Buffer overflow in the vnc_refresh_server_surface function in the VNC display driver in QEMU before 2.4.0.1 allows guest users to cause a denial of service (heap memory corruption and process crash) or possibly execute arbitrary code on the host via unspecified vectors, related to refreshing the server display surface.
CVSS Details
- CVSS 3.1 Base Score: 9.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade qemu | Aug 30, 2017 | Nov 6, 2015 |
| Debian | — | Upgrade qemu | Jul 30, 2024 | Nov 6, 2015 |
| Freebsd | — | Upgrade qemu-user-staticUpgrade qemuUpgrade qemu-develUpgrade qemu-sbruno | Dec 10, 2025 | Jan 1, 2016 |
| Gentoo Linux | — | Upgrade app-emulation/qemu. | Oct 30, 2017 | Nov 6, 2015 |
| Oracle_linux | — | Upgrade qemu-kvm-toolsUpgrade qemu-kvm-commonUpgrade qemu-kvmUpgrade qemu-img | Aug 8, 2017 | Nov 6, 2015 |
| Suse | — | Upgrade qemu-ksmUpgrade qemu-ui-spice-appUpgrade qemu-ui-cursesUpgrade qemu-seabiosUpgrade qemu-ipxeUpgrade qemu-ui-gtkUpgrade qemu-langUpgrade qemu-hw-display-virtio-vgaUpgrade qemu-skibootUpgrade qemu-chardev-spiceUpgrade qemu-ui-spice-coreUpgrade qemu-audio-ossUpgrade qemu-block-curlUpgrade qemu-ui-openglUpgrade qemu-block-sshUpgrade qemu-audio-alsaUpgrade qemu-audio-paUpgrade qemu-block-iscsiUpgrade qemu-armUpgrade qemu-s390Upgrade qemu-sgabiosUpgrade qemu-hw-usb-redirectUpgrade qemu-toolsUpgrade qemu-audio-spiceUpgrade qemu-vgabiosUpgrade qemu-hw-display-qxlUpgrade qemu-hw-display-virtio-gpu-pciUpgrade qemu-microvmUpgrade qemu-guest-agentUpgrade qemu-ppcUpgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade qemuUpgrade qemu-block-rbdUpgrade qemu-s390xUpgrade qemu-hw-display-virtio-gpuUpgrade qemu-chardev-baumUpgrade qemu-x86Upgrade qemu-kvm | Dec 9, 2016 | Nov 6, 2015 |
| Ubuntu | — | Upgrade qemu-system-sparcUpgrade qemu-system-miscUpgrade qemu-system-aarch64Upgrade qemu-system-mipsUpgrade qemu-kvmUpgrade qemu-system-ppcUpgrade qemu-system-x86Upgrade qemu-systemUpgrade qemu-system-arm | Nov 8, 2024 | Nov 6, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub