CVE-2019-12928 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2019-12928 Interim 1 34 2025-08-14T02:02:55Z current 2021-05-30T14:28:57Z 2025-08-14T02:02:55Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2019-12928 The QMP migrate command in QEMU version 4.0.0 and earlier is vulnerable to OS command injection, which allows the remote attacker to achieve code execution, denial of service, or information disclosure by sending a crafted QMP command to the listening server. Note: This has been disputed as a non-issue since QEMU's -qmp interface is meant to be used by trusted users. If one is able to access this interface via a tcp socket open to the internet, then it is an insecure configuration issue The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://www.suse.com/support/security/rating/ SUSE Security Ratings SLES for SAP Applications 11 SP3 SUSE CaaS Platform 3.0 SUSE Container as a Service Platform 2.0 SUSE Linux Enterprise Module for Basesystem 15 SP1 SUSE Linux Enterprise Module for Server Applications 15 SP1 SUSE Linux Enterprise Desktop 12 SP3 SUSE Linux Enterprise Software Development Kit 12 SP3 SUSE Linux Enterprise Desktop 12 SP4 SUSE Linux Enterprise Software Development Kit 12 SP4 SUSE Linux Enterprise Module for Basesystem 15 SUSE Linux Enterprise Module for Basesystem 15 SP1 SUSE Linux Enterprise High Performance Computing 12 SP4 SUSE Linux Enterprise Module for Basesystem 15 SUSE Linux Enterprise Module for Server Applications 15 SUSE Linux Enterprise Module for Basesystem 15 SP1 SUSE Linux Enterprise Module for Server Applications 15 SP1 SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS SUSE Linux Enterprise Server 11 SP1 for Teradata SUSE Linux Enterprise Server 11 SP3 LTSS SUSE Linux Enterprise Server 11 SP3 for Teradata SUSE Linux Enterprise Server 12 SP2-BCL SUSE Linux Enterprise Server 12 SP2-LTSS SUSE Linux Enterprise Server 12 SP3 SUSE Linux Enterprise Software Development Kit 12 SP3 SUSE Linux Enterprise Server 12 SP4 SUSE Linux Enterprise Software Development Kit 12 SP4 SUSE Linux Enterprise Server 12 SP4-LTSS SUSE Linux Enterprise Server 12-LTSS SUSE Linux Enterprise Module for Basesystem 15 SUSE Linux Enterprise Module for Server Applications 15 SUSE Linux Enterprise Module for Basesystem 15 SP1 SUSE Linux Enterprise Module for Server Applications 15 SP1 SUSE Linux Enterprise Server for SAP Applications 12 SUSE Linux Enterprise Server for SAP Applications 12 SP2 SUSE Linux Enterprise Software Development Kit 12 SP3 SUSE Linux Enterprise Server for SAP Applications 12 SP4 SUSE Linux Enterprise Software Development Kit 12 SP4 SUSE Linux Enterprise Module for Basesystem 15 SUSE Linux Enterprise Module for Server Applications 15 SUSE Linux Enterprise Module for Basesystem 15 SP1 SUSE Linux Enterprise Module for Server Applications 15 SP1 SUSE Linux Enterprise Module for Basesystem 15 SP1 SUSE Linux Enterprise Module for Server Applications 15 SP1 SUSE Linux Enterprise Module for Basesystem 15 SP1 SUSE Linux Enterprise Module for Server Applications 15 SP1 SUSE Linux Enterprise Module for Basesystem 15 SP1 SUSE Linux Enterprise Module for Server Applications 15 SP1 qemu qemu-block-curl qemu-block-rbd qemu-block-ssh qemu-guest-agent qemu-ipxe qemu-kvm qemu-lang qemu-seabios qemu-sgabios qemu-tools qemu-vgabios qemu-x86 xen xen-devel xen-doc-html xen-kmp-default xen-libs xen-libs-32bit xen-tools xen-tools-domU xen as a component of SLES for SAP Applications 11 SP3 xen-libs as a component of SUSE CaaS Platform 3.0 xen-tools-domU as a component of SUSE CaaS Platform 3.0 xen as a component of SUSE CaaS Platform 3.0 xen as a component of SUSE Container as a Service Platform 2.0 xen as a component of SUSE Linux Enterprise Desktop 12 SP3 xen-libs as a component of SUSE Linux Enterprise Desktop 12 SP3 xen-libs-32bit as a component of SUSE Linux Enterprise Desktop 12 SP3 xen as a component of SUSE Linux Enterprise Desktop 12 SP4 xen-libs as a component of SUSE Linux Enterprise Desktop 12 SP4 xen-libs-32bit as a component of SUSE Linux Enterprise Desktop 12 SP4 xen as a component of SUSE Linux Enterprise High Performance Computing 12 SP4 xen as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS xen-devel as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS xen-libs as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS xen-tools as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS xen-tools-domU as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS xen-libs as a component of SUSE Linux Enterprise Module for Basesystem 15 xen-tools-domU as a component of SUSE Linux Enterprise Module for Basesystem 15 xen as a component of SUSE Linux Enterprise Module for Basesystem 15 xen-libs as a component of SUSE Linux Enterprise Module for Basesystem 15 SP1 xen-tools-domU as a component of SUSE Linux Enterprise Module for Basesystem 15 SP1 xen as a component of SUSE Linux Enterprise Module for Basesystem 15 SP1 xen as a component of SUSE Linux Enterprise Module for Server Applications 15 xen-devel as a component of SUSE Linux Enterprise Module for Server Applications 15 xen-tools as a component of SUSE Linux Enterprise Module for Server Applications 15 xen as a component of SUSE Linux Enterprise Module for Server Applications 15 SP1 xen-devel as a component of SUSE Linux Enterprise Module for Server Applications 15 SP1 xen-tools as a component of SUSE Linux Enterprise Module for Server Applications 15 SP1 xen as a component of SUSE Linux Enterprise Server 11 SP1 for Teradata xen as a component of SUSE Linux Enterprise Server 11 SP3 LTSS xen as a component of SUSE Linux Enterprise Server 11 SP3 for Teradata qemu as a component of SUSE Linux Enterprise Server 12 SP2-BCL qemu-block-curl as a component of SUSE Linux Enterprise Server 12 SP2-BCL qemu-block-rbd as a component of SUSE Linux Enterprise Server 12 SP2-BCL qemu-block-ssh as a component of SUSE Linux Enterprise Server 12 SP2-BCL qemu-guest-agent as a component of SUSE Linux Enterprise Server 12 SP2-BCL qemu-ipxe as a component of SUSE Linux Enterprise Server 12 SP2-BCL qemu-kvm as a component of SUSE Linux Enterprise Server 12 SP2-BCL qemu-lang as a component of SUSE Linux Enterprise Server 12 SP2-BCL qemu-seabios as a component of SUSE Linux Enterprise Server 12 SP2-BCL qemu-sgabios as a component of SUSE Linux Enterprise Server 12 SP2-BCL qemu-tools as a component of SUSE Linux Enterprise Server 12 SP2-BCL qemu-vgabios as a component of SUSE Linux Enterprise Server 12 SP2-BCL qemu-x86 as a component of SUSE Linux Enterprise Server 12 SP2-BCL xen as a component of SUSE Linux Enterprise Server 12 SP2-LTSS xen-doc-html as a component of SUSE Linux Enterprise Server 12 SP2-LTSS xen-libs as a component of SUSE Linux Enterprise Server 12 SP2-LTSS xen-libs-32bit as a component of SUSE Linux Enterprise Server 12 SP2-LTSS xen-tools as a component of SUSE Linux Enterprise Server 12 SP2-LTSS xen-tools-domU as a component of SUSE Linux Enterprise Server 12 SP2-LTSS xen as a component of SUSE Linux Enterprise Server 12 SP3 xen-doc-html as a component of SUSE Linux Enterprise Server 12 SP3 xen-libs as a component of SUSE Linux Enterprise Server 12 SP3 xen-libs-32bit as a component of SUSE Linux Enterprise Server 12 SP3 xen-tools as a component of SUSE Linux Enterprise Server 12 SP3 xen-tools-domU as a component of SUSE Linux Enterprise Server 12 SP3 xen as a component of SUSE Linux Enterprise Server 12 SP4 xen-doc-html as a component of SUSE Linux Enterprise Server 12 SP4 xen-libs as a component of SUSE Linux Enterprise Server 12 SP4 xen-libs-32bit as a component of SUSE Linux Enterprise Server 12 SP4 xen-tools as a component of SUSE Linux Enterprise Server 12 SP4 xen-tools-domU as a component of SUSE Linux Enterprise Server 12 SP4 xen as a component of SUSE Linux Enterprise Server 12 SP4-LTSS xen-doc-html as a component of SUSE Linux Enterprise Server 12 SP4-LTSS xen-libs as a component of SUSE Linux Enterprise Server 12 SP4-LTSS xen-libs-32bit as a component of SUSE Linux Enterprise Server 12 SP4-LTSS xen-tools as a component of SUSE Linux Enterprise Server 12 SP4-LTSS xen-tools-domU as a component of SUSE Linux Enterprise Server 12 SP4-LTSS xen as a component of SUSE Linux Enterprise Server 12-LTSS xen-doc-html as a component of SUSE Linux Enterprise Server 12-LTSS xen-kmp-default as a component of SUSE Linux Enterprise Server 12-LTSS xen-libs as a component of SUSE Linux Enterprise Server 12-LTSS xen-libs-32bit as a component of SUSE Linux Enterprise Server 12-LTSS xen-tools as a component of SUSE Linux Enterprise Server 12-LTSS xen-tools-domU as a component of SUSE Linux Enterprise Server 12-LTSS xen as a component of SUSE Linux Enterprise Server for SAP Applications 12 xen as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 xen-doc-html as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 xen-libs as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 xen-libs-32bit as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 xen-tools as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 xen-tools-domU as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 xen as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 xen-doc-html as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 xen-libs as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 xen-libs-32bit as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 xen-tools as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 xen-tools-domU as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 xen-devel as a component of SUSE Linux Enterprise Software Development Kit 12 SP3 xen as a component of SUSE Linux Enterprise Software Development Kit 12 SP3 xen-devel as a component of SUSE Linux Enterprise Software Development Kit 12 SP4 xen as a component of SUSE Linux Enterprise Software Development Kit 12 SP4 The QMP migrate command in QEMU version 4.0.0 and earlier is vulnerable to OS command injection, which allows the remote attacker to achieve code execution, denial of service, or information disclosure by sending a crafted QMP command to the listening server. Note: This has been disputed as a non-issue since QEMU's -qmp interface is meant to be used by trusted users. If one is able to access this interface via a tcp socket open to the internet, then it is an insecure configuration issue CVE-2019-12928 SLES for SAP Applications 11 SP3:xen SUSE CaaS Platform 3.0:xen SUSE CaaS Platform 3.0:xen-libs SUSE CaaS Platform 3.0:xen-tools-domU SUSE Container as a Service Platform 2.0:xen SUSE Linux Enterprise Desktop 12 SP3:xen SUSE Linux Enterprise Desktop 12 SP3:xen-libs SUSE Linux Enterprise Desktop 12 SP3:xen-libs-32bit SUSE Linux Enterprise Desktop 12 SP4:xen SUSE Linux Enterprise Desktop 12 SP4:xen-libs SUSE Linux Enterprise Desktop 12 SP4:xen-libs-32bit SUSE Linux Enterprise High Performance Computing 12 SP4:xen SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:xen SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:xen-devel SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:xen-libs SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:xen-tools SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:xen-tools-domU SUSE Linux Enterprise Module for Basesystem 15 SP1:xen SUSE Linux Enterprise Module for Basesystem 15 SP1:xen-libs SUSE Linux Enterprise Module for Basesystem 15 SP1:xen-tools-domU SUSE Linux Enterprise Module for Basesystem 15:xen SUSE Linux Enterprise Module for Basesystem 15:xen-libs SUSE Linux Enterprise Module for Basesystem 15:xen-tools-domU SUSE Linux Enterprise Module for Server Applications 15 SP1:xen SUSE Linux Enterprise Module for Server Applications 15 SP1:xen-devel SUSE Linux Enterprise Module for Server Applications 15 SP1:xen-tools SUSE Linux Enterprise Module for Server Applications 15:xen SUSE Linux Enterprise Module for Server Applications 15:xen-devel SUSE Linux Enterprise Module for Server Applications 15:xen-tools SUSE Linux Enterprise Server 11 SP1 for Teradata:xen SUSE Linux Enterprise Server 11 SP3 LTSS:xen SUSE Linux Enterprise Server 11 SP3 for Teradata:xen SUSE Linux Enterprise Server 12 SP2-LTSS:xen SUSE Linux Enterprise Server 12 SP2-LTSS:xen-doc-html SUSE Linux Enterprise Server 12 SP2-LTSS:xen-libs SUSE Linux Enterprise Server 12 SP2-LTSS:xen-libs-32bit SUSE Linux Enterprise Server 12 SP2-LTSS:xen-tools SUSE Linux Enterprise Server 12 SP2-LTSS:xen-tools-domU SUSE Linux Enterprise Server 12 SP3:xen SUSE Linux Enterprise Server 12 SP3:xen-doc-html SUSE Linux Enterprise Server 12 SP3:xen-libs SUSE Linux Enterprise Server 12 SP3:xen-libs-32bit SUSE Linux Enterprise Server 12 SP3:xen-tools SUSE Linux Enterprise Server 12 SP3:xen-tools-domU SUSE Linux Enterprise Server 12 SP4-LTSS:xen SUSE Linux Enterprise Server 12 SP4-LTSS:xen-doc-html SUSE Linux Enterprise Server 12 SP4-LTSS:xen-libs SUSE Linux Enterprise Server 12 SP4-LTSS:xen-libs-32bit SUSE Linux Enterprise Server 12 SP4-LTSS:xen-tools SUSE Linux Enterprise Server 12 SP4-LTSS:xen-tools-domU SUSE Linux Enterprise Server 12 SP4:xen SUSE Linux Enterprise Server 12 SP4:xen-doc-html SUSE Linux Enterprise Server 12 SP4:xen-libs SUSE Linux Enterprise Server 12 SP4:xen-libs-32bit SUSE Linux Enterprise Server 12 SP4:xen-tools SUSE Linux Enterprise Server 12 SP4:xen-tools-domU SUSE Linux Enterprise Server 12-LTSS:xen SUSE Linux Enterprise Server 12-LTSS:xen-doc-html SUSE Linux Enterprise Server 12-LTSS:xen-kmp-default SUSE Linux Enterprise Server 12-LTSS:xen-libs SUSE Linux Enterprise Server 12-LTSS:xen-libs-32bit SUSE Linux Enterprise Server 12-LTSS:xen-tools SUSE Linux Enterprise Server 12-LTSS:xen-tools-domU SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-doc-html SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-libs-32bit SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools SUSE Linux Enterprise Server for SAP Applications 12 SP2:xen-tools-domU SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-doc-html SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-libs SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-libs-32bit SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-tools SUSE Linux Enterprise Server for SAP Applications 12 SP4:xen-tools-domU SUSE Linux Enterprise Server for SAP Applications 12:xen SUSE Linux Enterprise Software Development Kit 12 SP3:xen SUSE Linux Enterprise Software Development Kit 12 SP3:xen-devel SUSE Linux Enterprise Software Development Kit 12 SP4:xen SUSE Linux Enterprise Software Development Kit 12 SP4:xen-devel critical 10 AV:N/AC:L/Au:N/C:C/I:C/A:C 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H