QEMU (aka Quick Emulator), when built with the VGA display emulator support, allows local guest OS privileged users to cause a denial of service (out-of-bounds read and QEMU process crash) via vectors involving display update.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade qemu-kvmUpgrade qemu-imgUpgrade qemu-kvm-toolsUpgrade qemu-kvm-debuginfoUpgrade qemu-kvm-common | Apr 27, 2020 | Sep 1, 2017 |
| Amazon_linux | — | Upgrade qemu-kvm | Jun 12, 2018 | Sep 1, 2017 |
| Centos_linux | — | Upgrade qemu-guest-agentUpgrade qemu-kvm-commonUpgrade qemu-imgUpgrade qemu-kvm-debuginfoUpgrade qemu-kvm-toolsUpgrade qemu-kvm | Jul 17, 2018 | Sep 1, 2017 |
| Debian | — | Upgrade qemu | Dec 5, 2017 | Sep 1, 2017 |
| Gentoo Linux | — | Upgrade app-emulation/qemu. | Apr 9, 2018 | Sep 1, 2017 |
| Huawei Euleros 2_0_sp1 | — | Upgrade qemu-img | May 29, 2018 | Sep 1, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade qemu-kvm-commonUpgrade qemu-imgUpgrade qemu-kvm | May 3, 2018 | Sep 1, 2017 |
| Huawei Euleros 2_0_sp3 | — | Upgrade qemu-imgUpgrade qemu-kvmUpgrade qemu-kvm-common | Jul 3, 2018 | Sep 1, 2017 |
| Oracle_linux | — | Upgrade qemu-imgUpgrade qemu-block-iscsiUpgrade qemu-block-rbdUpgrade qemuUpgrade qemu-guest-agentUpgrade qemu-system-x86-coreUpgrade qemu-kvm-coreUpgrade qemu-system-aarch64-coreUpgrade qemu-commonUpgrade qemu-system-x86Upgrade qemu-kvmUpgrade ivshmem-toolsUpgrade qemu-block-glusterUpgrade qemu-kvm-toolsUpgrade qemu-kvm-commonUpgrade qemu-system-aarch64 | Apr 19, 2018 | Aug 24, 2017 |
| Redhat_linux | — | Upgrade qemu-kvm-debuginfoUpgrade qemu-guest-agentUpgrade qemu-imgUpgrade qemu-kvm-commonNo solution existsUpgrade qemu-kvm-toolsUpgrade qemu-kvm | Apr 11, 2018 | Sep 1, 2017 |
| Suse | — | Upgrade xen-toolsUpgrade qemu-block-iscsiUpgrade qemu-audio-alsaUpgrade qemu-ksmUpgrade qemu-microvmUpgrade qemu-guest-agentUpgrade qemu-block-sshUpgrade qemu-langUpgrade xen-kmp-paeUpgrade qemu-block-rbdUpgrade xen-kmp-defaultUpgrade qemu-seabiosUpgrade qemu-block-curlUpgrade qemu-skibootUpgrade qemu-chardev-baumUpgrade qemu-s390Upgrade qemu-ui-spice-coreUpgrade xenUpgrade qemu-hw-usb-redirectUpgrade qemu-vgabiosUpgrade qemu-s390xUpgrade qemu-audio-paUpgrade qemu-ui-spice-appUpgrade qemu-kvmUpgrade qemu-ppcUpgrade qemu-ui-gtkUpgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade xen-libs-32bitUpgrade qemu-ui-cursesUpgrade qemu-x86Upgrade qemu-hw-display-virtio-vgaUpgrade qemu-hw-display-virtio-gpuUpgrade xen-doc-htmlUpgrade qemu-toolsUpgrade qemu-chardev-spiceUpgrade xen-libsUpgrade xen-develUpgrade qemu-audio-ossUpgrade qemu-ui-openglUpgrade qemu-armUpgrade qemu-sgabiosUpgrade qemu-hw-display-qxlUpgrade kvmUpgrade qemuUpgrade qemu-ipxeUpgrade qemu-audio-spiceUpgrade xen-tools-domUUpgrade qemu-hw-display-virtio-gpu-pci | Nov 2, 2017 | Sep 1, 2017 |
| Ubuntu | — | Upgrade qemu-systemUpgrade qemu-system-s390xUpgrade qemu-system-ppcUpgrade qemu-system-mipsUpgrade qemu-system-x86Upgrade qemu-system-armUpgrade qemu-system-sparcUpgrade qemu-system-aarch64Upgrade qemu-system-misc | Feb 21, 2018 | Sep 1, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub