Heap-based buffer overflow in the IDE subsystem in QEMU, as used in Xen 4.5.x and earlier, when the container has a CDROM drive enabled, allows local guest users to execute arbitrary code on the host via unspecified ATAPI commands.
CVSS Details
- CVSS 3.1 Base Score: 8.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade qemuUpgrade xen | Aug 30, 2017 | Aug 12, 2015 |
| Centos_linux | — | Upgrade libcacard-develUpgrade qemu-kvm-commonUpgrade libcacard-toolsUpgrade libcacardUpgrade qemu-kvmUpgrade qemu-imgUpgrade qemu-kvm-tools | Dec 1, 2016 | Aug 12, 2015 |
| Debian | — | Upgrade qemuUpgrade xen | Jul 30, 2024 | Aug 12, 2015 |
| Freebsd | — | Upgrade qemuUpgrade qemu-develUpgrade xen-toolsUpgrade qemu-user-staticUpgrade qemu-sbruno | Dec 10, 2025 | Aug 4, 2015 |
| Gentoo Linux | — | Upgrade app-emulation/xen-tools.Upgrade app-emulation/xen-pvgrub.Upgrade app-emulation/xen.Upgrade app-emulation/pvgrub.Upgrade app-emulation/qemu. | Oct 30, 2017 | Aug 12, 2015 |
| Oracle_linux | — | Upgrade qemu-kvmUpgrade qemu-kvm-commonUpgrade libcacard-toolsUpgrade libcacardUpgrade libcacard-develUpgrade qemu-kvm-toolsUpgrade qemu-img | Oct 16, 2024 | Aug 12, 2015 |
| Suse | — | Upgrade qemu-block-rbdUpgrade xen-libs-32bitUpgrade qemu-ipxeUpgrade qemu-hw-display-virtio-vgaUpgrade qemu-skibootUpgrade qemu-ui-spice-appUpgrade xen-kmp-defaultUpgrade qemu-audio-ossUpgrade xen-kmp-paeUpgrade qemu-armUpgrade qemu-chardev-spiceUpgrade xen-libsUpgrade xen-tools-xendomains-wait-diskUpgrade qemu-seabiosUpgrade xen-doc-pdfUpgrade qemuUpgrade qemu-ui-spice-coreUpgrade qemu-hw-display-qxlUpgrade qemu-ksmUpgrade qemu-block-sshUpgrade qemu-audio-spiceUpgrade xen-toolsUpgrade qemu-hw-display-virtio-gpu-pciUpgrade xen-develUpgrade qemu-langUpgrade qemu-ui-openglUpgrade qemu-hw-display-virtio-gpuUpgrade qemu-guest-agentUpgrade qemu-block-iscsiUpgrade qemu-s390xUpgrade qemu-microvmUpgrade qemu-x86Upgrade qemu-ui-gtkUpgrade qemu-ppcUpgrade kvmUpgrade qemu-s390Upgrade xen-tools-domUUpgrade xenUpgrade qemu-vgabiosUpgrade qemu-audio-paUpgrade xen-doc-htmlUpgrade qemu-ui-cursesUpgrade qemu-sgabiosUpgrade qemu-block-curlUpgrade qemu-chardev-baumUpgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade qemu-toolsUpgrade qemu-hw-usb-redirectUpgrade xen-kmp-traceUpgrade qemu-kvmUpgrade qemu-audio-alsa | Dec 18, 2015 | Jul 27, 2015 |
| Ubuntu | — | Upgrade qemu-systemUpgrade qemu-system-ppcUpgrade qemu-system-mipsUpgrade qemu-system-armUpgrade qemu-system-sparcUpgrade qemu-system-x86Upgrade qemu-system-aarch64Upgrade qemu-system-misc | Nov 8, 2024 | Aug 12, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub