A heap buffer overflow flaw was found in QEMU's Cirrus CLGD 54xx VGA emulator's VNC display driver support before 2.9; the issue could occur when a VNC client attempted to update its display after a VGA operation is performed by a guest. A privileged user/process inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade xen | Jul 27, 2018 | Jul 27, 2018 |
| Centos_linux | — | Upgrade qemu-kvm-commonUpgrade qemu-kvm-toolsUpgrade qemu-kvmUpgrade qemu-guest-agentUpgrade qemu-imgUpgrade qemu-kvm-debuginfo | Apr 20, 2017 | Mar 14, 2017 |
| Debian | — | Upgrade xenUpgrade qemu-kvmUpgrade qemu | May 11, 2017 | Mar 14, 2017 |
| Freebsd | — | Upgrade xen-tools | Mar 23, 2017 | Mar 23, 2017 |
| Gentoo Linux | — | Upgrade app-emulation/qemu. | Oct 30, 2017 | Jun 6, 2017 |
| Huawei Euleros 2_0_sp1 | — | Upgrade qemu-img | Aug 28, 2019 | Jul 27, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade qemu-imgUpgrade qemu-kvmUpgrade qemu-kvm-common | Aug 28, 2019 | Jul 27, 2018 |
| Oracle_linux | — | Upgrade qemu-kvm-toolsUpgrade qemu-imgUpgrade qemu-kvmUpgrade qemu-guest-agentUpgrade qemu-kvm-common | Apr 18, 2017 | Mar 14, 2017 |
| Redhat_linux | — | Upgrade qemu-kvm-commonUpgrade qemu-kvm-debuginfoUpgrade qemu-imgUpgrade qemu-kvmUpgrade qemu-kvm-toolsNo solution existsUpgrade qemu-guest-agent | Apr 18, 2017 | Mar 14, 2017 |
| Suse | — | Upgrade qemu-toolsUpgrade xen-doc-pdfUpgrade xen-libs-32bitUpgrade qemu-kvmUpgrade qemu-ppcUpgrade qemu-vgabiosUpgrade qemu-guest-agentUpgrade xenUpgrade xen-toolsUpgrade qemu-ipxeUpgrade xen-develUpgrade qemu-langUpgrade qemu-sgabiosUpgrade qemu-block-sshUpgrade kvmUpgrade qemu-block-rbdUpgrade qemuUpgrade qemu-s390Upgrade qemu-seabiosUpgrade xen-doc-htmlUpgrade xen-kmp-paeUpgrade xen-tools-domUUpgrade xen-libsUpgrade qemu-armUpgrade xen-kmp-defaultUpgrade qemu-block-curlUpgrade qemu-x86 | Apr 20, 2017 | Mar 14, 2017 |
| Ubuntu | — | Upgrade qemu-system-s390xUpgrade qemu-system-x86Upgrade qemu-system-sparcUpgrade qemu-systemUpgrade qemu-system-mipsUpgrade qemu-system-miscUpgrade qemu-system-aarch64Upgrade qemu-system-ppcUpgrade qemu-system-arm | Apr 21, 2017 | Mar 14, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub