Integer signedness error in the virtio_net_load function in hw/net/virtio-net.c in QEMU 1.x before 1.7.2 allows remote attackers to execute arbitrary code via a crafted savevm image, which triggers a buffer overflow.
CVSS Details
- CVSS 3.1 Base Score: 8.4
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade libcacard-develUpgrade qemu-guest-agentUpgrade qemu-kvmUpgrade qemu-kvm-toolsUpgrade libcacard-toolsUpgrade libcacardUpgrade qemu-imgUpgrade qemu-kvm-common | Dec 1, 2016 | Nov 4, 2014 |
| Debian | — | Upgrade qemu | Jul 30, 2024 | Nov 4, 2014 |
| Oracle_linux | — | Upgrade libcacardUpgrade qemu-kvmUpgrade libcacard-toolsUpgrade qemu-kvm-commonUpgrade qemu-kvm-toolsUpgrade qemu-guest-agentUpgrade libcacard-develUpgrade qemu-img | Oct 16, 2024 | Nov 4, 2014 |
| Suse | — | Upgrade kvm | Jun 26, 2014 | Jun 26, 2014 |
| Ubuntu | — | Upgrade qemu-system-aarch64Upgrade qemu-kvmUpgrade qemu-system-armUpgrade qemu-system-miscUpgrade qemu-system-ppcUpgrade qemu-systemUpgrade qemu-system-x86Upgrade qemu-system-sparcUpgrade qemu-system-mips | Nov 8, 2024 | Nov 4, 2014 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub