Integer overflow in the qcow_open function in block/qcow.c in QEMU before 1.7.2 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a large image size, which triggers a buffer overflow or out-of-bounds read.
CVSS Details
- CVSS 3.1 Base Score: 5.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade qemu-kvm-commonUpgrade libcacard-toolsUpgrade qemu-guest-agentUpgrade libcacardUpgrade libcacard-develUpgrade qemu-kvm-toolsUpgrade qemu-imgUpgrade qemu-kvm | Dec 1, 2016 | Nov 4, 2014 |
| Debian | — | Upgrade qemuUpgrade qemu-kvm | Jul 30, 2024 | Nov 4, 2014 |
| Gentoo Linux | — | Upgrade app-emulation/qemu. | Oct 30, 2017 | Nov 4, 2014 |
| Oracle_linux | — | Upgrade qemu-kvmUpgrade qemu-imgUpgrade qemu-kvm-toolsUpgrade qemu-guest-agentUpgrade qemu-kvm-commonUpgrade libcacard-develUpgrade libcacardUpgrade libcacard-tools | Oct 16, 2024 | Nov 4, 2014 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 12, 2014 |
| Suse | — | Upgrade qemu-kvmUpgrade qemu-ppcUpgrade qemu-hw-usb-redirectUpgrade qemu-guest-agentUpgrade qemu-langUpgrade qemu-chardev-baumUpgrade qemu-vgabiosUpgrade qemu-seabiosUpgrade qemu-audio-alsaUpgrade qemu-s390xUpgrade qemu-microvmUpgrade qemu-block-curlUpgrade qemu-block-iscsiUpgrade qemu-s390Upgrade qemu-block-rbdUpgrade qemu-ui-gtkUpgrade qemu-audio-paUpgrade qemu-ui-spice-coreUpgrade qemu-block-sshUpgrade qemu-ksmUpgrade qemu-sgabiosUpgrade qemu-skibootUpgrade qemu-audio-spiceUpgrade qemu-toolsUpgrade qemu-ipxeUpgrade qemu-ui-cursesUpgrade qemu-hw-display-virtio-gpu-pciUpgrade qemu-hw-display-virtio-gpuUpgrade qemuUpgrade qemu-armUpgrade qemu-ui-spice-appUpgrade qemu-audio-ossUpgrade qemu-chardev-spiceUpgrade qemu-hw-display-qxlUpgrade qemu-hw-display-virtio-vgaUpgrade qemu-ui-openglUpgrade kvmUpgrade qemu-x86Upgrade qemu-hw-s390x-virtio-gpu-ccw | Dec 18, 2015 | Oct 8, 2014 |
| Ubuntu | — | Upgrade qemu-kvmUpgrade qemu-system-mipsUpgrade qemu-system-aarch64Upgrade qemu-system-sparcUpgrade qemu-systemUpgrade qemu-system-ppcUpgrade qemu-system-miscUpgrade qemu-system-armUpgrade qemu-system-x86 | Nov 8, 2024 | Nov 4, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub