this priority?

Cvss 3 Severity Score

5.7 · Medium

Score breakdown

Description

The Bluetooth subsystem in QEMU mishandles negative values for length variables, leading to memory corruption.

Read the notes from the security team

Status

Package Ubuntu Release Status
qemu 20.04 LTS focal
Not affected
19.10 eoan
Not affected
19.04 disco Ignored end of life
18.10 cosmic Ignored end of life
18.04 LTS bionic Ignored
16.04 LTS xenial Ignored
14.04 LTS trusty Ignored
qemu-kvm 20.04 LTS focal Not in release
19.10 eoan Not in release
19.04 disco Not in release
18.10 cosmic Not in release
18.04 LTS bionic Not in release
16.04 LTS xenial Not in release
14.04 LTS trusty Not in release

Notes

mdeslaur

as of 2020-06-18, proposed fix not committed as of https://github.com/qemu/qemu/commit/c0188e69d, the bluetooth subsystem is marked as unmaintained We will not be fixing this issue in Ubuntu stable releases. We recommend not using the bluetooth support.

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
qemu

Severity score breakdown

Parameter Value
Base score 5.7 · Medium
Attack vector Adjacent
Attack complexity Low
Privileges required Low
User interaction None
Scope Unchanged
Confidentiality None
Integrity impact None
Availability impact High
Vector CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

Other references