Action not permitted
Modal body text goes here.
cve-2016-9603
Vulnerability from cvelistv5
Published
2018-07-27 21:00
Modified
2024-08-06 02:59
Severity ?
EPSS score ?
Summary
A heap buffer overflow flaw was found in QEMU's Cirrus CLGD 54xx VGA emulator's VNC display driver support before 2.9; the issue could occur when a VNC client attempted to update its display after a VGA operation is performed by a guest. A privileged user/process inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T02:59:02.448Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "96893",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/96893"
},
{
"name": "RHSA-2017:0983",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2017:0983"
},
{
"name": "RHSA-2017:0982",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2017:0982"
},
{
"name": "[debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html"
},
{
"name": "GLSA-201706-03",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201706-03"
},
{
"name": "RHSA-2017:1206",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2017:1206"
},
{
"name": "1038023",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1038023"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://support.citrix.com/article/CTX221578"
},
{
"name": "RHSA-2017:0985",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2017:0985"
},
{
"name": "RHSA-2017:0987",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2017:0987"
},
{
"name": "RHSA-2017:0984",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2017:0984"
},
{
"name": "[debian-lts-announce] 20180206 [SECURITY] [DLA 1270-1] xen security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2018/02/msg00005.html"
},
{
"name": "RHSA-2017:0988",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2017:0988"
},
{
"name": "RHSA-2017:1441",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2017:1441"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9603"
},
{
"name": "RHSA-2017:0981",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2017:0981"
},
{
"name": "RHSA-2017:0980",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2017:0980"
},
{
"name": "RHSA-2017:1205",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2017:1205"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Qemu:",
"vendor": "QEMU",
"versions": [
{
"status": "affected",
"version": "2.9"
}
]
}
],
"datePublic": "2017-03-07T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "A heap buffer overflow flaw was found in QEMU\u0027s Cirrus CLGD 54xx VGA emulator\u0027s VNC display driver support before 2.9; the issue could occur when a VNC client attempted to update its display after a VGA operation is performed by a guest. A privileged user/process inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-09-07T09:57:01",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "96893",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/96893"
},
{
"name": "RHSA-2017:0983",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2017:0983"
},
{
"name": "RHSA-2017:0982",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2017:0982"
},
{
"name": "[debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html"
},
{
"name": "GLSA-201706-03",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201706-03"
},
{
"name": "RHSA-2017:1206",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2017:1206"
},
{
"name": "1038023",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1038023"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://support.citrix.com/article/CTX221578"
},
{
"name": "RHSA-2017:0985",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2017:0985"
},
{
"name": "RHSA-2017:0987",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2017:0987"
},
{
"name": "RHSA-2017:0984",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2017:0984"
},
{
"name": "[debian-lts-announce] 20180206 [SECURITY] [DLA 1270-1] xen security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2018/02/msg00005.html"
},
{
"name": "RHSA-2017:0988",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2017:0988"
},
{
"name": "RHSA-2017:1441",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2017:1441"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9603"
},
{
"name": "RHSA-2017:0981",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2017:0981"
},
{
"name": "RHSA-2017:0980",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2017:0980"
},
{
"name": "RHSA-2017:1205",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2017:1205"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2016-9603",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Qemu:",
"version": {
"version_data": [
{
"version_value": "2.9"
}
]
}
}
]
},
"vendor_name": "QEMU"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A heap buffer overflow flaw was found in QEMU\u0027s Cirrus CLGD 54xx VGA emulator\u0027s VNC display driver support before 2.9; the issue could occur when a VNC client attempted to update its display after a VGA operation is performed by a guest. A privileged user/process inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process."
}
]
},
"impact": {
"cvss": [
[
{
"vectorString": "5.5/CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.0"
}
],
[
{
"vectorString": "4.9/AV:A/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
}
]
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-122"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "96893",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/96893"
},
{
"name": "RHSA-2017:0983",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2017:0983"
},
{
"name": "RHSA-2017:0982",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2017:0982"
},
{
"name": "[debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html"
},
{
"name": "GLSA-201706-03",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201706-03"
},
{
"name": "RHSA-2017:1206",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2017:1206"
},
{
"name": "1038023",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1038023"
},
{
"name": "https://support.citrix.com/article/CTX221578",
"refsource": "CONFIRM",
"url": "https://support.citrix.com/article/CTX221578"
},
{
"name": "RHSA-2017:0985",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2017:0985"
},
{
"name": "RHSA-2017:0987",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2017:0987"
},
{
"name": "RHSA-2017:0984",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2017:0984"
},
{
"name": "[debian-lts-announce] 20180206 [SECURITY] [DLA 1270-1] xen security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2018/02/msg00005.html"
},
{
"name": "RHSA-2017:0988",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2017:0988"
},
{
"name": "RHSA-2017:1441",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2017:1441"
},
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9603",
"refsource": "CONFIRM",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9603"
},
{
"name": "RHSA-2017:0981",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2017:0981"
},
{
"name": "RHSA-2017:0980",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2017:0980"
},
{
"name": "RHSA-2017:1205",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2017:1205"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2016-9603",
"datePublished": "2018-07-27T21:00:00",
"dateReserved": "2016-11-23T00:00:00",
"dateUpdated": "2024-08-06T02:59:02.448Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2016-9603\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2018-07-27T21:29:00.290\",\"lastModified\":\"2024-11-21T03:01:29.667\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A heap buffer overflow flaw was found in QEMU\u0027s Cirrus CLGD 54xx VGA emulator\u0027s VNC display driver support before 2.9; the issue could occur when a VNC client attempted to update its display after a VGA operation is performed by a guest. A privileged user/process inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process.\"},{\"lang\":\"es\",\"value\":\"Se ha detectado una vulnerabilidad de desbordamiento de b\u00fafer basado en memoria din\u00e1mica (heap) en el soporte del controlador de pantalla VNC del emulador Cirrus CLGD 54xx VGA de QEMU en versiones anteriores a la 2.9. El problema pod\u00eda ocurrir cuando un cliente VNC intentaba actualizar su pantalla despu\u00e9s de que un invitado realizara una operaci\u00f3n VGA. Un usuario/proceso privilegiado dentro de un guest podr\u00eda usar esta vulnerabilidad para provocar que el proceso de QEMU se cierre inesperadamente o, potencialmente, ejecutar c\u00f3digo arbitrario en el host con privilegios del proceso de QEMU.\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"secalert@redhat.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":1.3,\"impactScore\":3.7},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":9.9,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.1,\"impactScore\":6.0}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:S/C:C/I:C/A:C\",\"baseScore\":9.0,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"COMPLETE\",\"integrityImpact\":\"COMPLETE\",\"availabilityImpact\":\"COMPLETE\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":8.0,\"impactScore\":10.0,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"secalert@redhat.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-122\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-119\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2.9.0\",\"matchCriteriaId\":\"296F09E2-48CC-4B5F-BE4F-04760D389E39\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:citrix:xenserver:6.0.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5FCF191B-971A-4945-AB14-08091689BE2F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:citrix:xenserver:6.2.0:sp1:*:*:*:*:*:*\",\"matchCriteriaId\":\"878949E0-D656-4E0E-858A-C6AD948A2A2F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:citrix:xenserver:6.5:sp1:*:*:*:*:*:*\",\"matchCriteriaId\":\"DBCF6643-ACDE-4DDB-8B01-D952DDF8951E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:citrix:xenserver:7.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"405F950F-0772-41A3-8B72-B67151CC1376\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:citrix:xenserver:7.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B5647AEA-DCE6-4950-A7EB-05465ECDDE16\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:openstack:5.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B152EDF3-3140-4343-802F-F4F1C329F5C3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:openstack:6.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"31EC146C-A6F6-4C0D-AF87-685286262DAA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:openstack:7.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9DAA72A4-AC7D-4544-89D4-5B07961D5A95\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:openstack:8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E8B8C725-34CF-4340-BE7B-37E58CF706D6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:openstack:9:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F40C26BE-56CB-4022-A1D8-3CA0A8F87F4B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:openstack:10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E722FEF7-58A6-47AD-B1D0-DB0B71B0C7AA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"16F59A04-14CF-49E2-9973-645477EA09DA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EE249E1B-A1FD-4E08-AA71-A0E1F10FFE97\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"33C068A4-3780-4EAB-A937-6082DF847564\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9BBCD86A-E6C7-4444-9D74-F861084090F0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"51EF4996-72F4-4FA4-814F-F5991E7A8318\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"98381E61-F082-4302-B51F-5648884F998B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D99A687E-EAE6-417E-A88E-D0082BC194CD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_server_eus:7.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A8442C20-41F9-47FD-9A12-E724D3A31FD7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9EC0D196-F7B8-4BDD-9050-779F7A7FBEE4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A4E9DD8A-A68B-4A69-8B01-BFF92A2020A8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E5ED5807-55B7-47C5-97A6-03233F4FBC3A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"825ECE2D-E232-46E0-A047-074B34DB1E97\"}]}]}],\"references\":[{\"url\":\"http://www.securityfocus.com/bid/96893\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://www.securitytracker.com/id/1038023\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2017:0980\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2017:0981\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2017:0982\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2017:0983\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2017:0984\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2017:0985\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2017:0987\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2017:0988\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2017:1205\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2017:1206\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2017:1441\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9603\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Issue Tracking\",\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2018/02/msg00005.html\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://security.gentoo.org/glsa/201706-03\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://support.citrix.com/article/CTX221578\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.securityfocus.com/bid/96893\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://www.securitytracker.com/id/1038023\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2017:0980\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2017:0981\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2017:0982\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2017:0983\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2017:0984\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2017:0985\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2017:0987\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2017:0988\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2017:1205\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2017:1206\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2017:1441\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9603\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2018/02/msg00005.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://security.gentoo.org/glsa/201706-03\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://support.citrix.com/article/CTX221578\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}"
}
}
rhsa-2017_1441
Vulnerability from csaf_redhat
Published
2017-06-14 15:20
Modified
2024-11-22 10:39
Summary
Red Hat Security Advisory: qemu-kvm-rhev security and bug fix update
Notes
Topic
An update for qemu-kvm-rhev is now available for Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-rhev packages provide the user-space component for running virtual machines that use KVM in environments managed by Red Hat products.
Security Fix(es):
* A heap buffer overflow flaw was found in QEMU's Cirrus CLGD 54xx VGA emulator's VNC display driver support; the issue could occur when a VNC client attempted to update its display after a VGA operation is performed by a guest. A privileged user/process inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process. (CVE-2016-9603)
* An out-of-bounds r/w access issue was found in QEMU's Cirrus CLGD 54xx VGA Emulator support. The vulnerability could occur while copying VGA data via various bitblt functions. A privileged user inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process. (CVE-2017-7980)
* An out-of-bounds memory access issue was found in QEMU's VNC display driver support. The vulnerability could occur while refreshing the VNC display surface area in the 'vnc_refresh_server_surface'. A user/process inside a guest could use this flaw to crash the QEMU process, resulting in a denial of service. (CVE-2017-2633)
* An out-of-bounds access issue was found in QEMU's Cirrus CLGD 54xx VGA Emulator support. The vulnerability could occur while copying VGA data using bitblt functions (for example, cirrus_bitblt_rop_fwd_transp_). A privileged user inside a guest could use this flaw to crash the QEMU process, resulting in denial of service. (CVE-2017-7718)
Red Hat would like to thank Jiangxin (PSIRT Huawei Inc.) and Li Qiang (Qihoo 360 Gear Team) for reporting CVE-2017-7980 and Jiangxin (PSIRT Huawei Inc.) for reporting CVE-2017-7718.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for qemu-kvm-rhev is now available for Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-rhev packages provide the user-space component for running virtual machines that use KVM in environments managed by Red Hat products.\n\nSecurity Fix(es):\n\n* A heap buffer overflow flaw was found in QEMU\u0027s Cirrus CLGD 54xx VGA emulator\u0027s VNC display driver support; the issue could occur when a VNC client attempted to update its display after a VGA operation is performed by a guest. A privileged user/process inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process. (CVE-2016-9603)\n\n* An out-of-bounds r/w access issue was found in QEMU\u0027s Cirrus CLGD 54xx VGA Emulator support. The vulnerability could occur while copying VGA data via various bitblt functions. A privileged user inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process. (CVE-2017-7980)\n\n* An out-of-bounds memory access issue was found in QEMU\u0027s VNC display driver support. The vulnerability could occur while refreshing the VNC display surface area in the \u0027vnc_refresh_server_surface\u0027. A user/process inside a guest could use this flaw to crash the QEMU process, resulting in a denial of service. (CVE-2017-2633)\n\n* An out-of-bounds access issue was found in QEMU\u0027s Cirrus CLGD 54xx VGA Emulator support. The vulnerability could occur while copying VGA data using bitblt functions (for example, cirrus_bitblt_rop_fwd_transp_). A privileged user inside a guest could use this flaw to crash the QEMU process, resulting in denial of service. (CVE-2017-7718)\n\nRed Hat would like to thank Jiangxin (PSIRT Huawei Inc.) and Li Qiang (Qihoo 360 Gear Team) for reporting CVE-2017-7980 and Jiangxin (PSIRT Huawei Inc.) for reporting CVE-2017-7718.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2017:1441",
"url": "https://access.redhat.com/errata/RHSA-2017:1441"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "1425939",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1425939"
},
{
"category": "external",
"summary": "1430056",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1430056"
},
{
"category": "external",
"summary": "1442810",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1442810"
},
{
"category": "external",
"summary": "1443441",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1443441"
},
{
"category": "external",
"summary": "1444371",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1444371"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_1441.json"
}
],
"title": "Red Hat Security Advisory: qemu-kvm-rhev security and bug fix update",
"tracking": {
"current_release_date": "2024-11-22T10:39:16+00:00",
"generator": {
"date": "2024-11-22T10:39:16+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2017:1441",
"initial_release_date": "2017-06-14T15:20:20+00:00",
"revision_history": [
{
"date": "2017-06-14T15:20:20+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2017-06-14T15:20:20+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-22T10:39:16+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6",
"product": {
"name": "Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6",
"product_id": "6Server-RH6-RHOS-5.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openstack:5::el6"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenStack Platform"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"product": {
"name": "qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"product_id": "qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev@0.12.1.2-2.503.el6_9.3?arch=x86_64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"product": {
"name": "qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"product_id": "qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-img-rhev@0.12.1.2-2.503.el6_9.3?arch=x86_64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"product": {
"name": "qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"product_id": "qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev-tools@0.12.1.2-2.503.el6_9.3?arch=x86_64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"product": {
"name": "qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"product_id": "qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev-debuginfo@0.12.1.2-2.503.el6_9.3?arch=x86_64\u0026epoch=2"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src",
"product": {
"name": "qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src",
"product_id": "qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev@0.12.1.2-2.503.el6_9.3?arch=src\u0026epoch=2"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6",
"product_id": "6Server-RH6-RHOS-5.0:qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64"
},
"product_reference": "qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"relates_to_product_reference": "6Server-RH6-RHOS-5.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6",
"product_id": "6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src"
},
"product_reference": "qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src",
"relates_to_product_reference": "6Server-RH6-RHOS-5.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6",
"product_id": "6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64"
},
"product_reference": "qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"relates_to_product_reference": "6Server-RH6-RHOS-5.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6",
"product_id": "6Server-RH6-RHOS-5.0:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64"
},
"product_reference": "qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"relates_to_product_reference": "6Server-RH6-RHOS-5.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6",
"product_id": "6Server-RH6-RHOS-5.0:qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
},
"product_reference": "qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"relates_to_product_reference": "6Server-RH6-RHOS-5.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2016-9603",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2016-11-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1430056"
}
],
"notes": [
{
"category": "description",
"text": "A heap buffer overflow flaw was found in QEMU\u0027s Cirrus CLGD 54xx VGA emulator\u0027s VNC display driver support; the issue could occur when a VNC client attempted to update its display after a VGA operation is performed by a guest. A privileged user/process inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: cirrus: heap buffer overflow via vnc connection",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RH6-RHOS-5.0:qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-9603"
},
{
"category": "external",
"summary": "RHBZ#1430056",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1430056"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-9603",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-9603"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-9603",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-9603"
}
],
"release_date": "2017-03-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-06-14T15:20:20+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"6Server-RH6-RHOS-5.0:qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:1441"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:A/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"6Server-RH6-RHOS-5.0:qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Qemu: cirrus: heap buffer overflow via vnc connection"
},
{
"cve": "CVE-2017-2633",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2016-12-01T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1425939"
}
],
"notes": [
{
"category": "description",
"text": "An out-of-bounds memory access issue was found in Quick Emulator (QEMU) in the VNC display driver. This flaw could occur while refreshing the VNC display surface area in the \u0027vnc_refresh_server_surface\u0027. A user inside a guest could use this flaw to crash the QEMU process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: VNC: memory corruption due to unchecked resolution limit",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RH6-RHOS-5.0:qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-2633"
},
{
"category": "external",
"summary": "RHBZ#1425939",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1425939"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-2633",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-2633"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-2633",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-2633"
}
],
"release_date": "2016-12-01T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-06-14T15:20:20+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"6Server-RH6-RHOS-5.0:qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:1441"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 3.8,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:A/AC:M/Au:S/C:N/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L",
"version": "3.0"
},
"products": [
"6Server-RH6-RHOS-5.0:qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Qemu: VNC: memory corruption due to unchecked resolution limit"
},
{
"acknowledgments": [
{
"names": [
"Jiangxin"
],
"organization": "PSIRT Huawei Inc."
}
],
"cve": "CVE-2017-7718",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2017-03-15T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1443441"
}
],
"notes": [
{
"category": "description",
"text": "An out-of-bounds access issue was found in QEMU\u0027s Cirrus CLGD 54xx VGA Emulator support. The vulnerability could occur while copying VGA data using bitblt functions (for example, cirrus_bitblt_rop_fwd_transp_). A privileged user inside a guest could use this flaw to crash the QEMU process, resulting in denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: display: cirrus: OOB read access issue",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RH6-RHOS-5.0:qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-7718"
},
{
"category": "external",
"summary": "RHBZ#1443441",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1443441"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-7718",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7718"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-7718",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7718"
}
],
"release_date": "2017-03-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-06-14T15:20:20+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"6Server-RH6-RHOS-5.0:qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:1441"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 2.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:A/AC:H/Au:S/C:P/I:N/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.0,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:L",
"version": "3.0"
},
"products": [
"6Server-RH6-RHOS-5.0:qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Qemu: display: cirrus: OOB read access issue"
},
{
"acknowledgments": [
{
"names": [
"Jiangxin"
],
"organization": "PSIRT Huawei Inc."
},
{
"names": [
"Li Qiang"
],
"organization": "Qihoo 360 Gear Team"
}
],
"cve": "CVE-2017-7980",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2017-02-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1444371"
}
],
"notes": [
{
"category": "description",
"text": "An out-of-bounds r/w access issue was found in QEMU\u0027s Cirrus CLGD 54xx VGA Emulator support. The vulnerability could occur while copying VGA data via various bitblt functions. A privileged user inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: display: cirrus: OOB r/w access issues in bitblt routines",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RH6-RHOS-5.0:qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-7980"
},
{
"category": "external",
"summary": "RHBZ#1444371",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1444371"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-7980",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7980"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-7980",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7980"
}
],
"release_date": "2017-03-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-06-14T15:20:20+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"6Server-RH6-RHOS-5.0:qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:1441"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:A/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"6Server-RH6-RHOS-5.0:qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Qemu: display: cirrus: OOB r/w access issues in bitblt routines"
}
]
}
rhsa-2017_0983
Vulnerability from csaf_redhat
Published
2017-04-18 04:56
Modified
2024-11-14 23:33
Summary
Red Hat Security Advisory: qemu-kvm-rhev security update
Notes
Topic
An update for qemu-kvm-rhev is now available for Red Hat OpenStack Platform 8.0 (Liberty).
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-rhev packages provide the user-space component for running virtual machines that use KVM in environments managed by Red Hat products.
Security Fix(es):
* Quick Emulator (QEMU), built with the Cirrus CLGD 54xx VGA Emulator and the VNC display driver support, is vulnerable to a heap buffer overflow issue. The issue could occur when a VNC client attempts to update its display after a VGA operation is performed by a guest. A privileged user/process inside guest could use this flaw to crash the QEMU process resulting in DoS or, potentially, leverage it to execute arbitrary code on the host with privileges of the QEMU process. (CVE-2016-9603)
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for qemu-kvm-rhev is now available for Red Hat OpenStack Platform 8.0 (Liberty).\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-rhev packages provide the user-space component for running virtual machines that use KVM in environments managed by Red Hat products.\n\nSecurity Fix(es):\n\n* Quick Emulator (QEMU), built with the Cirrus CLGD 54xx VGA Emulator and the VNC display driver support, is vulnerable to a heap buffer overflow issue. The issue could occur when a VNC client attempts to update its display after a VGA operation is performed by a guest. A privileged user/process inside guest could use this flaw to crash the QEMU process resulting in DoS or, potentially, leverage it to execute arbitrary code on the host with privileges of the QEMU process. (CVE-2016-9603)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2017:0983",
"url": "https://access.redhat.com/errata/RHSA-2017:0983"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "1430056",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1430056"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_0983.json"
}
],
"title": "Red Hat Security Advisory: qemu-kvm-rhev security update",
"tracking": {
"current_release_date": "2024-11-14T23:33:50+00:00",
"generator": {
"date": "2024-11-14T23:33:50+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2017:0983",
"initial_release_date": "2017-04-18T04:56:14+00:00",
"revision_history": [
{
"date": "2017-04-18T04:56:14+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2017-04-18T04:56:14+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-14T23:33:50+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenStack Platform 8.0 (Liberty)",
"product": {
"name": "Red Hat OpenStack Platform 8.0 (Liberty)",
"product_id": "7Server-RH7-RHOS-8.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openstack:8::el7"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenStack Platform"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_id": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev@2.6.0-28.el7_3.9?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"product": {
"name": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"product_id": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev-debuginfo@2.6.0-28.el7_3.9?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product": {
"name": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_id": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-tools-rhev@2.6.0-28.el7_3.9?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product": {
"name": "qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_id": "qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-img-rhev@2.6.0-28.el7_3.9?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product": {
"name": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_id": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-common-rhev@2.6.0-28.el7_3.9?arch=x86_64\u0026epoch=10"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"product": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"product_id": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev@2.6.0-28.el7_3.9?arch=src\u0026epoch=10"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64 as a component of Red Hat OpenStack Platform 8.0 (Liberty)",
"product_id": "7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64"
},
"product_reference": "qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-8.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64 as a component of Red Hat OpenStack Platform 8.0 (Liberty)",
"product_id": "7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64"
},
"product_reference": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-8.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src as a component of Red Hat OpenStack Platform 8.0 (Liberty)",
"product_id": "7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src"
},
"product_reference": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"relates_to_product_reference": "7Server-RH7-RHOS-8.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64 as a component of Red Hat OpenStack Platform 8.0 (Liberty)",
"product_id": "7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64"
},
"product_reference": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-8.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64 as a component of Red Hat OpenStack Platform 8.0 (Liberty)",
"product_id": "7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64"
},
"product_reference": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-8.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64 as a component of Red Hat OpenStack Platform 8.0 (Liberty)",
"product_id": "7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
},
"product_reference": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-8.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2016-9603",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2016-11-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1430056"
}
],
"notes": [
{
"category": "description",
"text": "A heap buffer overflow flaw was found in QEMU\u0027s Cirrus CLGD 54xx VGA emulator\u0027s VNC display driver support; the issue could occur when a VNC client attempted to update its display after a VGA operation is performed by a guest. A privileged user/process inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: cirrus: heap buffer overflow via vnc connection",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-9603"
},
{
"category": "external",
"summary": "RHBZ#1430056",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1430056"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-9603",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-9603"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-9603",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-9603"
}
],
"release_date": "2017-03-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-04-18T04:56:14+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:0983"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:A/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Qemu: cirrus: heap buffer overflow via vnc connection"
},
{
"acknowledgments": [
{
"names": [
"Jiangxin"
],
"organization": "PSIRT Huawei Inc."
}
],
"cve": "CVE-2017-7718",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2017-03-15T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1443441"
}
],
"notes": [
{
"category": "description",
"text": "An out-of-bounds access issue was found in QEMU\u0027s Cirrus CLGD 54xx VGA Emulator support. The vulnerability could occur while copying VGA data using bitblt functions (for example, cirrus_bitblt_rop_fwd_transp_). A privileged user inside a guest could use this flaw to crash the QEMU process, resulting in denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: display: cirrus: OOB read access issue",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-7718"
},
{
"category": "external",
"summary": "RHBZ#1443441",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1443441"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-7718",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7718"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-7718",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7718"
}
],
"release_date": "2017-03-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-04-18T04:56:14+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:0983"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 2.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:A/AC:H/Au:S/C:P/I:N/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.0,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:L",
"version": "3.0"
},
"products": [
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Qemu: display: cirrus: OOB read access issue"
},
{
"acknowledgments": [
{
"names": [
"Jiangxin"
],
"organization": "PSIRT Huawei Inc."
},
{
"names": [
"Li Qiang"
],
"organization": "Qihoo 360 Gear Team"
}
],
"cve": "CVE-2017-7980",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2017-02-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1444371"
}
],
"notes": [
{
"category": "description",
"text": "An out-of-bounds r/w access issue was found in QEMU\u0027s Cirrus CLGD 54xx VGA Emulator support. The vulnerability could occur while copying VGA data via various bitblt functions. A privileged user inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: display: cirrus: OOB r/w access issues in bitblt routines",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-7980"
},
{
"category": "external",
"summary": "RHBZ#1444371",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1444371"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-7980",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7980"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-7980",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7980"
}
],
"release_date": "2017-03-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-04-18T04:56:14+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:0983"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:A/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Qemu: display: cirrus: OOB r/w access issues in bitblt routines"
}
]
}
rhsa-2017_1205
Vulnerability from csaf_redhat
Published
2017-05-09 11:07
Modified
2024-11-22 10:39
Summary
Red Hat Security Advisory: qemu-kvm-rhev security update
Notes
Topic
An update for qemu-kvm-rhev is now available for RHEV 3.X Hypervisor and Agents for RHEL-6.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-rhev packages provide the user-space component for running virtual machines that use KVM in environments managed by Red Hat products.
Security Fix(es):
* A heap buffer overflow flaw was found in QEMU's Cirrus CLGD 54xx VGA emulator's VNC display driver support; the issue could occur when a VNC client attempted to update its display after a VGA operation is performed by a guest. A privileged user/process inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process. (CVE-2016-9603)
* Quick Emulator (QEMU) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds r/w access issue. The vulnerability could occur while copying VGA data via various bitblt functions. A privileged user inside the guest could use this flaw to crash the QEMU process (DoS) or potentially execute arbitrary code on a host with privileges of the host's QEMU process. (CVE-2017-7980)
* Quick Emulator (QEMU) built with the VNC display driver support is vulnerable to an out-of-bounds memory access issue. The vulnerability could occur while refreshing the VNC display surface area in the 'vnc_refresh_server_surface'. A user/process inside the guest could use this flaw to crash the QEMU process, resulting in a DoS. (CVE-2017-2633)
* Quick Emulator (QEMU) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The vulnerability could occur while copying VGA data using bitblt functions (for example, cirrus_bitblt_rop_fwd_transp_). A privileged user inside a guest could use this flaw to crash the QEMU process, resulting in DoS. (CVE-2017-7718)
Red Hat would like to thank Jiangxin (PSIRT Huawei Inc.) Li Qiang (Qihoo 360 Gear Team) for reporting CVE-2017-7980 and Jiangxin (PSIRT Huawei Inc.) for reporting CVE-2017-7718.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for qemu-kvm-rhev is now available for RHEV 3.X Hypervisor and Agents for RHEL-6.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-rhev packages provide the user-space component for running virtual machines that use KVM in environments managed by Red Hat products.\n\nSecurity Fix(es):\n\n* A heap buffer overflow flaw was found in QEMU\u0027s Cirrus CLGD 54xx VGA emulator\u0027s VNC display driver support; the issue could occur when a VNC client attempted to update its display after a VGA operation is performed by a guest. A privileged user/process inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process. (CVE-2016-9603)\n\n* Quick Emulator (QEMU) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds r/w access issue. The vulnerability could occur while copying VGA data via various bitblt functions. A privileged user inside the guest could use this flaw to crash the QEMU process (DoS) or potentially execute arbitrary code on a host with privileges of the host\u0027s QEMU process. (CVE-2017-7980)\n\n* Quick Emulator (QEMU) built with the VNC display driver support is vulnerable to an out-of-bounds memory access issue. The vulnerability could occur while refreshing the VNC display surface area in the \u0027vnc_refresh_server_surface\u0027. A user/process inside the guest could use this flaw to crash the QEMU process, resulting in a DoS. (CVE-2017-2633)\n\n* Quick Emulator (QEMU) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The vulnerability could occur while copying VGA data using bitblt functions (for example, cirrus_bitblt_rop_fwd_transp_). A privileged user inside a guest could use this flaw to crash the QEMU process, resulting in DoS. (CVE-2017-7718)\n\nRed Hat would like to thank Jiangxin (PSIRT Huawei Inc.) Li Qiang (Qihoo 360 Gear Team) for reporting CVE-2017-7980 and Jiangxin (PSIRT Huawei Inc.) for reporting CVE-2017-7718.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2017:1205",
"url": "https://access.redhat.com/errata/RHSA-2017:1205"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "1425939",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1425939"
},
{
"category": "external",
"summary": "1430056",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1430056"
},
{
"category": "external",
"summary": "1443441",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1443441"
},
{
"category": "external",
"summary": "1444371",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1444371"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_1205.json"
}
],
"title": "Red Hat Security Advisory: qemu-kvm-rhev security update",
"tracking": {
"current_release_date": "2024-11-22T10:39:27+00:00",
"generator": {
"date": "2024-11-22T10:39:27+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2017:1205",
"initial_release_date": "2017-05-09T11:07:02+00:00",
"revision_history": [
{
"date": "2017-05-09T11:07:02+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2017-05-09T11:07:02+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-22T10:39:27+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "RHEV Agents (vdsm)",
"product": {
"name": "RHEV Agents (vdsm)",
"product_id": "6Server-RHEV-Agents",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:enterprise_linux:6::hypervisor"
}
}
}
],
"category": "product_family",
"name": "Red Hat Virtualization"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"product": {
"name": "qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"product_id": "qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev@0.12.1.2-2.503.el6_9.3?arch=x86_64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"product": {
"name": "qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"product_id": "qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-img-rhev@0.12.1.2-2.503.el6_9.3?arch=x86_64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"product": {
"name": "qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"product_id": "qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev-tools@0.12.1.2-2.503.el6_9.3?arch=x86_64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"product": {
"name": "qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"product_id": "qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev-debuginfo@0.12.1.2-2.503.el6_9.3?arch=x86_64\u0026epoch=2"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src",
"product": {
"name": "qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src",
"product_id": "qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev@0.12.1.2-2.503.el6_9.3?arch=src\u0026epoch=2"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64 as a component of RHEV Agents (vdsm)",
"product_id": "6Server-RHEV-Agents:qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64"
},
"product_reference": "qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"relates_to_product_reference": "6Server-RHEV-Agents"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src as a component of RHEV Agents (vdsm)",
"product_id": "6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src"
},
"product_reference": "qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src",
"relates_to_product_reference": "6Server-RHEV-Agents"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64 as a component of RHEV Agents (vdsm)",
"product_id": "6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64"
},
"product_reference": "qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"relates_to_product_reference": "6Server-RHEV-Agents"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64 as a component of RHEV Agents (vdsm)",
"product_id": "6Server-RHEV-Agents:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64"
},
"product_reference": "qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"relates_to_product_reference": "6Server-RHEV-Agents"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64 as a component of RHEV Agents (vdsm)",
"product_id": "6Server-RHEV-Agents:qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
},
"product_reference": "qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"relates_to_product_reference": "6Server-RHEV-Agents"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2016-9603",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2016-11-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1430056"
}
],
"notes": [
{
"category": "description",
"text": "A heap buffer overflow flaw was found in QEMU\u0027s Cirrus CLGD 54xx VGA emulator\u0027s VNC display driver support; the issue could occur when a VNC client attempted to update its display after a VGA operation is performed by a guest. A privileged user/process inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: cirrus: heap buffer overflow via vnc connection",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RHEV-Agents:qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src",
"6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-9603"
},
{
"category": "external",
"summary": "RHBZ#1430056",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1430056"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-9603",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-9603"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-9603",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-9603"
}
],
"release_date": "2017-03-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-05-09T11:07:02+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"6Server-RHEV-Agents:qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src",
"6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:1205"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:A/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"6Server-RHEV-Agents:qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src",
"6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Qemu: cirrus: heap buffer overflow via vnc connection"
},
{
"cve": "CVE-2017-2633",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2016-12-01T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1425939"
}
],
"notes": [
{
"category": "description",
"text": "An out-of-bounds memory access issue was found in Quick Emulator (QEMU) in the VNC display driver. This flaw could occur while refreshing the VNC display surface area in the \u0027vnc_refresh_server_surface\u0027. A user inside a guest could use this flaw to crash the QEMU process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: VNC: memory corruption due to unchecked resolution limit",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RHEV-Agents:qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src",
"6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-2633"
},
{
"category": "external",
"summary": "RHBZ#1425939",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1425939"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-2633",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-2633"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-2633",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-2633"
}
],
"release_date": "2016-12-01T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-05-09T11:07:02+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"6Server-RHEV-Agents:qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src",
"6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:1205"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 3.8,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:A/AC:M/Au:S/C:N/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L",
"version": "3.0"
},
"products": [
"6Server-RHEV-Agents:qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src",
"6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Qemu: VNC: memory corruption due to unchecked resolution limit"
},
{
"acknowledgments": [
{
"names": [
"Jiangxin"
],
"organization": "PSIRT Huawei Inc."
}
],
"cve": "CVE-2017-7718",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2017-03-15T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1443441"
}
],
"notes": [
{
"category": "description",
"text": "An out-of-bounds access issue was found in QEMU\u0027s Cirrus CLGD 54xx VGA Emulator support. The vulnerability could occur while copying VGA data using bitblt functions (for example, cirrus_bitblt_rop_fwd_transp_). A privileged user inside a guest could use this flaw to crash the QEMU process, resulting in denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: display: cirrus: OOB read access issue",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RHEV-Agents:qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src",
"6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-7718"
},
{
"category": "external",
"summary": "RHBZ#1443441",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1443441"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-7718",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7718"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-7718",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7718"
}
],
"release_date": "2017-03-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-05-09T11:07:02+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"6Server-RHEV-Agents:qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src",
"6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:1205"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 2.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:A/AC:H/Au:S/C:P/I:N/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.0,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:L",
"version": "3.0"
},
"products": [
"6Server-RHEV-Agents:qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src",
"6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Qemu: display: cirrus: OOB read access issue"
},
{
"acknowledgments": [
{
"names": [
"Jiangxin"
],
"organization": "PSIRT Huawei Inc."
},
{
"names": [
"Li Qiang"
],
"organization": "Qihoo 360 Gear Team"
}
],
"cve": "CVE-2017-7980",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2017-02-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1444371"
}
],
"notes": [
{
"category": "description",
"text": "An out-of-bounds r/w access issue was found in QEMU\u0027s Cirrus CLGD 54xx VGA Emulator support. The vulnerability could occur while copying VGA data via various bitblt functions. A privileged user inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: display: cirrus: OOB r/w access issues in bitblt routines",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RHEV-Agents:qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src",
"6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-7980"
},
{
"category": "external",
"summary": "RHBZ#1444371",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1444371"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-7980",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7980"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-7980",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7980"
}
],
"release_date": "2017-03-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-05-09T11:07:02+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"6Server-RHEV-Agents:qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src",
"6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:1205"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:A/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"6Server-RHEV-Agents:qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src",
"6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Qemu: display: cirrus: OOB r/w access issues in bitblt routines"
}
]
}
rhsa-2017_0988
Vulnerability from csaf_redhat
Published
2017-04-18 13:55
Modified
2024-11-14 23:33
Summary
Red Hat Security Advisory: qemu-kvm-rhev security update
Notes
Topic
An update for qemu-kvm-rhev is now available for Red Hat OpenStack Platform 10.0 (Newton).
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-rhev packages provide the user-space component for running virtual machines that use KVM in environments managed by Red Hat products.
Security Fix(es):
* Quick Emulator (QEMU), built with the Cirrus CLGD 54xx VGA Emulator and the VNC display driver support, is vulnerable to a heap buffer overflow issue. The issue could occur when a VNC client attempts to update its display after a VGA operation is performed by a guest. A privileged user/process inside guest could use this flaw to crash the QEMU process resulting in DoS or, potentially, leverage it to execute arbitrary code on the host with privileges of the QEMU process. (CVE-2016-9603)
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for qemu-kvm-rhev is now available for Red Hat OpenStack Platform 10.0 (Newton).\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-rhev packages provide the user-space component for running virtual machines that use KVM in environments managed by Red Hat products.\n\nSecurity Fix(es):\n\n* Quick Emulator (QEMU), built with the Cirrus CLGD 54xx VGA Emulator and the VNC display driver support, is vulnerable to a heap buffer overflow issue. The issue could occur when a VNC client attempts to update its display after a VGA operation is performed by a guest. A privileged user/process inside guest could use this flaw to crash the QEMU process resulting in DoS or, potentially, leverage it to execute arbitrary code on the host with privileges of the QEMU process. (CVE-2016-9603)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2017:0988",
"url": "https://access.redhat.com/errata/RHSA-2017:0988"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "1430056",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1430056"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_0988.json"
}
],
"title": "Red Hat Security Advisory: qemu-kvm-rhev security update",
"tracking": {
"current_release_date": "2024-11-14T23:33:37+00:00",
"generator": {
"date": "2024-11-14T23:33:37+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2017:0988",
"initial_release_date": "2017-04-18T13:55:36+00:00",
"revision_history": [
{
"date": "2017-04-18T13:55:36+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2017-04-18T13:55:36+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-14T23:33:37+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenStack Platform 10.0",
"product": {
"name": "Red Hat OpenStack Platform 10.0",
"product_id": "7Server-RH7-RHOS-10.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openstack:10::el7"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenStack Platform"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_id": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev@2.6.0-28.el7_3.9?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"product": {
"name": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"product_id": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev-debuginfo@2.6.0-28.el7_3.9?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product": {
"name": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_id": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-tools-rhev@2.6.0-28.el7_3.9?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product": {
"name": "qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_id": "qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-img-rhev@2.6.0-28.el7_3.9?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product": {
"name": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_id": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-common-rhev@2.6.0-28.el7_3.9?arch=x86_64\u0026epoch=10"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"product": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"product_id": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev@2.6.0-28.el7_3.9?arch=src\u0026epoch=10"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64 as a component of Red Hat OpenStack Platform 10.0",
"product_id": "7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64"
},
"product_reference": "qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-10.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64 as a component of Red Hat OpenStack Platform 10.0",
"product_id": "7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64"
},
"product_reference": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-10.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src as a component of Red Hat OpenStack Platform 10.0",
"product_id": "7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src"
},
"product_reference": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"relates_to_product_reference": "7Server-RH7-RHOS-10.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64 as a component of Red Hat OpenStack Platform 10.0",
"product_id": "7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64"
},
"product_reference": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-10.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64 as a component of Red Hat OpenStack Platform 10.0",
"product_id": "7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64"
},
"product_reference": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-10.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64 as a component of Red Hat OpenStack Platform 10.0",
"product_id": "7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
},
"product_reference": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-10.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2016-9603",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2016-11-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1430056"
}
],
"notes": [
{
"category": "description",
"text": "A heap buffer overflow flaw was found in QEMU\u0027s Cirrus CLGD 54xx VGA emulator\u0027s VNC display driver support; the issue could occur when a VNC client attempted to update its display after a VGA operation is performed by a guest. A privileged user/process inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: cirrus: heap buffer overflow via vnc connection",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-9603"
},
{
"category": "external",
"summary": "RHBZ#1430056",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1430056"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-9603",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-9603"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-9603",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-9603"
}
],
"release_date": "2017-03-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-04-18T13:55:36+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:0988"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:A/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Qemu: cirrus: heap buffer overflow via vnc connection"
},
{
"acknowledgments": [
{
"names": [
"Jiangxin"
],
"organization": "PSIRT Huawei Inc."
}
],
"cve": "CVE-2017-7718",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2017-03-15T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1443441"
}
],
"notes": [
{
"category": "description",
"text": "An out-of-bounds access issue was found in QEMU\u0027s Cirrus CLGD 54xx VGA Emulator support. The vulnerability could occur while copying VGA data using bitblt functions (for example, cirrus_bitblt_rop_fwd_transp_). A privileged user inside a guest could use this flaw to crash the QEMU process, resulting in denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: display: cirrus: OOB read access issue",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-7718"
},
{
"category": "external",
"summary": "RHBZ#1443441",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1443441"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-7718",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7718"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-7718",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7718"
}
],
"release_date": "2017-03-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-04-18T13:55:36+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:0988"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 2.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:A/AC:H/Au:S/C:P/I:N/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.0,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:L",
"version": "3.0"
},
"products": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Qemu: display: cirrus: OOB read access issue"
},
{
"acknowledgments": [
{
"names": [
"Jiangxin"
],
"organization": "PSIRT Huawei Inc."
},
{
"names": [
"Li Qiang"
],
"organization": "Qihoo 360 Gear Team"
}
],
"cve": "CVE-2017-7980",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2017-02-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1444371"
}
],
"notes": [
{
"category": "description",
"text": "An out-of-bounds r/w access issue was found in QEMU\u0027s Cirrus CLGD 54xx VGA Emulator support. The vulnerability could occur while copying VGA data via various bitblt functions. A privileged user inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: display: cirrus: OOB r/w access issues in bitblt routines",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-7980"
},
{
"category": "external",
"summary": "RHBZ#1444371",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1444371"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-7980",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7980"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-7980",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7980"
}
],
"release_date": "2017-03-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-04-18T13:55:36+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:0988"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:A/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Qemu: display: cirrus: OOB r/w access issues in bitblt routines"
}
]
}
rhsa-2017_0987
Vulnerability from csaf_redhat
Published
2017-04-18 12:32
Modified
2024-11-14 21:42
Summary
Red Hat Security Advisory: qemu-kvm security update
Notes
Topic
An update for qemu-kvm is now available for Red Hat Enterprise Linux 7.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM.
Security Fix(es):
* A heap buffer overflow flaw was found in QEMU's Cirrus CLGD 54xx VGA emulator's VNC display driver support; the issue could occur when a VNC client attempted to update its display after a VGA operation is performed by a guest. A privileged user/process inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process. (CVE-2016-9603)
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for qemu-kvm is now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM.\n\nSecurity Fix(es):\n\n* A heap buffer overflow flaw was found in QEMU\u0027s Cirrus CLGD 54xx VGA emulator\u0027s VNC display driver support; the issue could occur when a VNC client attempted to update its display after a VGA operation is performed by a guest. A privileged user/process inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process. (CVE-2016-9603)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2017:0987",
"url": "https://access.redhat.com/errata/RHSA-2017:0987"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "1430056",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1430056"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_0987.json"
}
],
"title": "Red Hat Security Advisory: qemu-kvm security update",
"tracking": {
"current_release_date": "2024-11-14T21:42:44+00:00",
"generator": {
"date": "2024-11-14T21:42:44+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2017:0987",
"initial_release_date": "2017-04-18T12:32:47+00:00",
"revision_history": [
{
"date": "2017-04-18T12:32:47+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2017-04-18T12:32:47+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-14T21:42:44+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Client (v. 7)",
"product": {
"name": "Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client-7.3.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:7::client"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product": {
"name": "Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional-7.3.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:7::computenode"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Server (v. 7)",
"product": {
"name": "Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.3.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:7::server"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Workstation (v. 7)",
"product": {
"name": "Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.3.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:7::workstation"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-kvm-10:1.5.3-126.el7_3.6.x86_64",
"product": {
"name": "qemu-kvm-10:1.5.3-126.el7_3.6.x86_64",
"product_id": "qemu-kvm-10:1.5.3-126.el7_3.6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm@1.5.3-126.el7_3.6?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-img-10:1.5.3-126.el7_3.6.x86_64",
"product": {
"name": "qemu-img-10:1.5.3-126.el7_3.6.x86_64",
"product_id": "qemu-img-10:1.5.3-126.el7_3.6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-img@1.5.3-126.el7_3.6?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.6.x86_64",
"product": {
"name": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.6.x86_64",
"product_id": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-debuginfo@1.5.3-126.el7_3.6?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-common-10:1.5.3-126.el7_3.6.x86_64",
"product": {
"name": "qemu-kvm-common-10:1.5.3-126.el7_3.6.x86_64",
"product_id": "qemu-kvm-common-10:1.5.3-126.el7_3.6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-common@1.5.3-126.el7_3.6?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-tools-10:1.5.3-126.el7_3.6.x86_64",
"product": {
"name": "qemu-kvm-tools-10:1.5.3-126.el7_3.6.x86_64",
"product_id": "qemu-kvm-tools-10:1.5.3-126.el7_3.6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-tools@1.5.3-126.el7_3.6?arch=x86_64\u0026epoch=10"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-kvm-10:1.5.3-126.el7_3.6.src",
"product": {
"name": "qemu-kvm-10:1.5.3-126.el7_3.6.src",
"product_id": "qemu-kvm-10:1.5.3-126.el7_3.6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm@1.5.3-126.el7_3.6?arch=src\u0026epoch=10"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-img-10:1.5.3-126.el7_3.6.ppc64",
"product": {
"name": "qemu-img-10:1.5.3-126.el7_3.6.ppc64",
"product_id": "qemu-img-10:1.5.3-126.el7_3.6.ppc64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-img@1.5.3-126.el7_3.6?arch=ppc64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.6.ppc64",
"product": {
"name": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.6.ppc64",
"product_id": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.6.ppc64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-debuginfo@1.5.3-126.el7_3.6?arch=ppc64\u0026epoch=10"
}
}
}
],
"category": "architecture",
"name": "ppc64"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-img-10:1.5.3-126.el7_3.6.ppc64le",
"product": {
"name": "qemu-img-10:1.5.3-126.el7_3.6.ppc64le",
"product_id": "qemu-img-10:1.5.3-126.el7_3.6.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-img@1.5.3-126.el7_3.6?arch=ppc64le\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.6.ppc64le",
"product": {
"name": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.6.ppc64le",
"product_id": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.6.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-debuginfo@1.5.3-126.el7_3.6?arch=ppc64le\u0026epoch=10"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-10:1.5.3-126.el7_3.6.ppc64 as a component of Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client-7.3.Z:qemu-img-10:1.5.3-126.el7_3.6.ppc64"
},
"product_reference": "qemu-img-10:1.5.3-126.el7_3.6.ppc64",
"relates_to_product_reference": "7Client-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-10:1.5.3-126.el7_3.6.ppc64le as a component of Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client-7.3.Z:qemu-img-10:1.5.3-126.el7_3.6.ppc64le"
},
"product_reference": "qemu-img-10:1.5.3-126.el7_3.6.ppc64le",
"relates_to_product_reference": "7Client-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-10:1.5.3-126.el7_3.6.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client-7.3.Z:qemu-img-10:1.5.3-126.el7_3.6.x86_64"
},
"product_reference": "qemu-img-10:1.5.3-126.el7_3.6.x86_64",
"relates_to_product_reference": "7Client-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-10:1.5.3-126.el7_3.6.src as a component of Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.6.src"
},
"product_reference": "qemu-kvm-10:1.5.3-126.el7_3.6.src",
"relates_to_product_reference": "7Client-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-10:1.5.3-126.el7_3.6.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.6.x86_64"
},
"product_reference": "qemu-kvm-10:1.5.3-126.el7_3.6.x86_64",
"relates_to_product_reference": "7Client-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-common-10:1.5.3-126.el7_3.6.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client-7.3.Z:qemu-kvm-common-10:1.5.3-126.el7_3.6.x86_64"
},
"product_reference": "qemu-kvm-common-10:1.5.3-126.el7_3.6.x86_64",
"relates_to_product_reference": "7Client-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.6.ppc64 as a component of Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.6.ppc64"
},
"product_reference": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.6.ppc64",
"relates_to_product_reference": "7Client-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.6.ppc64le as a component of Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.6.ppc64le"
},
"product_reference": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.6.ppc64le",
"relates_to_product_reference": "7Client-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.6.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.6.x86_64"
},
"product_reference": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.6.x86_64",
"relates_to_product_reference": "7Client-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-tools-10:1.5.3-126.el7_3.6.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client-7.3.Z:qemu-kvm-tools-10:1.5.3-126.el7_3.6.x86_64"
},
"product_reference": "qemu-kvm-tools-10:1.5.3-126.el7_3.6.x86_64",
"relates_to_product_reference": "7Client-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-10:1.5.3-126.el7_3.6.ppc64 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional-7.3.Z:qemu-img-10:1.5.3-126.el7_3.6.ppc64"
},
"product_reference": "qemu-img-10:1.5.3-126.el7_3.6.ppc64",
"relates_to_product_reference": "7ComputeNode-optional-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-10:1.5.3-126.el7_3.6.ppc64le as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional-7.3.Z:qemu-img-10:1.5.3-126.el7_3.6.ppc64le"
},
"product_reference": "qemu-img-10:1.5.3-126.el7_3.6.ppc64le",
"relates_to_product_reference": "7ComputeNode-optional-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-10:1.5.3-126.el7_3.6.x86_64 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional-7.3.Z:qemu-img-10:1.5.3-126.el7_3.6.x86_64"
},
"product_reference": "qemu-img-10:1.5.3-126.el7_3.6.x86_64",
"relates_to_product_reference": "7ComputeNode-optional-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-10:1.5.3-126.el7_3.6.src as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.6.src"
},
"product_reference": "qemu-kvm-10:1.5.3-126.el7_3.6.src",
"relates_to_product_reference": "7ComputeNode-optional-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-10:1.5.3-126.el7_3.6.x86_64 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.6.x86_64"
},
"product_reference": "qemu-kvm-10:1.5.3-126.el7_3.6.x86_64",
"relates_to_product_reference": "7ComputeNode-optional-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-common-10:1.5.3-126.el7_3.6.x86_64 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional-7.3.Z:qemu-kvm-common-10:1.5.3-126.el7_3.6.x86_64"
},
"product_reference": "qemu-kvm-common-10:1.5.3-126.el7_3.6.x86_64",
"relates_to_product_reference": "7ComputeNode-optional-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.6.ppc64 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.6.ppc64"
},
"product_reference": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.6.ppc64",
"relates_to_product_reference": "7ComputeNode-optional-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.6.ppc64le as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.6.ppc64le"
},
"product_reference": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.6.ppc64le",
"relates_to_product_reference": "7ComputeNode-optional-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.6.x86_64 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.6.x86_64"
},
"product_reference": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.6.x86_64",
"relates_to_product_reference": "7ComputeNode-optional-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-tools-10:1.5.3-126.el7_3.6.x86_64 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional-7.3.Z:qemu-kvm-tools-10:1.5.3-126.el7_3.6.x86_64"
},
"product_reference": "qemu-kvm-tools-10:1.5.3-126.el7_3.6.x86_64",
"relates_to_product_reference": "7ComputeNode-optional-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-10:1.5.3-126.el7_3.6.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.3.Z:qemu-img-10:1.5.3-126.el7_3.6.ppc64"
},
"product_reference": "qemu-img-10:1.5.3-126.el7_3.6.ppc64",
"relates_to_product_reference": "7Server-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-10:1.5.3-126.el7_3.6.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.3.Z:qemu-img-10:1.5.3-126.el7_3.6.ppc64le"
},
"product_reference": "qemu-img-10:1.5.3-126.el7_3.6.ppc64le",
"relates_to_product_reference": "7Server-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-10:1.5.3-126.el7_3.6.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.3.Z:qemu-img-10:1.5.3-126.el7_3.6.x86_64"
},
"product_reference": "qemu-img-10:1.5.3-126.el7_3.6.x86_64",
"relates_to_product_reference": "7Server-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-10:1.5.3-126.el7_3.6.src as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.6.src"
},
"product_reference": "qemu-kvm-10:1.5.3-126.el7_3.6.src",
"relates_to_product_reference": "7Server-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-10:1.5.3-126.el7_3.6.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.6.x86_64"
},
"product_reference": "qemu-kvm-10:1.5.3-126.el7_3.6.x86_64",
"relates_to_product_reference": "7Server-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-common-10:1.5.3-126.el7_3.6.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.3.Z:qemu-kvm-common-10:1.5.3-126.el7_3.6.x86_64"
},
"product_reference": "qemu-kvm-common-10:1.5.3-126.el7_3.6.x86_64",
"relates_to_product_reference": "7Server-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.6.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.6.ppc64"
},
"product_reference": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.6.ppc64",
"relates_to_product_reference": "7Server-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.6.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.6.ppc64le"
},
"product_reference": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.6.ppc64le",
"relates_to_product_reference": "7Server-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.6.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.6.x86_64"
},
"product_reference": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.6.x86_64",
"relates_to_product_reference": "7Server-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-tools-10:1.5.3-126.el7_3.6.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.3.Z:qemu-kvm-tools-10:1.5.3-126.el7_3.6.x86_64"
},
"product_reference": "qemu-kvm-tools-10:1.5.3-126.el7_3.6.x86_64",
"relates_to_product_reference": "7Server-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-10:1.5.3-126.el7_3.6.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.3.Z:qemu-img-10:1.5.3-126.el7_3.6.ppc64"
},
"product_reference": "qemu-img-10:1.5.3-126.el7_3.6.ppc64",
"relates_to_product_reference": "7Workstation-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-10:1.5.3-126.el7_3.6.ppc64le as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.3.Z:qemu-img-10:1.5.3-126.el7_3.6.ppc64le"
},
"product_reference": "qemu-img-10:1.5.3-126.el7_3.6.ppc64le",
"relates_to_product_reference": "7Workstation-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-10:1.5.3-126.el7_3.6.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.3.Z:qemu-img-10:1.5.3-126.el7_3.6.x86_64"
},
"product_reference": "qemu-img-10:1.5.3-126.el7_3.6.x86_64",
"relates_to_product_reference": "7Workstation-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-10:1.5.3-126.el7_3.6.src as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.6.src"
},
"product_reference": "qemu-kvm-10:1.5.3-126.el7_3.6.src",
"relates_to_product_reference": "7Workstation-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-10:1.5.3-126.el7_3.6.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.6.x86_64"
},
"product_reference": "qemu-kvm-10:1.5.3-126.el7_3.6.x86_64",
"relates_to_product_reference": "7Workstation-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-common-10:1.5.3-126.el7_3.6.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.3.Z:qemu-kvm-common-10:1.5.3-126.el7_3.6.x86_64"
},
"product_reference": "qemu-kvm-common-10:1.5.3-126.el7_3.6.x86_64",
"relates_to_product_reference": "7Workstation-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.6.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.6.ppc64"
},
"product_reference": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.6.ppc64",
"relates_to_product_reference": "7Workstation-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.6.ppc64le as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.6.ppc64le"
},
"product_reference": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.6.ppc64le",
"relates_to_product_reference": "7Workstation-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.6.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.6.x86_64"
},
"product_reference": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.6.x86_64",
"relates_to_product_reference": "7Workstation-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-tools-10:1.5.3-126.el7_3.6.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.3.Z:qemu-kvm-tools-10:1.5.3-126.el7_3.6.x86_64"
},
"product_reference": "qemu-kvm-tools-10:1.5.3-126.el7_3.6.x86_64",
"relates_to_product_reference": "7Workstation-7.3.Z"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2016-9603",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2016-11-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1430056"
}
],
"notes": [
{
"category": "description",
"text": "A heap buffer overflow flaw was found in QEMU\u0027s Cirrus CLGD 54xx VGA emulator\u0027s VNC display driver support; the issue could occur when a VNC client attempted to update its display after a VGA operation is performed by a guest. A privileged user/process inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: cirrus: heap buffer overflow via vnc connection",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Client-7.3.Z:qemu-img-10:1.5.3-126.el7_3.6.ppc64",
"7Client-7.3.Z:qemu-img-10:1.5.3-126.el7_3.6.ppc64le",
"7Client-7.3.Z:qemu-img-10:1.5.3-126.el7_3.6.x86_64",
"7Client-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.6.src",
"7Client-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.6.x86_64",
"7Client-7.3.Z:qemu-kvm-common-10:1.5.3-126.el7_3.6.x86_64",
"7Client-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.6.ppc64",
"7Client-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.6.ppc64le",
"7Client-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.6.x86_64",
"7Client-7.3.Z:qemu-kvm-tools-10:1.5.3-126.el7_3.6.x86_64",
"7ComputeNode-optional-7.3.Z:qemu-img-10:1.5.3-126.el7_3.6.ppc64",
"7ComputeNode-optional-7.3.Z:qemu-img-10:1.5.3-126.el7_3.6.ppc64le",
"7ComputeNode-optional-7.3.Z:qemu-img-10:1.5.3-126.el7_3.6.x86_64",
"7ComputeNode-optional-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.6.src",
"7ComputeNode-optional-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.6.x86_64",
"7ComputeNode-optional-7.3.Z:qemu-kvm-common-10:1.5.3-126.el7_3.6.x86_64",
"7ComputeNode-optional-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.6.ppc64",
"7ComputeNode-optional-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.6.ppc64le",
"7ComputeNode-optional-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.6.x86_64",
"7ComputeNode-optional-7.3.Z:qemu-kvm-tools-10:1.5.3-126.el7_3.6.x86_64",
"7Server-7.3.Z:qemu-img-10:1.5.3-126.el7_3.6.ppc64",
"7Server-7.3.Z:qemu-img-10:1.5.3-126.el7_3.6.ppc64le",
"7Server-7.3.Z:qemu-img-10:1.5.3-126.el7_3.6.x86_64",
"7Server-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.6.src",
"7Server-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.6.x86_64",
"7Server-7.3.Z:qemu-kvm-common-10:1.5.3-126.el7_3.6.x86_64",
"7Server-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.6.ppc64",
"7Server-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.6.ppc64le",
"7Server-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.6.x86_64",
"7Server-7.3.Z:qemu-kvm-tools-10:1.5.3-126.el7_3.6.x86_64",
"7Workstation-7.3.Z:qemu-img-10:1.5.3-126.el7_3.6.ppc64",
"7Workstation-7.3.Z:qemu-img-10:1.5.3-126.el7_3.6.ppc64le",
"7Workstation-7.3.Z:qemu-img-10:1.5.3-126.el7_3.6.x86_64",
"7Workstation-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.6.src",
"7Workstation-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.6.x86_64",
"7Workstation-7.3.Z:qemu-kvm-common-10:1.5.3-126.el7_3.6.x86_64",
"7Workstation-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.6.ppc64",
"7Workstation-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.6.ppc64le",
"7Workstation-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.6.x86_64",
"7Workstation-7.3.Z:qemu-kvm-tools-10:1.5.3-126.el7_3.6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-9603"
},
{
"category": "external",
"summary": "RHBZ#1430056",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1430056"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-9603",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-9603"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-9603",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-9603"
}
],
"release_date": "2017-03-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-04-18T12:32:47+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"7Client-7.3.Z:qemu-img-10:1.5.3-126.el7_3.6.ppc64",
"7Client-7.3.Z:qemu-img-10:1.5.3-126.el7_3.6.ppc64le",
"7Client-7.3.Z:qemu-img-10:1.5.3-126.el7_3.6.x86_64",
"7Client-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.6.src",
"7Client-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.6.x86_64",
"7Client-7.3.Z:qemu-kvm-common-10:1.5.3-126.el7_3.6.x86_64",
"7Client-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.6.ppc64",
"7Client-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.6.ppc64le",
"7Client-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.6.x86_64",
"7Client-7.3.Z:qemu-kvm-tools-10:1.5.3-126.el7_3.6.x86_64",
"7ComputeNode-optional-7.3.Z:qemu-img-10:1.5.3-126.el7_3.6.ppc64",
"7ComputeNode-optional-7.3.Z:qemu-img-10:1.5.3-126.el7_3.6.ppc64le",
"7ComputeNode-optional-7.3.Z:qemu-img-10:1.5.3-126.el7_3.6.x86_64",
"7ComputeNode-optional-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.6.src",
"7ComputeNode-optional-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.6.x86_64",
"7ComputeNode-optional-7.3.Z:qemu-kvm-common-10:1.5.3-126.el7_3.6.x86_64",
"7ComputeNode-optional-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.6.ppc64",
"7ComputeNode-optional-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.6.ppc64le",
"7ComputeNode-optional-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.6.x86_64",
"7ComputeNode-optional-7.3.Z:qemu-kvm-tools-10:1.5.3-126.el7_3.6.x86_64",
"7Server-7.3.Z:qemu-img-10:1.5.3-126.el7_3.6.ppc64",
"7Server-7.3.Z:qemu-img-10:1.5.3-126.el7_3.6.ppc64le",
"7Server-7.3.Z:qemu-img-10:1.5.3-126.el7_3.6.x86_64",
"7Server-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.6.src",
"7Server-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.6.x86_64",
"7Server-7.3.Z:qemu-kvm-common-10:1.5.3-126.el7_3.6.x86_64",
"7Server-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.6.ppc64",
"7Server-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.6.ppc64le",
"7Server-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.6.x86_64",
"7Server-7.3.Z:qemu-kvm-tools-10:1.5.3-126.el7_3.6.x86_64",
"7Workstation-7.3.Z:qemu-img-10:1.5.3-126.el7_3.6.ppc64",
"7Workstation-7.3.Z:qemu-img-10:1.5.3-126.el7_3.6.ppc64le",
"7Workstation-7.3.Z:qemu-img-10:1.5.3-126.el7_3.6.x86_64",
"7Workstation-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.6.src",
"7Workstation-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.6.x86_64",
"7Workstation-7.3.Z:qemu-kvm-common-10:1.5.3-126.el7_3.6.x86_64",
"7Workstation-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.6.ppc64",
"7Workstation-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.6.ppc64le",
"7Workstation-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.6.x86_64",
"7Workstation-7.3.Z:qemu-kvm-tools-10:1.5.3-126.el7_3.6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:0987"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:A/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"7Client-7.3.Z:qemu-img-10:1.5.3-126.el7_3.6.ppc64",
"7Client-7.3.Z:qemu-img-10:1.5.3-126.el7_3.6.ppc64le",
"7Client-7.3.Z:qemu-img-10:1.5.3-126.el7_3.6.x86_64",
"7Client-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.6.src",
"7Client-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.6.x86_64",
"7Client-7.3.Z:qemu-kvm-common-10:1.5.3-126.el7_3.6.x86_64",
"7Client-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.6.ppc64",
"7Client-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.6.ppc64le",
"7Client-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.6.x86_64",
"7Client-7.3.Z:qemu-kvm-tools-10:1.5.3-126.el7_3.6.x86_64",
"7ComputeNode-optional-7.3.Z:qemu-img-10:1.5.3-126.el7_3.6.ppc64",
"7ComputeNode-optional-7.3.Z:qemu-img-10:1.5.3-126.el7_3.6.ppc64le",
"7ComputeNode-optional-7.3.Z:qemu-img-10:1.5.3-126.el7_3.6.x86_64",
"7ComputeNode-optional-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.6.src",
"7ComputeNode-optional-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.6.x86_64",
"7ComputeNode-optional-7.3.Z:qemu-kvm-common-10:1.5.3-126.el7_3.6.x86_64",
"7ComputeNode-optional-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.6.ppc64",
"7ComputeNode-optional-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.6.ppc64le",
"7ComputeNode-optional-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.6.x86_64",
"7ComputeNode-optional-7.3.Z:qemu-kvm-tools-10:1.5.3-126.el7_3.6.x86_64",
"7Server-7.3.Z:qemu-img-10:1.5.3-126.el7_3.6.ppc64",
"7Server-7.3.Z:qemu-img-10:1.5.3-126.el7_3.6.ppc64le",
"7Server-7.3.Z:qemu-img-10:1.5.3-126.el7_3.6.x86_64",
"7Server-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.6.src",
"7Server-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.6.x86_64",
"7Server-7.3.Z:qemu-kvm-common-10:1.5.3-126.el7_3.6.x86_64",
"7Server-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.6.ppc64",
"7Server-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.6.ppc64le",
"7Server-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.6.x86_64",
"7Server-7.3.Z:qemu-kvm-tools-10:1.5.3-126.el7_3.6.x86_64",
"7Workstation-7.3.Z:qemu-img-10:1.5.3-126.el7_3.6.ppc64",
"7Workstation-7.3.Z:qemu-img-10:1.5.3-126.el7_3.6.ppc64le",
"7Workstation-7.3.Z:qemu-img-10:1.5.3-126.el7_3.6.x86_64",
"7Workstation-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.6.src",
"7Workstation-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.6.x86_64",
"7Workstation-7.3.Z:qemu-kvm-common-10:1.5.3-126.el7_3.6.x86_64",
"7Workstation-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.6.ppc64",
"7Workstation-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.6.ppc64le",
"7Workstation-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.6.x86_64",
"7Workstation-7.3.Z:qemu-kvm-tools-10:1.5.3-126.el7_3.6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Qemu: cirrus: heap buffer overflow via vnc connection"
}
]
}
rhsa-2017_0980
Vulnerability from csaf_redhat
Published
2017-04-18 04:56
Modified
2024-11-14 23:33
Summary
Red Hat Security Advisory: qemu-kvm-rhev security update
Notes
Topic
An update for qemu-kvm-rhev is now available for Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-rhev packages provide the user-space component for running virtual machines that use KVM in environments managed by Red Hat products.
Security Fix(es):
* Quick Emulator (QEMU), built with the Cirrus CLGD 54xx VGA Emulator and the VNC display driver support, is vulnerable to a heap buffer overflow issue. The issue could occur when a VNC client attempts to update its display after a VGA operation is performed by a guest. A privileged user/process inside guest could use this flaw to crash the QEMU process resulting in DoS or, potentially, leverage it to execute arbitrary code on the host with privileges of the QEMU process. (CVE-2016-9603)
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for qemu-kvm-rhev is now available for Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-rhev packages provide the user-space component for running virtual machines that use KVM in environments managed by Red Hat products.\n\nSecurity Fix(es):\n\n* Quick Emulator (QEMU), built with the Cirrus CLGD 54xx VGA Emulator and the VNC display driver support, is vulnerable to a heap buffer overflow issue. The issue could occur when a VNC client attempts to update its display after a VGA operation is performed by a guest. A privileged user/process inside guest could use this flaw to crash the QEMU process resulting in DoS or, potentially, leverage it to execute arbitrary code on the host with privileges of the QEMU process. (CVE-2016-9603)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2017:0980",
"url": "https://access.redhat.com/errata/RHSA-2017:0980"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "1430056",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1430056"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_0980.json"
}
],
"title": "Red Hat Security Advisory: qemu-kvm-rhev security update",
"tracking": {
"current_release_date": "2024-11-14T23:33:28+00:00",
"generator": {
"date": "2024-11-14T23:33:28+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2017:0980",
"initial_release_date": "2017-04-18T04:56:54+00:00",
"revision_history": [
{
"date": "2017-04-18T04:56:54+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2017-04-18T04:56:54+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-14T23:33:28+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7",
"product": {
"name": "Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7",
"product_id": "7Server-RH7-RHOS-5.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openstack:5::el7"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenStack Platform"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_id": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev@2.6.0-28.el7_3.9?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"product": {
"name": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"product_id": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev-debuginfo@2.6.0-28.el7_3.9?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product": {
"name": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_id": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-tools-rhev@2.6.0-28.el7_3.9?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product": {
"name": "qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_id": "qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-img-rhev@2.6.0-28.el7_3.9?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product": {
"name": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_id": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-common-rhev@2.6.0-28.el7_3.9?arch=x86_64\u0026epoch=10"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"product": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"product_id": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev@2.6.0-28.el7_3.9?arch=src\u0026epoch=10"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7",
"product_id": "7Server-RH7-RHOS-5.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64"
},
"product_reference": "qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-5.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7",
"product_id": "7Server-RH7-RHOS-5.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64"
},
"product_reference": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-5.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7",
"product_id": "7Server-RH7-RHOS-5.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src"
},
"product_reference": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"relates_to_product_reference": "7Server-RH7-RHOS-5.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7",
"product_id": "7Server-RH7-RHOS-5.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64"
},
"product_reference": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-5.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7",
"product_id": "7Server-RH7-RHOS-5.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64"
},
"product_reference": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-5.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7",
"product_id": "7Server-RH7-RHOS-5.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
},
"product_reference": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-5.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2016-9603",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2016-11-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1430056"
}
],
"notes": [
{
"category": "description",
"text": "A heap buffer overflow flaw was found in QEMU\u0027s Cirrus CLGD 54xx VGA emulator\u0027s VNC display driver support; the issue could occur when a VNC client attempted to update its display after a VGA operation is performed by a guest. A privileged user/process inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: cirrus: heap buffer overflow via vnc connection",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-5.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-5.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-9603"
},
{
"category": "external",
"summary": "RHBZ#1430056",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1430056"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-9603",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-9603"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-9603",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-9603"
}
],
"release_date": "2017-03-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-04-18T04:56:54+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"7Server-RH7-RHOS-5.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-5.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:0980"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:A/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"7Server-RH7-RHOS-5.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-5.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Qemu: cirrus: heap buffer overflow via vnc connection"
},
{
"acknowledgments": [
{
"names": [
"Jiangxin"
],
"organization": "PSIRT Huawei Inc."
}
],
"cve": "CVE-2017-7718",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2017-03-15T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1443441"
}
],
"notes": [
{
"category": "description",
"text": "An out-of-bounds access issue was found in QEMU\u0027s Cirrus CLGD 54xx VGA Emulator support. The vulnerability could occur while copying VGA data using bitblt functions (for example, cirrus_bitblt_rop_fwd_transp_). A privileged user inside a guest could use this flaw to crash the QEMU process, resulting in denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: display: cirrus: OOB read access issue",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-5.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-5.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-7718"
},
{
"category": "external",
"summary": "RHBZ#1443441",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1443441"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-7718",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7718"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-7718",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7718"
}
],
"release_date": "2017-03-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-04-18T04:56:54+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"7Server-RH7-RHOS-5.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-5.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:0980"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 2.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:A/AC:H/Au:S/C:P/I:N/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.0,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:L",
"version": "3.0"
},
"products": [
"7Server-RH7-RHOS-5.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-5.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Qemu: display: cirrus: OOB read access issue"
},
{
"acknowledgments": [
{
"names": [
"Jiangxin"
],
"organization": "PSIRT Huawei Inc."
},
{
"names": [
"Li Qiang"
],
"organization": "Qihoo 360 Gear Team"
}
],
"cve": "CVE-2017-7980",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2017-02-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1444371"
}
],
"notes": [
{
"category": "description",
"text": "An out-of-bounds r/w access issue was found in QEMU\u0027s Cirrus CLGD 54xx VGA Emulator support. The vulnerability could occur while copying VGA data via various bitblt functions. A privileged user inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: display: cirrus: OOB r/w access issues in bitblt routines",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-5.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-5.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-7980"
},
{
"category": "external",
"summary": "RHBZ#1444371",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1444371"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-7980",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7980"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-7980",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7980"
}
],
"release_date": "2017-03-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-04-18T04:56:54+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"7Server-RH7-RHOS-5.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-5.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:0980"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:A/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"7Server-RH7-RHOS-5.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-5.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Qemu: display: cirrus: OOB r/w access issues in bitblt routines"
}
]
}
rhsa-2017_1206
Vulnerability from csaf_redhat
Published
2017-05-09 12:29
Modified
2024-11-22 10:39
Summary
Red Hat Security Advisory: qemu-kvm security update
Notes
Topic
An update for qemu-kvm is now available for Red Hat Enterprise Linux 6.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm package provides the user-space component for running virtual machines that use KVM.
Security Fix(es):
* A heap buffer overflow flaw was found in QEMU's Cirrus CLGD 54xx VGA emulator's VNC display driver support; the issue could occur when a VNC client attempted to update its display after a VGA operation is performed by a guest. A privileged user/process inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process. (CVE-2016-9603)
* An out-of-bounds r/w access issue was found in QEMU's Cirrus CLGD 54xx VGA Emulator support. The vulnerability could occur while copying VGA data via various bitblt functions. A privileged user inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process. (CVE-2017-7980)
* An out-of-bounds memory access issue was found in QEMU's VNC display driver support. The vulnerability could occur while refreshing the VNC display surface area in the 'vnc_refresh_server_surface'. A user/process inside a guest could use this flaw to crash the QEMU process, resulting in a denial of service. (CVE-2017-2633)
* An out-of-bounds access issue was found in QEMU's Cirrus CLGD 54xx VGA Emulator support. The vulnerability could occur while copying VGA data using bitblt functions (for example, cirrus_bitblt_rop_fwd_transp_). A privileged user inside a guest could use this flaw to crash the QEMU process, resulting in denial of service. (CVE-2017-7718)
Red Hat would like to thank Jiangxin (PSIRT Huawei Inc.) and Li Qiang (Qihoo 360 Gear Team) for reporting CVE-2017-7980 and Jiangxin (PSIRT Huawei Inc.) for reporting CVE-2017-7718.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for qemu-kvm is now available for Red Hat Enterprise Linux 6.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm package provides the user-space component for running virtual machines that use KVM.\n\nSecurity Fix(es):\n\n* A heap buffer overflow flaw was found in QEMU\u0027s Cirrus CLGD 54xx VGA emulator\u0027s VNC display driver support; the issue could occur when a VNC client attempted to update its display after a VGA operation is performed by a guest. A privileged user/process inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process. (CVE-2016-9603)\n\n* An out-of-bounds r/w access issue was found in QEMU\u0027s Cirrus CLGD 54xx VGA Emulator support. The vulnerability could occur while copying VGA data via various bitblt functions. A privileged user inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process. (CVE-2017-7980)\n\n* An out-of-bounds memory access issue was found in QEMU\u0027s VNC display driver support. The vulnerability could occur while refreshing the VNC display surface area in the \u0027vnc_refresh_server_surface\u0027. A user/process inside a guest could use this flaw to crash the QEMU process, resulting in a denial of service. (CVE-2017-2633)\n\n* An out-of-bounds access issue was found in QEMU\u0027s Cirrus CLGD 54xx VGA Emulator support. The vulnerability could occur while copying VGA data using bitblt functions (for example, cirrus_bitblt_rop_fwd_transp_). A privileged user inside a guest could use this flaw to crash the QEMU process, resulting in denial of service. (CVE-2017-7718)\n\nRed Hat would like to thank Jiangxin (PSIRT Huawei Inc.) and Li Qiang (Qihoo 360 Gear Team) for reporting CVE-2017-7980 and Jiangxin (PSIRT Huawei Inc.) for reporting CVE-2017-7718.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2017:1206",
"url": "https://access.redhat.com/errata/RHSA-2017:1206"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "1400438",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1400438"
},
{
"category": "external",
"summary": "1425939",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1425939"
},
{
"category": "external",
"summary": "1430056",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1430056"
},
{
"category": "external",
"summary": "1437060",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1437060"
},
{
"category": "external",
"summary": "1443441",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1443441"
},
{
"category": "external",
"summary": "1444371",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1444371"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_1206.json"
}
],
"title": "Red Hat Security Advisory: qemu-kvm security update",
"tracking": {
"current_release_date": "2024-11-22T10:39:21+00:00",
"generator": {
"date": "2024-11-22T10:39:21+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2017:1206",
"initial_release_date": "2017-05-09T12:29:49+00:00",
"revision_history": [
{
"date": "2017-05-09T12:29:49+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2017-05-09T12:29:49+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-22T10:39:21+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Desktop (v. 6)",
"product": {
"name": "Red Hat Enterprise Linux Desktop (v. 6)",
"product_id": "6Client-6.9.z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:6::client"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux HPC Node (v. 6)",
"product": {
"name": "Red Hat Enterprise Linux HPC Node (v. 6)",
"product_id": "6ComputeNode-6.9.z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:6::computenode"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Server (v. 6)",
"product": {
"name": "Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-6.9.z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:6::server"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Workstation (v. 6)",
"product": {
"name": "Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-6.9.z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:6::workstation"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"product": {
"name": "qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"product_id": "qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-img@0.12.1.2-2.503.el6_9.3?arch=x86_64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"product": {
"name": "qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"product_id": "qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-guest-agent@0.12.1.2-2.503.el6_9.3?arch=x86_64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"product": {
"name": "qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"product_id": "qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-tools@0.12.1.2-2.503.el6_9.3?arch=x86_64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"product": {
"name": "qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"product_id": "qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm@0.12.1.2-2.503.el6_9.3?arch=x86_64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"product": {
"name": "qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"product_id": "qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-debuginfo@0.12.1.2-2.503.el6_9.3?arch=x86_64\u0026epoch=2"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"product": {
"name": "qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"product_id": "qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-guest-agent@0.12.1.2-2.503.el6_9.3?arch=i686\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"product": {
"name": "qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"product_id": "qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-debuginfo@0.12.1.2-2.503.el6_9.3?arch=i686\u0026epoch=2"
}
}
}
],
"category": "architecture",
"name": "i686"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"product": {
"name": "qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"product_id": "qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm@0.12.1.2-2.503.el6_9.3?arch=src\u0026epoch=2"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"product": {
"name": "qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"product_id": "qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-guest-agent@0.12.1.2-2.503.el6_9.3?arch=ppc64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"product": {
"name": "qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"product_id": "qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-debuginfo@0.12.1.2-2.503.el6_9.3?arch=ppc64\u0026epoch=2"
}
}
}
],
"category": "architecture",
"name": "ppc64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686 as a component of Red Hat Enterprise Linux Desktop (v. 6)",
"product_id": "6Client-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686"
},
"product_reference": "qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"relates_to_product_reference": "6Client-6.9.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64 as a component of Red Hat Enterprise Linux Desktop (v. 6)",
"product_id": "6Client-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64"
},
"product_reference": "qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"relates_to_product_reference": "6Client-6.9.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 6)",
"product_id": "6Client-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64"
},
"product_reference": "qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"relates_to_product_reference": "6Client-6.9.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 6)",
"product_id": "6Client-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64"
},
"product_reference": "qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"relates_to_product_reference": "6Client-6.9.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src as a component of Red Hat Enterprise Linux Desktop (v. 6)",
"product_id": "6Client-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src"
},
"product_reference": "qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"relates_to_product_reference": "6Client-6.9.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 6)",
"product_id": "6Client-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64"
},
"product_reference": "qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"relates_to_product_reference": "6Client-6.9.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686 as a component of Red Hat Enterprise Linux Desktop (v. 6)",
"product_id": "6Client-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686"
},
"product_reference": "qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"relates_to_product_reference": "6Client-6.9.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64 as a component of Red Hat Enterprise Linux Desktop (v. 6)",
"product_id": "6Client-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64"
},
"product_reference": "qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"relates_to_product_reference": "6Client-6.9.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 6)",
"product_id": "6Client-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64"
},
"product_reference": "qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"relates_to_product_reference": "6Client-6.9.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 6)",
"product_id": "6Client-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
},
"product_reference": "qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"relates_to_product_reference": "6Client-6.9.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686 as a component of Red Hat Enterprise Linux HPC Node (v. 6)",
"product_id": "6ComputeNode-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686"
},
"product_reference": "qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"relates_to_product_reference": "6ComputeNode-6.9.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64 as a component of Red Hat Enterprise Linux HPC Node (v. 6)",
"product_id": "6ComputeNode-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64"
},
"product_reference": "qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"relates_to_product_reference": "6ComputeNode-6.9.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64 as a component of Red Hat Enterprise Linux HPC Node (v. 6)",
"product_id": "6ComputeNode-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64"
},
"product_reference": "qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"relates_to_product_reference": "6ComputeNode-6.9.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64 as a component of Red Hat Enterprise Linux HPC Node (v. 6)",
"product_id": "6ComputeNode-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64"
},
"product_reference": "qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"relates_to_product_reference": "6ComputeNode-6.9.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src as a component of Red Hat Enterprise Linux HPC Node (v. 6)",
"product_id": "6ComputeNode-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src"
},
"product_reference": "qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"relates_to_product_reference": "6ComputeNode-6.9.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64 as a component of Red Hat Enterprise Linux HPC Node (v. 6)",
"product_id": "6ComputeNode-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64"
},
"product_reference": "qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"relates_to_product_reference": "6ComputeNode-6.9.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686 as a component of Red Hat Enterprise Linux HPC Node (v. 6)",
"product_id": "6ComputeNode-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686"
},
"product_reference": "qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"relates_to_product_reference": "6ComputeNode-6.9.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64 as a component of Red Hat Enterprise Linux HPC Node (v. 6)",
"product_id": "6ComputeNode-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64"
},
"product_reference": "qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"relates_to_product_reference": "6ComputeNode-6.9.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64 as a component of Red Hat Enterprise Linux HPC Node (v. 6)",
"product_id": "6ComputeNode-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64"
},
"product_reference": "qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"relates_to_product_reference": "6ComputeNode-6.9.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64 as a component of Red Hat Enterprise Linux HPC Node (v. 6)",
"product_id": "6ComputeNode-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
},
"product_reference": "qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"relates_to_product_reference": "6ComputeNode-6.9.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686 as a component of Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686"
},
"product_reference": "qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"relates_to_product_reference": "6Server-6.9.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64 as a component of Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64"
},
"product_reference": "qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"relates_to_product_reference": "6Server-6.9.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64 as a component of Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64"
},
"product_reference": "qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"relates_to_product_reference": "6Server-6.9.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64 as a component of Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64"
},
"product_reference": "qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"relates_to_product_reference": "6Server-6.9.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src as a component of Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src"
},
"product_reference": "qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"relates_to_product_reference": "6Server-6.9.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64 as a component of Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64"
},
"product_reference": "qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"relates_to_product_reference": "6Server-6.9.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686 as a component of Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686"
},
"product_reference": "qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"relates_to_product_reference": "6Server-6.9.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64 as a component of Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64"
},
"product_reference": "qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"relates_to_product_reference": "6Server-6.9.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64 as a component of Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64"
},
"product_reference": "qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"relates_to_product_reference": "6Server-6.9.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64 as a component of Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
},
"product_reference": "qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"relates_to_product_reference": "6Server-6.9.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686 as a component of Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686"
},
"product_reference": "qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"relates_to_product_reference": "6Workstation-6.9.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64"
},
"product_reference": "qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"relates_to_product_reference": "6Workstation-6.9.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64"
},
"product_reference": "qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"relates_to_product_reference": "6Workstation-6.9.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64"
},
"product_reference": "qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"relates_to_product_reference": "6Workstation-6.9.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src as a component of Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src"
},
"product_reference": "qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"relates_to_product_reference": "6Workstation-6.9.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64"
},
"product_reference": "qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"relates_to_product_reference": "6Workstation-6.9.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686 as a component of Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686"
},
"product_reference": "qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"relates_to_product_reference": "6Workstation-6.9.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64"
},
"product_reference": "qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"relates_to_product_reference": "6Workstation-6.9.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64"
},
"product_reference": "qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"relates_to_product_reference": "6Workstation-6.9.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
},
"product_reference": "qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"relates_to_product_reference": "6Workstation-6.9.z"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2016-9603",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2016-11-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1430056"
}
],
"notes": [
{
"category": "description",
"text": "A heap buffer overflow flaw was found in QEMU\u0027s Cirrus CLGD 54xx VGA emulator\u0027s VNC display driver support; the issue could occur when a VNC client attempted to update its display after a VGA operation is performed by a guest. A privileged user/process inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: cirrus: heap buffer overflow via vnc connection",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Client-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6Client-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Client-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6Client-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6Client-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Client-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6ComputeNode-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6ComputeNode-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6ComputeNode-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6ComputeNode-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6ComputeNode-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6Server-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Server-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6Server-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6Server-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Server-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6Workstation-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Workstation-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6Workstation-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6Workstation-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Workstation-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-9603"
},
{
"category": "external",
"summary": "RHBZ#1430056",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1430056"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-9603",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-9603"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-9603",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-9603"
}
],
"release_date": "2017-03-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-05-09T12:29:49+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"6Client-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6Client-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Client-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6Client-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6Client-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Client-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6ComputeNode-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6ComputeNode-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6ComputeNode-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6ComputeNode-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6ComputeNode-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6Server-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Server-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6Server-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6Server-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Server-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6Workstation-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Workstation-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6Workstation-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6Workstation-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Workstation-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:1206"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:A/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"6Client-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6Client-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Client-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6Client-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6Client-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Client-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6ComputeNode-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6ComputeNode-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6ComputeNode-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6ComputeNode-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6ComputeNode-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6Server-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Server-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6Server-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6Server-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Server-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6Workstation-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Workstation-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6Workstation-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6Workstation-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Workstation-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Qemu: cirrus: heap buffer overflow via vnc connection"
},
{
"cve": "CVE-2017-2633",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2016-12-01T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1425939"
}
],
"notes": [
{
"category": "description",
"text": "An out-of-bounds memory access issue was found in Quick Emulator (QEMU) in the VNC display driver. This flaw could occur while refreshing the VNC display surface area in the \u0027vnc_refresh_server_surface\u0027. A user inside a guest could use this flaw to crash the QEMU process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: VNC: memory corruption due to unchecked resolution limit",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Client-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6Client-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Client-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6Client-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6Client-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Client-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6ComputeNode-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6ComputeNode-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6ComputeNode-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6ComputeNode-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6ComputeNode-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6Server-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Server-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6Server-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6Server-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Server-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6Workstation-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Workstation-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6Workstation-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6Workstation-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Workstation-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-2633"
},
{
"category": "external",
"summary": "RHBZ#1425939",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1425939"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-2633",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-2633"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-2633",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-2633"
}
],
"release_date": "2016-12-01T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-05-09T12:29:49+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"6Client-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6Client-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Client-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6Client-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6Client-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Client-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6ComputeNode-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6ComputeNode-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6ComputeNode-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6ComputeNode-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6ComputeNode-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6Server-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Server-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6Server-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6Server-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Server-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6Workstation-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Workstation-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6Workstation-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6Workstation-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Workstation-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:1206"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 3.8,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:A/AC:M/Au:S/C:N/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L",
"version": "3.0"
},
"products": [
"6Client-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6Client-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Client-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6Client-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6Client-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Client-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6ComputeNode-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6ComputeNode-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6ComputeNode-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6ComputeNode-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6ComputeNode-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6Server-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Server-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6Server-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6Server-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Server-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6Workstation-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Workstation-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6Workstation-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6Workstation-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Workstation-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Qemu: VNC: memory corruption due to unchecked resolution limit"
},
{
"acknowledgments": [
{
"names": [
"Jiangxin"
],
"organization": "PSIRT Huawei Inc."
}
],
"cve": "CVE-2017-7718",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2017-03-15T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1443441"
}
],
"notes": [
{
"category": "description",
"text": "An out-of-bounds access issue was found in QEMU\u0027s Cirrus CLGD 54xx VGA Emulator support. The vulnerability could occur while copying VGA data using bitblt functions (for example, cirrus_bitblt_rop_fwd_transp_). A privileged user inside a guest could use this flaw to crash the QEMU process, resulting in denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: display: cirrus: OOB read access issue",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Client-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6Client-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Client-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6Client-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6Client-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Client-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6ComputeNode-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6ComputeNode-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6ComputeNode-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6ComputeNode-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6ComputeNode-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6Server-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Server-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6Server-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6Server-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Server-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6Workstation-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Workstation-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6Workstation-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6Workstation-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Workstation-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-7718"
},
{
"category": "external",
"summary": "RHBZ#1443441",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1443441"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-7718",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7718"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-7718",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7718"
}
],
"release_date": "2017-03-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-05-09T12:29:49+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"6Client-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6Client-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Client-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6Client-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6Client-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Client-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6ComputeNode-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6ComputeNode-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6ComputeNode-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6ComputeNode-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6ComputeNode-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6Server-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Server-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6Server-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6Server-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Server-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6Workstation-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Workstation-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6Workstation-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6Workstation-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Workstation-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:1206"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 2.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:A/AC:H/Au:S/C:P/I:N/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.0,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:L",
"version": "3.0"
},
"products": [
"6Client-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6Client-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Client-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6Client-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6Client-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Client-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6ComputeNode-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6ComputeNode-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6ComputeNode-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6ComputeNode-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6ComputeNode-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6Server-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Server-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6Server-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6Server-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Server-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6Workstation-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Workstation-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6Workstation-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6Workstation-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Workstation-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Qemu: display: cirrus: OOB read access issue"
},
{
"acknowledgments": [
{
"names": [
"Jiangxin"
],
"organization": "PSIRT Huawei Inc."
},
{
"names": [
"Li Qiang"
],
"organization": "Qihoo 360 Gear Team"
}
],
"cve": "CVE-2017-7980",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2017-02-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1444371"
}
],
"notes": [
{
"category": "description",
"text": "An out-of-bounds r/w access issue was found in QEMU\u0027s Cirrus CLGD 54xx VGA Emulator support. The vulnerability could occur while copying VGA data via various bitblt functions. A privileged user inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: display: cirrus: OOB r/w access issues in bitblt routines",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Client-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6Client-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Client-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6Client-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6Client-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Client-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6ComputeNode-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6ComputeNode-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6ComputeNode-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6ComputeNode-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6ComputeNode-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6Server-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Server-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6Server-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6Server-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Server-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6Workstation-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Workstation-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6Workstation-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6Workstation-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Workstation-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-7980"
},
{
"category": "external",
"summary": "RHBZ#1444371",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1444371"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-7980",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7980"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-7980",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7980"
}
],
"release_date": "2017-03-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-05-09T12:29:49+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"6Client-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6Client-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Client-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6Client-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6Client-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Client-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6ComputeNode-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6ComputeNode-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6ComputeNode-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6ComputeNode-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6ComputeNode-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6Server-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Server-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6Server-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6Server-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Server-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6Workstation-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Workstation-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6Workstation-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6Workstation-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Workstation-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:1206"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:A/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"6Client-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6Client-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Client-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6Client-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6Client-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Client-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6ComputeNode-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6ComputeNode-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6ComputeNode-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6ComputeNode-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6ComputeNode-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6Server-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Server-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6Server-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6Server-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Server-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6Workstation-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Workstation-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6Workstation-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6Workstation-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Workstation-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Qemu: display: cirrus: OOB r/w access issues in bitblt routines"
}
]
}
rhsa-2017_0982
Vulnerability from csaf_redhat
Published
2017-04-18 04:56
Modified
2024-11-14 23:33
Summary
Red Hat Security Advisory: qemu-kvm-rhev security update
Notes
Topic
An update for qemu-kvm-rhev is now available for Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-rhev packages provide the user-space component for running virtual machines that use KVM in environments managed by Red Hat products.
Security Fix(es):
* Quick Emulator (QEMU), built with the Cirrus CLGD 54xx VGA Emulator and the VNC display driver support, is vulnerable to a heap buffer overflow issue. The issue could occur when a VNC client attempts to update its display after a VGA operation is performed by a guest. A privileged user/process inside guest could use this flaw to crash the QEMU process resulting in DoS or, potentially, leverage it to execute arbitrary code on the host with privileges of the QEMU process. (CVE-2016-9603)
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for qemu-kvm-rhev is now available for Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-rhev packages provide the user-space component for running virtual machines that use KVM in environments managed by Red Hat products.\n\nSecurity Fix(es):\n\n* Quick Emulator (QEMU), built with the Cirrus CLGD 54xx VGA Emulator and the VNC display driver support, is vulnerable to a heap buffer overflow issue. The issue could occur when a VNC client attempts to update its display after a VGA operation is performed by a guest. A privileged user/process inside guest could use this flaw to crash the QEMU process resulting in DoS or, potentially, leverage it to execute arbitrary code on the host with privileges of the QEMU process. (CVE-2016-9603)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2017:0982",
"url": "https://access.redhat.com/errata/RHSA-2017:0982"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "1430056",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1430056"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_0982.json"
}
],
"title": "Red Hat Security Advisory: qemu-kvm-rhev security update",
"tracking": {
"current_release_date": "2024-11-14T23:33:55+00:00",
"generator": {
"date": "2024-11-14T23:33:55+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2017:0982",
"initial_release_date": "2017-04-18T04:56:28+00:00",
"revision_history": [
{
"date": "2017-04-18T04:56:28+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2017-04-18T04:56:28+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-14T23:33:55+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7",
"product": {
"name": "Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7",
"product_id": "7Server-RH7-RHOS-7.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openstack:7::el7"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenStack Platform"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_id": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev@2.6.0-28.el7_3.9?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"product": {
"name": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"product_id": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev-debuginfo@2.6.0-28.el7_3.9?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product": {
"name": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_id": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-tools-rhev@2.6.0-28.el7_3.9?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product": {
"name": "qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_id": "qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-img-rhev@2.6.0-28.el7_3.9?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product": {
"name": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_id": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-common-rhev@2.6.0-28.el7_3.9?arch=x86_64\u0026epoch=10"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"product": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"product_id": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev@2.6.0-28.el7_3.9?arch=src\u0026epoch=10"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7",
"product_id": "7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64"
},
"product_reference": "qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7",
"product_id": "7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64"
},
"product_reference": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src as a component of Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7",
"product_id": "7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src"
},
"product_reference": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"relates_to_product_reference": "7Server-RH7-RHOS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7",
"product_id": "7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64"
},
"product_reference": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7",
"product_id": "7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64"
},
"product_reference": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7",
"product_id": "7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
},
"product_reference": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-7.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2016-9603",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2016-11-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1430056"
}
],
"notes": [
{
"category": "description",
"text": "A heap buffer overflow flaw was found in QEMU\u0027s Cirrus CLGD 54xx VGA emulator\u0027s VNC display driver support; the issue could occur when a VNC client attempted to update its display after a VGA operation is performed by a guest. A privileged user/process inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: cirrus: heap buffer overflow via vnc connection",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-9603"
},
{
"category": "external",
"summary": "RHBZ#1430056",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1430056"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-9603",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-9603"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-9603",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-9603"
}
],
"release_date": "2017-03-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-04-18T04:56:28+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:0982"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:A/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Qemu: cirrus: heap buffer overflow via vnc connection"
},
{
"acknowledgments": [
{
"names": [
"Jiangxin"
],
"organization": "PSIRT Huawei Inc."
}
],
"cve": "CVE-2017-7718",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2017-03-15T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1443441"
}
],
"notes": [
{
"category": "description",
"text": "An out-of-bounds access issue was found in QEMU\u0027s Cirrus CLGD 54xx VGA Emulator support. The vulnerability could occur while copying VGA data using bitblt functions (for example, cirrus_bitblt_rop_fwd_transp_). A privileged user inside a guest could use this flaw to crash the QEMU process, resulting in denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: display: cirrus: OOB read access issue",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-7718"
},
{
"category": "external",
"summary": "RHBZ#1443441",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1443441"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-7718",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7718"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-7718",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7718"
}
],
"release_date": "2017-03-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-04-18T04:56:28+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:0982"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 2.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:A/AC:H/Au:S/C:P/I:N/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.0,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:L",
"version": "3.0"
},
"products": [
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Qemu: display: cirrus: OOB read access issue"
},
{
"acknowledgments": [
{
"names": [
"Jiangxin"
],
"organization": "PSIRT Huawei Inc."
},
{
"names": [
"Li Qiang"
],
"organization": "Qihoo 360 Gear Team"
}
],
"cve": "CVE-2017-7980",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2017-02-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1444371"
}
],
"notes": [
{
"category": "description",
"text": "An out-of-bounds r/w access issue was found in QEMU\u0027s Cirrus CLGD 54xx VGA Emulator support. The vulnerability could occur while copying VGA data via various bitblt functions. A privileged user inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: display: cirrus: OOB r/w access issues in bitblt routines",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-7980"
},
{
"category": "external",
"summary": "RHBZ#1444371",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1444371"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-7980",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7980"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-7980",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7980"
}
],
"release_date": "2017-03-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-04-18T04:56:28+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:0982"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:A/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Qemu: display: cirrus: OOB r/w access issues in bitblt routines"
}
]
}
rhsa-2017_0985
Vulnerability from csaf_redhat
Published
2017-04-18 06:06
Modified
2024-11-14 21:42
Summary
Red Hat Security Advisory: qemu-kvm-rhev security, bug fix, and enhancement update
Notes
Topic
An update for qemu-kvm-rhev is now available for Red Hat Virtualization Hypervisor 7.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on AMD64 and Intel 64 systems. The qemu-kvm-rhev packages provide the user-space component for running virtual machines using KVM in environments managed by Red Hat Virtualization Manager.
Security Fix(es):
* Quick Emulator (QEMU), built with the Cirrus CLGD 54xx VGA Emulator and the VNC display driver support, is vulnerable to a heap buffer overflow issue. The issue could occur when a VNC client attempts to update its display after a VGA operation is performed by a guest. A privileged user/process inside guest could use this flaw to crash the QEMU process resulting in DoS or, potentially, leverage it to execute arbitrary code on the host with privileges of the QEMU process. (CVE-2016-9603)
Bug Fix(es):
* When attempting to use a virtual CPU with the "invtsc" feature, the "nonstop_tsc" flag was not set for the guest. This update adjusts the flag to be migrateable, and "nonstop_tsc" is now properly set when requested. (BZ#1413897)
* Previously, the QEMU emulator failed to open disk images with backing files stored on a Gluster volume. This update ensures that QEMU is able to handle Gluster disk URIs correctly, and the problem no longer occurs. (BZ#1425125)
* Prior to this update, creating a new GlusterFS instance in some cases consumed an excessive amount of memory. This update reuses data for existing GlusterFS volumes, which reduces the memory consumption when creating new instances. (BZ#1413044)
* Under certain circumstances, guest machines previously encountered I/O errors or were paused when a large number of block transfer actions was being performed. With this update, QEMU ensures that the number of block transfers does not exceed the host limit, which prevents the described problem. (BZ#1431149)
Enhancement(s):
* The QEMU emulator is now able to present virtual L3 cache information to the guest. This improves the performance and stability of tasks and processes that use L3 cache, such as SAP HANA. (BZ#1430802)
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for qemu-kvm-rhev is now available for Red Hat Virtualization Hypervisor 7.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on AMD64 and Intel 64 systems. The qemu-kvm-rhev packages provide the user-space component for running virtual machines using KVM in environments managed by Red Hat Virtualization Manager.\n\nSecurity Fix(es):\n\n* Quick Emulator (QEMU), built with the Cirrus CLGD 54xx VGA Emulator and the VNC display driver support, is vulnerable to a heap buffer overflow issue. The issue could occur when a VNC client attempts to update its display after a VGA operation is performed by a guest. A privileged user/process inside guest could use this flaw to crash the QEMU process resulting in DoS or, potentially, leverage it to execute arbitrary code on the host with privileges of the QEMU process. (CVE-2016-9603)\n\nBug Fix(es):\n\n* When attempting to use a virtual CPU with the \"invtsc\" feature, the \"nonstop_tsc\" flag was not set for the guest. This update adjusts the flag to be migrateable, and \"nonstop_tsc\" is now properly set when requested. (BZ#1413897)\n\n* Previously, the QEMU emulator failed to open disk images with backing files stored on a Gluster volume. This update ensures that QEMU is able to handle Gluster disk URIs correctly, and the problem no longer occurs. (BZ#1425125)\n\n* Prior to this update, creating a new GlusterFS instance in some cases consumed an excessive amount of memory. This update reuses data for existing GlusterFS volumes, which reduces the memory consumption when creating new instances. (BZ#1413044)\n\n* Under certain circumstances, guest machines previously encountered I/O errors or were paused when a large number of block transfer actions was being performed. With this update, QEMU ensures that the number of block transfers does not exceed the host limit, which prevents the described problem. (BZ#1431149)\n\nEnhancement(s):\n\n* The QEMU emulator is now able to present virtual L3 cache information to the guest. This improves the performance and stability of tasks and processes that use L3 cache, such as SAP HANA. (BZ#1430802)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2017:0985",
"url": "https://access.redhat.com/errata/RHSA-2017:0985"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "1413044",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1413044"
},
{
"category": "external",
"summary": "1413897",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1413897"
},
{
"category": "external",
"summary": "1425125",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1425125"
},
{
"category": "external",
"summary": "1430056",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1430056"
},
{
"category": "external",
"summary": "1430802",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1430802"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_0985.json"
}
],
"title": "Red Hat Security Advisory: qemu-kvm-rhev security, bug fix, and enhancement update",
"tracking": {
"current_release_date": "2024-11-14T21:42:39+00:00",
"generator": {
"date": "2024-11-14T21:42:39+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2017:0985",
"initial_release_date": "2017-04-18T06:06:24+00:00",
"revision_history": [
{
"date": "2017-04-18T06:06:24+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2017-04-18T06:06:24+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-14T21:42:39+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "RHEV-H and VDSM for 7 Hosts",
"product": {
"name": "RHEV-H and VDSM for 7 Hosts",
"product_id": "7Server-RHEV-Agents-7",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:7::hypervisor"
}
}
},
{
"category": "product_name",
"name": "Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts",
"product": {
"name": "Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts",
"product_id": "7Server-RHEV-4-Agents-7",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:7::hypervisor"
}
}
}
],
"category": "product_family",
"name": "Red Hat Virtualization"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_id": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev@2.6.0-28.el7_3.9?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"product": {
"name": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"product_id": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev-debuginfo@2.6.0-28.el7_3.9?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product": {
"name": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_id": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-tools-rhev@2.6.0-28.el7_3.9?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product": {
"name": "qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_id": "qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-img-rhev@2.6.0-28.el7_3.9?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product": {
"name": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_id": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-common-rhev@2.6.0-28.el7_3.9?arch=x86_64\u0026epoch=10"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"product": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"product_id": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev@2.6.0-28.el7_3.9?arch=src\u0026epoch=10"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.ppc64le",
"product": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.ppc64le",
"product_id": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev@2.6.0-28.el7_3.9?arch=ppc64le\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.ppc64le",
"product": {
"name": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.ppc64le",
"product_id": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev-debuginfo@2.6.0-28.el7_3.9?arch=ppc64le\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.ppc64le",
"product": {
"name": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.ppc64le",
"product_id": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-tools-rhev@2.6.0-28.el7_3.9?arch=ppc64le\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-img-rhev-10:2.6.0-28.el7_3.9.ppc64le",
"product": {
"name": "qemu-img-rhev-10:2.6.0-28.el7_3.9.ppc64le",
"product_id": "qemu-img-rhev-10:2.6.0-28.el7_3.9.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-img-rhev@2.6.0-28.el7_3.9?arch=ppc64le\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.ppc64le",
"product": {
"name": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.ppc64le",
"product_id": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-common-rhev@2.6.0-28.el7_3.9?arch=ppc64le\u0026epoch=10"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-rhev-10:2.6.0-28.el7_3.9.ppc64le as a component of Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts",
"product_id": "7Server-RHEV-4-Agents-7:qemu-img-rhev-10:2.6.0-28.el7_3.9.ppc64le"
},
"product_reference": "qemu-img-rhev-10:2.6.0-28.el7_3.9.ppc64le",
"relates_to_product_reference": "7Server-RHEV-4-Agents-7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64 as a component of Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts",
"product_id": "7Server-RHEV-4-Agents-7:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64"
},
"product_reference": "qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"relates_to_product_reference": "7Server-RHEV-4-Agents-7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.ppc64le as a component of Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts",
"product_id": "7Server-RHEV-4-Agents-7:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.ppc64le"
},
"product_reference": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.ppc64le",
"relates_to_product_reference": "7Server-RHEV-4-Agents-7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64 as a component of Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts",
"product_id": "7Server-RHEV-4-Agents-7:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64"
},
"product_reference": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"relates_to_product_reference": "7Server-RHEV-4-Agents-7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.ppc64le as a component of Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts",
"product_id": "7Server-RHEV-4-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.ppc64le"
},
"product_reference": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.ppc64le",
"relates_to_product_reference": "7Server-RHEV-4-Agents-7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src as a component of Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts",
"product_id": "7Server-RHEV-4-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src"
},
"product_reference": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"relates_to_product_reference": "7Server-RHEV-4-Agents-7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64 as a component of Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts",
"product_id": "7Server-RHEV-4-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64"
},
"product_reference": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"relates_to_product_reference": "7Server-RHEV-4-Agents-7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.ppc64le as a component of Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts",
"product_id": "7Server-RHEV-4-Agents-7:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.ppc64le"
},
"product_reference": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.ppc64le",
"relates_to_product_reference": "7Server-RHEV-4-Agents-7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64 as a component of Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts",
"product_id": "7Server-RHEV-4-Agents-7:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64"
},
"product_reference": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"relates_to_product_reference": "7Server-RHEV-4-Agents-7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.ppc64le as a component of Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts",
"product_id": "7Server-RHEV-4-Agents-7:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.ppc64le"
},
"product_reference": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.ppc64le",
"relates_to_product_reference": "7Server-RHEV-4-Agents-7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64 as a component of Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts",
"product_id": "7Server-RHEV-4-Agents-7:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
},
"product_reference": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64",
"relates_to_product_reference": "7Server-RHEV-4-Agents-7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-rhev-10:2.6.0-28.el7_3.9.ppc64le as a component of RHEV-H and VDSM for 7 Hosts",
"product_id": "7Server-RHEV-Agents-7:qemu-img-rhev-10:2.6.0-28.el7_3.9.ppc64le"
},
"product_reference": "qemu-img-rhev-10:2.6.0-28.el7_3.9.ppc64le",
"relates_to_product_reference": "7Server-RHEV-Agents-7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64 as a component of RHEV-H and VDSM for 7 Hosts",
"product_id": "7Server-RHEV-Agents-7:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64"
},
"product_reference": "qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"relates_to_product_reference": "7Server-RHEV-Agents-7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.ppc64le as a component of RHEV-H and VDSM for 7 Hosts",
"product_id": "7Server-RHEV-Agents-7:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.ppc64le"
},
"product_reference": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.ppc64le",
"relates_to_product_reference": "7Server-RHEV-Agents-7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64 as a component of RHEV-H and VDSM for 7 Hosts",
"product_id": "7Server-RHEV-Agents-7:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64"
},
"product_reference": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"relates_to_product_reference": "7Server-RHEV-Agents-7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.ppc64le as a component of RHEV-H and VDSM for 7 Hosts",
"product_id": "7Server-RHEV-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.ppc64le"
},
"product_reference": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.ppc64le",
"relates_to_product_reference": "7Server-RHEV-Agents-7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src as a component of RHEV-H and VDSM for 7 Hosts",
"product_id": "7Server-RHEV-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src"
},
"product_reference": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"relates_to_product_reference": "7Server-RHEV-Agents-7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64 as a component of RHEV-H and VDSM for 7 Hosts",
"product_id": "7Server-RHEV-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64"
},
"product_reference": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"relates_to_product_reference": "7Server-RHEV-Agents-7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.ppc64le as a component of RHEV-H and VDSM for 7 Hosts",
"product_id": "7Server-RHEV-Agents-7:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.ppc64le"
},
"product_reference": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.ppc64le",
"relates_to_product_reference": "7Server-RHEV-Agents-7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64 as a component of RHEV-H and VDSM for 7 Hosts",
"product_id": "7Server-RHEV-Agents-7:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64"
},
"product_reference": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"relates_to_product_reference": "7Server-RHEV-Agents-7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.ppc64le as a component of RHEV-H and VDSM for 7 Hosts",
"product_id": "7Server-RHEV-Agents-7:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.ppc64le"
},
"product_reference": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.ppc64le",
"relates_to_product_reference": "7Server-RHEV-Agents-7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64 as a component of RHEV-H and VDSM for 7 Hosts",
"product_id": "7Server-RHEV-Agents-7:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
},
"product_reference": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64",
"relates_to_product_reference": "7Server-RHEV-Agents-7"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2016-9603",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2016-11-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1430056"
}
],
"notes": [
{
"category": "description",
"text": "A heap buffer overflow flaw was found in QEMU\u0027s Cirrus CLGD 54xx VGA emulator\u0027s VNC display driver support; the issue could occur when a VNC client attempted to update its display after a VGA operation is performed by a guest. A privileged user/process inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: cirrus: heap buffer overflow via vnc connection",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHEV-4-Agents-7:qemu-img-rhev-10:2.6.0-28.el7_3.9.ppc64le",
"7Server-RHEV-4-Agents-7:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RHEV-4-Agents-7:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.ppc64le",
"7Server-RHEV-4-Agents-7:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RHEV-4-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.ppc64le",
"7Server-RHEV-4-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RHEV-4-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RHEV-4-Agents-7:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.ppc64le",
"7Server-RHEV-4-Agents-7:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RHEV-4-Agents-7:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.ppc64le",
"7Server-RHEV-4-Agents-7:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RHEV-Agents-7:qemu-img-rhev-10:2.6.0-28.el7_3.9.ppc64le",
"7Server-RHEV-Agents-7:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RHEV-Agents-7:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.ppc64le",
"7Server-RHEV-Agents-7:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RHEV-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.ppc64le",
"7Server-RHEV-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RHEV-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RHEV-Agents-7:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.ppc64le",
"7Server-RHEV-Agents-7:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RHEV-Agents-7:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.ppc64le",
"7Server-RHEV-Agents-7:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-9603"
},
{
"category": "external",
"summary": "RHBZ#1430056",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1430056"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-9603",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-9603"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-9603",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-9603"
}
],
"release_date": "2017-03-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-04-18T06:06:24+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"7Server-RHEV-4-Agents-7:qemu-img-rhev-10:2.6.0-28.el7_3.9.ppc64le",
"7Server-RHEV-4-Agents-7:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RHEV-4-Agents-7:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.ppc64le",
"7Server-RHEV-4-Agents-7:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RHEV-4-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.ppc64le",
"7Server-RHEV-4-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RHEV-4-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RHEV-4-Agents-7:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.ppc64le",
"7Server-RHEV-4-Agents-7:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RHEV-4-Agents-7:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.ppc64le",
"7Server-RHEV-4-Agents-7:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RHEV-Agents-7:qemu-img-rhev-10:2.6.0-28.el7_3.9.ppc64le",
"7Server-RHEV-Agents-7:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RHEV-Agents-7:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.ppc64le",
"7Server-RHEV-Agents-7:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RHEV-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.ppc64le",
"7Server-RHEV-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RHEV-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RHEV-Agents-7:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.ppc64le",
"7Server-RHEV-Agents-7:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RHEV-Agents-7:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.ppc64le",
"7Server-RHEV-Agents-7:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:0985"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:A/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"7Server-RHEV-4-Agents-7:qemu-img-rhev-10:2.6.0-28.el7_3.9.ppc64le",
"7Server-RHEV-4-Agents-7:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RHEV-4-Agents-7:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.ppc64le",
"7Server-RHEV-4-Agents-7:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RHEV-4-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.ppc64le",
"7Server-RHEV-4-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RHEV-4-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RHEV-4-Agents-7:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.ppc64le",
"7Server-RHEV-4-Agents-7:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RHEV-4-Agents-7:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.ppc64le",
"7Server-RHEV-4-Agents-7:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RHEV-Agents-7:qemu-img-rhev-10:2.6.0-28.el7_3.9.ppc64le",
"7Server-RHEV-Agents-7:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RHEV-Agents-7:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.ppc64le",
"7Server-RHEV-Agents-7:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RHEV-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.ppc64le",
"7Server-RHEV-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RHEV-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RHEV-Agents-7:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.ppc64le",
"7Server-RHEV-Agents-7:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RHEV-Agents-7:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.ppc64le",
"7Server-RHEV-Agents-7:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Qemu: cirrus: heap buffer overflow via vnc connection"
}
]
}
rhsa-2017_0981
Vulnerability from csaf_redhat
Published
2017-04-18 04:56
Modified
2024-11-14 23:34
Summary
Red Hat Security Advisory: qemu-kvm-rhev security update
Notes
Topic
An update for qemu-kvm-rhev is now available for Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-rhev packages provide the user-space component for running virtual machines that use KVM in environments managed by Red Hat products.
Security Fix(es):
* Quick Emulator (QEMU), built with the Cirrus CLGD 54xx VGA Emulator and the VNC display driver support, is vulnerable to a heap buffer overflow issue. The issue could occur when a VNC client attempts to update its display after a VGA operation is performed by a guest. A privileged user/process inside guest could use this flaw to crash the QEMU process resulting in DoS or, potentially, leverage it to execute arbitrary code on the host with privileges of the QEMU process. (CVE-2016-9603)
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for qemu-kvm-rhev is now available for Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-rhev packages provide the user-space component for running virtual machines that use KVM in environments managed by Red Hat products.\n\nSecurity Fix(es):\n\n* Quick Emulator (QEMU), built with the Cirrus CLGD 54xx VGA Emulator and the VNC display driver support, is vulnerable to a heap buffer overflow issue. The issue could occur when a VNC client attempts to update its display after a VGA operation is performed by a guest. A privileged user/process inside guest could use this flaw to crash the QEMU process resulting in DoS or, potentially, leverage it to execute arbitrary code on the host with privileges of the QEMU process. (CVE-2016-9603)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2017:0981",
"url": "https://access.redhat.com/errata/RHSA-2017:0981"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "1430056",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1430056"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_0981.json"
}
],
"title": "Red Hat Security Advisory: qemu-kvm-rhev security update",
"tracking": {
"current_release_date": "2024-11-14T23:34:00+00:00",
"generator": {
"date": "2024-11-14T23:34:00+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2017:0981",
"initial_release_date": "2017-04-18T04:56:42+00:00",
"revision_history": [
{
"date": "2017-04-18T04:56:42+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2017-04-18T04:56:42+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-14T23:34:00+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7",
"product": {
"name": "Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7",
"product_id": "7Server-RH7-RHOS-6.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openstack:6::el7"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenStack Platform"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_id": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev@2.6.0-28.el7_3.9?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"product": {
"name": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"product_id": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev-debuginfo@2.6.0-28.el7_3.9?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product": {
"name": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_id": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-tools-rhev@2.6.0-28.el7_3.9?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product": {
"name": "qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_id": "qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-img-rhev@2.6.0-28.el7_3.9?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product": {
"name": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_id": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-common-rhev@2.6.0-28.el7_3.9?arch=x86_64\u0026epoch=10"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"product": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"product_id": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev@2.6.0-28.el7_3.9?arch=src\u0026epoch=10"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7",
"product_id": "7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64"
},
"product_reference": "qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7",
"product_id": "7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64"
},
"product_reference": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src as a component of Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7",
"product_id": "7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src"
},
"product_reference": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"relates_to_product_reference": "7Server-RH7-RHOS-6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7",
"product_id": "7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64"
},
"product_reference": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7",
"product_id": "7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64"
},
"product_reference": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7",
"product_id": "7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
},
"product_reference": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-6.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2016-9603",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2016-11-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1430056"
}
],
"notes": [
{
"category": "description",
"text": "A heap buffer overflow flaw was found in QEMU\u0027s Cirrus CLGD 54xx VGA emulator\u0027s VNC display driver support; the issue could occur when a VNC client attempted to update its display after a VGA operation is performed by a guest. A privileged user/process inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: cirrus: heap buffer overflow via vnc connection",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-9603"
},
{
"category": "external",
"summary": "RHBZ#1430056",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1430056"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-9603",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-9603"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-9603",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-9603"
}
],
"release_date": "2017-03-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-04-18T04:56:42+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:0981"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:A/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Qemu: cirrus: heap buffer overflow via vnc connection"
},
{
"acknowledgments": [
{
"names": [
"Jiangxin"
],
"organization": "PSIRT Huawei Inc."
}
],
"cve": "CVE-2017-7718",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2017-03-15T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1443441"
}
],
"notes": [
{
"category": "description",
"text": "An out-of-bounds access issue was found in QEMU\u0027s Cirrus CLGD 54xx VGA Emulator support. The vulnerability could occur while copying VGA data using bitblt functions (for example, cirrus_bitblt_rop_fwd_transp_). A privileged user inside a guest could use this flaw to crash the QEMU process, resulting in denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: display: cirrus: OOB read access issue",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-7718"
},
{
"category": "external",
"summary": "RHBZ#1443441",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1443441"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-7718",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7718"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-7718",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7718"
}
],
"release_date": "2017-03-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-04-18T04:56:42+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:0981"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 2.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:A/AC:H/Au:S/C:P/I:N/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.0,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:L",
"version": "3.0"
},
"products": [
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Qemu: display: cirrus: OOB read access issue"
},
{
"acknowledgments": [
{
"names": [
"Jiangxin"
],
"organization": "PSIRT Huawei Inc."
},
{
"names": [
"Li Qiang"
],
"organization": "Qihoo 360 Gear Team"
}
],
"cve": "CVE-2017-7980",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2017-02-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1444371"
}
],
"notes": [
{
"category": "description",
"text": "An out-of-bounds r/w access issue was found in QEMU\u0027s Cirrus CLGD 54xx VGA Emulator support. The vulnerability could occur while copying VGA data via various bitblt functions. A privileged user inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: display: cirrus: OOB r/w access issues in bitblt routines",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-7980"
},
{
"category": "external",
"summary": "RHBZ#1444371",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1444371"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-7980",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7980"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-7980",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7980"
}
],
"release_date": "2017-03-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-04-18T04:56:42+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:0981"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:A/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Qemu: display: cirrus: OOB r/w access issues in bitblt routines"
}
]
}
rhsa-2017_0984
Vulnerability from csaf_redhat
Published
2017-04-18 04:56
Modified
2024-11-14 23:33
Summary
Red Hat Security Advisory: qemu-kvm-rhev security update
Notes
Topic
An update for qemu-kvm-rhev is now available for Red Hat OpenStack Platform 9.0 (Mitaka).
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-rhev packages provide the user-space component for running virtual machines that use KVM in environments managed by Red Hat products.
Security Fix(es):
* Quick Emulator (QEMU), built with the Cirrus CLGD 54xx VGA Emulator and the VNC display driver support, is vulnerable to a heap buffer overflow issue. The issue could occur when a VNC client attempts to update its display after a VGA operation is performed by a guest. A privileged user/process inside guest could use this flaw to crash the QEMU process resulting in DoS or, potentially, leverage it to execute arbitrary code on the host with privileges of the QEMU process. (CVE-2016-9603)
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for qemu-kvm-rhev is now available for Red Hat OpenStack Platform 9.0 (Mitaka).\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-rhev packages provide the user-space component for running virtual machines that use KVM in environments managed by Red Hat products.\n\nSecurity Fix(es):\n\n* Quick Emulator (QEMU), built with the Cirrus CLGD 54xx VGA Emulator and the VNC display driver support, is vulnerable to a heap buffer overflow issue. The issue could occur when a VNC client attempts to update its display after a VGA operation is performed by a guest. A privileged user/process inside guest could use this flaw to crash the QEMU process resulting in DoS or, potentially, leverage it to execute arbitrary code on the host with privileges of the QEMU process. (CVE-2016-9603)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2017:0984",
"url": "https://access.redhat.com/errata/RHSA-2017:0984"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "1430056",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1430056"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_0984.json"
}
],
"title": "Red Hat Security Advisory: qemu-kvm-rhev security update",
"tracking": {
"current_release_date": "2024-11-14T23:33:45+00:00",
"generator": {
"date": "2024-11-14T23:33:45+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2017:0984",
"initial_release_date": "2017-04-18T04:56:01+00:00",
"revision_history": [
{
"date": "2017-04-18T04:56:01+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2017-04-18T04:56:01+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-14T23:33:45+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenStack Platform 9.0",
"product": {
"name": "Red Hat OpenStack Platform 9.0",
"product_id": "7Server-RH7-RHOS-9.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openstack:9::el7"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenStack Platform"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_id": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev@2.6.0-28.el7_3.9?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"product": {
"name": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"product_id": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev-debuginfo@2.6.0-28.el7_3.9?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product": {
"name": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_id": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-tools-rhev@2.6.0-28.el7_3.9?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product": {
"name": "qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_id": "qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-img-rhev@2.6.0-28.el7_3.9?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product": {
"name": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_id": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-common-rhev@2.6.0-28.el7_3.9?arch=x86_64\u0026epoch=10"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"product": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"product_id": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev@2.6.0-28.el7_3.9?arch=src\u0026epoch=10"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64 as a component of Red Hat OpenStack Platform 9.0",
"product_id": "7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64"
},
"product_reference": "qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-9.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64 as a component of Red Hat OpenStack Platform 9.0",
"product_id": "7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64"
},
"product_reference": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-9.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src as a component of Red Hat OpenStack Platform 9.0",
"product_id": "7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src"
},
"product_reference": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"relates_to_product_reference": "7Server-RH7-RHOS-9.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64 as a component of Red Hat OpenStack Platform 9.0",
"product_id": "7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64"
},
"product_reference": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-9.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64 as a component of Red Hat OpenStack Platform 9.0",
"product_id": "7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64"
},
"product_reference": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-9.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64 as a component of Red Hat OpenStack Platform 9.0",
"product_id": "7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
},
"product_reference": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-9.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2016-9603",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2016-11-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1430056"
}
],
"notes": [
{
"category": "description",
"text": "A heap buffer overflow flaw was found in QEMU\u0027s Cirrus CLGD 54xx VGA emulator\u0027s VNC display driver support; the issue could occur when a VNC client attempted to update its display after a VGA operation is performed by a guest. A privileged user/process inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: cirrus: heap buffer overflow via vnc connection",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-9603"
},
{
"category": "external",
"summary": "RHBZ#1430056",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1430056"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-9603",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-9603"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-9603",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-9603"
}
],
"release_date": "2017-03-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-04-18T04:56:01+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:0984"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:A/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Qemu: cirrus: heap buffer overflow via vnc connection"
},
{
"acknowledgments": [
{
"names": [
"Jiangxin"
],
"organization": "PSIRT Huawei Inc."
}
],
"cve": "CVE-2017-7718",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2017-03-15T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1443441"
}
],
"notes": [
{
"category": "description",
"text": "An out-of-bounds access issue was found in QEMU\u0027s Cirrus CLGD 54xx VGA Emulator support. The vulnerability could occur while copying VGA data using bitblt functions (for example, cirrus_bitblt_rop_fwd_transp_). A privileged user inside a guest could use this flaw to crash the QEMU process, resulting in denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: display: cirrus: OOB read access issue",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-7718"
},
{
"category": "external",
"summary": "RHBZ#1443441",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1443441"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-7718",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7718"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-7718",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7718"
}
],
"release_date": "2017-03-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-04-18T04:56:01+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:0984"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 2.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:A/AC:H/Au:S/C:P/I:N/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.0,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:L",
"version": "3.0"
},
"products": [
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Qemu: display: cirrus: OOB read access issue"
},
{
"acknowledgments": [
{
"names": [
"Jiangxin"
],
"organization": "PSIRT Huawei Inc."
},
{
"names": [
"Li Qiang"
],
"organization": "Qihoo 360 Gear Team"
}
],
"cve": "CVE-2017-7980",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2017-02-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1444371"
}
],
"notes": [
{
"category": "description",
"text": "An out-of-bounds r/w access issue was found in QEMU\u0027s Cirrus CLGD 54xx VGA Emulator support. The vulnerability could occur while copying VGA data via various bitblt functions. A privileged user inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: display: cirrus: OOB r/w access issues in bitblt routines",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-7980"
},
{
"category": "external",
"summary": "RHBZ#1444371",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1444371"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-7980",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7980"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-7980",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7980"
}
],
"release_date": "2017-03-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-04-18T04:56:01+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:0984"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:A/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Qemu: display: cirrus: OOB r/w access issues in bitblt routines"
}
]
}
gsd-2016-9603
Vulnerability from gsd
Modified
2023-12-13 01:21
Details
A heap buffer overflow flaw was found in QEMU's Cirrus CLGD 54xx VGA emulator's VNC display driver support before 2.9; the issue could occur when a VNC client attempted to update its display after a VGA operation is performed by a guest. A privileged user/process inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2016-9603",
"description": "A heap buffer overflow flaw was found in QEMU\u0027s Cirrus CLGD 54xx VGA emulator\u0027s VNC display driver support before 2.9; the issue could occur when a VNC client attempted to update its display after a VGA operation is performed by a guest. A privileged user/process inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process.",
"id": "GSD-2016-9603",
"references": [
"https://www.suse.com/security/cve/CVE-2016-9603.html",
"https://access.redhat.com/errata/RHSA-2017:1441",
"https://access.redhat.com/errata/RHSA-2017:1206",
"https://access.redhat.com/errata/RHSA-2017:1205",
"https://access.redhat.com/errata/RHSA-2017:0988",
"https://access.redhat.com/errata/RHSA-2017:0987",
"https://access.redhat.com/errata/RHSA-2017:0985",
"https://access.redhat.com/errata/RHSA-2017:0984",
"https://access.redhat.com/errata/RHSA-2017:0983",
"https://access.redhat.com/errata/RHSA-2017:0982",
"https://access.redhat.com/errata/RHSA-2017:0981",
"https://access.redhat.com/errata/RHSA-2017:0980",
"https://ubuntu.com/security/CVE-2016-9603",
"https://linux.oracle.com/cve/CVE-2016-9603.html"
]
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2016-9603"
],
"details": "A heap buffer overflow flaw was found in QEMU\u0027s Cirrus CLGD 54xx VGA emulator\u0027s VNC display driver support before 2.9; the issue could occur when a VNC client attempted to update its display after a VGA operation is performed by a guest. A privileged user/process inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process.",
"id": "GSD-2016-9603",
"modified": "2023-12-13T01:21:22.057469Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2016-9603",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Qemu:",
"version": {
"version_data": [
{
"version_value": "2.9"
}
]
}
}
]
},
"vendor_name": "QEMU"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A heap buffer overflow flaw was found in QEMU\u0027s Cirrus CLGD 54xx VGA emulator\u0027s VNC display driver support before 2.9; the issue could occur when a VNC client attempted to update its display after a VGA operation is performed by a guest. A privileged user/process inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process."
}
]
},
"impact": {
"cvss": [
[
{
"vectorString": "5.5/CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.0"
}
],
[
{
"vectorString": "4.9/AV:A/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
}
]
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-122"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "96893",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/96893"
},
{
"name": "RHSA-2017:0983",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2017:0983"
},
{
"name": "RHSA-2017:0982",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2017:0982"
},
{
"name": "[debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html"
},
{
"name": "GLSA-201706-03",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201706-03"
},
{
"name": "RHSA-2017:1206",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2017:1206"
},
{
"name": "1038023",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1038023"
},
{
"name": "https://support.citrix.com/article/CTX221578",
"refsource": "CONFIRM",
"url": "https://support.citrix.com/article/CTX221578"
},
{
"name": "RHSA-2017:0985",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2017:0985"
},
{
"name": "RHSA-2017:0987",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2017:0987"
},
{
"name": "RHSA-2017:0984",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2017:0984"
},
{
"name": "[debian-lts-announce] 20180206 [SECURITY] [DLA 1270-1] xen security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2018/02/msg00005.html"
},
{
"name": "RHSA-2017:0988",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2017:0988"
},
{
"name": "RHSA-2017:1441",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2017:1441"
},
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9603",
"refsource": "CONFIRM",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9603"
},
{
"name": "RHSA-2017:0981",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2017:0981"
},
{
"name": "RHSA-2017:0980",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2017:0980"
},
{
"name": "RHSA-2017:1205",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2017:1205"
}
]
}
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "2.9.0",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:redhat:openstack:9:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:redhat:openstack:8:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:citrix:xenserver:7.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:redhat:openstack:10:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:citrix:xenserver:6.5:sp1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:citrix:xenserver:7.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:citrix:xenserver:6.0.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:citrix:xenserver:6.2.0:sp1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_server_eus:7.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:redhat:openstack:7.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:redhat:openstack:6.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:redhat:openstack:5.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2016-9603"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "A heap buffer overflow flaw was found in QEMU\u0027s Cirrus CLGD 54xx VGA emulator\u0027s VNC display driver support before 2.9; the issue could occur when a VNC client attempted to update its display after a VGA operation is performed by a guest. A privileged user/process inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-119"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9603",
"refsource": "CONFIRM",
"tags": [
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9603"
},
{
"name": "https://support.citrix.com/article/CTX221578",
"refsource": "CONFIRM",
"tags": [
"Third Party Advisory"
],
"url": "https://support.citrix.com/article/CTX221578"
},
{
"name": "GLSA-201706-03",
"refsource": "GENTOO",
"tags": [
"Third Party Advisory"
],
"url": "https://security.gentoo.org/glsa/201706-03"
},
{
"name": "[debian-lts-announce] 20180206 [SECURITY] [DLA 1270-1] xen security update",
"refsource": "MLIST",
"tags": [
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2018/02/msg00005.html"
},
{
"name": "RHSA-2017:1441",
"refsource": "REDHAT",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/errata/RHSA-2017:1441"
},
{
"name": "RHSA-2017:1206",
"refsource": "REDHAT",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/errata/RHSA-2017:1206"
},
{
"name": "RHSA-2017:1205",
"refsource": "REDHAT",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/errata/RHSA-2017:1205"
},
{
"name": "RHSA-2017:0988",
"refsource": "REDHAT",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/errata/RHSA-2017:0988"
},
{
"name": "RHSA-2017:0987",
"refsource": "REDHAT",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/errata/RHSA-2017:0987"
},
{
"name": "RHSA-2017:0985",
"refsource": "REDHAT",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/errata/RHSA-2017:0985"
},
{
"name": "RHSA-2017:0984",
"refsource": "REDHAT",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/errata/RHSA-2017:0984"
},
{
"name": "RHSA-2017:0983",
"refsource": "REDHAT",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/errata/RHSA-2017:0983"
},
{
"name": "RHSA-2017:0982",
"refsource": "REDHAT",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/errata/RHSA-2017:0982"
},
{
"name": "RHSA-2017:0981",
"refsource": "REDHAT",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/errata/RHSA-2017:0981"
},
{
"name": "RHSA-2017:0980",
"refsource": "REDHAT",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/errata/RHSA-2017:0980"
},
{
"name": "1038023",
"refsource": "SECTRACK",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securitytracker.com/id/1038023"
},
{
"name": "96893",
"refsource": "BID",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/96893"
},
{
"name": "[debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update",
"refsource": "MLIST",
"tags": [],
"url": "https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html"
}
]
}
},
"impact": {
"baseMetricV2": {
"cvssV2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "COMPLETE",
"baseScore": 9.0,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"userInteractionRequired": false
},
"baseMetricV3": {
"cvssV3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 3.1,
"impactScore": 6.0
}
},
"lastModifiedDate": "2021-08-04T17:15Z",
"publishedDate": "2018-07-27T21:29Z"
}
}
}
ghsa-49mx-v59p-m55m
Vulnerability from github
Published
2022-05-13 01:07
Modified
2022-05-13 01:07
Severity ?
Details
A heap buffer overflow flaw was found in QEMU's Cirrus CLGD 54xx VGA emulator's VNC display driver support before 2.9; the issue could occur when a VNC client attempted to update its display after a VGA operation is performed by a guest. A privileged user/process inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process.
{
"affected": [],
"aliases": [
"CVE-2016-9603"
],
"database_specific": {
"cwe_ids": [
"CWE-119"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-07-27T21:29:00Z",
"severity": "CRITICAL"
},
"details": "A heap buffer overflow flaw was found in QEMU\u0027s Cirrus CLGD 54xx VGA emulator\u0027s VNC display driver support before 2.9; the issue could occur when a VNC client attempted to update its display after a VGA operation is performed by a guest. A privileged user/process inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process.",
"id": "GHSA-49mx-v59p-m55m",
"modified": "2022-05-13T01:07:29Z",
"published": "2022-05-13T01:07:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-9603"
},
{
"type": "WEB",
"url": "https://support.citrix.com/article/CTX221578"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/201706-03"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2018/02/msg00005.html"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9603"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:1441"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:1206"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:1205"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:0988"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:0987"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:0985"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:0984"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:0983"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:0982"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:0981"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:0980"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/96893"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1038023"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.