Impact

https://security-tracker.debian.org/tracker/CVE-2019-14378

ip_reass in ip_input.c in libslirp 4.0.0 has a heap-based buffer overflow via a large packet because it mishandles a case involving the first fragment.

Patches

On upstream libslirp, the vulnerability was fixed on Jul 28, 2019: https://gitlab.freedesktop.org/slirp/libslirp/commit/126c04acbabd7ad32c2b018fe10dfac2a3bc1210

The fix was to applied to slirp4netns in:

• 4f98340 (Aug 1, 2019; included in v0.4.0-beta.3)
• 3f9e646 (Aug 3, 2019; included in v0.3.2)
• 08b92fd (Aug 3, 2019; included in v0.2.3)