RHSA-2017_1205

Vulnerability from csaf_redhat - Published: 2017-05-09 11:07 - Updated: 2024-11-22 10:39
Summary
Red Hat Security Advisory: qemu-kvm-rhev security update
Severity
Important
Notes
Topic: An update for qemu-kvm-rhev is now available for RHEV 3.X Hypervisor and Agents for RHEL-6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-rhev packages provide the user-space component for running virtual machines that use KVM in environments managed by Red Hat products. Security Fix(es): * A heap buffer overflow flaw was found in QEMU's Cirrus CLGD 54xx VGA emulator's VNC display driver support; the issue could occur when a VNC client attempted to update its display after a VGA operation is performed by a guest. A privileged user/process inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process. (CVE-2016-9603) * Quick Emulator (QEMU) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds r/w access issue. The vulnerability could occur while copying VGA data via various bitblt functions. A privileged user inside the guest could use this flaw to crash the QEMU process (DoS) or potentially execute arbitrary code on a host with privileges of the host's QEMU process. (CVE-2017-7980) * Quick Emulator (QEMU) built with the VNC display driver support is vulnerable to an out-of-bounds memory access issue. The vulnerability could occur while refreshing the VNC display surface area in the 'vnc_refresh_server_surface'. A user/process inside the guest could use this flaw to crash the QEMU process, resulting in a DoS. (CVE-2017-2633) * Quick Emulator (QEMU) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The vulnerability could occur while copying VGA data using bitblt functions (for example, cirrus_bitblt_rop_fwd_transp_). A privileged user inside a guest could use this flaw to crash the QEMU process, resulting in DoS. (CVE-2017-7718) Red Hat would like to thank Jiangxin (PSIRT Huawei Inc.) Li Qiang (Qihoo 360 Gear Team) for reporting CVE-2017-7980 and Jiangxin (PSIRT Huawei Inc.) for reporting CVE-2017-7718.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
CVE-2016-9603

A heap buffer overflow flaw was found in QEMU's Cirrus CLGD 54xx VGA emulator's VNC display driver support; the issue could occur when a VNC client attempted to update its display after a VGA operation is performed by a guest. A privileged user/process inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process.

5.5 (Medium)
CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L
CWE-122 - Heap-based Buffer Overflow
Affected products
Product Identifier Version Remediation
Unresolved product id: 6Server-RHEV-Agents:qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64 —
Vendor Fix fix
Unresolved product id: 6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src —
Vendor Fix fix
Unresolved product id: 6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64 —
Vendor Fix fix
Unresolved product id: 6Server-RHEV-Agents:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64 —
Vendor Fix fix
Unresolved product id: 6Server-RHEV-Agents:qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64 —
Vendor Fix fix
Threats
Impact Important
CVE-2017-2633

An out-of-bounds memory access issue was found in Quick Emulator (QEMU) in the VNC display driver. This flaw could occur while refreshing the VNC display surface area in the 'vnc_refresh_server_surface'. A user inside a guest could use this flaw to crash the QEMU process.

5.4 (Medium)
CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L
CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected products
Fixed 5 products, the same list as for CVE-2016-9603
Threats
Impact Moderate
CVE-2017-7718

An out-of-bounds access issue was found in QEMU's Cirrus CLGD 54xx VGA Emulator support. The vulnerability could occur while copying VGA data using bitblt functions (for example, cirrus_bitblt_rop_fwd_transp_). A privileged user inside a guest could use this flaw to crash the QEMU process, resulting in denial of service.

4.0 (Medium)
CVSS:3.0/AV:A/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:L
CWE-125 - Out-of-bounds Read
Affected products
Fixed 5 products, the same list as for CVE-2016-9603
Threats
Impact Moderate
CVE-2017-7980

An out-of-bounds r/w access issue was found in QEMU's Cirrus CLGD 54xx VGA Emulator support. The vulnerability could occur while copying VGA data via various bitblt functions. A privileged user inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process.

5.5 (Medium)
CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L
CWE-787 - Out-of-bounds Write
Affected products
Fixed 5 products, the same list as for CVE-2016-9603
Threats
Impact Important
References
Acknowledgments
PSIRT Huawei Inc. Jiangxin
Qihoo 360 Gear Team Li Qiang
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for qemu-kvm-rhev is now available for RHEV 3.X Hypervisor and Agents for RHEL-6.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-rhev packages provide the user-space component for running virtual machines that use KVM in environments managed by Red Hat products.\n\nSecurity Fix(es):\n\n* A heap buffer overflow flaw was found in QEMU\u0027s Cirrus CLGD 54xx VGA emulator\u0027s VNC display driver support; the issue could occur when a VNC client attempted to update its display after a VGA operation is performed by a guest. A privileged user/process inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process. (CVE-2016-9603)\n\n* Quick Emulator (QEMU) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds r/w access issue. The vulnerability could occur while copying VGA data via various bitblt functions. A privileged user inside the guest could use this flaw to crash the QEMU process (DoS) or potentially execute arbitrary code on a host with privileges of the host\u0027s QEMU process. (CVE-2017-7980)\n\n* Quick Emulator (QEMU) built with the VNC display driver support is vulnerable to an out-of-bounds memory access issue. The vulnerability could occur while refreshing the VNC display surface area in the \u0027vnc_refresh_server_surface\u0027. A user/process inside the guest could use this flaw to crash the QEMU process, resulting in a DoS. (CVE-2017-2633)\n\n* Quick Emulator (QEMU) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The vulnerability could occur while copying VGA data using bitblt functions (for example, cirrus_bitblt_rop_fwd_transp_). A privileged user inside a guest could use this flaw to crash the QEMU process, resulting in DoS. (CVE-2017-7718)\n\nRed Hat would like to thank Jiangxin (PSIRT Huawei Inc.) Li Qiang (Qihoo 360 Gear Team) for reporting CVE-2017-7980 and Jiangxin (PSIRT Huawei Inc.) for reporting CVE-2017-7718.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2017:1205",
        "url": "https://access.redhat.com/errata/RHSA-2017:1205"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "1425939",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1425939"
      },
      {
        "category": "external",
        "summary": "1430056",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1430056"
      },
      {
        "category": "external",
        "summary": "1443441",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1443441"
      },
      {
        "category": "external",
        "summary": "1444371",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1444371"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_1205.json"
      }
    ],
    "title": "Red Hat Security Advisory: qemu-kvm-rhev security update",
    "tracking": {
      "current_release_date": "2024-11-22T10:39:27+00:00",
      "generator": {
        "date": "2024-11-22T10:39:27+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2017:1205",
      "initial_release_date": "2017-05-09T11:07:02+00:00",
      "revision_history": [
        {
          "date": "2017-05-09T11:07:02+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2017-05-09T11:07:02+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-22T10:39:27+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "RHEV Agents (vdsm)",
                "product": {
                  "name": "RHEV Agents (vdsm)",
                  "product_id": "6Server-RHEV-Agents",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:enterprise_linux:6::hypervisor"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Virtualization"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
                "product": {
                  "name": "qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
                  "product_id": "qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/qemu-kvm-rhev@0.12.1.2-2.503.el6_9.3?arch=x86_64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
                "product": {
                  "name": "qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
                  "product_id": "qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/qemu-img-rhev@0.12.1.2-2.503.el6_9.3?arch=x86_64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
                "product": {
                  "name": "qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
                  "product_id": "qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/qemu-kvm-rhev-tools@0.12.1.2-2.503.el6_9.3?arch=x86_64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
                "product": {
                  "name": "qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
                  "product_id": "qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/qemu-kvm-rhev-debuginfo@0.12.1.2-2.503.el6_9.3?arch=x86_64\u0026epoch=2"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src",
                "product": {
                  "name": "qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src",
                  "product_id": "qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/qemu-kvm-rhev@0.12.1.2-2.503.el6_9.3?arch=src\u0026epoch=2"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64 as a component of RHEV Agents (vdsm)",
          "product_id": "6Server-RHEV-Agents:qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64"
        },
        "product_reference": "qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
        "relates_to_product_reference": "6Server-RHEV-Agents"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src as a component of RHEV Agents (vdsm)",
          "product_id": "6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src"
        },
        "product_reference": "qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src",
        "relates_to_product_reference": "6Server-RHEV-Agents"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64 as a component of RHEV Agents (vdsm)",
          "product_id": "6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64"
        },
        "product_reference": "qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
        "relates_to_product_reference": "6Server-RHEV-Agents"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64 as a component of RHEV Agents (vdsm)",
          "product_id": "6Server-RHEV-Agents:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64"
        },
        "product_reference": "qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
        "relates_to_product_reference": "6Server-RHEV-Agents"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64 as a component of RHEV Agents (vdsm)",
          "product_id": "6Server-RHEV-Agents:qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
        },
        "product_reference": "qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
        "relates_to_product_reference": "6Server-RHEV-Agents"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2016-9603",
      "cwe": {
        "id": "CWE-122",
        "name": "Heap-based Buffer Overflow"
      },
      "discovery_date": "2016-11-16T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1430056"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A heap buffer overflow flaw was found in QEMU\u0027s Cirrus CLGD 54xx VGA emulator\u0027s VNC display driver support; the issue could occur when a VNC client attempted to update its display after a VGA operation is performed by a guest. A privileged user/process inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Qemu: cirrus: heap buffer overflow via vnc connection",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-RHEV-Agents:qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
          "6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src",
          "6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
          "6Server-RHEV-Agents:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
          "6Server-RHEV-Agents:qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2016-9603"
        },
        {
          "category": "external",
          "summary": "RHBZ#1430056",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1430056"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2016-9603",
          "url": "https://www.cve.org/CVERecord?id=CVE-2016-9603"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-9603",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-9603"
        }
      ],
      "release_date": "2017-03-14T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2017-05-09T11:07:02+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
          "product_ids": [
            "6Server-RHEV-Agents:qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
            "6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src",
            "6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
            "6Server-RHEV-Agents:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
            "6Server-RHEV-Agents:qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2017:1205"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "ADJACENT_NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 4.9,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:A/AC:M/Au:S/C:P/I:P/A:P",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
            "version": "3.0"
          },
          "products": [
            "6Server-RHEV-Agents:qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
            "6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src",
            "6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
            "6Server-RHEV-Agents:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
            "6Server-RHEV-Agents:qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "Qemu: cirrus: heap buffer overflow via vnc connection"
    },
    {
      "cve": "CVE-2017-2633",
      "cwe": {
        "id": "CWE-120",
        "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
      },
      "discovery_date": "2016-12-01T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1425939"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "An out-of-bounds memory access issue was found in Quick Emulator (QEMU) in the VNC display driver. This flaw could occur while refreshing the VNC display surface area in the \u0027vnc_refresh_server_surface\u0027. A user inside a guest could use this flaw to crash the QEMU process.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Qemu: VNC: memory corruption due to unchecked resolution limit",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-RHEV-Agents:qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
          "6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src",
          "6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
          "6Server-RHEV-Agents:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
          "6Server-RHEV-Agents:qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2017-2633"
        },
        {
          "category": "external",
          "summary": "RHBZ#1425939",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1425939"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2017-2633",
          "url": "https://www.cve.org/CVERecord?id=CVE-2017-2633"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-2633",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-2633"
        }
      ],
      "release_date": "2016-12-01T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2017-05-09T11:07:02+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
          "product_ids": [
            "6Server-RHEV-Agents:qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
            "6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src",
            "6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
            "6Server-RHEV-Agents:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
            "6Server-RHEV-Agents:qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2017:1205"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "ADJACENT_NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 3.8,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:A/AC:M/Au:S/C:N/I:P/A:P",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L",
            "version": "3.0"
          },
          "products": [
            "6Server-RHEV-Agents:qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
            "6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src",
            "6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
            "6Server-RHEV-Agents:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
            "6Server-RHEV-Agents:qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "Qemu: VNC: memory corruption due to unchecked resolution limit"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Jiangxin"
          ],
          "organization": "PSIRT Huawei Inc."
        }
      ],
      "cve": "CVE-2017-7718",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2017-03-15T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1443441"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "An out-of-bounds access issue was found in QEMU\u0027s Cirrus CLGD 54xx VGA Emulator support. The vulnerability could occur while copying VGA data using bitblt functions (for example, cirrus_bitblt_rop_fwd_transp_). A privileged user inside a guest could use this flaw to crash the QEMU process, resulting in denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Qemu: display: cirrus: OOB read access issue",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-RHEV-Agents:qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
          "6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src",
          "6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
          "6Server-RHEV-Agents:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
          "6Server-RHEV-Agents:qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2017-7718"
        },
        {
          "category": "external",
          "summary": "RHBZ#1443441",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1443441"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2017-7718",
          "url": "https://www.cve.org/CVERecord?id=CVE-2017-7718"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-7718",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7718"
        }
      ],
      "release_date": "2017-03-14T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2017-05-09T11:07:02+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
          "product_ids": [
            "6Server-RHEV-Agents:qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
            "6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src",
            "6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
            "6Server-RHEV-Agents:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
            "6Server-RHEV-Agents:qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2017:1205"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "HIGH",
            "accessVector": "ADJACENT_NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 2.9,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:A/AC:H/Au:S/C:P/I:N/A:P",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.0,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:A/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:L",
            "version": "3.0"
          },
          "products": [
            "6Server-RHEV-Agents:qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
            "6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src",
            "6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
            "6Server-RHEV-Agents:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
            "6Server-RHEV-Agents:qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "Qemu: display: cirrus: OOB read access issue"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Jiangxin"
          ],
          "organization": "PSIRT Huawei Inc."
        },
        {
          "names": [
            "Li Qiang"
          ],
          "organization": "Qihoo 360 Gear Team"
        }
      ],
      "cve": "CVE-2017-7980",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2017-02-22T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1444371"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "An out-of-bounds r/w access issue was found in QEMU\u0027s Cirrus CLGD 54xx VGA Emulator support. The vulnerability could occur while copying VGA data via various bitblt functions. A privileged user inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Qemu: display: cirrus: OOB r/w access issues in bitblt routines",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-RHEV-Agents:qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
          "6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src",
          "6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
          "6Server-RHEV-Agents:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
          "6Server-RHEV-Agents:qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2017-7980"
        },
        {
          "category": "external",
          "summary": "RHBZ#1444371",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1444371"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2017-7980",
          "url": "https://www.cve.org/CVERecord?id=CVE-2017-7980"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-7980",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7980"
        }
      ],
      "release_date": "2017-03-15T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2017-05-09T11:07:02+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
          "product_ids": [
            "6Server-RHEV-Agents:qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
            "6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src",
            "6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
            "6Server-RHEV-Agents:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
            "6Server-RHEV-Agents:qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2017:1205"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "ADJACENT_NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 4.9,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:A/AC:M/Au:S/C:P/I:P/A:P",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
            "version": "3.0"
          },
          "products": [
            "6Server-RHEV-Agents:qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
            "6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src",
            "6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
            "6Server-RHEV-Agents:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
            "6Server-RHEV-Agents:qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "Qemu: display: cirrus: OOB r/w access issues in bitblt routines"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.