Heap-based buffer overflow in the Cirrus VGA emulator (hw/display/cirrus_vga.c) in QEMU before 2.2.0 allows local guest users to execute arbitrary code via vectors related to blit regions. NOTE: this vulnerability exists because an incomplete fix for CVE-2007-1320.
CVSS Details
- CVSS 3.1 Base Score: 7.7
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade qemu | Aug 30, 2017 | Dec 8, 2014 |
| Centos_linux | — | Upgrade qemu-kvm-toolsUpgrade qemu-kvmUpgrade qemu-imgUpgrade qemu-guest-agent | Dec 1, 2016 | Dec 8, 2014 |
| Debian | — | Upgrade qemu-kvmUpgrade qemu | Jul 30, 2024 | Dec 8, 2014 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Feb 16, 2016 |
| Gentoo Linux | — | Upgrade app-emulation/qemu. | Oct 30, 2017 | Dec 8, 2014 |
| Oracle_linux | — | Upgrade qemu-guest-agentUpgrade qemu-kvm-toolsUpgrade qemu-kvm-commonUpgrade libcacard-develUpgrade libcacardUpgrade qemu-imgUpgrade qemu-kvmUpgrade libcacard-tools | Oct 16, 2024 | Dec 8, 2014 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Dec 4, 2014 |
| Suse | — | Upgrade libvirt-develUpgrade qemu-ksmUpgrade libvirt-client-32bitUpgrade qemu-microvmUpgrade qemu-audio-alsaUpgrade qemu-x86Upgrade qemu-hw-usb-redirectUpgrade qemu-kvmUpgrade qemu-ui-cursesUpgrade qemu-guest-agentUpgrade qemu-hw-display-virtio-gpu-pciUpgrade qemu-ui-spice-coreUpgrade qemu-s390Upgrade qemu-audio-paUpgrade qemu-ui-gtkUpgrade xen-kmp-paeUpgrade qemu-ppcUpgrade libvirt-clientUpgrade xen-tools-domUUpgrade qemu-chardev-baumUpgrade xenUpgrade qemu-block-curlUpgrade qemu-sgabiosUpgrade libvirt-devel-32bitUpgrade qemu-seabiosUpgrade qemu-block-iscsiUpgrade qemu-vgabiosUpgrade xen-doc-pdfUpgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade libvirt-docUpgrade libvirt-pythonUpgrade qemu-s390xUpgrade qemu-audio-spiceUpgrade qemu-ui-openglUpgrade qemu-block-sshUpgrade xen-libs-32bitUpgrade qemu-chardev-spiceUpgrade qemuUpgrade qemu-langUpgrade qemu-audio-ossUpgrade libvirt-lock-sanlockUpgrade qemu-armUpgrade xen-toolsUpgrade qemu-block-rbdUpgrade xen-doc-htmlUpgrade qemu-hw-display-virtio-vgaUpgrade qemu-ui-spice-appUpgrade xen-libsUpgrade qemu-skibootUpgrade qemu-hw-display-virtio-gpuUpgrade kvmUpgrade qemu-ipxeUpgrade libvirtUpgrade qemu-toolsUpgrade xen-develUpgrade qemu-hw-display-qxlUpgrade xen-kmp-default | Dec 18, 2015 | Dec 8, 2014 |
| Ubuntu | — | Upgrade qemu-system-mipsUpgrade qemu-kvmUpgrade qemu-system-miscUpgrade qemu-system-sparcUpgrade qemu-system-armUpgrade qemu-systemUpgrade qemu-system-ppcUpgrade qemu-system-aarch64Upgrade qemu-system-x86 | Nov 8, 2024 | Dec 8, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub