A heap buffer overflow flaw was found in QEMU's Cirrus CLGD 54xx VGA emulator's VNC display driver support before 2.9; the issue could occur when a VNC client attempted to update its display after a VGA operation is performed by a guest. A privileged user/process inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade xen | Jul 27, 2018 | Jul 27, 2018 |
| Centos_linux | — | Upgrade qemu-imgUpgrade qemu-guest-agentUpgrade qemu-kvm-debuginfoUpgrade qemu-kvmUpgrade qemu-kvm-toolsUpgrade qemu-kvm-common | Apr 20, 2017 | Mar 14, 2017 |
| Debian | — | Upgrade xenUpgrade qemu-kvmUpgrade qemu | May 11, 2017 | Mar 14, 2017 |
| Freebsd | — | Upgrade xen-tools | Mar 23, 2017 | Mar 23, 2017 |
| Gentoo Linux | — | Upgrade app-emulation/qemu. | Oct 30, 2017 | Jun 6, 2017 |
| Huawei Euleros 2_0_sp1 | — | Upgrade qemu-img | Aug 28, 2019 | Jul 27, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade qemu-kvmUpgrade qemu-kvm-commonUpgrade qemu-img | Aug 28, 2019 | Jul 27, 2018 |
| Oracle_linux | — | Upgrade qemu-kvm-commonUpgrade qemu-guest-agentUpgrade qemu-kvmUpgrade qemu-imgUpgrade qemu-kvm-tools | Apr 18, 2017 | Mar 14, 2017 |
| Redhat_linux | — | Upgrade qemu-kvm-debuginfoUpgrade qemu-kvm-commonUpgrade qemu-imgUpgrade qemu-kvmUpgrade qemu-kvm-toolsNo solution existsUpgrade qemu-guest-agent | Apr 18, 2017 | Mar 14, 2017 |
| Suse | — | Upgrade xen-doc-htmlUpgrade xen-kmp-defaultUpgrade qemu-block-curlUpgrade qemu-seabiosUpgrade qemu-armUpgrade xen-libsUpgrade xen-kmp-paeUpgrade xen-tools-domUUpgrade qemu-s390Upgrade qemu-x86Upgrade qemuUpgrade qemu-toolsUpgrade qemu-block-sshUpgrade xen-toolsUpgrade xen-develUpgrade qemu-block-rbdUpgrade qemu-sgabiosUpgrade kvmUpgrade qemu-guest-agentUpgrade qemu-vgabiosUpgrade qemu-kvmUpgrade xen-libs-32bitUpgrade xen-doc-pdfUpgrade qemu-ppcUpgrade xenUpgrade qemu-langUpgrade qemu-ipxe | Apr 20, 2017 | Mar 14, 2017 |
| Ubuntu | — | Upgrade qemu-system-s390xUpgrade qemu-system-sparcUpgrade qemu-system-x86Upgrade qemu-system-ppcUpgrade qemu-system-mipsUpgrade qemu-system-miscUpgrade qemu-systemUpgrade qemu-system-aarch64Upgrade qemu-system-arm | Apr 21, 2017 | Mar 14, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub