Vulnerability-Lookup

SUSE-SU-2017:2946-1

Vulnerability from csaf_suse - Published: 2017-11-08 07:48 - Updated: 2026-09-20 12:34

Summary

Security update for qemu

Severity

Important

Notes

Title of the patch: Security update for qemu

Description of the patch: This update for qemu fixes several issues. These security issues were fixed: - CVE-2017-10911: The make_response function in the Linux kernel allowed guest OS users to obtain sensitive information from host OS (or other guest OS) kernel memory by leveraging the copying of uninitialized padding fields in Xen block-interface response structures (bsc#1057378). - CVE-2017-12809: The IDE disk and CD/DVD-ROM Emulator support allowed local guest OS privileged users to cause a denial of service (NULL pointer dereference and QEMU process crash) by flushing an empty CDROM device drive (bsc#1054724). - CVE-2017-15289: The mode4and5 write functions allowed local OS guest privileged users to cause a denial of service (out-of-bounds write access and Qemu process crash) via vectors related to dst calculation (bsc#1063122) - CVE-2017-15038: Race condition in the v9fs_xattrwalk function local guest OS users to obtain sensitive information from host heap memory via vectors related to reading extended attributes (bsc#1062069) - CVE-2017-14167: Integer overflow in the load_multiboot function allowed local guest OS users to execute arbitrary code on the host via crafted multiboot header address values, which trigger an out-of-bounds write (bsc#1057585) - CVE-2017-11434: The dhcp_decode function in slirp/bootp.c allowed local guest OS users to cause a denial of service (out-of-bounds read) via a crafted DHCP options string (bsc#1049381) - CVE-2017-11334: The address_space_write_continue function allowed local guest OS privileged users to cause a denial of service (out-of-bounds access and guest instance crash) by leveraging use of qemu_map_ram_ptr to access guest ram block area (bsc#1048902) - CVE-2017-13672: The VGA display emulator support allowed local guest OS privileged users to cause a denial of service (out-of-bounds read and QEMU process crash) via vectors involving display update (bsc#1056334) - CVE-2017-5973: A infinite loop while doing control transfer in xhci_kick_epctx allowed privileged user inside the guest to crash the host process resulting in DoS (bsc#1025109) - CVE-2017-5987: The sdhci_sdma_transfer_multi_blocks function in hw/sd/sdhci.c allowed local OS guest privileged users to cause a denial of service (infinite loop and QEMU process crash) via vectors involving the transfer mode register during multi block transfer (bsc#1025311) - CVE-2017-6505: The ohci_service_ed_list function allowed local guest OS users to cause a denial of service (infinite loop) via vectors involving the number of link endpoint list descriptors (bsc#1028184) - CVE-2016-9603: A privileged user within the guest VM could have caused a heap overflow in the device model process, potentially escalating their privileges to that of the device model process (bsc#1028656) - CVE-2017-7718: hw/display/cirrus_vga_rop.h allowed local guest OS privileged users to cause a denial of service (out-of-bounds read and QEMU process crash) via vectors related to copying VGA data via the cirrus_bitblt_rop_fwd_transp_ and cirrus_bitblt_rop_fwd_ functions (bsc#1034908) - CVE-2017-7980: An out-of-bounds r/w access issues in the Cirrus CLGD 54xx VGA Emulator support allowed privileged user inside guest to use this flaw to crash the Qemu process resulting in DoS or potentially execute arbitrary code on a host with privileges of Qemu process on the host (bsc#1035406) - CVE-2017-8112: hw/scsi/vmw_pvscsi.c allowed local guest OS privileged users to cause a denial of service (infinite loop and CPU consumption) via the message ring page count (bsc#1036211) - CVE-2017-9375: The USB xHCI controller emulator support was vulnerable to an infinite recursive call loop issue, which allowed a privileged user inside guest to crash the Qemu process resulting in DoS (bsc#1042800) - CVE-2017-9374: Missing free of 's->ipacket', causes a host memory leak, allowing for DoS (bsc#1043073) - CVE-2017-9373: The IDE AHCI Emulation support was vulnerable to a host memory leakage issue, which allowed a privileged user inside guest to leak host memory resulting in DoS (bsc#1042801) - CVE-2017-9330: USB OHCI Emulation in qemu allowed local guest OS users to cause a denial of service (infinite loop) by leveraging an incorrect return value (bsc#1042159) - CVE-2017-8379: Memory leak in the keyboard input event handlers support allowed local guest OS privileged users to cause a denial of service (host memory consumption) by rapidly generating large keyboard events (bsc#1037334) - CVE-2017-8309: Memory leak in the audio/audio.c allowed remote attackers to cause a denial of service (memory consumption) by repeatedly starting and stopping audio capture (bsc#1037242) - CVE-2017-8380: The MegaRAID SAS 8708EM2 Host Bus Adapter emulation support was vulnerable to an out-of-bounds read access issue which allowed a privileged user inside guest to read host memory resulting in DoS (bsc#1037336) - CVE-2017-7493: The VirtFS, host directory sharing via Plan 9 File System(9pfs) support, was vulnerable to an improper access control issue. It could occur while accessing virtfs metadata files in mapped-file security mode. A guest user could have used this flaw to escalate their privileges inside guest (bsc#1039495) - CVE-2016-9602: The VirtFS host directory sharing via Plan 9 File System(9pfs) support was vulnerable to an improper link following issue which allowed a privileged user inside guest to access host file system beyond the shared folder and potentially escalating their privileges on a host (bsc#1020427) - CVE-2017-5579: The 16550A UART serial device emulation support was vulnerable to a memory leakage issue allowing a privileged user to cause a DoS and/or potentially crash the Qemu process on the host (bsc#1021741) - CVE-2017-9503: The MegaRAID SAS 8708EM2 Host Bus Adapter emulation support was vulnerable to a null pointer dereference issue which allowed a privileged user inside guest to crash the Qemu process on the host resulting in DoS (bsc#1043296) - CVE-2017-10664: qemu-nbd did not ignore SIGPIPE, which allowed remote attackers to cause a denial of service (daemon crash) by disconnecting during a server-to-client reply attempt (bsc#1046636) - CVE-2017-10806: Stack-based buffer overflow allowed local guest OS users to cause a denial of service (QEMU process crash) via vectors related to logging debug messages (bsc#1047674) - CVE-2016-9602: The VirtFS host directory sharing via Plan 9 File System(9pfs) support was vulnerable to an improper link following issue which allowed a privileged user inside guest to access host file system beyond the shared folder and potentially escalating their privileges on a host (bsc#1020427) - CVE-2017-7377: The v9fs_create and v9fs_lcreate functions in hw/9pfs/9p.c allowed local guest OS privileged users to cause a denial of service (file descriptor or memory consumption) via vectors related to an already in-use fid (bsc#1032075) - CVE-2017-8086: A memory leak in the v9fs_list_xattr function in hw/9pfs/9p-xattr.c allowed local guest OS privileged users to cause a denial of service (memory consumption) via vectors involving the orig_value variable (bsc#1035950) - CVE-2017-7471: The VirtFS host directory sharing via Plan 9 File System(9pfs) support was vulnerable to an improper access control issue which allowed a privileged user inside guest to access host file system beyond the shared folder and potentially escalating their privileges on a host (bsc#1034866) - CVE-2016-6835: Buffer overflow in the VMWARE VMXNET3 NIC device support, causing an OOB read access (bsc#994605) - CVE-2016-6834: A infinite loop during packet fragmentation in the VMWARE VMXNET3 NIC device support allowed privileged user inside guest to crash the Qemu instance resulting in DoS (bsc#994418) - Fix privilege escalation in TCG mode (bsc#1030624) This non-security issue was fixed: - Fix regression introduced by recent virtfs security fixes (bsc#1045035)

Patchnames: SUSE-OpenStack-Cloud-6-2017-1827,SUSE-SLE-SAP-12-SP1-2017-1827,SUSE-SLE-SERVER-12-SP1-2017-1827

CVE-2016-6834

4.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 105 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise High Performance Computing 12 SP1:qemu-0:2.3.1-33.3.3.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise High Performance Computing 12 SP1:qemu-0:2.3.1-33.3.3.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise High Performance Computing 12 SP1:qemu-0:2.3.1-33.3.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise High Performance Computing 12 SP1:qemu-block-curl-0:2.3.1-33.3.3.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise High Performance Computing 12 SP1:qemu-block-curl-0:2.3.1-33.3.3.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise High Performance Computing 12 SP1:qemu-block-curl-0:2.3.1-33.3.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise High Performance Computing 12 SP1:qemu-block-rbd-0:2.3.1-33.3.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise High Performance Computing 12 SP1:qemu-guest-agent-0:2.3.1-33.3.3.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise High Performance Computing 12 SP1:qemu-guest-agent-0:2.3.1-33.3.3.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise High Performance Computing 12 SP1:qemu-guest-agent-0:2.3.1-33.3.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise High Performance Computing 12 SP1:qemu-ipxe-0:1.0.0-33.3.3.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise High Performance Computing 12 SP1:qemu-kvm-0:2.3.1-33.3.3.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise High Performance Computing 12 SP1:qemu-kvm-0:2.3.1-33.3.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise High Performance Computing 12 SP1:qemu-lang-0:2.3.1-33.3.3.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise High Performance Computing 12 SP1:qemu-lang-0:2.3.1-33.3.3.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise High Performance Computing 12 SP1:qemu-lang-0:2.3.1-33.3.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise High Performance Computing 12 SP1:qemu-ppc-0:2.3.1-33.3.3.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise High Performance Computing 12 SP1:qemu-s390-0:2.3.1-33.3.3.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise High Performance Computing 12 SP1:qemu-seabios-0:1.8.1-33.3.3.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise High Performance Computing 12 SP1:qemu-sgabios-0:8-33.3.3.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise High Performance Computing 12 SP1:qemu-tools-0:2.3.1-33.3.3.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise High Performance Computing 12 SP1:qemu-tools-0:2.3.1-33.3.3.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise High Performance Computing 12 SP1:qemu-tools-0:2.3.1-33.3.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise High Performance Computing 12 SP1:qemu-vgabios-0:1.8.1-33.3.3.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise High Performance Computing 12 SP1:qemu-x86-0:2.3.1-33.3.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-0:2.3.1-33.3.3.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-0:2.3.1-33.3.3.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-0:2.3.1-33.3.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-block-curl-0:2.3.1-33.3.3.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-block-curl-0:2.3.1-33.3.3.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-block-curl-0:2.3.1-33.3.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-block-rbd-0:2.3.1-33.3.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-guest-agent-0:2.3.1-33.3.3.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-guest-agent-0:2.3.1-33.3.3.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-guest-agent-0:2.3.1-33.3.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-ipxe-0:1.0.0-33.3.3.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-kvm-0:2.3.1-33.3.3.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-kvm-0:2.3.1-33.3.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-lang-0:2.3.1-33.3.3.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-lang-0:2.3.1-33.3.3.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-lang-0:2.3.1-33.3.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-ppc-0:2.3.1-33.3.3.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-s390-0:2.3.1-33.3.3.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-seabios-0:1.8.1-33.3.3.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-sgabios-0:8-33.3.3.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-tools-0:2.3.1-33.3.3.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-tools-0:2.3.1-33.3.3.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-tools-0:2.3.1-33.3.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-vgabios-0:1.8.1-33.3.3.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP1-LTSS:qemu-x86-0:2.3.1-33.3.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP1:qemu-0:2.3.1-33.3.3.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP1:qemu-0:2.3.1-33.3.3.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP1:qemu-0:2.3.1-33.3.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP1:qemu-block-curl-0:2.3.1-33.3.3.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP1:qemu-block-curl-0:2.3.1-33.3.3.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP1:qemu-block-curl-0:2.3.1-33.3.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP1:qemu-block-rbd-0:2.3.1-33.3.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP1:qemu-guest-agent-0:2.3.1-33.3.3.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP1:qemu-guest-agent-0:2.3.1-33.3.3.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP1:qemu-guest-agent-0:2.3.1-33.3.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP1:qemu-ipxe-0:1.0.0-33.3.3.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP1:qemu-kvm-0:2.3.1-33.3.3.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP1:qemu-kvm-0:2.3.1-33.3.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP1:qemu-lang-0:2.3.1-33.3.3.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP1:qemu-lang-0:2.3.1-33.3.3.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP1:qemu-lang-0:2.3.1-33.3.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP1:qemu-ppc-0:2.3.1-33.3.3.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP1:qemu-s390-0:2.3.1-33.3.3.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP1:qemu-seabios-0:1.8.1-33.3.3.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP1:qemu-sgabios-0:8-33.3.3.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP1:qemu-tools-0:2.3.1-33.3.3.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP1:qemu-tools-0:2.3.1-33.3.3.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP1:qemu-tools-0:2.3.1-33.3.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP1:qemu-vgabios-0:1.8.1-33.3.3.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP1:qemu-x86-0:2.3.1-33.3.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-0:2.3.1-33.3.3.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-0:2.3.1-33.3.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-block-curl-0:2.3.1-33.3.3.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-block-curl-0:2.3.1-33.3.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-block-rbd-0:2.3.1-33.3.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-guest-agent-0:2.3.1-33.3.3.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-guest-agent-0:2.3.1-33.3.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-ipxe-0:1.0.0-33.3.3.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-kvm-0:2.3.1-33.3.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-lang-0:2.3.1-33.3.3.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-lang-0:2.3.1-33.3.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-ppc-0:2.3.1-33.3.3.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-seabios-0:1.8.1-33.3.3.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-sgabios-0:8-33.3.3.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-tools-0:2.3.1-33.3.3.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-tools-0:2.3.1-33.3.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-vgabios-0:1.8.1-33.3.3.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP1:qemu-x86-0:2.3.1-33.3.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE OpenStack Cloud 6:qemu-0:2.3.1-33.3.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE OpenStack Cloud 6:qemu-block-curl-0:2.3.1-33.3.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE OpenStack Cloud 6:qemu-block-rbd-0:2.3.1-33.3.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE OpenStack Cloud 6:qemu-guest-agent-0:2.3.1-33.3.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE OpenStack Cloud 6:qemu-ipxe-0:1.0.0-33.3.3.noarch	—	Vendor Fix
Unresolved product id: SUSE OpenStack Cloud 6:qemu-kvm-0:2.3.1-33.3.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE OpenStack Cloud 6:qemu-lang-0:2.3.1-33.3.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE OpenStack Cloud 6:qemu-seabios-0:1.8.1-33.3.3.noarch	—	Vendor Fix
Unresolved product id: SUSE OpenStack Cloud 6:qemu-sgabios-0:8-33.3.3.noarch	—	Vendor Fix
Unresolved product id: SUSE OpenStack Cloud 6:qemu-tools-0:2.3.1-33.3.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE OpenStack Cloud 6:qemu-vgabios-0:1.8.1-33.3.3.noarch	—	Vendor Fix
Unresolved product id: SUSE OpenStack Cloud 6:qemu-x86-0:2.3.1-33.3.3.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2016-6835

6 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H

Affected products

Recommended 105 products, the same list as for CVE-2016-6834

Threats

Impact moderate

CVE-2016-9602

8.8 (High)


                
                  CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 105 products, the same list as for CVE-2016-6834

Threats

Impact moderate

CVE-2016-9603

9.9 (Critical)


                
                  CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected products

Recommended 105 products, the same list as for CVE-2016-6834

Threats

Impact low

CVE-2017-10664

5.3 (Medium)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected products

Recommended 105 products, the same list as for CVE-2016-6834

Threats

Impact moderate

CVE-2017-10806

5.9 (Medium)


                
                  CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H

Affected products

Recommended 105 products, the same list as for CVE-2016-6834

Threats

Impact moderate

CVE-2017-10911

4.3 (Medium)


                
                  CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Affected products

Recommended 105 products, the same list as for CVE-2016-6834

Threats

Impact moderate

CVE-2017-11334

6.2 (Medium)


                
                  CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 105 products, the same list as for CVE-2016-6834

Threats

Impact moderate

CVE-2017-11434

8.6 (High)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Affected products

Recommended 105 products, the same list as for CVE-2016-6834

Threats

Impact low

CVE-2017-12809

5.5 (Medium)


                
                  CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 105 products, the same list as for CVE-2016-6834

Threats

Impact moderate

CVE-2017-13672

3 (Low)


                
                  CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L

Affected products

Recommended 105 products, the same list as for CVE-2016-6834

Threats

Impact low

CVE-2017-14167

4 (Medium)


                
                  CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

Affected products

Recommended 105 products, the same list as for CVE-2016-6834

Threats

Impact low

CVE-2017-15038

3 (Low)


                
                  CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N

Affected products

Recommended 105 products, the same list as for CVE-2016-6834

Threats

Impact low

CVE-2017-15289

6 (Medium)


                
                  CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H

Affected products

Recommended 105 products, the same list as for CVE-2016-6834

Threats

Impact low

CVE-2017-5579

6.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Affected products

Recommended 105 products, the same list as for CVE-2016-6834

Threats

Impact low

CVE-2017-5973

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 105 products, the same list as for CVE-2016-6834

Threats

Impact moderate

CVE-2017-5987

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 105 products, the same list as for CVE-2016-6834

Threats

Impact low

CVE-2017-6505

6.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Affected products

Recommended 105 products, the same list as for CVE-2016-6834

Threats

Impact moderate

CVE-2017-7377

6 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H

Affected products

Recommended 105 products, the same list as for CVE-2016-6834

Threats

Impact moderate

CVE-2017-7471

9 (Critical)


                
                  CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected products

Recommended 105 products, the same list as for CVE-2016-6834

Threats

Impact moderate

CVE-2017-7493

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 105 products, the same list as for CVE-2016-6834

Threats

Impact important

CVE-2017-7718

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 105 products, the same list as for CVE-2016-6834

Threats

Impact moderate

CVE-2017-7980

5.5 (Medium)


                
                  CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L

Affected products

Recommended 105 products, the same list as for CVE-2016-6834

Threats

Impact moderate

CVE-2017-8086

6.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Affected products

Recommended 105 products, the same list as for CVE-2016-6834

Threats

Impact moderate

CVE-2017-8112

6.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Affected products

Recommended 105 products, the same list as for CVE-2016-6834

Threats

Impact low

CVE-2017-8309

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 105 products, the same list as for CVE-2016-6834

Threats

Impact low

CVE-2017-8379

6.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Affected products

Recommended 105 products, the same list as for CVE-2016-6834

Threats

Impact low

CVE-2017-8380

9.8 (Critical)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 105 products, the same list as for CVE-2016-6834

Threats

Impact low

CVE-2017-9330

3.8 (Low)


                
                  CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L

Affected products

Recommended 105 products, the same list as for CVE-2016-6834

Threats

Impact low

CVE-2017-9373

3.8 (Low)


                
                  CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L

Affected products

Recommended 105 products, the same list as for CVE-2016-6834

Threats

Impact low

CVE-2017-9374

3.8 (Low)


                
                  CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L

Affected products

Recommended 105 products, the same list as for CVE-2016-6834

Threats

Impact low

CVE-2017-9375

3.8 (Low)


                
                  CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L

Affected products

Recommended 105 products, the same list as for CVE-2016-6834

Threats

Impact low

CVE-2017-9503

3.8 (Low)


                
                  CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L

Affected products

Recommended 105 products, the same list as for CVE-2016-6834

Threats

Impact low

References

171 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/s…	self
https://www.suse.com/support/update/announcement/…	self
https://lists.suse.com/pipermail/sle-security-upd…	self
https://bugzilla.suse.com/1020427	self
https://bugzilla.suse.com/1021741	self
https://bugzilla.suse.com/1025109	self
https://bugzilla.suse.com/1025311	self
https://bugzilla.suse.com/1028184	self
https://bugzilla.suse.com/1028656	self
https://bugzilla.suse.com/1030624	self
https://bugzilla.suse.com/1032075	self
https://bugzilla.suse.com/1034866	self
https://bugzilla.suse.com/1034908	self
https://bugzilla.suse.com/1035406	self
https://bugzilla.suse.com/1035950	self
https://bugzilla.suse.com/1036211	self
https://bugzilla.suse.com/1037242	self
https://bugzilla.suse.com/1037334	self
https://bugzilla.suse.com/1037336	self
https://bugzilla.suse.com/1039495	self
https://bugzilla.suse.com/1042159	self
https://bugzilla.suse.com/1042800	self
https://bugzilla.suse.com/1042801	self
https://bugzilla.suse.com/1043073	self
https://bugzilla.suse.com/1043296	self
https://bugzilla.suse.com/1045035	self
https://bugzilla.suse.com/1046636	self
https://bugzilla.suse.com/1047674	self
https://bugzilla.suse.com/1048902	self
https://bugzilla.suse.com/1049381	self
https://bugzilla.suse.com/1054724	self
https://bugzilla.suse.com/1056334	self
https://bugzilla.suse.com/1057378	self
https://bugzilla.suse.com/1057585	self
https://bugzilla.suse.com/1062069	self
https://bugzilla.suse.com/1063122	self
https://bugzilla.suse.com/994418	self
https://bugzilla.suse.com/994605	self
https://www.suse.com/security/cve/CVE-2016-6834/	self
https://www.suse.com/security/cve/CVE-2016-6835/	self
https://www.suse.com/security/cve/CVE-2016-9602/	self
https://www.suse.com/security/cve/CVE-2016-9603/	self
https://www.suse.com/security/cve/CVE-2017-10664/	self
https://www.suse.com/security/cve/CVE-2017-10806/	self
https://www.suse.com/security/cve/CVE-2017-10911/	self
https://www.suse.com/security/cve/CVE-2017-11334/	self
https://www.suse.com/security/cve/CVE-2017-11434/	self
https://www.suse.com/security/cve/CVE-2017-12809/	self
https://www.suse.com/security/cve/CVE-2017-13672/	self
https://www.suse.com/security/cve/CVE-2017-14167/	self
https://www.suse.com/security/cve/CVE-2017-15038/	self
https://www.suse.com/security/cve/CVE-2017-15289/	self
https://www.suse.com/security/cve/CVE-2017-5579/	self
https://www.suse.com/security/cve/CVE-2017-5973/	self
https://www.suse.com/security/cve/CVE-2017-5987/	self
https://www.suse.com/security/cve/CVE-2017-6505/	self
https://www.suse.com/security/cve/CVE-2017-7377/	self
https://www.suse.com/security/cve/CVE-2017-7471/	self
https://www.suse.com/security/cve/CVE-2017-7493/	self
https://www.suse.com/security/cve/CVE-2017-7718/	self
https://www.suse.com/security/cve/CVE-2017-7980/	self
https://www.suse.com/security/cve/CVE-2017-8086/	self
https://www.suse.com/security/cve/CVE-2017-8112/	self
https://www.suse.com/security/cve/CVE-2017-8309/	self
https://www.suse.com/security/cve/CVE-2017-8379/	self
https://www.suse.com/security/cve/CVE-2017-8380/	self
https://www.suse.com/security/cve/CVE-2017-9330/	self
https://www.suse.com/security/cve/CVE-2017-9373/	self
https://www.suse.com/security/cve/CVE-2017-9374/	self
https://www.suse.com/security/cve/CVE-2017-9375/	self
https://www.suse.com/security/cve/CVE-2017-9503/	self
https://www.suse.com/security/cve/CVE-2016-6834	external
https://bugzilla.suse.com/994418	external
https://bugzilla.suse.com/994421	external
https://www.suse.com/security/cve/CVE-2016-6835	external
https://bugzilla.suse.com/994605	external
https://bugzilla.suse.com/994625	external
https://www.suse.com/security/cve/CVE-2016-9602	external
https://bugzilla.suse.com/1020427	external
https://www.suse.com/security/cve/CVE-2016-9603	external
https://bugzilla.suse.com/1028655	external
https://bugzilla.suse.com/1028656	external
https://bugzilla.suse.com/1178658	external
https://www.suse.com/security/cve/CVE-2017-10664	external
https://bugzilla.suse.com/1046636	external
https://bugzilla.suse.com/1046637	external
https://bugzilla.suse.com/1178658	external
https://www.suse.com/security/cve/CVE-2017-10806	external
https://bugzilla.suse.com/1047674	external
https://bugzilla.suse.com/1047675	external
https://www.suse.com/security/cve/CVE-2017-10911	external
https://bugzilla.suse.com/1042863	external
https://bugzilla.suse.com/1043330	external
https://bugzilla.suse.com/1057378	external
https://www.suse.com/security/cve/CVE-2017-11334	external
https://bugzilla.suse.com/1048902	external
https://bugzilla.suse.com/1048920	external
https://www.suse.com/security/cve/CVE-2017-11434	external
https://bugzilla.suse.com/1049381	external
https://bugzilla.suse.com/1049578	external
https://bugzilla.suse.com/1178658	external
https://www.suse.com/security/cve/CVE-2017-12809	external
https://bugzilla.suse.com/1054724	external
https://www.suse.com/security/cve/CVE-2017-13672	external
https://bugzilla.suse.com/1056334	external
https://bugzilla.suse.com/1056336	external
https://bugzilla.suse.com/1084604	external
https://www.suse.com/security/cve/CVE-2017-14167	external
https://bugzilla.suse.com/1057585	external
https://www.suse.com/security/cve/CVE-2017-15038	external
https://bugzilla.suse.com/1062069	external
https://www.suse.com/security/cve/CVE-2017-15289	external
https://bugzilla.suse.com/1063122	external
https://bugzilla.suse.com/1063123	external
https://bugzilla.suse.com/1178658	external
https://www.suse.com/security/cve/CVE-2017-5579	external
https://bugzilla.suse.com/1021741	external
https://bugzilla.suse.com/1022627	external
https://www.suse.com/security/cve/CVE-2017-5973	external
https://bugzilla.suse.com/1025109	external
https://bugzilla.suse.com/1025188	external
https://www.suse.com/security/cve/CVE-2017-5987	external
https://bugzilla.suse.com/1025311	external
https://www.suse.com/security/cve/CVE-2017-6505	external
https://bugzilla.suse.com/1028184	external
https://bugzilla.suse.com/1028235	external
https://bugzilla.suse.com/1178658	external
https://www.suse.com/security/cve/CVE-2017-7377	external
https://bugzilla.suse.com/1032075	external
https://www.suse.com/security/cve/CVE-2017-7471	external
https://bugzilla.suse.com/1034866	external
https://bugzilla.suse.com/1034990	external
https://www.suse.com/security/cve/CVE-2017-7493	external
https://bugzilla.suse.com/1039495	external
https://www.suse.com/security/cve/CVE-2017-7718	external
https://bugzilla.suse.com/1034908	external
https://bugzilla.suse.com/1034994	external
https://bugzilla.suse.com/1178658	external
https://www.suse.com/security/cve/CVE-2017-7980	external
https://bugzilla.suse.com/1035406	external
https://bugzilla.suse.com/1035483	external
https://www.suse.com/security/cve/CVE-2017-8086	external
https://bugzilla.suse.com/1035950	external
https://www.suse.com/security/cve/CVE-2017-8112	external
https://bugzilla.suse.com/1036211	external
https://bugzilla.suse.com/1036470	external
https://www.suse.com/security/cve/CVE-2017-8309	external
https://bugzilla.suse.com/1037242	external
https://bugzilla.suse.com/1037243	external
https://bugzilla.suse.com/1178658	external
https://www.suse.com/security/cve/CVE-2017-8379	external
https://bugzilla.suse.com/1037334	external
https://www.suse.com/security/cve/CVE-2017-8380	external
https://bugzilla.suse.com/1037336	external
https://www.suse.com/security/cve/CVE-2017-9330	external
https://bugzilla.suse.com/1042159	external
https://bugzilla.suse.com/1042160	external
https://bugzilla.suse.com/1043157	external
https://bugzilla.suse.com/1178658	external
https://www.suse.com/security/cve/CVE-2017-9373	external
https://bugzilla.suse.com/1042801	external
https://www.suse.com/security/cve/CVE-2017-9374	external
https://bugzilla.suse.com/1043073	external
https://bugzilla.suse.com/1043074	external
https://www.suse.com/security/cve/CVE-2017-9375	external
https://bugzilla.suse.com/1042800	external
https://www.suse.com/security/cve/CVE-2017-9503	external
https://bugzilla.suse.com/1043296	external
https://bugzilla.suse.com/1043297	external
https://bugzilla.suse.com/1043312	external

JSON

To clipboard

Loading 1.1 MB of JSON…

CVE-2016-6834 (GCVE-0-2016-6834)

Vulnerability from cvelistv5 – Published: 2016-12-10 00:00 – Updated: 2024-08-06 01:43

Summary

The net_tx_pkt_do_sw_fragmentation function in hw/net/net_tx_pkt.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via a zero length for the current fragment length.

Severity

No CVSS data available.

CWE

Assigner

redhat redhat root Scorecard

References

7 references

URL	Tags
http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=ea…	x_refsource_CONFIRM
http://www.securityfocus.com/bid/92446	vdb-entryx_refsource_BID
https://security.gentoo.org/glsa/201609-01	vendor-advisoryx_refsource_GENTOO
http://www.openwall.com/lists/oss-security/2016/08/18/7	mailing-listx_refsource_MLIST
https://lists.gnu.org/archive/html/qemu-devel/201…	mailing-listx_refsource_MLIST
http://www.openwall.com/lists/oss-security/2016/08/11/8	mailing-listx_refsource_MLIST
https://lists.debian.org/debian-lts-announce/2018…	mailing-listx_refsource_MLIST

Date Public

2016-08-09 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T01:43:37.903Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=ead315e43ea0c2ca3491209c6c8db8ce3f2bbe05"
          },
          {
            "name": "92446",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/92446"
          },
          {
            "name": "GLSA-201609-01",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201609-01"
          },
          {
            "name": "[oss-security] 20160817 Re: CVE request Qemu: an infinite loop during packet fragmentation",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2016/08/18/7"
          },
          {
            "name": "[qemu-devel] 20160809 [PULL 1/3] net: check fragment length during fragmentation",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.gnu.org/archive/html/qemu-devel/2016-08/msg01601.html"
          },
          {
            "name": "[oss-security] 20160812 CVE request Qemu: an infinite loop during packet fragmentation",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2016/08/11/8"
          },
          {
            "name": "[debian-lts-announce] 20181130 [SECURITY] [DLA 1599-1] qemu security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2016-08-09T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The net_tx_pkt_do_sw_fragmentation function in hw/net/net_tx_pkt.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via a zero length for the current fragment length."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-12-01T10:57:01.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=ead315e43ea0c2ca3491209c6c8db8ce3f2bbe05"
        },
        {
          "name": "92446",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/92446"
        },
        {
          "name": "GLSA-201609-01",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201609-01"
        },
        {
          "name": "[oss-security] 20160817 Re: CVE request Qemu: an infinite loop during packet fragmentation",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2016/08/18/7"
        },
        {
          "name": "[qemu-devel] 20160809 [PULL 1/3] net: check fragment length during fragmentation",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.gnu.org/archive/html/qemu-devel/2016-08/msg01601.html"
        },
        {
          "name": "[oss-security] 20160812 CVE request Qemu: an infinite loop during packet fragmentation",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2016/08/11/8"
        },
        {
          "name": "[debian-lts-announce] 20181130 [SECURITY] [DLA 1599-1] qemu security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2016-6834",
    "datePublished": "2016-12-10T00:00:00.000Z",
    "dateReserved": "2016-08-17T00:00:00.000Z",
    "dateUpdated": "2024-08-06T01:43:37.903Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2016-6835 (GCVE-0-2016-6835)

Vulnerability from cvelistv5 – Published: 2016-12-10 00:00 – Updated: 2024-08-06 01:43

Summary

The vmxnet_tx_pkt_parse_headers function in hw/net/vmxnet_tx_pkt.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (buffer over-read) by leveraging failure to check IP header length.

Severity

No CVSS data available.

CWE

Assigner

redhat redhat root Scorecard

References

6 references

URL	Tags
https://lists.gnu.org/archive/html/qemu-stable/20…	mailing-listx_refsource_MLIST
https://lists.debian.org/debian-lts-announce/2018…	mailing-listx_refsource_MLIST
http://www.openwall.com/lists/oss-security/2016/08/11/7	mailing-listx_refsource_MLIST
http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=93…	x_refsource_CONFIRM
http://www.openwall.com/lists/oss-security/2016/08/18/4	mailing-listx_refsource_MLIST
https://access.redhat.com/errata/RHSA-2017:2392	vendor-advisoryx_refsource_REDHAT

Date Public

2016-08-10 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T01:43:37.918Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "[qemu-devel] 20160810 Re: [PATCH] net: vmxnet: check IP header length",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.gnu.org/archive/html/qemu-stable/2016-08/msg00077.html"
          },
          {
            "name": "[debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html"
          },
          {
            "name": "[oss-security] 20160812 CVE request Qemu: buffer overflow in vmxnet_tx_pkt_parse_headers() in vmxnet3 device emulation",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2016/08/11/7"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=93060258ae748573ca7197204125a2670047896d"
          },
          {
            "name": "[oss-security] 20160817 Re: CVE request Qemu: buffer overflow in vmxnet_tx_pkt_parse_headers() in vmxnet3 device emulation",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2016/08/18/4"
          },
          {
            "name": "RHSA-2017:2392",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:2392"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2016-08-10T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The vmxnet_tx_pkt_parse_headers function in hw/net/vmxnet_tx_pkt.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (buffer over-read) by leveraging failure to check IP header length."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-09-07T09:57:01.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "[qemu-devel] 20160810 Re: [PATCH] net: vmxnet: check IP header length",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.gnu.org/archive/html/qemu-stable/2016-08/msg00077.html"
        },
        {
          "name": "[debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html"
        },
        {
          "name": "[oss-security] 20160812 CVE request Qemu: buffer overflow in vmxnet_tx_pkt_parse_headers() in vmxnet3 device emulation",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2016/08/11/7"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=93060258ae748573ca7197204125a2670047896d"
        },
        {
          "name": "[oss-security] 20160817 Re: CVE request Qemu: buffer overflow in vmxnet_tx_pkt_parse_headers() in vmxnet3 device emulation",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2016/08/18/4"
        },
        {
          "name": "RHSA-2017:2392",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:2392"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2016-6835",
    "datePublished": "2016-12-10T00:00:00.000Z",
    "dateReserved": "2016-08-17T00:00:00.000Z",
    "dateUpdated": "2024-08-06T01:43:37.918Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2016-9602 (GCVE-0-2016-9602)

Vulnerability from cvelistv5 – Published: 2018-04-26 19:00 – Updated: 2024-08-06 02:59

Summary

Qemu before version 2.9 is vulnerable to an improper link following when built with the VirtFS. A privileged user inside guest could use this flaw to access host file system beyond the shared folder and potentially escalating their privileges on a host.

Severity

7.6 (High)


                        
                          CVSS:3.0/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

CWE

CWE-59

Assigner

redhat redhat root Scorecard

References

8 references

URL	Tags
https://lists.gnu.org/archive/html/qemu-devel/201…	mailing-listx_refsource_MLIST
http://www.securitytracker.com/id/1037604	vdb-entryx_refsource_SECTRACK
https://lists.debian.org/debian-lts-announce/2018…	mailing-listx_refsource_MLIST
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2…	x_refsource_CONFIRM
http://www.openwall.com/lists/oss-security/2017/0…	mailing-listx_refsource_MLIST
https://lists.gnu.org/archive/html/qemu-devel/201…	mailing-listx_refsource_MLIST
https://security.gentoo.org/glsa/201704-01	vendor-advisoryx_refsource_GENTOO
http://www.securityfocus.com/bid/95461	vdb-entryx_refsource_BID

Impacted products

1 product

Vendor	Product	Version
unspecified	Qemu	Affected: qemu 2.9

Date Public

2017-01-17 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T02:59:03.165Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "[qemu-devel] 20170220 [PATCH 00/29] 9pfs: local: fix vulnerability to symlink attacks",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.gnu.org/archive/html/qemu-devel/2017-02/msg04347.html"
          },
          {
            "name": "1037604",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1037604"
          },
          {
            "name": "[debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9602"
          },
          {
            "name": "[oss-security] 20170117 CVE-2016-9602 Qemu: 9p: virtfs allows guest to access host filesystem",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2017/01/17/12"
          },
          {
            "name": "[qemu-devel] 20170130 [PATCH RFC 00/36] 9pfs: local: fix vulnerability to symlink attacks",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.gnu.org/archive/html/qemu-devel/2017-01/msg06225.html"
          },
          {
            "name": "GLSA-201704-01",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201704-01"
          },
          {
            "name": "95461",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/95461"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Qemu",
          "vendor": "unspecified",
          "versions": [
            {
              "status": "affected",
              "version": "qemu 2.9"
            }
          ]
        }
      ],
      "datePublic": "2017-01-17T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Qemu before version 2.9 is vulnerable to an improper link following when built with the VirtFS. A privileged user inside guest could use this flaw to access host file system beyond the shared folder and potentially escalating their privileges on a host."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "HIGH",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "CWE-59",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-09-07T09:57:01.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "[qemu-devel] 20170220 [PATCH 00/29] 9pfs: local: fix vulnerability to symlink attacks",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.gnu.org/archive/html/qemu-devel/2017-02/msg04347.html"
        },
        {
          "name": "1037604",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1037604"
        },
        {
          "name": "[debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9602"
        },
        {
          "name": "[oss-security] 20170117 CVE-2016-9602 Qemu: 9p: virtfs allows guest to access host filesystem",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2017/01/17/12"
        },
        {
          "name": "[qemu-devel] 20170130 [PATCH RFC 00/36] 9pfs: local: fix vulnerability to symlink attacks",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.gnu.org/archive/html/qemu-devel/2017-01/msg06225.html"
        },
        {
          "name": "GLSA-201704-01",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201704-01"
        },
        {
          "name": "95461",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/95461"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2016-9602",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Qemu",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "qemu 2.9"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": ""
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Qemu before version 2.9 is vulnerable to an improper link following when built with the VirtFS. A privileged user inside guest could use this flaw to access host file system beyond the shared folder and potentially escalating their privileges on a host."
            }
          ]
        },
        "impact": {
          "cvss": [
            [
              {
                "vectorString": "7.6/CVSS:3.0/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
                "version": "3.0"
              }
            ],
            [
              {
                "vectorString": "6.5/AV:A/AC:H/Au:S/C:C/I:C/A:C",
                "version": "2.0"
              }
            ]
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-59"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "[qemu-devel] 20170220 [PATCH 00/29] 9pfs: local: fix vulnerability to symlink attacks",
              "refsource": "MLIST",
              "url": "https://lists.gnu.org/archive/html/qemu-devel/2017-02/msg04347.html"
            },
            {
              "name": "1037604",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1037604"
            },
            {
              "name": "[debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9602",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9602"
            },
            {
              "name": "[oss-security] 20170117 CVE-2016-9602 Qemu: 9p: virtfs allows guest to access host filesystem",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2017/01/17/12"
            },
            {
              "name": "[qemu-devel] 20170130 [PATCH RFC 00/36] 9pfs: local: fix vulnerability to symlink attacks",
              "refsource": "MLIST",
              "url": "https://lists.gnu.org/archive/html/qemu-devel/2017-01/msg06225.html"
            },
            {
              "name": "GLSA-201704-01",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201704-01"
            },
            {
              "name": "95461",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/95461"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2016-9602",
    "datePublished": "2018-04-26T19:00:00.000Z",
    "dateReserved": "2016-11-23T00:00:00.000Z",
    "dateUpdated": "2024-08-06T02:59:03.165Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2016-9603 (GCVE-0-2016-9603)

Vulnerability from cvelistv5 – Published: 2018-07-27 21:00 – Updated: 2024-08-06 02:59

Summary

A heap buffer overflow flaw was found in QEMU's Cirrus CLGD 54xx VGA emulator's VNC display driver support before 2.9; the issue could occur when a VNC client attempted to update its display after a VGA operation is performed by a guest. A privileged user/process inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process.

Severity

5.5 (Medium)


                        
                          CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L

CWE

CWE-122

Assigner

redhat redhat root Scorecard

References

18 references

URL	Tags
http://www.securityfocus.com/bid/96893	vdb-entryx_refsource_BID
https://access.redhat.com/errata/RHSA-2017:0983	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2017:0982	vendor-advisoryx_refsource_REDHAT
https://lists.debian.org/debian-lts-announce/2018…	mailing-listx_refsource_MLIST
https://security.gentoo.org/glsa/201706-03	vendor-advisoryx_refsource_GENTOO
https://access.redhat.com/errata/RHSA-2017:1206	vendor-advisoryx_refsource_REDHAT
http://www.securitytracker.com/id/1038023	vdb-entryx_refsource_SECTRACK
https://support.citrix.com/article/CTX221578	x_refsource_CONFIRM
https://access.redhat.com/errata/RHSA-2017:0985	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2017:0987	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2017:0984	vendor-advisoryx_refsource_REDHAT
https://lists.debian.org/debian-lts-announce/2018…	mailing-listx_refsource_MLIST
https://access.redhat.com/errata/RHSA-2017:0988	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2017:1441	vendor-advisoryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2…	x_refsource_CONFIRM
https://access.redhat.com/errata/RHSA-2017:0981	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2017:0980	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2017:1205	vendor-advisoryx_refsource_REDHAT

Impacted products

1 product

Vendor	Product	Version
QEMU	Qemu:	Affected: 2.9

Date Public

2017-03-07 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T02:59:02.448Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "96893",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/96893"
          },
          {
            "name": "RHSA-2017:0983",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:0983"
          },
          {
            "name": "RHSA-2017:0982",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:0982"
          },
          {
            "name": "[debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html"
          },
          {
            "name": "GLSA-201706-03",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201706-03"
          },
          {
            "name": "RHSA-2017:1206",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:1206"
          },
          {
            "name": "1038023",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1038023"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://support.citrix.com/article/CTX221578"
          },
          {
            "name": "RHSA-2017:0985",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:0985"
          },
          {
            "name": "RHSA-2017:0987",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:0987"
          },
          {
            "name": "RHSA-2017:0984",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:0984"
          },
          {
            "name": "[debian-lts-announce] 20180206 [SECURITY] [DLA 1270-1] xen security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/02/msg00005.html"
          },
          {
            "name": "RHSA-2017:0988",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:0988"
          },
          {
            "name": "RHSA-2017:1441",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:1441"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9603"
          },
          {
            "name": "RHSA-2017:0981",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:0981"
          },
          {
            "name": "RHSA-2017:0980",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:0980"
          },
          {
            "name": "RHSA-2017:1205",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:1205"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Qemu:",
          "vendor": "QEMU",
          "versions": [
            {
              "status": "affected",
              "version": "2.9"
            }
          ]
        }
      ],
      "datePublic": "2017-03-07T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A heap buffer overflow flaw was found in QEMU\u0027s Cirrus CLGD 54xx VGA emulator\u0027s VNC display driver support before 2.9; the issue could occur when a VNC client attempted to update its display after a VGA operation is performed by a guest. A privileged user/process inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "HIGH",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "CWE-122",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-09-07T09:57:01.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "96893",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/96893"
        },
        {
          "name": "RHSA-2017:0983",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:0983"
        },
        {
          "name": "RHSA-2017:0982",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:0982"
        },
        {
          "name": "[debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html"
        },
        {
          "name": "GLSA-201706-03",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201706-03"
        },
        {
          "name": "RHSA-2017:1206",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:1206"
        },
        {
          "name": "1038023",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1038023"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://support.citrix.com/article/CTX221578"
        },
        {
          "name": "RHSA-2017:0985",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:0985"
        },
        {
          "name": "RHSA-2017:0987",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:0987"
        },
        {
          "name": "RHSA-2017:0984",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:0984"
        },
        {
          "name": "[debian-lts-announce] 20180206 [SECURITY] [DLA 1270-1] xen security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/02/msg00005.html"
        },
        {
          "name": "RHSA-2017:0988",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:0988"
        },
        {
          "name": "RHSA-2017:1441",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:1441"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9603"
        },
        {
          "name": "RHSA-2017:0981",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:0981"
        },
        {
          "name": "RHSA-2017:0980",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:0980"
        },
        {
          "name": "RHSA-2017:1205",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:1205"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2016-9603",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Qemu:",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "2.9"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "QEMU"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A heap buffer overflow flaw was found in QEMU\u0027s Cirrus CLGD 54xx VGA emulator\u0027s VNC display driver support before 2.9; the issue could occur when a VNC client attempted to update its display after a VGA operation is performed by a guest. A privileged user/process inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process."
            }
          ]
        },
        "impact": {
          "cvss": [
            [
              {
                "vectorString": "5.5/CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
                "version": "3.0"
              }
            ],
            [
              {
                "vectorString": "4.9/AV:A/AC:M/Au:S/C:P/I:P/A:P",
                "version": "2.0"
              }
            ]
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-122"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "96893",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/96893"
            },
            {
              "name": "RHSA-2017:0983",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:0983"
            },
            {
              "name": "RHSA-2017:0982",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:0982"
            },
            {
              "name": "[debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html"
            },
            {
              "name": "GLSA-201706-03",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201706-03"
            },
            {
              "name": "RHSA-2017:1206",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:1206"
            },
            {
              "name": "1038023",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1038023"
            },
            {
              "name": "https://support.citrix.com/article/CTX221578",
              "refsource": "CONFIRM",
              "url": "https://support.citrix.com/article/CTX221578"
            },
            {
              "name": "RHSA-2017:0985",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:0985"
            },
            {
              "name": "RHSA-2017:0987",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:0987"
            },
            {
              "name": "RHSA-2017:0984",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:0984"
            },
            {
              "name": "[debian-lts-announce] 20180206 [SECURITY] [DLA 1270-1] xen security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/02/msg00005.html"
            },
            {
              "name": "RHSA-2017:0988",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:0988"
            },
            {
              "name": "RHSA-2017:1441",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:1441"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9603",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9603"
            },
            {
              "name": "RHSA-2017:0981",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:0981"
            },
            {
              "name": "RHSA-2017:0980",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:0980"
            },
            {
              "name": "RHSA-2017:1205",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:1205"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2016-9603",
    "datePublished": "2018-07-27T21:00:00.000Z",
    "dateReserved": "2016-11-23T00:00:00.000Z",
    "dateUpdated": "2024-08-06T02:59:02.448Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2017-10664 (GCVE-0-2017-10664)

Vulnerability from cvelistv5 – Published: 2017-08-02 19:00 – Updated: 2024-08-05 17:41

Summary

qemu-nbd in QEMU (aka Quick Emulator) does not ignore SIGPIPE, which allows remote attackers to cause a denial of service (daemon crash) by disconnecting during a server-to-client reply attempt.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root Scorecard

References

14 references

URL	Tags
http://www.debian.org/security/2017/dsa-3920	vendor-advisoryx_refsource_DEBIAN
https://access.redhat.com/errata/RHSA-2017:2445	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2017:3473	vendor-advisoryx_refsource_REDHAT
http://www.securityfocus.com/bid/99513	vdb-entryx_refsource_BID
https://lists.gnu.org/archive/html/qemu-devel/201…	mailing-listx_refsource_MLIST
https://access.redhat.com/errata/RHSA-2017:3470	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2017:3472	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2017:3474	vendor-advisoryx_refsource_REDHAT
http://www.openwall.com/lists/oss-security/2017/06/29/1	mailing-listx_refsource_MLIST
https://access.redhat.com/errata/RHSA-2017:3471	vendor-advisoryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=1466190	x_refsource_MISC
https://access.redhat.com/errata/RHSA-2017:3466	vendor-advisoryx_refsource_REDHAT
https://lists.debian.org/debian-lts-announce/2018…	mailing-listx_refsource_MLIST
https://access.redhat.com/errata/RHSA-2017:2390	vendor-advisoryx_refsource_REDHAT

Date Public

2017-06-11 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T17:41:55.608Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "DSA-3920",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2017/dsa-3920"
          },
          {
            "name": "RHSA-2017:2445",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:2445"
          },
          {
            "name": "RHSA-2017:3473",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:3473"
          },
          {
            "name": "99513",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/99513"
          },
          {
            "name": "[qemu-devel] 20170611 [PATCH] qemu-nbd: Ignore SIGPIPE",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.gnu.org/archive/html/qemu-devel/2017-06/msg02693.html"
          },
          {
            "name": "RHSA-2017:3470",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:3470"
          },
          {
            "name": "RHSA-2017:3472",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:3472"
          },
          {
            "name": "RHSA-2017:3474",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:3474"
          },
          {
            "name": "[oss-security] 20170629 CVE-2017-10664 Qemu: qemu-nbd: server breaks with SIGPIPE upon client abort",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2017/06/29/1"
          },
          {
            "name": "RHSA-2017:3471",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:3471"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1466190"
          },
          {
            "name": "RHSA-2017:3466",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:3466"
          },
          {
            "name": "[debian-lts-announce] 20181130 [SECURITY] [DLA 1599-1] qemu security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html"
          },
          {
            "name": "RHSA-2017:2390",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:2390"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2017-06-11T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "qemu-nbd in QEMU (aka Quick Emulator) does not ignore SIGPIPE, which allows remote attackers to cause a denial of service (daemon crash) by disconnecting during a server-to-client reply attempt."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-12-01T10:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "DSA-3920",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2017/dsa-3920"
        },
        {
          "name": "RHSA-2017:2445",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:2445"
        },
        {
          "name": "RHSA-2017:3473",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:3473"
        },
        {
          "name": "99513",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/99513"
        },
        {
          "name": "[qemu-devel] 20170611 [PATCH] qemu-nbd: Ignore SIGPIPE",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.gnu.org/archive/html/qemu-devel/2017-06/msg02693.html"
        },
        {
          "name": "RHSA-2017:3470",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:3470"
        },
        {
          "name": "RHSA-2017:3472",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:3472"
        },
        {
          "name": "RHSA-2017:3474",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:3474"
        },
        {
          "name": "[oss-security] 20170629 CVE-2017-10664 Qemu: qemu-nbd: server breaks with SIGPIPE upon client abort",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2017/06/29/1"
        },
        {
          "name": "RHSA-2017:3471",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:3471"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1466190"
        },
        {
          "name": "RHSA-2017:3466",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:3466"
        },
        {
          "name": "[debian-lts-announce] 20181130 [SECURITY] [DLA 1599-1] qemu security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html"
        },
        {
          "name": "RHSA-2017:2390",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:2390"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2017-10664",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "qemu-nbd in QEMU (aka Quick Emulator) does not ignore SIGPIPE, which allows remote attackers to cause a denial of service (daemon crash) by disconnecting during a server-to-client reply attempt."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "DSA-3920",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2017/dsa-3920"
            },
            {
              "name": "RHSA-2017:2445",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:2445"
            },
            {
              "name": "RHSA-2017:3473",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:3473"
            },
            {
              "name": "99513",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/99513"
            },
            {
              "name": "[qemu-devel] 20170611 [PATCH] qemu-nbd: Ignore SIGPIPE",
              "refsource": "MLIST",
              "url": "https://lists.gnu.org/archive/html/qemu-devel/2017-06/msg02693.html"
            },
            {
              "name": "RHSA-2017:3470",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:3470"
            },
            {
              "name": "RHSA-2017:3472",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:3472"
            },
            {
              "name": "RHSA-2017:3474",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:3474"
            },
            {
              "name": "[oss-security] 20170629 CVE-2017-10664 Qemu: qemu-nbd: server breaks with SIGPIPE upon client abort",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2017/06/29/1"
            },
            {
              "name": "RHSA-2017:3471",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:3471"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1466190",
              "refsource": "MISC",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1466190"
            },
            {
              "name": "RHSA-2017:3466",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:3466"
            },
            {
              "name": "[debian-lts-announce] 20181130 [SECURITY] [DLA 1599-1] qemu security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html"
            },
            {
              "name": "RHSA-2017:2390",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:2390"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2017-10664",
    "datePublished": "2017-08-02T19:00:00.000Z",
    "dateReserved": "2017-06-28T00:00:00.000Z",
    "dateUpdated": "2024-08-05T17:41:55.608Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2017-10806 (GCVE-0-2017-10806)

Vulnerability from cvelistv5 – Published: 2017-08-02 19:00 – Updated: 2024-08-05 17:50

Summary

Stack-based buffer overflow in hw/usb/redirect.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (QEMU process crash) via vectors related to logging debug messages.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root Scorecard

References

6 references

URL	Tags
https://lists.debian.org/debian-lts-announce/2018…	mailing-listx_refsource_MLIST
https://bugzilla.redhat.com/show_bug.cgi?id=1468496	x_refsource_CONFIRM
http://www.securityfocus.com/bid/99475	vdb-entryx_refsource_BID
http://www.openwall.com/lists/oss-security/2017/07/07/1	mailing-listx_refsource_MLIST
https://lists.nongnu.org/archive/html/qemu-devel/…	mailing-listx_refsource_MLIST
http://www.debian.org/security/2017/dsa-3925	vendor-advisoryx_refsource_DEBIAN

Date Public

2017-05-12 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T17:50:12.077Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "[debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1468496"
          },
          {
            "name": "99475",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/99475"
          },
          {
            "name": "[oss-security] 20170707 CVE-2017-10806 Qemu: usb-redirect: stack buffer overflow in debug logging",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2017/07/07/1"
          },
          {
            "name": "[qemu-devel] 20170512 [PULL 2/6] usb-redir: fix stack overflow in usbredir_log_data",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.nongnu.org/archive/html/qemu-devel/2017-05/msg03087.html"
          },
          {
            "name": "DSA-3925",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2017/dsa-3925"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2017-05-12T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Stack-based buffer overflow in hw/usb/redirect.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (QEMU process crash) via vectors related to logging debug messages."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-09-07T09:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "[debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1468496"
        },
        {
          "name": "99475",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/99475"
        },
        {
          "name": "[oss-security] 20170707 CVE-2017-10806 Qemu: usb-redirect: stack buffer overflow in debug logging",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2017/07/07/1"
        },
        {
          "name": "[qemu-devel] 20170512 [PULL 2/6] usb-redir: fix stack overflow in usbredir_log_data",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.nongnu.org/archive/html/qemu-devel/2017-05/msg03087.html"
        },
        {
          "name": "DSA-3925",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2017/dsa-3925"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2017-10806",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Stack-based buffer overflow in hw/usb/redirect.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (QEMU process crash) via vectors related to logging debug messages."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "[debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1468496",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1468496"
            },
            {
              "name": "99475",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/99475"
            },
            {
              "name": "[oss-security] 20170707 CVE-2017-10806 Qemu: usb-redirect: stack buffer overflow in debug logging",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2017/07/07/1"
            },
            {
              "name": "[qemu-devel] 20170512 [PULL 2/6] usb-redir: fix stack overflow in usbredir_log_data",
              "refsource": "MLIST",
              "url": "https://lists.nongnu.org/archive/html/qemu-devel/2017-05/msg03087.html"
            },
            {
              "name": "DSA-3925",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2017/dsa-3925"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2017-10806",
    "datePublished": "2017-08-02T19:00:00.000Z",
    "dateReserved": "2017-07-03T00:00:00.000Z",
    "dateUpdated": "2024-08-05T17:50:12.077Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2017-10911 (GCVE-0-2017-10911)

Vulnerability from cvelistv5 – Published: 2017-07-05 01:00 – Updated: 2024-08-05 17:50

Summary

The make_response function in drivers/block/xen-blkback/blkback.c in the Linux kernel before 4.11.8 allows guest OS users to obtain sensitive information from host OS (or other guest OS) kernel memory by leveraging the copying of uninitialized padding fields in Xen block-interface response structures, aka XSA-216.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root Scorecard

References

11 references

URL	Tags
https://xenbits.xen.org/xsa/advisory-216.html	x_refsource_CONFIRM
http://www.debian.org/security/2017/dsa-3927	vendor-advisoryx_refsource_DEBIAN
http://git.kernel.org/cgit/linux/kernel/git/torva…	x_refsource_CONFIRM
http://www.debian.org/security/2017/dsa-3920	vendor-advisoryx_refsource_DEBIAN
https://lists.debian.org/debian-lts-announce/2018…	mailing-listx_refsource_MLIST
https://security.gentoo.org/glsa/201708-03	vendor-advisoryx_refsource_GENTOO
http://www.kernel.org/pub/linux/kernel/v4.x/Chang…	x_refsource_CONFIRM
http://www.securityfocus.com/bid/99162	vdb-entryx_refsource_BID
http://www.securitytracker.com/id/1038720	vdb-entryx_refsource_SECTRACK
https://github.com/torvalds/linux/commit/089bc014…	x_refsource_CONFIRM
http://www.debian.org/security/2017/dsa-3945	vendor-advisoryx_refsource_DEBIAN

Date Public

2017-07-04 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T17:50:12.586Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://xenbits.xen.org/xsa/advisory-216.html"
          },
          {
            "name": "DSA-3927",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2017/dsa-3927"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=089bc0143f489bd3a4578bdff5f4ca68fb26f341"
          },
          {
            "name": "DSA-3920",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2017/dsa-3920"
          },
          {
            "name": "[debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html"
          },
          {
            "name": "GLSA-201708-03",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201708-03"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.11.8"
          },
          {
            "name": "99162",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/99162"
          },
          {
            "name": "1038720",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1038720"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/torvalds/linux/commit/089bc0143f489bd3a4578bdff5f4ca68fb26f341"
          },
          {
            "name": "DSA-3945",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2017/dsa-3945"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2017-07-04T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The make_response function in drivers/block/xen-blkback/blkback.c in the Linux kernel before 4.11.8 allows guest OS users to obtain sensitive information from host OS (or other guest OS) kernel memory by leveraging the copying of uninitialized padding fields in Xen block-interface response structures, aka XSA-216."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-09-07T09:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://xenbits.xen.org/xsa/advisory-216.html"
        },
        {
          "name": "DSA-3927",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2017/dsa-3927"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=089bc0143f489bd3a4578bdff5f4ca68fb26f341"
        },
        {
          "name": "DSA-3920",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2017/dsa-3920"
        },
        {
          "name": "[debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html"
        },
        {
          "name": "GLSA-201708-03",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201708-03"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.11.8"
        },
        {
          "name": "99162",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/99162"
        },
        {
          "name": "1038720",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1038720"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/torvalds/linux/commit/089bc0143f489bd3a4578bdff5f4ca68fb26f341"
        },
        {
          "name": "DSA-3945",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2017/dsa-3945"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2017-10911",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The make_response function in drivers/block/xen-blkback/blkback.c in the Linux kernel before 4.11.8 allows guest OS users to obtain sensitive information from host OS (or other guest OS) kernel memory by leveraging the copying of uninitialized padding fields in Xen block-interface response structures, aka XSA-216."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://xenbits.xen.org/xsa/advisory-216.html",
              "refsource": "CONFIRM",
              "url": "https://xenbits.xen.org/xsa/advisory-216.html"
            },
            {
              "name": "DSA-3927",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2017/dsa-3927"
            },
            {
              "name": "http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=089bc0143f489bd3a4578bdff5f4ca68fb26f341",
              "refsource": "CONFIRM",
              "url": "http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=089bc0143f489bd3a4578bdff5f4ca68fb26f341"
            },
            {
              "name": "DSA-3920",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2017/dsa-3920"
            },
            {
              "name": "[debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html"
            },
            {
              "name": "GLSA-201708-03",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201708-03"
            },
            {
              "name": "http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.11.8",
              "refsource": "CONFIRM",
              "url": "http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.11.8"
            },
            {
              "name": "99162",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/99162"
            },
            {
              "name": "1038720",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1038720"
            },
            {
              "name": "https://github.com/torvalds/linux/commit/089bc0143f489bd3a4578bdff5f4ca68fb26f341",
              "refsource": "CONFIRM",
              "url": "https://github.com/torvalds/linux/commit/089bc0143f489bd3a4578bdff5f4ca68fb26f341"
            },
            {
              "name": "DSA-3945",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2017/dsa-3945"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2017-10911",
    "datePublished": "2017-07-05T01:00:00.000Z",
    "dateReserved": "2017-07-04T00:00:00.000Z",
    "dateUpdated": "2024-08-05T17:50:12.586Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2017-11334 (GCVE-0-2017-11334)

Vulnerability from cvelistv5 – Published: 2017-08-02 19:00 – Updated: 2024-08-05 18:05

Summary

The address_space_write_continue function in exec.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (out-of-bounds access and guest instance crash) by leveraging use of qemu_map_ram_ptr to access guest ram block area.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root Scorecard

References

13 references

URL	Tags
https://access.redhat.com/errata/RHSA-2017:3473	vendor-advisoryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=1471638	x_refsource_CONFIRM
https://access.redhat.com/errata/RHSA-2017:3470	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2017:3472	vendor-advisoryx_refsource_REDHAT
http://www.openwall.com/lists/oss-security/2017/07/17/4	mailing-listx_refsource_MLIST
https://lists.gnu.org/archive/html/qemu-devel/201…	mailing-listx_refsource_MLIST
https://access.redhat.com/errata/RHSA-2017:3474	vendor-advisoryx_refsource_REDHAT
https://usn.ubuntu.com/3575-1/	vendor-advisoryx_refsource_UBUNTU
https://access.redhat.com/errata/RHSA-2017:3471	vendor-advisoryx_refsource_REDHAT
http://www.securityfocus.com/bid/99895	vdb-entryx_refsource_BID
https://access.redhat.com/errata/RHSA-2017:3466	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2017:3369	vendor-advisoryx_refsource_REDHAT
http://www.debian.org/security/2017/dsa-3925	vendor-advisoryx_refsource_DEBIAN

Date Public

2017-07-13 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T18:05:30.599Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "RHSA-2017:3473",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:3473"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1471638"
          },
          {
            "name": "RHSA-2017:3470",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:3470"
          },
          {
            "name": "RHSA-2017:3472",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:3472"
          },
          {
            "name": "[oss-security] 20170717 CVE-2017-11334 Qemu: exec: oob access during dma operation",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2017/07/17/4"
          },
          {
            "name": "[qemu-devel] 20170713 [PULL 21/41] exec: use qemu_ram_ptr_length to access guest ram",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.gnu.org/archive/html/qemu-devel/2017-07/msg03775.html"
          },
          {
            "name": "RHSA-2017:3474",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:3474"
          },
          {
            "name": "USN-3575-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3575-1/"
          },
          {
            "name": "RHSA-2017:3471",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:3471"
          },
          {
            "name": "99895",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/99895"
          },
          {
            "name": "RHSA-2017:3466",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:3466"
          },
          {
            "name": "RHSA-2017:3369",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:3369"
          },
          {
            "name": "DSA-3925",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2017/dsa-3925"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2017-07-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The address_space_write_continue function in exec.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (out-of-bounds access and guest instance crash) by leveraging use of qemu_map_ram_ptr to access guest ram block area."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-03-15T09:57:02.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "RHSA-2017:3473",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:3473"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1471638"
        },
        {
          "name": "RHSA-2017:3470",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:3470"
        },
        {
          "name": "RHSA-2017:3472",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:3472"
        },
        {
          "name": "[oss-security] 20170717 CVE-2017-11334 Qemu: exec: oob access during dma operation",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2017/07/17/4"
        },
        {
          "name": "[qemu-devel] 20170713 [PULL 21/41] exec: use qemu_ram_ptr_length to access guest ram",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.gnu.org/archive/html/qemu-devel/2017-07/msg03775.html"
        },
        {
          "name": "RHSA-2017:3474",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:3474"
        },
        {
          "name": "USN-3575-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3575-1/"
        },
        {
          "name": "RHSA-2017:3471",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:3471"
        },
        {
          "name": "99895",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/99895"
        },
        {
          "name": "RHSA-2017:3466",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:3466"
        },
        {
          "name": "RHSA-2017:3369",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:3369"
        },
        {
          "name": "DSA-3925",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2017/dsa-3925"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2017-11334",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The address_space_write_continue function in exec.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (out-of-bounds access and guest instance crash) by leveraging use of qemu_map_ram_ptr to access guest ram block area."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "RHSA-2017:3473",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:3473"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1471638",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1471638"
            },
            {
              "name": "RHSA-2017:3470",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:3470"
            },
            {
              "name": "RHSA-2017:3472",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:3472"
            },
            {
              "name": "[oss-security] 20170717 CVE-2017-11334 Qemu: exec: oob access during dma operation",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2017/07/17/4"
            },
            {
              "name": "[qemu-devel] 20170713 [PULL 21/41] exec: use qemu_ram_ptr_length to access guest ram",
              "refsource": "MLIST",
              "url": "https://lists.gnu.org/archive/html/qemu-devel/2017-07/msg03775.html"
            },
            {
              "name": "RHSA-2017:3474",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:3474"
            },
            {
              "name": "USN-3575-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/3575-1/"
            },
            {
              "name": "RHSA-2017:3471",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:3471"
            },
            {
              "name": "99895",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/99895"
            },
            {
              "name": "RHSA-2017:3466",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:3466"
            },
            {
              "name": "RHSA-2017:3369",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:3369"
            },
            {
              "name": "DSA-3925",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2017/dsa-3925"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2017-11334",
    "datePublished": "2017-08-02T19:00:00.000Z",
    "dateReserved": "2017-07-14T00:00:00.000Z",
    "dateUpdated": "2024-08-05T18:05:30.599Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2017-11434 (GCVE-0-2017-11434)

Vulnerability from cvelistv5 – Published: 2017-07-25 18:00 – Updated: 2024-08-05 18:12

Summary

The dhcp_decode function in slirp/bootp.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (out-of-bounds read and QEMU process crash) via a crafted DHCP options string.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root Scorecard

References

6 references

URL	Tags
https://lists.debian.org/debian-lts-announce/2018…	mailing-listx_refsource_MLIST
http://www.securityfocus.com/bid/99923	vdb-entryx_refsource_BID
https://lists.gnu.org/archive/html/qemu-devel/201…	mailing-listx_refsource_MLIST
https://bugzilla.redhat.com/show_bug.cgi?id=1472611	x_refsource_CONFIRM
http://www.openwall.com/lists/oss-security/2017/07/19/2	mailing-listx_refsource_MLIST
http://www.debian.org/security/2017/dsa-3925	vendor-advisoryx_refsource_DEBIAN

Date Public

2017-07-17 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T18:12:39.858Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "[debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html"
          },
          {
            "name": "99923",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/99923"
          },
          {
            "name": "[qemu-devel] 20170717 [PATCH] slirp: check len against dhcp options array end",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.gnu.org/archive/html/qemu-devel/2017-07/msg05001.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1472611"
          },
          {
            "name": "[oss-security] 20170719 CVE-2017-11434 Qemu: slirp: out-of-bounds read while parsing dhcp options",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2017/07/19/2"
          },
          {
            "name": "DSA-3925",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2017/dsa-3925"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2017-07-17T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The dhcp_decode function in slirp/bootp.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (out-of-bounds read and QEMU process crash) via a crafted DHCP options string."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-09-07T09:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "[debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html"
        },
        {
          "name": "99923",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/99923"
        },
        {
          "name": "[qemu-devel] 20170717 [PATCH] slirp: check len against dhcp options array end",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.gnu.org/archive/html/qemu-devel/2017-07/msg05001.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1472611"
        },
        {
          "name": "[oss-security] 20170719 CVE-2017-11434 Qemu: slirp: out-of-bounds read while parsing dhcp options",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2017/07/19/2"
        },
        {
          "name": "DSA-3925",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2017/dsa-3925"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2017-11434",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The dhcp_decode function in slirp/bootp.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (out-of-bounds read and QEMU process crash) via a crafted DHCP options string."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "[debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html"
            },
            {
              "name": "99923",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/99923"
            },
            {
              "name": "[qemu-devel] 20170717 [PATCH] slirp: check len against dhcp options array end",
              "refsource": "MLIST",
              "url": "https://lists.gnu.org/archive/html/qemu-devel/2017-07/msg05001.html"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1472611",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1472611"
            },
            {
              "name": "[oss-security] 20170719 CVE-2017-11434 Qemu: slirp: out-of-bounds read while parsing dhcp options",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2017/07/19/2"
            },
            {
              "name": "DSA-3925",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2017/dsa-3925"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2017-11434",
    "datePublished": "2017-07-25T18:00:00.000Z",
    "dateReserved": "2017-07-18T00:00:00.000Z",
    "dateUpdated": "2024-08-05T18:12:39.858Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2017-12809 (GCVE-0-2017-12809)

Vulnerability from cvelistv5 – Published: 2017-08-23 16:00 – Updated: 2024-08-05 18:51

Summary

QEMU (aka Quick Emulator), when built with the IDE disk and CD/DVD-ROM Emulator support, allows local guest OS privileged users to cause a denial of service (NULL pointer dereference and QEMU process crash) by flushing an empty CDROM device drive.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root Scorecard

References

4 references

URL	Tags
http://www.debian.org/security/2017/dsa-3991	vendor-advisoryx_refsource_DEBIAN
https://lists.gnu.org/archive/html/qemu-devel/201…	mailing-listx_refsource_MLIST
http://www.securityfocus.com/bid/100451	vdb-entryx_refsource_BID
http://www.openwall.com/lists/oss-security/2017/08/21/2	mailing-listx_refsource_MLIST

Date Public

2017-08-09 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T18:51:07.135Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "DSA-3991",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2017/dsa-3991"
          },
          {
            "name": "[qemu-devel] 20170809 [Qemu-devel] [PATCH 1/2] IDE: Do not flush empty CDROM drives",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.gnu.org/archive/html/qemu-devel/2017-08/msg01850.html"
          },
          {
            "name": "100451",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/100451"
          },
          {
            "name": "[oss-security] 20170821 CVE-2017-12809 Qemu: ide: flushing of empty CDROM drives leads to NULL dereference",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2017/08/21/2"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2017-08-09T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "QEMU (aka Quick Emulator), when built with the IDE disk and CD/DVD-ROM Emulator support, allows local guest OS privileged users to cause a denial of service (NULL pointer dereference and QEMU process crash) by flushing an empty CDROM device drive."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-11-03T18:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "DSA-3991",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2017/dsa-3991"
        },
        {
          "name": "[qemu-devel] 20170809 [Qemu-devel] [PATCH 1/2] IDE: Do not flush empty CDROM drives",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.gnu.org/archive/html/qemu-devel/2017-08/msg01850.html"
        },
        {
          "name": "100451",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/100451"
        },
        {
          "name": "[oss-security] 20170821 CVE-2017-12809 Qemu: ide: flushing of empty CDROM drives leads to NULL dereference",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2017/08/21/2"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2017-12809",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "QEMU (aka Quick Emulator), when built with the IDE disk and CD/DVD-ROM Emulator support, allows local guest OS privileged users to cause a denial of service (NULL pointer dereference and QEMU process crash) by flushing an empty CDROM device drive."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "DSA-3991",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2017/dsa-3991"
            },
            {
              "name": "[qemu-devel] 20170809 [Qemu-devel] [PATCH 1/2] IDE: Do not flush empty CDROM drives",
              "refsource": "MLIST",
              "url": "https://lists.gnu.org/archive/html/qemu-devel/2017-08/msg01850.html"
            },
            {
              "name": "100451",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/100451"
            },
            {
              "name": "[oss-security] 20170821 CVE-2017-12809 Qemu: ide: flushing of empty CDROM drives leads to NULL dereference",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2017/08/21/2"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2017-12809",
    "datePublished": "2017-08-23T16:00:00.000Z",
    "dateReserved": "2017-08-11T00:00:00.000Z",
    "dateUpdated": "2024-08-05T18:51:07.135Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

SUSE-SU-2017:2946-1

CVE-2016-6834 (GCVE-0-2016-6834)

CVE-2016-6835 (GCVE-0-2016-6835)

CVE-2016-9602 (GCVE-0-2016-9602)

CVE-2016-9603 (GCVE-0-2016-9603)

CVE-2017-10664 (GCVE-0-2017-10664)

CVE-2017-10806 (GCVE-0-2017-10806)

CVE-2017-10911 (GCVE-0-2017-10911)

CVE-2017-11334 (GCVE-0-2017-11334)

CVE-2017-11434 (GCVE-0-2017-11434)

CVE-2017-12809 (GCVE-0-2017-12809)

Tags

Sightings

Nomenclature

Related by attack behaviour