Integer signedness error in the NE2000 emulator in QEMU 0.8.2, as used in Xen and possibly other products, allows local users to trigger a heap-based buffer overflow via certain register values that bypass sanity checks, aka QEMU NE2000 "receive" integer signedness error. NOTE: this identifier was inadvertently used by some sources to cover multiple issues that were labeled "NE2000 network driver and the socket code," but separate identifiers have been created for the individual vulnerabilities since there are sometimes different fixes; see CVE-2007-5729 and CVE-2007-5730.
CVSS Details
- CVSS 3.1 Base Score: 7.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade qemu | Jul 30, 2024 | Oct 30, 2007 |
| Freebsd | — | Upgrade qemu-develUpgrade qemu | Dec 10, 2025 | May 1, 2007 |
| Oracle_linux | — | Upgrade xen-libsUpgrade xen-develUpgrade xen | Oct 16, 2024 | Oct 30, 2007 |
| Suse | — | Upgrade xen-libsUpgrade xen-develUpgrade xen-doc-pdfUpgrade xen-doc-htmlUpgrade xenUpgrade xen-tools-domUUpgrade xen-libs-32bitUpgrade xen-kmp-defaultUpgrade xen-kmp-paeUpgrade xen-tools | Aug 9, 2024 | Jun 28, 2013 |
| Ubuntu | — | Upgrade kvmUpgrade qemuUpgrade xen-3.1 | Nov 19, 2024 | Oct 30, 2007 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub