Impact

https://security-tracker.debian.org/tracker/CVE-2020-7039

tcp_emu in tcp_subr.c in libslirp 4.1.0, as used in QEMU 4.2.0, mismanages memory, as demonstrated by IRC DCC commands in EMU_IRC. This can cause a heap-based buffer overflow or other out-of-bounds access which can lead to a DoS or potential execute arbitrary code.

Patches

slirp4netns v0.3.2, 0.4.0-beta.3, and later versions are not affected because tcp_emu is disabled:

8c4db8e#diff-6ca387a3a00bdc638c01a82f8200db0fR106

3f9e646#diff-6ca387a3a00bdc638c01a82f8200db0fR106