{"schema_version":"1.8.0","id":"CVE-2020-7211","published":"2020-01-21T17:15:12.580Z","modified":"2026-08-07T15:14:44.623634Z","related":["SUSE-SU-2020:0334-1","SUSE-SU-2020:0388-1","SUSE-SU-2020:1138-1","SUSE-SU-2020:1139-1","SUSE-SU-2020:14444-1","SUSE-SU-2020:14448-1","SUSE-SU-2020:1630-1"],"details":"tftp.c in libslirp 4.1.0, as used in QEMU 4.2.0, does not prevent ..\\ directory traversal on Windows.","affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/qemu/qemu","events":[{"introduced":"b0ca999a43a22b38158a222233d3f5881648bb4f"},{"last_affected":"b0ca999a43a22b38158a222233d3f5881648bb4f"}],"database_specific":{"cpe":"cpe:2.3:a:qemu:qemu:4.2.0:*:*:*:*:*:*:*","extracted_events":[{"introduced":"4.2.0"},{"last_affected":"4.2.0"}],"source":"CPE_STRING"}}],"versions":["4.2.0","v4.2.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-7211.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/spring-projects/spring-framework","events":[{"introduced":"8d2fd1163309e659c7411b7e5557eddb912ec684"},{"last_affected":"8d2fd1163309e659c7411b7e5557eddb912ec684"}],"database_specific":{"cpe":"cpe:2.3:a:libslirp_project:libslirp:4.1.0:*:*:*:*:*:*:*","extracted_events":[{"introduced":"4.1.0"},{"last_affected":"4.1.0"}],"source":"CPE_STRING"}}],"versions":["4.1.0","v4.1.0.RELEASE"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-7211.json"}},{"ranges":[{"type":"GIT","repo":"https://gitlab.com/qemu-project/qemu","events":[{"introduced":"b0ca999a43a22b38158a222233d3f5881648bb4f"},{"last_affected":"b0ca999a43a22b38158a222233d3f5881648bb4f"}],"database_specific":{"cpe":"cpe:2.3:a:qemu:qemu:4.2.0:*:*:*:*:*:*:*","extracted_events":[{"introduced":"4.2.0"},{"last_affected":"4.2.0"}],"source":"CPE_STRING"}}],"versions":["4.2.0","v4.2.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-7211.json"}},{"ranges":[{"type":"GIT","repo":"https://gitlab.freedesktop.org/slirp/libslirp","events":[{"introduced":"6651ba26c4e94f64d6448a2db4991269ce553bd9"},{"last_affected":"6651ba26c4e94f64d6448a2db4991269ce553bd9"},{"fixed":"14ec36e107a8c9af7d0a80c3571fe39b291ff1d4"}],"database_specific":{"cpe":"cpe:2.3:a:libslirp_project:libslirp:4.1.0:*:*:*:*:*:*:*","extracted_events":[{"introduced":"4.1.0"},{"last_affected":"4.1.0"}],"source":["CPE_STRING","REFERENCES"]}}],"versions":["4.1.0","v4.1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-7211.json","vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"120643303157668002325465674923733077484","length":2682},"id":"CVE-2020-7211-ac505295","signature_type":"Function","signature_version":"v1","source":"https://gitlab.freedesktop.org/slirp/libslirp@14ec36e107a8c9af7d0a80c3571fe39b291ff1d4","target":{"file":"src/tftp.c","function":"tftp_handle_rrq"}},{"deprecated":false,"digest":{"line_hashes":["335400942427289243216194261493011164826","112539507008349734606060646785474580570","6747955274008167017013603513309967456","321079386013491220200005200596066450513","213290603849672081954127312170418223250"],"threshold":0.9},"id":"CVE-2020-7211-ad897835","signature_type":"Line","signature_version":"v1","source":"https://gitlab.freedesktop.org/slirp/libslirp@14ec36e107a8c9af7d0a80c3571fe39b291ff1d4","target":{"file":"src/tftp.c"}}],"vanir_signatures_modified":"2026-08-07T15:14:44Z"}}],"references":[{"type":"ADVISORY","url":"http://www.openwall.com/lists/oss-security/2020/01/17/2"},{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2020-7211"},{"type":"FIX","url":"https://gitlab.freedesktop.org/slirp/libslirp/commit/14ec36e107a8c9af7d0a80c3571fe39b291ff1d4"}],"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}]}