Heap-based buffer overflow in the IDE subsystem in QEMU, as used in Xen 4.5.x and earlier, when the container has a CDROM drive enabled, allows local guest users to execute arbitrary code on the host via unspecified ATAPI commands.
CVSS Details
- CVSS 3.1 Base Score: 8.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade xenUpgrade qemu | Aug 30, 2017 | Aug 12, 2015 |
| Centos_linux | — | Upgrade libcacard-toolsUpgrade libcacardUpgrade qemu-kvm-commonUpgrade libcacard-develUpgrade qemu-kvmUpgrade qemu-imgUpgrade qemu-kvm-tools | Dec 1, 2016 | Aug 12, 2015 |
| Debian | — | Upgrade xenUpgrade qemu | Jul 30, 2024 | Aug 12, 2015 |
| Freebsd | — | Upgrade qemuUpgrade qemu-develUpgrade xen-toolsUpgrade qemu-sbrunoUpgrade qemu-user-static | Dec 10, 2025 | Aug 4, 2015 |
| Gentoo Linux | — | Upgrade app-emulation/xen-tools.Upgrade app-emulation/xen-pvgrub.Upgrade app-emulation/pvgrub.Upgrade app-emulation/qemu.Upgrade app-emulation/xen. | Oct 30, 2017 | Aug 12, 2015 |
| Oracle_linux | — | Upgrade libcacard-develUpgrade libcacardUpgrade qemu-kvm-commonUpgrade libcacard-toolsUpgrade qemu-kvmUpgrade qemu-imgUpgrade qemu-kvm-tools | Oct 16, 2024 | Aug 12, 2015 |
| Suse | — | Upgrade qemu-kvmUpgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade qemu-block-curlUpgrade qemu-audio-alsaUpgrade qemu-sgabiosUpgrade qemu-vgabiosUpgrade qemu-ui-cursesUpgrade qemu-ui-gtkUpgrade xenUpgrade qemu-microvmUpgrade qemu-ppcUpgrade qemu-chardev-baumUpgrade qemu-toolsUpgrade qemu-s390Upgrade xen-doc-htmlUpgrade kvmUpgrade xen-kmp-traceUpgrade qemu-audio-paUpgrade qemu-x86Upgrade qemu-hw-usb-redirectUpgrade xen-tools-domUUpgrade qemu-audio-spiceUpgrade xen-tools-xendomains-wait-diskUpgrade xen-develUpgrade xen-libsUpgrade qemu-hw-display-qxlUpgrade qemu-guest-agentUpgrade qemu-seabiosUpgrade qemu-armUpgrade qemu-block-iscsiUpgrade qemu-ui-openglUpgrade qemu-ui-spice-appUpgrade qemu-chardev-spiceUpgrade qemu-hw-display-virtio-vgaUpgrade qemu-ksmUpgrade xen-kmp-defaultUpgrade qemu-hw-display-virtio-gpu-pciUpgrade xen-libs-32bitUpgrade qemu-block-rbdUpgrade qemu-audio-ossUpgrade xen-toolsUpgrade xen-kmp-paeUpgrade xen-doc-pdfUpgrade qemu-skibootUpgrade qemu-block-sshUpgrade qemu-ipxeUpgrade qemu-hw-display-virtio-gpuUpgrade qemuUpgrade qemu-s390xUpgrade qemu-ui-spice-coreUpgrade qemu-lang | Dec 18, 2015 | Jul 27, 2015 |
| Ubuntu | — | Upgrade qemu-system-ppcUpgrade qemu-systemUpgrade qemu-system-mipsUpgrade qemu-system-sparcUpgrade qemu-system-aarch64Upgrade qemu-system-armUpgrade qemu-system-x86Upgrade qemu-system-misc | Nov 8, 2024 | Aug 12, 2015 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub