Action not permitted
Modal body text goes here.
cve-2017-7980
Vulnerability from cvelistv5
Published
2017-07-25 14:00
Modified
2024-08-05 16:19
Severity ?
EPSS score ?
Summary
Heap-based buffer overflow in Cirrus CLGD 54xx VGA Emulator in Quick Emulator (Qemu) 2.8 and earlier allows local guest OS users to execute arbitrary code or cause a denial of service (crash) via vectors related to a VNC client updating its display after a VGA operation.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T16:19:29.573Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "RHSA-2017:0983",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2017:0983"
},
{
"name": "[oss-security] 20170421 CVE-2017-7980 Qemu: display: cirrus: OOB r/w access issues in bitblt routines",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2017/04/21/1"
},
{
"name": "RHSA-2017:0982",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2017:0982"
},
{
"name": "[debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html"
},
{
"name": "RHSA-2017:1430",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2017:1430"
},
{
"name": "GLSA-201706-03",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201706-03"
},
{
"name": "USN-3289-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "http://ubuntu.com/usn/usn-3289-1"
},
{
"name": "RHSA-2017:1206",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2017:1206"
},
{
"name": "97955",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/97955"
},
{
"name": "102129",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/102129"
},
{
"name": "RHSA-2017:0984",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2017:0984"
},
{
"name": "RHSA-2017:0988",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2017:0988"
},
{
"name": "RHSA-2017:1441",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2017:1441"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1430056"
},
{
"name": "RHSA-2017:0981",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2017:0981"
},
{
"name": "RHSA-2017:0980",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2017:0980"
},
{
"name": "RHSA-2017:1205",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2017:1205"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://support.citrix.com/article/CTX230138"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2017-03-14T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Heap-based buffer overflow in Cirrus CLGD 54xx VGA Emulator in Quick Emulator (Qemu) 2.8 and earlier allows local guest OS users to execute arbitrary code or cause a denial of service (crash) via vectors related to a VNC client updating its display after a VGA operation."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-09-07T09:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "RHSA-2017:0983",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2017:0983"
},
{
"name": "[oss-security] 20170421 CVE-2017-7980 Qemu: display: cirrus: OOB r/w access issues in bitblt routines",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2017/04/21/1"
},
{
"name": "RHSA-2017:0982",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2017:0982"
},
{
"name": "[debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html"
},
{
"name": "RHSA-2017:1430",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2017:1430"
},
{
"name": "GLSA-201706-03",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201706-03"
},
{
"name": "USN-3289-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "http://ubuntu.com/usn/usn-3289-1"
},
{
"name": "RHSA-2017:1206",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2017:1206"
},
{
"name": "97955",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/97955"
},
{
"name": "102129",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/102129"
},
{
"name": "RHSA-2017:0984",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2017:0984"
},
{
"name": "RHSA-2017:0988",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2017:0988"
},
{
"name": "RHSA-2017:1441",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2017:1441"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1430056"
},
{
"name": "RHSA-2017:0981",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2017:0981"
},
{
"name": "RHSA-2017:0980",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2017:0980"
},
{
"name": "RHSA-2017:1205",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2017:1205"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://support.citrix.com/article/CTX230138"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2017-7980",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Heap-based buffer overflow in Cirrus CLGD 54xx VGA Emulator in Quick Emulator (Qemu) 2.8 and earlier allows local guest OS users to execute arbitrary code or cause a denial of service (crash) via vectors related to a VNC client updating its display after a VGA operation."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "RHSA-2017:0983",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2017:0983"
},
{
"name": "[oss-security] 20170421 CVE-2017-7980 Qemu: display: cirrus: OOB r/w access issues in bitblt routines",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2017/04/21/1"
},
{
"name": "RHSA-2017:0982",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2017:0982"
},
{
"name": "[debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html"
},
{
"name": "RHSA-2017:1430",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2017:1430"
},
{
"name": "GLSA-201706-03",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201706-03"
},
{
"name": "USN-3289-1",
"refsource": "UBUNTU",
"url": "http://ubuntu.com/usn/usn-3289-1"
},
{
"name": "RHSA-2017:1206",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2017:1206"
},
{
"name": "97955",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/97955"
},
{
"name": "102129",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/102129"
},
{
"name": "RHSA-2017:0984",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2017:0984"
},
{
"name": "RHSA-2017:0988",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2017:0988"
},
{
"name": "RHSA-2017:1441",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2017:1441"
},
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=1430056",
"refsource": "CONFIRM",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1430056"
},
{
"name": "RHSA-2017:0981",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2017:0981"
},
{
"name": "RHSA-2017:0980",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2017:0980"
},
{
"name": "RHSA-2017:1205",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2017:1205"
},
{
"name": "https://support.citrix.com/article/CTX230138",
"refsource": "CONFIRM",
"url": "https://support.citrix.com/article/CTX230138"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-7980",
"datePublished": "2017-07-25T14:00:00",
"dateReserved": "2017-04-20T00:00:00",
"dateUpdated": "2024-08-05T16:19:29.573Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2017-7980\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2017-07-25T14:29:00.283\",\"lastModified\":\"2024-11-21T03:33:05.540\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Heap-based buffer overflow in Cirrus CLGD 54xx VGA Emulator in Quick Emulator (Qemu) 2.8 and earlier allows local guest OS users to execute arbitrary code or cause a denial of service (crash) via vectors related to a VNC client updating its display after a VGA operation.\"},{\"lang\":\"es\",\"value\":\"Desbordamiento de b\u00fafer basado en memoria din\u00e1mica (heap) en Cirrus CLGD 54xx VGA Emulator en Quick Emulator (Qemu) en versiones 2.8 y anteriores permite que los usuarios invitados del sistema operativo ejecuten c\u00f3digo arbitrario o provoquen una denegaci\u00f3n de servicio (DoS) mediante vectores relacionados con un cliente VNC que actualiza su display despu\u00e9s de una operaci\u00f3n VGA.\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:L/AC:L/Au:N/C:P/I:P/A:P\",\"baseScore\":4.6,\"accessVector\":\"LOCAL\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":3.9,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-119\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"2.8\",\"matchCriteriaId\":\"715CFA1A-8873-49BC-A504-8F472F9AEC92\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*\",\"matchCriteriaId\":\"B5A6F2F3-4894-4392-8296-3B8DD2679084\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*\",\"matchCriteriaId\":\"F7016A2A-8365-4F1A-89A2-7A19F2BCAE5B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:16.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1AFB20FA-CB00-4729-AB3A-816454C6D096\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:17.04:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"588D4F37-0A56-47A4-B710-4D5F3D214FB9\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:openstack:6.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"31EC146C-A6F6-4C0D-AF87-685286262DAA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:openstack:7.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9DAA72A4-AC7D-4544-89D4-5B07961D5A95\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:openstack:8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E8B8C725-34CF-4340-BE7B-37E58CF706D6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:openstack:9:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F40C26BE-56CB-4022-A1D8-3CA0A8F87F4B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:openstack:10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E722FEF7-58A6-47AD-B1D0-DB0B71B0C7AA\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:openstack:5.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B152EDF3-3140-4343-802F-F4F1C329F5C3\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"142AD0DD-4CF3-4D74-9442-459CE3347E3A\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:openstack:5.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B152EDF3-3140-4343-802F-F4F1C329F5C3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:virtualization:3.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D86166F9-BBF0-4650-8CCD-0F9C97104D21\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2F6AB192-9D7D-4A9A-8995-E53A9DE9EAFC\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EE249E1B-A1FD-4E08-AA71-A0E1F10FFE97\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"33C068A4-3780-4EAB-A937-6082DF847564\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9BBCD86A-E6C7-4444-9D74-F861084090F0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"51EF4996-72F4-4FA4-814F-F5991E7A8318\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"98381E61-F082-4302-B51F-5648884F998B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D99A687E-EAE6-417E-A88E-D0082BC194CD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B353CE99-D57C-465B-AAB0-73EF581127D1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_server_eus:7.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A8442C20-41F9-47FD-9A12-E724D3A31FD7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9EC0D196-F7B8-4BDD-9050-779F7A7FBEE4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A4E9DD8A-A68B-4A69-8B01-BFF92A2020A8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BF77CDCF-B9C9-427D-B2BF-36650FB2148C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_server_tus:7.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"24C0F4E1-C52C-41E0-9F14-F83ADD5CC7ED\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B76AA310-FEC7-497F-AF04-C3EC1E76C4CC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E5ED5807-55B7-47C5-97A6-03233F4FBC3A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"825ECE2D-E232-46E0-A047-074B34DB1E97\"}]}]}],\"references\":[{\"url\":\"http://ubuntu.com/usn/usn-3289-1\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2017/04/21/1\",\"source\":\"cve@mitre.org\",\"tags\":[\"Mailing List\",\"Patch\",\"Third Party Advisory\"]},{\"url\":\"http://www.securityfocus.com/bid/102129\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://www.securityfocus.com/bid/97955\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2017:0980\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2017:0981\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2017:0982\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2017:0983\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2017:0984\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2017:0988\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2017:1205\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2017:1206\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2017:1430\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2017:1441\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=1430056\",\"source\":\"cve@mitre.org\",\"tags\":[\"Issue Tracking\",\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://security.gentoo.org/glsa/201706-03\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://support.citrix.com/article/CTX230138\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://ubuntu.com/usn/usn-3289-1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2017/04/21/1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Patch\",\"Third Party Advisory\"]},{\"url\":\"http://www.securityfocus.com/bid/102129\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://www.securityfocus.com/bid/97955\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2017:0980\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2017:0981\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2017:0982\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2017:0983\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2017:0984\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2017:0988\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2017:1205\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2017:1206\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2017:1430\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2017:1441\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=1430056\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://security.gentoo.org/glsa/201706-03\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://support.citrix.com/article/CTX230138\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}"
}
}
rhsa-2017_1441
Vulnerability from csaf_redhat
Published
2017-06-14 15:20
Modified
2024-11-22 10:39
Summary
Red Hat Security Advisory: qemu-kvm-rhev security and bug fix update
Notes
Topic
An update for qemu-kvm-rhev is now available for Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-rhev packages provide the user-space component for running virtual machines that use KVM in environments managed by Red Hat products.
Security Fix(es):
* A heap buffer overflow flaw was found in QEMU's Cirrus CLGD 54xx VGA emulator's VNC display driver support; the issue could occur when a VNC client attempted to update its display after a VGA operation is performed by a guest. A privileged user/process inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process. (CVE-2016-9603)
* An out-of-bounds r/w access issue was found in QEMU's Cirrus CLGD 54xx VGA Emulator support. The vulnerability could occur while copying VGA data via various bitblt functions. A privileged user inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process. (CVE-2017-7980)
* An out-of-bounds memory access issue was found in QEMU's VNC display driver support. The vulnerability could occur while refreshing the VNC display surface area in the 'vnc_refresh_server_surface'. A user/process inside a guest could use this flaw to crash the QEMU process, resulting in a denial of service. (CVE-2017-2633)
* An out-of-bounds access issue was found in QEMU's Cirrus CLGD 54xx VGA Emulator support. The vulnerability could occur while copying VGA data using bitblt functions (for example, cirrus_bitblt_rop_fwd_transp_). A privileged user inside a guest could use this flaw to crash the QEMU process, resulting in denial of service. (CVE-2017-7718)
Red Hat would like to thank Jiangxin (PSIRT Huawei Inc.) and Li Qiang (Qihoo 360 Gear Team) for reporting CVE-2017-7980 and Jiangxin (PSIRT Huawei Inc.) for reporting CVE-2017-7718.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for qemu-kvm-rhev is now available for Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-rhev packages provide the user-space component for running virtual machines that use KVM in environments managed by Red Hat products.\n\nSecurity Fix(es):\n\n* A heap buffer overflow flaw was found in QEMU\u0027s Cirrus CLGD 54xx VGA emulator\u0027s VNC display driver support; the issue could occur when a VNC client attempted to update its display after a VGA operation is performed by a guest. A privileged user/process inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process. (CVE-2016-9603)\n\n* An out-of-bounds r/w access issue was found in QEMU\u0027s Cirrus CLGD 54xx VGA Emulator support. The vulnerability could occur while copying VGA data via various bitblt functions. A privileged user inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process. (CVE-2017-7980)\n\n* An out-of-bounds memory access issue was found in QEMU\u0027s VNC display driver support. The vulnerability could occur while refreshing the VNC display surface area in the \u0027vnc_refresh_server_surface\u0027. A user/process inside a guest could use this flaw to crash the QEMU process, resulting in a denial of service. (CVE-2017-2633)\n\n* An out-of-bounds access issue was found in QEMU\u0027s Cirrus CLGD 54xx VGA Emulator support. The vulnerability could occur while copying VGA data using bitblt functions (for example, cirrus_bitblt_rop_fwd_transp_). A privileged user inside a guest could use this flaw to crash the QEMU process, resulting in denial of service. (CVE-2017-7718)\n\nRed Hat would like to thank Jiangxin (PSIRT Huawei Inc.) and Li Qiang (Qihoo 360 Gear Team) for reporting CVE-2017-7980 and Jiangxin (PSIRT Huawei Inc.) for reporting CVE-2017-7718.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2017:1441",
"url": "https://access.redhat.com/errata/RHSA-2017:1441"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "1425939",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1425939"
},
{
"category": "external",
"summary": "1430056",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1430056"
},
{
"category": "external",
"summary": "1442810",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1442810"
},
{
"category": "external",
"summary": "1443441",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1443441"
},
{
"category": "external",
"summary": "1444371",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1444371"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_1441.json"
}
],
"title": "Red Hat Security Advisory: qemu-kvm-rhev security and bug fix update",
"tracking": {
"current_release_date": "2024-11-22T10:39:16+00:00",
"generator": {
"date": "2024-11-22T10:39:16+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2017:1441",
"initial_release_date": "2017-06-14T15:20:20+00:00",
"revision_history": [
{
"date": "2017-06-14T15:20:20+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2017-06-14T15:20:20+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-22T10:39:16+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6",
"product": {
"name": "Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6",
"product_id": "6Server-RH6-RHOS-5.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openstack:5::el6"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenStack Platform"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"product": {
"name": "qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"product_id": "qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev@0.12.1.2-2.503.el6_9.3?arch=x86_64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"product": {
"name": "qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"product_id": "qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-img-rhev@0.12.1.2-2.503.el6_9.3?arch=x86_64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"product": {
"name": "qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"product_id": "qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev-tools@0.12.1.2-2.503.el6_9.3?arch=x86_64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"product": {
"name": "qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"product_id": "qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev-debuginfo@0.12.1.2-2.503.el6_9.3?arch=x86_64\u0026epoch=2"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src",
"product": {
"name": "qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src",
"product_id": "qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev@0.12.1.2-2.503.el6_9.3?arch=src\u0026epoch=2"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6",
"product_id": "6Server-RH6-RHOS-5.0:qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64"
},
"product_reference": "qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"relates_to_product_reference": "6Server-RH6-RHOS-5.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6",
"product_id": "6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src"
},
"product_reference": "qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src",
"relates_to_product_reference": "6Server-RH6-RHOS-5.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6",
"product_id": "6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64"
},
"product_reference": "qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"relates_to_product_reference": "6Server-RH6-RHOS-5.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6",
"product_id": "6Server-RH6-RHOS-5.0:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64"
},
"product_reference": "qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"relates_to_product_reference": "6Server-RH6-RHOS-5.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6",
"product_id": "6Server-RH6-RHOS-5.0:qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
},
"product_reference": "qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"relates_to_product_reference": "6Server-RH6-RHOS-5.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2016-9603",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2016-11-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1430056"
}
],
"notes": [
{
"category": "description",
"text": "A heap buffer overflow flaw was found in QEMU\u0027s Cirrus CLGD 54xx VGA emulator\u0027s VNC display driver support; the issue could occur when a VNC client attempted to update its display after a VGA operation is performed by a guest. A privileged user/process inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: cirrus: heap buffer overflow via vnc connection",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RH6-RHOS-5.0:qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-9603"
},
{
"category": "external",
"summary": "RHBZ#1430056",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1430056"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-9603",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-9603"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-9603",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-9603"
}
],
"release_date": "2017-03-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-06-14T15:20:20+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"6Server-RH6-RHOS-5.0:qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:1441"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:A/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"6Server-RH6-RHOS-5.0:qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Qemu: cirrus: heap buffer overflow via vnc connection"
},
{
"cve": "CVE-2017-2633",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2016-12-01T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1425939"
}
],
"notes": [
{
"category": "description",
"text": "An out-of-bounds memory access issue was found in Quick Emulator (QEMU) in the VNC display driver. This flaw could occur while refreshing the VNC display surface area in the \u0027vnc_refresh_server_surface\u0027. A user inside a guest could use this flaw to crash the QEMU process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: VNC: memory corruption due to unchecked resolution limit",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RH6-RHOS-5.0:qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-2633"
},
{
"category": "external",
"summary": "RHBZ#1425939",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1425939"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-2633",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-2633"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-2633",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-2633"
}
],
"release_date": "2016-12-01T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-06-14T15:20:20+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"6Server-RH6-RHOS-5.0:qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:1441"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 3.8,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:A/AC:M/Au:S/C:N/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L",
"version": "3.0"
},
"products": [
"6Server-RH6-RHOS-5.0:qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Qemu: VNC: memory corruption due to unchecked resolution limit"
},
{
"acknowledgments": [
{
"names": [
"Jiangxin"
],
"organization": "PSIRT Huawei Inc."
}
],
"cve": "CVE-2017-7718",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2017-03-15T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1443441"
}
],
"notes": [
{
"category": "description",
"text": "An out-of-bounds access issue was found in QEMU\u0027s Cirrus CLGD 54xx VGA Emulator support. The vulnerability could occur while copying VGA data using bitblt functions (for example, cirrus_bitblt_rop_fwd_transp_). A privileged user inside a guest could use this flaw to crash the QEMU process, resulting in denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: display: cirrus: OOB read access issue",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RH6-RHOS-5.0:qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-7718"
},
{
"category": "external",
"summary": "RHBZ#1443441",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1443441"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-7718",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7718"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-7718",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7718"
}
],
"release_date": "2017-03-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-06-14T15:20:20+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"6Server-RH6-RHOS-5.0:qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:1441"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 2.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:A/AC:H/Au:S/C:P/I:N/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.0,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:L",
"version": "3.0"
},
"products": [
"6Server-RH6-RHOS-5.0:qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Qemu: display: cirrus: OOB read access issue"
},
{
"acknowledgments": [
{
"names": [
"Jiangxin"
],
"organization": "PSIRT Huawei Inc."
},
{
"names": [
"Li Qiang"
],
"organization": "Qihoo 360 Gear Team"
}
],
"cve": "CVE-2017-7980",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2017-02-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1444371"
}
],
"notes": [
{
"category": "description",
"text": "An out-of-bounds r/w access issue was found in QEMU\u0027s Cirrus CLGD 54xx VGA Emulator support. The vulnerability could occur while copying VGA data via various bitblt functions. A privileged user inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: display: cirrus: OOB r/w access issues in bitblt routines",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RH6-RHOS-5.0:qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-7980"
},
{
"category": "external",
"summary": "RHBZ#1444371",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1444371"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-7980",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7980"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-7980",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7980"
}
],
"release_date": "2017-03-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-06-14T15:20:20+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"6Server-RH6-RHOS-5.0:qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:1441"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:A/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"6Server-RH6-RHOS-5.0:qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Qemu: display: cirrus: OOB r/w access issues in bitblt routines"
}
]
}
rhsa-2017_0983
Vulnerability from csaf_redhat
Published
2017-04-18 04:56
Modified
2024-11-14 23:33
Summary
Red Hat Security Advisory: qemu-kvm-rhev security update
Notes
Topic
An update for qemu-kvm-rhev is now available for Red Hat OpenStack Platform 8.0 (Liberty).
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-rhev packages provide the user-space component for running virtual machines that use KVM in environments managed by Red Hat products.
Security Fix(es):
* Quick Emulator (QEMU), built with the Cirrus CLGD 54xx VGA Emulator and the VNC display driver support, is vulnerable to a heap buffer overflow issue. The issue could occur when a VNC client attempts to update its display after a VGA operation is performed by a guest. A privileged user/process inside guest could use this flaw to crash the QEMU process resulting in DoS or, potentially, leverage it to execute arbitrary code on the host with privileges of the QEMU process. (CVE-2016-9603)
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for qemu-kvm-rhev is now available for Red Hat OpenStack Platform 8.0 (Liberty).\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-rhev packages provide the user-space component for running virtual machines that use KVM in environments managed by Red Hat products.\n\nSecurity Fix(es):\n\n* Quick Emulator (QEMU), built with the Cirrus CLGD 54xx VGA Emulator and the VNC display driver support, is vulnerable to a heap buffer overflow issue. The issue could occur when a VNC client attempts to update its display after a VGA operation is performed by a guest. A privileged user/process inside guest could use this flaw to crash the QEMU process resulting in DoS or, potentially, leverage it to execute arbitrary code on the host with privileges of the QEMU process. (CVE-2016-9603)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2017:0983",
"url": "https://access.redhat.com/errata/RHSA-2017:0983"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "1430056",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1430056"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_0983.json"
}
],
"title": "Red Hat Security Advisory: qemu-kvm-rhev security update",
"tracking": {
"current_release_date": "2024-11-14T23:33:50+00:00",
"generator": {
"date": "2024-11-14T23:33:50+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2017:0983",
"initial_release_date": "2017-04-18T04:56:14+00:00",
"revision_history": [
{
"date": "2017-04-18T04:56:14+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2017-04-18T04:56:14+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-14T23:33:50+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenStack Platform 8.0 (Liberty)",
"product": {
"name": "Red Hat OpenStack Platform 8.0 (Liberty)",
"product_id": "7Server-RH7-RHOS-8.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openstack:8::el7"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenStack Platform"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_id": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev@2.6.0-28.el7_3.9?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"product": {
"name": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"product_id": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev-debuginfo@2.6.0-28.el7_3.9?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product": {
"name": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_id": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-tools-rhev@2.6.0-28.el7_3.9?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product": {
"name": "qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_id": "qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-img-rhev@2.6.0-28.el7_3.9?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product": {
"name": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_id": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-common-rhev@2.6.0-28.el7_3.9?arch=x86_64\u0026epoch=10"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"product": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"product_id": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev@2.6.0-28.el7_3.9?arch=src\u0026epoch=10"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64 as a component of Red Hat OpenStack Platform 8.0 (Liberty)",
"product_id": "7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64"
},
"product_reference": "qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-8.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64 as a component of Red Hat OpenStack Platform 8.0 (Liberty)",
"product_id": "7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64"
},
"product_reference": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-8.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src as a component of Red Hat OpenStack Platform 8.0 (Liberty)",
"product_id": "7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src"
},
"product_reference": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"relates_to_product_reference": "7Server-RH7-RHOS-8.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64 as a component of Red Hat OpenStack Platform 8.0 (Liberty)",
"product_id": "7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64"
},
"product_reference": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-8.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64 as a component of Red Hat OpenStack Platform 8.0 (Liberty)",
"product_id": "7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64"
},
"product_reference": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-8.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64 as a component of Red Hat OpenStack Platform 8.0 (Liberty)",
"product_id": "7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
},
"product_reference": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-8.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2016-9603",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2016-11-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1430056"
}
],
"notes": [
{
"category": "description",
"text": "A heap buffer overflow flaw was found in QEMU\u0027s Cirrus CLGD 54xx VGA emulator\u0027s VNC display driver support; the issue could occur when a VNC client attempted to update its display after a VGA operation is performed by a guest. A privileged user/process inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: cirrus: heap buffer overflow via vnc connection",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-9603"
},
{
"category": "external",
"summary": "RHBZ#1430056",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1430056"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-9603",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-9603"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-9603",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-9603"
}
],
"release_date": "2017-03-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-04-18T04:56:14+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:0983"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:A/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Qemu: cirrus: heap buffer overflow via vnc connection"
},
{
"acknowledgments": [
{
"names": [
"Jiangxin"
],
"organization": "PSIRT Huawei Inc."
}
],
"cve": "CVE-2017-7718",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2017-03-15T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1443441"
}
],
"notes": [
{
"category": "description",
"text": "An out-of-bounds access issue was found in QEMU\u0027s Cirrus CLGD 54xx VGA Emulator support. The vulnerability could occur while copying VGA data using bitblt functions (for example, cirrus_bitblt_rop_fwd_transp_). A privileged user inside a guest could use this flaw to crash the QEMU process, resulting in denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: display: cirrus: OOB read access issue",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-7718"
},
{
"category": "external",
"summary": "RHBZ#1443441",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1443441"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-7718",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7718"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-7718",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7718"
}
],
"release_date": "2017-03-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-04-18T04:56:14+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:0983"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 2.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:A/AC:H/Au:S/C:P/I:N/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.0,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:L",
"version": "3.0"
},
"products": [
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Qemu: display: cirrus: OOB read access issue"
},
{
"acknowledgments": [
{
"names": [
"Jiangxin"
],
"organization": "PSIRT Huawei Inc."
},
{
"names": [
"Li Qiang"
],
"organization": "Qihoo 360 Gear Team"
}
],
"cve": "CVE-2017-7980",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2017-02-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1444371"
}
],
"notes": [
{
"category": "description",
"text": "An out-of-bounds r/w access issue was found in QEMU\u0027s Cirrus CLGD 54xx VGA Emulator support. The vulnerability could occur while copying VGA data via various bitblt functions. A privileged user inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: display: cirrus: OOB r/w access issues in bitblt routines",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-7980"
},
{
"category": "external",
"summary": "RHBZ#1444371",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1444371"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-7980",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7980"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-7980",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7980"
}
],
"release_date": "2017-03-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-04-18T04:56:14+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:0983"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:A/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Qemu: display: cirrus: OOB r/w access issues in bitblt routines"
}
]
}
rhsa-2017_1205
Vulnerability from csaf_redhat
Published
2017-05-09 11:07
Modified
2024-11-22 10:39
Summary
Red Hat Security Advisory: qemu-kvm-rhev security update
Notes
Topic
An update for qemu-kvm-rhev is now available for RHEV 3.X Hypervisor and Agents for RHEL-6.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-rhev packages provide the user-space component for running virtual machines that use KVM in environments managed by Red Hat products.
Security Fix(es):
* A heap buffer overflow flaw was found in QEMU's Cirrus CLGD 54xx VGA emulator's VNC display driver support; the issue could occur when a VNC client attempted to update its display after a VGA operation is performed by a guest. A privileged user/process inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process. (CVE-2016-9603)
* Quick Emulator (QEMU) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds r/w access issue. The vulnerability could occur while copying VGA data via various bitblt functions. A privileged user inside the guest could use this flaw to crash the QEMU process (DoS) or potentially execute arbitrary code on a host with privileges of the host's QEMU process. (CVE-2017-7980)
* Quick Emulator (QEMU) built with the VNC display driver support is vulnerable to an out-of-bounds memory access issue. The vulnerability could occur while refreshing the VNC display surface area in the 'vnc_refresh_server_surface'. A user/process inside the guest could use this flaw to crash the QEMU process, resulting in a DoS. (CVE-2017-2633)
* Quick Emulator (QEMU) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The vulnerability could occur while copying VGA data using bitblt functions (for example, cirrus_bitblt_rop_fwd_transp_). A privileged user inside a guest could use this flaw to crash the QEMU process, resulting in DoS. (CVE-2017-7718)
Red Hat would like to thank Jiangxin (PSIRT Huawei Inc.) Li Qiang (Qihoo 360 Gear Team) for reporting CVE-2017-7980 and Jiangxin (PSIRT Huawei Inc.) for reporting CVE-2017-7718.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for qemu-kvm-rhev is now available for RHEV 3.X Hypervisor and Agents for RHEL-6.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-rhev packages provide the user-space component for running virtual machines that use KVM in environments managed by Red Hat products.\n\nSecurity Fix(es):\n\n* A heap buffer overflow flaw was found in QEMU\u0027s Cirrus CLGD 54xx VGA emulator\u0027s VNC display driver support; the issue could occur when a VNC client attempted to update its display after a VGA operation is performed by a guest. A privileged user/process inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process. (CVE-2016-9603)\n\n* Quick Emulator (QEMU) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds r/w access issue. The vulnerability could occur while copying VGA data via various bitblt functions. A privileged user inside the guest could use this flaw to crash the QEMU process (DoS) or potentially execute arbitrary code on a host with privileges of the host\u0027s QEMU process. (CVE-2017-7980)\n\n* Quick Emulator (QEMU) built with the VNC display driver support is vulnerable to an out-of-bounds memory access issue. The vulnerability could occur while refreshing the VNC display surface area in the \u0027vnc_refresh_server_surface\u0027. A user/process inside the guest could use this flaw to crash the QEMU process, resulting in a DoS. (CVE-2017-2633)\n\n* Quick Emulator (QEMU) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The vulnerability could occur while copying VGA data using bitblt functions (for example, cirrus_bitblt_rop_fwd_transp_). A privileged user inside a guest could use this flaw to crash the QEMU process, resulting in DoS. (CVE-2017-7718)\n\nRed Hat would like to thank Jiangxin (PSIRT Huawei Inc.) Li Qiang (Qihoo 360 Gear Team) for reporting CVE-2017-7980 and Jiangxin (PSIRT Huawei Inc.) for reporting CVE-2017-7718.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2017:1205",
"url": "https://access.redhat.com/errata/RHSA-2017:1205"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "1425939",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1425939"
},
{
"category": "external",
"summary": "1430056",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1430056"
},
{
"category": "external",
"summary": "1443441",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1443441"
},
{
"category": "external",
"summary": "1444371",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1444371"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_1205.json"
}
],
"title": "Red Hat Security Advisory: qemu-kvm-rhev security update",
"tracking": {
"current_release_date": "2024-11-22T10:39:27+00:00",
"generator": {
"date": "2024-11-22T10:39:27+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2017:1205",
"initial_release_date": "2017-05-09T11:07:02+00:00",
"revision_history": [
{
"date": "2017-05-09T11:07:02+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2017-05-09T11:07:02+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-22T10:39:27+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "RHEV Agents (vdsm)",
"product": {
"name": "RHEV Agents (vdsm)",
"product_id": "6Server-RHEV-Agents",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:enterprise_linux:6::hypervisor"
}
}
}
],
"category": "product_family",
"name": "Red Hat Virtualization"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"product": {
"name": "qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"product_id": "qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev@0.12.1.2-2.503.el6_9.3?arch=x86_64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"product": {
"name": "qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"product_id": "qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-img-rhev@0.12.1.2-2.503.el6_9.3?arch=x86_64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"product": {
"name": "qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"product_id": "qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev-tools@0.12.1.2-2.503.el6_9.3?arch=x86_64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"product": {
"name": "qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"product_id": "qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev-debuginfo@0.12.1.2-2.503.el6_9.3?arch=x86_64\u0026epoch=2"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src",
"product": {
"name": "qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src",
"product_id": "qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev@0.12.1.2-2.503.el6_9.3?arch=src\u0026epoch=2"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64 as a component of RHEV Agents (vdsm)",
"product_id": "6Server-RHEV-Agents:qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64"
},
"product_reference": "qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"relates_to_product_reference": "6Server-RHEV-Agents"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src as a component of RHEV Agents (vdsm)",
"product_id": "6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src"
},
"product_reference": "qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src",
"relates_to_product_reference": "6Server-RHEV-Agents"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64 as a component of RHEV Agents (vdsm)",
"product_id": "6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64"
},
"product_reference": "qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"relates_to_product_reference": "6Server-RHEV-Agents"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64 as a component of RHEV Agents (vdsm)",
"product_id": "6Server-RHEV-Agents:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64"
},
"product_reference": "qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"relates_to_product_reference": "6Server-RHEV-Agents"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64 as a component of RHEV Agents (vdsm)",
"product_id": "6Server-RHEV-Agents:qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
},
"product_reference": "qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"relates_to_product_reference": "6Server-RHEV-Agents"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2016-9603",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2016-11-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1430056"
}
],
"notes": [
{
"category": "description",
"text": "A heap buffer overflow flaw was found in QEMU\u0027s Cirrus CLGD 54xx VGA emulator\u0027s VNC display driver support; the issue could occur when a VNC client attempted to update its display after a VGA operation is performed by a guest. A privileged user/process inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: cirrus: heap buffer overflow via vnc connection",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RHEV-Agents:qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src",
"6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-9603"
},
{
"category": "external",
"summary": "RHBZ#1430056",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1430056"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-9603",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-9603"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-9603",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-9603"
}
],
"release_date": "2017-03-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-05-09T11:07:02+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"6Server-RHEV-Agents:qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src",
"6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:1205"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:A/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"6Server-RHEV-Agents:qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src",
"6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Qemu: cirrus: heap buffer overflow via vnc connection"
},
{
"cve": "CVE-2017-2633",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2016-12-01T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1425939"
}
],
"notes": [
{
"category": "description",
"text": "An out-of-bounds memory access issue was found in Quick Emulator (QEMU) in the VNC display driver. This flaw could occur while refreshing the VNC display surface area in the \u0027vnc_refresh_server_surface\u0027. A user inside a guest could use this flaw to crash the QEMU process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: VNC: memory corruption due to unchecked resolution limit",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RHEV-Agents:qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src",
"6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-2633"
},
{
"category": "external",
"summary": "RHBZ#1425939",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1425939"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-2633",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-2633"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-2633",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-2633"
}
],
"release_date": "2016-12-01T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-05-09T11:07:02+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"6Server-RHEV-Agents:qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src",
"6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:1205"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 3.8,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:A/AC:M/Au:S/C:N/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L",
"version": "3.0"
},
"products": [
"6Server-RHEV-Agents:qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src",
"6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Qemu: VNC: memory corruption due to unchecked resolution limit"
},
{
"acknowledgments": [
{
"names": [
"Jiangxin"
],
"organization": "PSIRT Huawei Inc."
}
],
"cve": "CVE-2017-7718",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2017-03-15T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1443441"
}
],
"notes": [
{
"category": "description",
"text": "An out-of-bounds access issue was found in QEMU\u0027s Cirrus CLGD 54xx VGA Emulator support. The vulnerability could occur while copying VGA data using bitblt functions (for example, cirrus_bitblt_rop_fwd_transp_). A privileged user inside a guest could use this flaw to crash the QEMU process, resulting in denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: display: cirrus: OOB read access issue",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RHEV-Agents:qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src",
"6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-7718"
},
{
"category": "external",
"summary": "RHBZ#1443441",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1443441"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-7718",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7718"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-7718",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7718"
}
],
"release_date": "2017-03-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-05-09T11:07:02+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"6Server-RHEV-Agents:qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src",
"6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:1205"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 2.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:A/AC:H/Au:S/C:P/I:N/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.0,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:L",
"version": "3.0"
},
"products": [
"6Server-RHEV-Agents:qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src",
"6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Qemu: display: cirrus: OOB read access issue"
},
{
"acknowledgments": [
{
"names": [
"Jiangxin"
],
"organization": "PSIRT Huawei Inc."
},
{
"names": [
"Li Qiang"
],
"organization": "Qihoo 360 Gear Team"
}
],
"cve": "CVE-2017-7980",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2017-02-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1444371"
}
],
"notes": [
{
"category": "description",
"text": "An out-of-bounds r/w access issue was found in QEMU\u0027s Cirrus CLGD 54xx VGA Emulator support. The vulnerability could occur while copying VGA data via various bitblt functions. A privileged user inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: display: cirrus: OOB r/w access issues in bitblt routines",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RHEV-Agents:qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src",
"6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-7980"
},
{
"category": "external",
"summary": "RHBZ#1444371",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1444371"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-7980",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7980"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-7980",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7980"
}
],
"release_date": "2017-03-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-05-09T11:07:02+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"6Server-RHEV-Agents:qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src",
"6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:1205"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:A/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"6Server-RHEV-Agents:qemu-img-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.src",
"6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Qemu: display: cirrus: OOB r/w access issues in bitblt routines"
}
]
}
rhsa-2017_0988
Vulnerability from csaf_redhat
Published
2017-04-18 13:55
Modified
2024-11-14 23:33
Summary
Red Hat Security Advisory: qemu-kvm-rhev security update
Notes
Topic
An update for qemu-kvm-rhev is now available for Red Hat OpenStack Platform 10.0 (Newton).
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-rhev packages provide the user-space component for running virtual machines that use KVM in environments managed by Red Hat products.
Security Fix(es):
* Quick Emulator (QEMU), built with the Cirrus CLGD 54xx VGA Emulator and the VNC display driver support, is vulnerable to a heap buffer overflow issue. The issue could occur when a VNC client attempts to update its display after a VGA operation is performed by a guest. A privileged user/process inside guest could use this flaw to crash the QEMU process resulting in DoS or, potentially, leverage it to execute arbitrary code on the host with privileges of the QEMU process. (CVE-2016-9603)
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for qemu-kvm-rhev is now available for Red Hat OpenStack Platform 10.0 (Newton).\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-rhev packages provide the user-space component for running virtual machines that use KVM in environments managed by Red Hat products.\n\nSecurity Fix(es):\n\n* Quick Emulator (QEMU), built with the Cirrus CLGD 54xx VGA Emulator and the VNC display driver support, is vulnerable to a heap buffer overflow issue. The issue could occur when a VNC client attempts to update its display after a VGA operation is performed by a guest. A privileged user/process inside guest could use this flaw to crash the QEMU process resulting in DoS or, potentially, leverage it to execute arbitrary code on the host with privileges of the QEMU process. (CVE-2016-9603)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2017:0988",
"url": "https://access.redhat.com/errata/RHSA-2017:0988"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "1430056",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1430056"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_0988.json"
}
],
"title": "Red Hat Security Advisory: qemu-kvm-rhev security update",
"tracking": {
"current_release_date": "2024-11-14T23:33:37+00:00",
"generator": {
"date": "2024-11-14T23:33:37+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2017:0988",
"initial_release_date": "2017-04-18T13:55:36+00:00",
"revision_history": [
{
"date": "2017-04-18T13:55:36+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2017-04-18T13:55:36+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-14T23:33:37+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenStack Platform 10.0",
"product": {
"name": "Red Hat OpenStack Platform 10.0",
"product_id": "7Server-RH7-RHOS-10.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openstack:10::el7"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenStack Platform"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_id": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev@2.6.0-28.el7_3.9?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"product": {
"name": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"product_id": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev-debuginfo@2.6.0-28.el7_3.9?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product": {
"name": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_id": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-tools-rhev@2.6.0-28.el7_3.9?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product": {
"name": "qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_id": "qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-img-rhev@2.6.0-28.el7_3.9?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product": {
"name": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_id": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-common-rhev@2.6.0-28.el7_3.9?arch=x86_64\u0026epoch=10"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"product": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"product_id": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev@2.6.0-28.el7_3.9?arch=src\u0026epoch=10"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64 as a component of Red Hat OpenStack Platform 10.0",
"product_id": "7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64"
},
"product_reference": "qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-10.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64 as a component of Red Hat OpenStack Platform 10.0",
"product_id": "7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64"
},
"product_reference": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-10.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src as a component of Red Hat OpenStack Platform 10.0",
"product_id": "7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src"
},
"product_reference": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"relates_to_product_reference": "7Server-RH7-RHOS-10.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64 as a component of Red Hat OpenStack Platform 10.0",
"product_id": "7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64"
},
"product_reference": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-10.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64 as a component of Red Hat OpenStack Platform 10.0",
"product_id": "7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64"
},
"product_reference": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-10.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64 as a component of Red Hat OpenStack Platform 10.0",
"product_id": "7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
},
"product_reference": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-10.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2016-9603",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2016-11-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1430056"
}
],
"notes": [
{
"category": "description",
"text": "A heap buffer overflow flaw was found in QEMU\u0027s Cirrus CLGD 54xx VGA emulator\u0027s VNC display driver support; the issue could occur when a VNC client attempted to update its display after a VGA operation is performed by a guest. A privileged user/process inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: cirrus: heap buffer overflow via vnc connection",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-9603"
},
{
"category": "external",
"summary": "RHBZ#1430056",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1430056"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-9603",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-9603"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-9603",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-9603"
}
],
"release_date": "2017-03-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-04-18T13:55:36+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:0988"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:A/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Qemu: cirrus: heap buffer overflow via vnc connection"
},
{
"acknowledgments": [
{
"names": [
"Jiangxin"
],
"organization": "PSIRT Huawei Inc."
}
],
"cve": "CVE-2017-7718",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2017-03-15T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1443441"
}
],
"notes": [
{
"category": "description",
"text": "An out-of-bounds access issue was found in QEMU\u0027s Cirrus CLGD 54xx VGA Emulator support. The vulnerability could occur while copying VGA data using bitblt functions (for example, cirrus_bitblt_rop_fwd_transp_). A privileged user inside a guest could use this flaw to crash the QEMU process, resulting in denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: display: cirrus: OOB read access issue",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-7718"
},
{
"category": "external",
"summary": "RHBZ#1443441",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1443441"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-7718",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7718"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-7718",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7718"
}
],
"release_date": "2017-03-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-04-18T13:55:36+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:0988"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 2.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:A/AC:H/Au:S/C:P/I:N/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.0,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:L",
"version": "3.0"
},
"products": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Qemu: display: cirrus: OOB read access issue"
},
{
"acknowledgments": [
{
"names": [
"Jiangxin"
],
"organization": "PSIRT Huawei Inc."
},
{
"names": [
"Li Qiang"
],
"organization": "Qihoo 360 Gear Team"
}
],
"cve": "CVE-2017-7980",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2017-02-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1444371"
}
],
"notes": [
{
"category": "description",
"text": "An out-of-bounds r/w access issue was found in QEMU\u0027s Cirrus CLGD 54xx VGA Emulator support. The vulnerability could occur while copying VGA data via various bitblt functions. A privileged user inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: display: cirrus: OOB r/w access issues in bitblt routines",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-7980"
},
{
"category": "external",
"summary": "RHBZ#1444371",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1444371"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-7980",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7980"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-7980",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7980"
}
],
"release_date": "2017-03-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-04-18T13:55:36+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:0988"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:A/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Qemu: display: cirrus: OOB r/w access issues in bitblt routines"
}
]
}
rhsa-2017_0980
Vulnerability from csaf_redhat
Published
2017-04-18 04:56
Modified
2024-11-14 23:33
Summary
Red Hat Security Advisory: qemu-kvm-rhev security update
Notes
Topic
An update for qemu-kvm-rhev is now available for Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-rhev packages provide the user-space component for running virtual machines that use KVM in environments managed by Red Hat products.
Security Fix(es):
* Quick Emulator (QEMU), built with the Cirrus CLGD 54xx VGA Emulator and the VNC display driver support, is vulnerable to a heap buffer overflow issue. The issue could occur when a VNC client attempts to update its display after a VGA operation is performed by a guest. A privileged user/process inside guest could use this flaw to crash the QEMU process resulting in DoS or, potentially, leverage it to execute arbitrary code on the host with privileges of the QEMU process. (CVE-2016-9603)
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for qemu-kvm-rhev is now available for Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-rhev packages provide the user-space component for running virtual machines that use KVM in environments managed by Red Hat products.\n\nSecurity Fix(es):\n\n* Quick Emulator (QEMU), built with the Cirrus CLGD 54xx VGA Emulator and the VNC display driver support, is vulnerable to a heap buffer overflow issue. The issue could occur when a VNC client attempts to update its display after a VGA operation is performed by a guest. A privileged user/process inside guest could use this flaw to crash the QEMU process resulting in DoS or, potentially, leverage it to execute arbitrary code on the host with privileges of the QEMU process. (CVE-2016-9603)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2017:0980",
"url": "https://access.redhat.com/errata/RHSA-2017:0980"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "1430056",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1430056"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_0980.json"
}
],
"title": "Red Hat Security Advisory: qemu-kvm-rhev security update",
"tracking": {
"current_release_date": "2024-11-14T23:33:28+00:00",
"generator": {
"date": "2024-11-14T23:33:28+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2017:0980",
"initial_release_date": "2017-04-18T04:56:54+00:00",
"revision_history": [
{
"date": "2017-04-18T04:56:54+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2017-04-18T04:56:54+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-14T23:33:28+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7",
"product": {
"name": "Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7",
"product_id": "7Server-RH7-RHOS-5.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openstack:5::el7"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenStack Platform"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_id": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev@2.6.0-28.el7_3.9?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"product": {
"name": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"product_id": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev-debuginfo@2.6.0-28.el7_3.9?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product": {
"name": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_id": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-tools-rhev@2.6.0-28.el7_3.9?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product": {
"name": "qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_id": "qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-img-rhev@2.6.0-28.el7_3.9?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product": {
"name": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_id": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-common-rhev@2.6.0-28.el7_3.9?arch=x86_64\u0026epoch=10"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"product": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"product_id": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev@2.6.0-28.el7_3.9?arch=src\u0026epoch=10"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7",
"product_id": "7Server-RH7-RHOS-5.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64"
},
"product_reference": "qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-5.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7",
"product_id": "7Server-RH7-RHOS-5.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64"
},
"product_reference": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-5.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7",
"product_id": "7Server-RH7-RHOS-5.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src"
},
"product_reference": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"relates_to_product_reference": "7Server-RH7-RHOS-5.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7",
"product_id": "7Server-RH7-RHOS-5.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64"
},
"product_reference": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-5.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7",
"product_id": "7Server-RH7-RHOS-5.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64"
},
"product_reference": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-5.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7",
"product_id": "7Server-RH7-RHOS-5.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
},
"product_reference": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-5.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2016-9603",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2016-11-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1430056"
}
],
"notes": [
{
"category": "description",
"text": "A heap buffer overflow flaw was found in QEMU\u0027s Cirrus CLGD 54xx VGA emulator\u0027s VNC display driver support; the issue could occur when a VNC client attempted to update its display after a VGA operation is performed by a guest. A privileged user/process inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: cirrus: heap buffer overflow via vnc connection",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-5.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-5.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-9603"
},
{
"category": "external",
"summary": "RHBZ#1430056",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1430056"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-9603",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-9603"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-9603",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-9603"
}
],
"release_date": "2017-03-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-04-18T04:56:54+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"7Server-RH7-RHOS-5.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-5.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:0980"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:A/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"7Server-RH7-RHOS-5.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-5.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Qemu: cirrus: heap buffer overflow via vnc connection"
},
{
"acknowledgments": [
{
"names": [
"Jiangxin"
],
"organization": "PSIRT Huawei Inc."
}
],
"cve": "CVE-2017-7718",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2017-03-15T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1443441"
}
],
"notes": [
{
"category": "description",
"text": "An out-of-bounds access issue was found in QEMU\u0027s Cirrus CLGD 54xx VGA Emulator support. The vulnerability could occur while copying VGA data using bitblt functions (for example, cirrus_bitblt_rop_fwd_transp_). A privileged user inside a guest could use this flaw to crash the QEMU process, resulting in denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: display: cirrus: OOB read access issue",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-5.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-5.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-7718"
},
{
"category": "external",
"summary": "RHBZ#1443441",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1443441"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-7718",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7718"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-7718",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7718"
}
],
"release_date": "2017-03-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-04-18T04:56:54+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"7Server-RH7-RHOS-5.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-5.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:0980"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 2.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:A/AC:H/Au:S/C:P/I:N/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.0,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:L",
"version": "3.0"
},
"products": [
"7Server-RH7-RHOS-5.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-5.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Qemu: display: cirrus: OOB read access issue"
},
{
"acknowledgments": [
{
"names": [
"Jiangxin"
],
"organization": "PSIRT Huawei Inc."
},
{
"names": [
"Li Qiang"
],
"organization": "Qihoo 360 Gear Team"
}
],
"cve": "CVE-2017-7980",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2017-02-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1444371"
}
],
"notes": [
{
"category": "description",
"text": "An out-of-bounds r/w access issue was found in QEMU\u0027s Cirrus CLGD 54xx VGA Emulator support. The vulnerability could occur while copying VGA data via various bitblt functions. A privileged user inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: display: cirrus: OOB r/w access issues in bitblt routines",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-5.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-5.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-7980"
},
{
"category": "external",
"summary": "RHBZ#1444371",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1444371"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-7980",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7980"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-7980",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7980"
}
],
"release_date": "2017-03-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-04-18T04:56:54+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"7Server-RH7-RHOS-5.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-5.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:0980"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:A/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"7Server-RH7-RHOS-5.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-5.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Qemu: display: cirrus: OOB r/w access issues in bitblt routines"
}
]
}
rhsa-2017_1206
Vulnerability from csaf_redhat
Published
2017-05-09 12:29
Modified
2024-11-22 10:39
Summary
Red Hat Security Advisory: qemu-kvm security update
Notes
Topic
An update for qemu-kvm is now available for Red Hat Enterprise Linux 6.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm package provides the user-space component for running virtual machines that use KVM.
Security Fix(es):
* A heap buffer overflow flaw was found in QEMU's Cirrus CLGD 54xx VGA emulator's VNC display driver support; the issue could occur when a VNC client attempted to update its display after a VGA operation is performed by a guest. A privileged user/process inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process. (CVE-2016-9603)
* An out-of-bounds r/w access issue was found in QEMU's Cirrus CLGD 54xx VGA Emulator support. The vulnerability could occur while copying VGA data via various bitblt functions. A privileged user inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process. (CVE-2017-7980)
* An out-of-bounds memory access issue was found in QEMU's VNC display driver support. The vulnerability could occur while refreshing the VNC display surface area in the 'vnc_refresh_server_surface'. A user/process inside a guest could use this flaw to crash the QEMU process, resulting in a denial of service. (CVE-2017-2633)
* An out-of-bounds access issue was found in QEMU's Cirrus CLGD 54xx VGA Emulator support. The vulnerability could occur while copying VGA data using bitblt functions (for example, cirrus_bitblt_rop_fwd_transp_). A privileged user inside a guest could use this flaw to crash the QEMU process, resulting in denial of service. (CVE-2017-7718)
Red Hat would like to thank Jiangxin (PSIRT Huawei Inc.) and Li Qiang (Qihoo 360 Gear Team) for reporting CVE-2017-7980 and Jiangxin (PSIRT Huawei Inc.) for reporting CVE-2017-7718.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for qemu-kvm is now available for Red Hat Enterprise Linux 6.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm package provides the user-space component for running virtual machines that use KVM.\n\nSecurity Fix(es):\n\n* A heap buffer overflow flaw was found in QEMU\u0027s Cirrus CLGD 54xx VGA emulator\u0027s VNC display driver support; the issue could occur when a VNC client attempted to update its display after a VGA operation is performed by a guest. A privileged user/process inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process. (CVE-2016-9603)\n\n* An out-of-bounds r/w access issue was found in QEMU\u0027s Cirrus CLGD 54xx VGA Emulator support. The vulnerability could occur while copying VGA data via various bitblt functions. A privileged user inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process. (CVE-2017-7980)\n\n* An out-of-bounds memory access issue was found in QEMU\u0027s VNC display driver support. The vulnerability could occur while refreshing the VNC display surface area in the \u0027vnc_refresh_server_surface\u0027. A user/process inside a guest could use this flaw to crash the QEMU process, resulting in a denial of service. (CVE-2017-2633)\n\n* An out-of-bounds access issue was found in QEMU\u0027s Cirrus CLGD 54xx VGA Emulator support. The vulnerability could occur while copying VGA data using bitblt functions (for example, cirrus_bitblt_rop_fwd_transp_). A privileged user inside a guest could use this flaw to crash the QEMU process, resulting in denial of service. (CVE-2017-7718)\n\nRed Hat would like to thank Jiangxin (PSIRT Huawei Inc.) and Li Qiang (Qihoo 360 Gear Team) for reporting CVE-2017-7980 and Jiangxin (PSIRT Huawei Inc.) for reporting CVE-2017-7718.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2017:1206",
"url": "https://access.redhat.com/errata/RHSA-2017:1206"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "1400438",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1400438"
},
{
"category": "external",
"summary": "1425939",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1425939"
},
{
"category": "external",
"summary": "1430056",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1430056"
},
{
"category": "external",
"summary": "1437060",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1437060"
},
{
"category": "external",
"summary": "1443441",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1443441"
},
{
"category": "external",
"summary": "1444371",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1444371"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_1206.json"
}
],
"title": "Red Hat Security Advisory: qemu-kvm security update",
"tracking": {
"current_release_date": "2024-11-22T10:39:21+00:00",
"generator": {
"date": "2024-11-22T10:39:21+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2017:1206",
"initial_release_date": "2017-05-09T12:29:49+00:00",
"revision_history": [
{
"date": "2017-05-09T12:29:49+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2017-05-09T12:29:49+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-22T10:39:21+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Desktop (v. 6)",
"product": {
"name": "Red Hat Enterprise Linux Desktop (v. 6)",
"product_id": "6Client-6.9.z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:6::client"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux HPC Node (v. 6)",
"product": {
"name": "Red Hat Enterprise Linux HPC Node (v. 6)",
"product_id": "6ComputeNode-6.9.z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:6::computenode"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Server (v. 6)",
"product": {
"name": "Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-6.9.z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:6::server"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Workstation (v. 6)",
"product": {
"name": "Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-6.9.z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:6::workstation"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"product": {
"name": "qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"product_id": "qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-img@0.12.1.2-2.503.el6_9.3?arch=x86_64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"product": {
"name": "qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"product_id": "qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-guest-agent@0.12.1.2-2.503.el6_9.3?arch=x86_64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"product": {
"name": "qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"product_id": "qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-tools@0.12.1.2-2.503.el6_9.3?arch=x86_64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"product": {
"name": "qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"product_id": "qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm@0.12.1.2-2.503.el6_9.3?arch=x86_64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"product": {
"name": "qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"product_id": "qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-debuginfo@0.12.1.2-2.503.el6_9.3?arch=x86_64\u0026epoch=2"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"product": {
"name": "qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"product_id": "qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-guest-agent@0.12.1.2-2.503.el6_9.3?arch=i686\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"product": {
"name": "qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"product_id": "qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-debuginfo@0.12.1.2-2.503.el6_9.3?arch=i686\u0026epoch=2"
}
}
}
],
"category": "architecture",
"name": "i686"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"product": {
"name": "qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"product_id": "qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm@0.12.1.2-2.503.el6_9.3?arch=src\u0026epoch=2"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"product": {
"name": "qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"product_id": "qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-guest-agent@0.12.1.2-2.503.el6_9.3?arch=ppc64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"product": {
"name": "qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"product_id": "qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-debuginfo@0.12.1.2-2.503.el6_9.3?arch=ppc64\u0026epoch=2"
}
}
}
],
"category": "architecture",
"name": "ppc64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686 as a component of Red Hat Enterprise Linux Desktop (v. 6)",
"product_id": "6Client-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686"
},
"product_reference": "qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"relates_to_product_reference": "6Client-6.9.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64 as a component of Red Hat Enterprise Linux Desktop (v. 6)",
"product_id": "6Client-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64"
},
"product_reference": "qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"relates_to_product_reference": "6Client-6.9.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 6)",
"product_id": "6Client-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64"
},
"product_reference": "qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"relates_to_product_reference": "6Client-6.9.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 6)",
"product_id": "6Client-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64"
},
"product_reference": "qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"relates_to_product_reference": "6Client-6.9.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src as a component of Red Hat Enterprise Linux Desktop (v. 6)",
"product_id": "6Client-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src"
},
"product_reference": "qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"relates_to_product_reference": "6Client-6.9.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 6)",
"product_id": "6Client-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64"
},
"product_reference": "qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"relates_to_product_reference": "6Client-6.9.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686 as a component of Red Hat Enterprise Linux Desktop (v. 6)",
"product_id": "6Client-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686"
},
"product_reference": "qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"relates_to_product_reference": "6Client-6.9.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64 as a component of Red Hat Enterprise Linux Desktop (v. 6)",
"product_id": "6Client-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64"
},
"product_reference": "qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"relates_to_product_reference": "6Client-6.9.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 6)",
"product_id": "6Client-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64"
},
"product_reference": "qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"relates_to_product_reference": "6Client-6.9.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 6)",
"product_id": "6Client-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
},
"product_reference": "qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"relates_to_product_reference": "6Client-6.9.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686 as a component of Red Hat Enterprise Linux HPC Node (v. 6)",
"product_id": "6ComputeNode-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686"
},
"product_reference": "qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"relates_to_product_reference": "6ComputeNode-6.9.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64 as a component of Red Hat Enterprise Linux HPC Node (v. 6)",
"product_id": "6ComputeNode-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64"
},
"product_reference": "qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"relates_to_product_reference": "6ComputeNode-6.9.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64 as a component of Red Hat Enterprise Linux HPC Node (v. 6)",
"product_id": "6ComputeNode-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64"
},
"product_reference": "qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"relates_to_product_reference": "6ComputeNode-6.9.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64 as a component of Red Hat Enterprise Linux HPC Node (v. 6)",
"product_id": "6ComputeNode-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64"
},
"product_reference": "qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"relates_to_product_reference": "6ComputeNode-6.9.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src as a component of Red Hat Enterprise Linux HPC Node (v. 6)",
"product_id": "6ComputeNode-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src"
},
"product_reference": "qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"relates_to_product_reference": "6ComputeNode-6.9.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64 as a component of Red Hat Enterprise Linux HPC Node (v. 6)",
"product_id": "6ComputeNode-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64"
},
"product_reference": "qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"relates_to_product_reference": "6ComputeNode-6.9.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686 as a component of Red Hat Enterprise Linux HPC Node (v. 6)",
"product_id": "6ComputeNode-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686"
},
"product_reference": "qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"relates_to_product_reference": "6ComputeNode-6.9.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64 as a component of Red Hat Enterprise Linux HPC Node (v. 6)",
"product_id": "6ComputeNode-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64"
},
"product_reference": "qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"relates_to_product_reference": "6ComputeNode-6.9.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64 as a component of Red Hat Enterprise Linux HPC Node (v. 6)",
"product_id": "6ComputeNode-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64"
},
"product_reference": "qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"relates_to_product_reference": "6ComputeNode-6.9.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64 as a component of Red Hat Enterprise Linux HPC Node (v. 6)",
"product_id": "6ComputeNode-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
},
"product_reference": "qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"relates_to_product_reference": "6ComputeNode-6.9.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686 as a component of Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686"
},
"product_reference": "qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"relates_to_product_reference": "6Server-6.9.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64 as a component of Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64"
},
"product_reference": "qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"relates_to_product_reference": "6Server-6.9.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64 as a component of Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64"
},
"product_reference": "qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"relates_to_product_reference": "6Server-6.9.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64 as a component of Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64"
},
"product_reference": "qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"relates_to_product_reference": "6Server-6.9.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src as a component of Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src"
},
"product_reference": "qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"relates_to_product_reference": "6Server-6.9.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64 as a component of Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64"
},
"product_reference": "qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"relates_to_product_reference": "6Server-6.9.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686 as a component of Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686"
},
"product_reference": "qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"relates_to_product_reference": "6Server-6.9.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64 as a component of Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64"
},
"product_reference": "qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"relates_to_product_reference": "6Server-6.9.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64 as a component of Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64"
},
"product_reference": "qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"relates_to_product_reference": "6Server-6.9.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64 as a component of Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
},
"product_reference": "qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"relates_to_product_reference": "6Server-6.9.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686 as a component of Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686"
},
"product_reference": "qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"relates_to_product_reference": "6Workstation-6.9.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64"
},
"product_reference": "qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"relates_to_product_reference": "6Workstation-6.9.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64"
},
"product_reference": "qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"relates_to_product_reference": "6Workstation-6.9.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64"
},
"product_reference": "qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"relates_to_product_reference": "6Workstation-6.9.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src as a component of Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src"
},
"product_reference": "qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"relates_to_product_reference": "6Workstation-6.9.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64"
},
"product_reference": "qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"relates_to_product_reference": "6Workstation-6.9.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686 as a component of Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686"
},
"product_reference": "qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"relates_to_product_reference": "6Workstation-6.9.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64"
},
"product_reference": "qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"relates_to_product_reference": "6Workstation-6.9.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64"
},
"product_reference": "qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"relates_to_product_reference": "6Workstation-6.9.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
},
"product_reference": "qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"relates_to_product_reference": "6Workstation-6.9.z"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2016-9603",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2016-11-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1430056"
}
],
"notes": [
{
"category": "description",
"text": "A heap buffer overflow flaw was found in QEMU\u0027s Cirrus CLGD 54xx VGA emulator\u0027s VNC display driver support; the issue could occur when a VNC client attempted to update its display after a VGA operation is performed by a guest. A privileged user/process inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: cirrus: heap buffer overflow via vnc connection",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Client-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6Client-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Client-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6Client-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6Client-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Client-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6ComputeNode-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6ComputeNode-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6ComputeNode-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6ComputeNode-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6ComputeNode-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6Server-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Server-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6Server-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6Server-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Server-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6Workstation-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Workstation-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6Workstation-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6Workstation-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Workstation-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-9603"
},
{
"category": "external",
"summary": "RHBZ#1430056",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1430056"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-9603",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-9603"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-9603",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-9603"
}
],
"release_date": "2017-03-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-05-09T12:29:49+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"6Client-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6Client-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Client-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6Client-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6Client-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Client-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6ComputeNode-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6ComputeNode-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6ComputeNode-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6ComputeNode-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6ComputeNode-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6Server-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Server-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6Server-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6Server-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Server-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6Workstation-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Workstation-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6Workstation-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6Workstation-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Workstation-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:1206"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:A/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"6Client-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6Client-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Client-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6Client-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6Client-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Client-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6ComputeNode-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6ComputeNode-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6ComputeNode-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6ComputeNode-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6ComputeNode-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6Server-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Server-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6Server-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6Server-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Server-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6Workstation-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Workstation-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6Workstation-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6Workstation-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Workstation-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Qemu: cirrus: heap buffer overflow via vnc connection"
},
{
"cve": "CVE-2017-2633",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2016-12-01T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1425939"
}
],
"notes": [
{
"category": "description",
"text": "An out-of-bounds memory access issue was found in Quick Emulator (QEMU) in the VNC display driver. This flaw could occur while refreshing the VNC display surface area in the \u0027vnc_refresh_server_surface\u0027. A user inside a guest could use this flaw to crash the QEMU process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: VNC: memory corruption due to unchecked resolution limit",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Client-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6Client-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Client-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6Client-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6Client-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Client-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6ComputeNode-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6ComputeNode-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6ComputeNode-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6ComputeNode-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6ComputeNode-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6Server-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Server-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6Server-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6Server-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Server-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6Workstation-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Workstation-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6Workstation-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6Workstation-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Workstation-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-2633"
},
{
"category": "external",
"summary": "RHBZ#1425939",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1425939"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-2633",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-2633"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-2633",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-2633"
}
],
"release_date": "2016-12-01T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-05-09T12:29:49+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"6Client-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6Client-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Client-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6Client-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6Client-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Client-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6ComputeNode-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6ComputeNode-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6ComputeNode-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6ComputeNode-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6ComputeNode-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6Server-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Server-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6Server-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6Server-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Server-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6Workstation-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Workstation-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6Workstation-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6Workstation-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Workstation-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:1206"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 3.8,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:A/AC:M/Au:S/C:N/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L",
"version": "3.0"
},
"products": [
"6Client-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6Client-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Client-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6Client-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6Client-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Client-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6ComputeNode-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6ComputeNode-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6ComputeNode-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6ComputeNode-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6ComputeNode-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6Server-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Server-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6Server-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6Server-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Server-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6Workstation-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Workstation-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6Workstation-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6Workstation-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Workstation-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Qemu: VNC: memory corruption due to unchecked resolution limit"
},
{
"acknowledgments": [
{
"names": [
"Jiangxin"
],
"organization": "PSIRT Huawei Inc."
}
],
"cve": "CVE-2017-7718",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2017-03-15T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1443441"
}
],
"notes": [
{
"category": "description",
"text": "An out-of-bounds access issue was found in QEMU\u0027s Cirrus CLGD 54xx VGA Emulator support. The vulnerability could occur while copying VGA data using bitblt functions (for example, cirrus_bitblt_rop_fwd_transp_). A privileged user inside a guest could use this flaw to crash the QEMU process, resulting in denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: display: cirrus: OOB read access issue",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Client-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6Client-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Client-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6Client-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6Client-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Client-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6ComputeNode-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6ComputeNode-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6ComputeNode-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6ComputeNode-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6ComputeNode-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6Server-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Server-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6Server-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6Server-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Server-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6Workstation-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Workstation-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6Workstation-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6Workstation-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Workstation-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-7718"
},
{
"category": "external",
"summary": "RHBZ#1443441",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1443441"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-7718",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7718"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-7718",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7718"
}
],
"release_date": "2017-03-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-05-09T12:29:49+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"6Client-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6Client-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Client-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6Client-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6Client-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Client-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6ComputeNode-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6ComputeNode-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6ComputeNode-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6ComputeNode-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6ComputeNode-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6Server-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Server-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6Server-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6Server-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Server-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6Workstation-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Workstation-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6Workstation-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6Workstation-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Workstation-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:1206"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 2.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:A/AC:H/Au:S/C:P/I:N/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.0,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:L",
"version": "3.0"
},
"products": [
"6Client-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6Client-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Client-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6Client-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6Client-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Client-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6ComputeNode-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6ComputeNode-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6ComputeNode-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6ComputeNode-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6ComputeNode-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6Server-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Server-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6Server-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6Server-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Server-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6Workstation-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Workstation-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6Workstation-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6Workstation-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Workstation-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Qemu: display: cirrus: OOB read access issue"
},
{
"acknowledgments": [
{
"names": [
"Jiangxin"
],
"organization": "PSIRT Huawei Inc."
},
{
"names": [
"Li Qiang"
],
"organization": "Qihoo 360 Gear Team"
}
],
"cve": "CVE-2017-7980",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2017-02-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1444371"
}
],
"notes": [
{
"category": "description",
"text": "An out-of-bounds r/w access issue was found in QEMU\u0027s Cirrus CLGD 54xx VGA Emulator support. The vulnerability could occur while copying VGA data via various bitblt functions. A privileged user inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: display: cirrus: OOB r/w access issues in bitblt routines",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Client-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6Client-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Client-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6Client-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6Client-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Client-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6ComputeNode-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6ComputeNode-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6ComputeNode-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6ComputeNode-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6ComputeNode-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6Server-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Server-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6Server-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6Server-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Server-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6Workstation-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Workstation-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6Workstation-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6Workstation-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Workstation-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-7980"
},
{
"category": "external",
"summary": "RHBZ#1444371",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1444371"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-7980",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7980"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-7980",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7980"
}
],
"release_date": "2017-03-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-05-09T12:29:49+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"6Client-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6Client-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Client-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6Client-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6Client-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Client-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6ComputeNode-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6ComputeNode-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6ComputeNode-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6ComputeNode-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6ComputeNode-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6Server-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Server-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6Server-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6Server-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Server-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6Workstation-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Workstation-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6Workstation-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6Workstation-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Workstation-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:1206"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:A/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"6Client-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6Client-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Client-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6Client-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6Client-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Client-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Client-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6ComputeNode-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6ComputeNode-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6ComputeNode-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6ComputeNode-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6ComputeNode-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6ComputeNode-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6Server-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Server-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6Server-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6Server-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Server-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Server-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.i686",
"6Workstation-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Workstation-6.9.z:qemu-guest-agent-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-img-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.src",
"6Workstation-6.9.z:qemu-kvm-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.i686",
"6Workstation-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.ppc64",
"6Workstation-6.9.z:qemu-kvm-debuginfo-2:0.12.1.2-2.503.el6_9.3.x86_64",
"6Workstation-6.9.z:qemu-kvm-tools-2:0.12.1.2-2.503.el6_9.3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Qemu: display: cirrus: OOB r/w access issues in bitblt routines"
}
]
}
rhsa-2017_1430
Vulnerability from csaf_redhat
Published
2017-06-13 07:26
Modified
2024-11-14 23:33
Summary
Red Hat Security Advisory: qemu-kvm security and bug fix update
Notes
Topic
An update for qemu-kvm is now available for Red Hat Enterprise Linux 7.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm package provides the user-space component for running virtual machines that use KVM.
Security Fix(es):
* An out-of-bounds r/w access issue was found in QEMU's Cirrus CLGD 54xx VGA Emulator support. The vulnerability could occur while copying VGA data via various bitblt functions. A privileged user inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process. (CVE-2017-7980)
* An out-of-bounds access issue was found in QEMU's Cirrus CLGD 54xx VGA Emulator support. The vulnerability could occur while copying VGA data using bitblt functions (for example, cirrus_bitblt_rop_fwd_transp_). A privileged user inside a guest could use this flaw to crash the QEMU process, resulting in denial of service. (CVE-2017-7718)
Red Hat would like to thank Jiangxin (PSIRT Huawei Inc) and Li Qiang (Qihoo 360 Gear Team) for reporting CVE-2017-7980 and Jiangxin (PSIRT Huawei Inc) for reporting CVE-2017-7718.
Bug Fix(es):
* Previously, guest virtual machines in some cases became unresponsive when the "pty" back end of a serial device performed an irregular I/O communication. This update improves the handling of serial I/O on guests, which prevents the described problem from occurring. (BZ#1452332)
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for qemu-kvm is now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm package provides the user-space component for running virtual machines that use KVM.\n\nSecurity Fix(es):\n\n* An out-of-bounds r/w access issue was found in QEMU\u0027s Cirrus CLGD 54xx VGA Emulator support. The vulnerability could occur while copying VGA data via various bitblt functions. A privileged user inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process. (CVE-2017-7980)\n\n* An out-of-bounds access issue was found in QEMU\u0027s Cirrus CLGD 54xx VGA Emulator support. The vulnerability could occur while copying VGA data using bitblt functions (for example, cirrus_bitblt_rop_fwd_transp_). A privileged user inside a guest could use this flaw to crash the QEMU process, resulting in denial of service. (CVE-2017-7718)\n\nRed Hat would like to thank Jiangxin (PSIRT Huawei Inc) and Li Qiang (Qihoo 360 Gear Team) for reporting CVE-2017-7980 and Jiangxin (PSIRT Huawei Inc) for reporting CVE-2017-7718.\n\nBug Fix(es):\n\n* Previously, guest virtual machines in some cases became unresponsive when the \"pty\" back end of a serial device performed an irregular I/O communication. This update improves the handling of serial I/O on guests, which prevents the described problem from occurring. (BZ#1452332)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2017:1430",
"url": "https://access.redhat.com/errata/RHSA-2017:1430"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "1443441",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1443441"
},
{
"category": "external",
"summary": "1444371",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1444371"
},
{
"category": "external",
"summary": "1452332",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1452332"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_1430.json"
}
],
"title": "Red Hat Security Advisory: qemu-kvm security and bug fix update",
"tracking": {
"current_release_date": "2024-11-14T23:33:50+00:00",
"generator": {
"date": "2024-11-14T23:33:50+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2017:1430",
"initial_release_date": "2017-06-13T07:26:41+00:00",
"revision_history": [
{
"date": "2017-06-13T07:26:41+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2017-06-13T07:26:41+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-14T23:33:50+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Client (v. 7)",
"product": {
"name": "Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client-7.3.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:7::client"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product": {
"name": "Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional-7.3.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:7::computenode"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Server (v. 7)",
"product": {
"name": "Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.3.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:7::server"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Workstation (v. 7)",
"product": {
"name": "Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.3.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:7::workstation"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-kvm-common-10:1.5.3-126.el7_3.9.x86_64",
"product": {
"name": "qemu-kvm-common-10:1.5.3-126.el7_3.9.x86_64",
"product_id": "qemu-kvm-common-10:1.5.3-126.el7_3.9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-common@1.5.3-126.el7_3.9?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.x86_64",
"product": {
"name": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.x86_64",
"product_id": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-debuginfo@1.5.3-126.el7_3.9?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-img-10:1.5.3-126.el7_3.9.x86_64",
"product": {
"name": "qemu-img-10:1.5.3-126.el7_3.9.x86_64",
"product_id": "qemu-img-10:1.5.3-126.el7_3.9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-img@1.5.3-126.el7_3.9?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-tools-10:1.5.3-126.el7_3.9.x86_64",
"product": {
"name": "qemu-kvm-tools-10:1.5.3-126.el7_3.9.x86_64",
"product_id": "qemu-kvm-tools-10:1.5.3-126.el7_3.9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-tools@1.5.3-126.el7_3.9?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-10:1.5.3-126.el7_3.9.x86_64",
"product": {
"name": "qemu-kvm-10:1.5.3-126.el7_3.9.x86_64",
"product_id": "qemu-kvm-10:1.5.3-126.el7_3.9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm@1.5.3-126.el7_3.9?arch=x86_64\u0026epoch=10"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-kvm-10:1.5.3-126.el7_3.9.src",
"product": {
"name": "qemu-kvm-10:1.5.3-126.el7_3.9.src",
"product_id": "qemu-kvm-10:1.5.3-126.el7_3.9.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm@1.5.3-126.el7_3.9?arch=src\u0026epoch=10"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.ppc64",
"product": {
"name": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.ppc64",
"product_id": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.ppc64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-debuginfo@1.5.3-126.el7_3.9?arch=ppc64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-img-10:1.5.3-126.el7_3.9.ppc64",
"product": {
"name": "qemu-img-10:1.5.3-126.el7_3.9.ppc64",
"product_id": "qemu-img-10:1.5.3-126.el7_3.9.ppc64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-img@1.5.3-126.el7_3.9?arch=ppc64\u0026epoch=10"
}
}
}
],
"category": "architecture",
"name": "ppc64"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.ppc64le",
"product": {
"name": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.ppc64le",
"product_id": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-debuginfo@1.5.3-126.el7_3.9?arch=ppc64le\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-img-10:1.5.3-126.el7_3.9.ppc64le",
"product": {
"name": "qemu-img-10:1.5.3-126.el7_3.9.ppc64le",
"product_id": "qemu-img-10:1.5.3-126.el7_3.9.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-img@1.5.3-126.el7_3.9?arch=ppc64le\u0026epoch=10"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-10:1.5.3-126.el7_3.9.ppc64 as a component of Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.ppc64"
},
"product_reference": "qemu-img-10:1.5.3-126.el7_3.9.ppc64",
"relates_to_product_reference": "7Client-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-10:1.5.3-126.el7_3.9.ppc64le as a component of Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.ppc64le"
},
"product_reference": "qemu-img-10:1.5.3-126.el7_3.9.ppc64le",
"relates_to_product_reference": "7Client-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-10:1.5.3-126.el7_3.9.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.x86_64"
},
"product_reference": "qemu-img-10:1.5.3-126.el7_3.9.x86_64",
"relates_to_product_reference": "7Client-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-10:1.5.3-126.el7_3.9.src as a component of Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.9.src"
},
"product_reference": "qemu-kvm-10:1.5.3-126.el7_3.9.src",
"relates_to_product_reference": "7Client-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-10:1.5.3-126.el7_3.9.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.9.x86_64"
},
"product_reference": "qemu-kvm-10:1.5.3-126.el7_3.9.x86_64",
"relates_to_product_reference": "7Client-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-common-10:1.5.3-126.el7_3.9.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client-7.3.Z:qemu-kvm-common-10:1.5.3-126.el7_3.9.x86_64"
},
"product_reference": "qemu-kvm-common-10:1.5.3-126.el7_3.9.x86_64",
"relates_to_product_reference": "7Client-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.ppc64 as a component of Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.ppc64"
},
"product_reference": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.ppc64",
"relates_to_product_reference": "7Client-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.ppc64le as a component of Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.ppc64le"
},
"product_reference": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.ppc64le",
"relates_to_product_reference": "7Client-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.x86_64"
},
"product_reference": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.x86_64",
"relates_to_product_reference": "7Client-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-tools-10:1.5.3-126.el7_3.9.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client-7.3.Z:qemu-kvm-tools-10:1.5.3-126.el7_3.9.x86_64"
},
"product_reference": "qemu-kvm-tools-10:1.5.3-126.el7_3.9.x86_64",
"relates_to_product_reference": "7Client-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-10:1.5.3-126.el7_3.9.ppc64 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.ppc64"
},
"product_reference": "qemu-img-10:1.5.3-126.el7_3.9.ppc64",
"relates_to_product_reference": "7ComputeNode-optional-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-10:1.5.3-126.el7_3.9.ppc64le as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.ppc64le"
},
"product_reference": "qemu-img-10:1.5.3-126.el7_3.9.ppc64le",
"relates_to_product_reference": "7ComputeNode-optional-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-10:1.5.3-126.el7_3.9.x86_64 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.x86_64"
},
"product_reference": "qemu-img-10:1.5.3-126.el7_3.9.x86_64",
"relates_to_product_reference": "7ComputeNode-optional-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-10:1.5.3-126.el7_3.9.src as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.9.src"
},
"product_reference": "qemu-kvm-10:1.5.3-126.el7_3.9.src",
"relates_to_product_reference": "7ComputeNode-optional-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-10:1.5.3-126.el7_3.9.x86_64 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.9.x86_64"
},
"product_reference": "qemu-kvm-10:1.5.3-126.el7_3.9.x86_64",
"relates_to_product_reference": "7ComputeNode-optional-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-common-10:1.5.3-126.el7_3.9.x86_64 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional-7.3.Z:qemu-kvm-common-10:1.5.3-126.el7_3.9.x86_64"
},
"product_reference": "qemu-kvm-common-10:1.5.3-126.el7_3.9.x86_64",
"relates_to_product_reference": "7ComputeNode-optional-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.ppc64 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.ppc64"
},
"product_reference": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.ppc64",
"relates_to_product_reference": "7ComputeNode-optional-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.ppc64le as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.ppc64le"
},
"product_reference": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.ppc64le",
"relates_to_product_reference": "7ComputeNode-optional-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.x86_64 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.x86_64"
},
"product_reference": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.x86_64",
"relates_to_product_reference": "7ComputeNode-optional-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-tools-10:1.5.3-126.el7_3.9.x86_64 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional-7.3.Z:qemu-kvm-tools-10:1.5.3-126.el7_3.9.x86_64"
},
"product_reference": "qemu-kvm-tools-10:1.5.3-126.el7_3.9.x86_64",
"relates_to_product_reference": "7ComputeNode-optional-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-10:1.5.3-126.el7_3.9.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.ppc64"
},
"product_reference": "qemu-img-10:1.5.3-126.el7_3.9.ppc64",
"relates_to_product_reference": "7Server-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-10:1.5.3-126.el7_3.9.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.ppc64le"
},
"product_reference": "qemu-img-10:1.5.3-126.el7_3.9.ppc64le",
"relates_to_product_reference": "7Server-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-10:1.5.3-126.el7_3.9.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.x86_64"
},
"product_reference": "qemu-img-10:1.5.3-126.el7_3.9.x86_64",
"relates_to_product_reference": "7Server-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-10:1.5.3-126.el7_3.9.src as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.9.src"
},
"product_reference": "qemu-kvm-10:1.5.3-126.el7_3.9.src",
"relates_to_product_reference": "7Server-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-10:1.5.3-126.el7_3.9.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.9.x86_64"
},
"product_reference": "qemu-kvm-10:1.5.3-126.el7_3.9.x86_64",
"relates_to_product_reference": "7Server-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-common-10:1.5.3-126.el7_3.9.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.3.Z:qemu-kvm-common-10:1.5.3-126.el7_3.9.x86_64"
},
"product_reference": "qemu-kvm-common-10:1.5.3-126.el7_3.9.x86_64",
"relates_to_product_reference": "7Server-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.ppc64"
},
"product_reference": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.ppc64",
"relates_to_product_reference": "7Server-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.ppc64le"
},
"product_reference": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.ppc64le",
"relates_to_product_reference": "7Server-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.x86_64"
},
"product_reference": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.x86_64",
"relates_to_product_reference": "7Server-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-tools-10:1.5.3-126.el7_3.9.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.3.Z:qemu-kvm-tools-10:1.5.3-126.el7_3.9.x86_64"
},
"product_reference": "qemu-kvm-tools-10:1.5.3-126.el7_3.9.x86_64",
"relates_to_product_reference": "7Server-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-10:1.5.3-126.el7_3.9.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.ppc64"
},
"product_reference": "qemu-img-10:1.5.3-126.el7_3.9.ppc64",
"relates_to_product_reference": "7Workstation-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-10:1.5.3-126.el7_3.9.ppc64le as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.ppc64le"
},
"product_reference": "qemu-img-10:1.5.3-126.el7_3.9.ppc64le",
"relates_to_product_reference": "7Workstation-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-10:1.5.3-126.el7_3.9.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.x86_64"
},
"product_reference": "qemu-img-10:1.5.3-126.el7_3.9.x86_64",
"relates_to_product_reference": "7Workstation-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-10:1.5.3-126.el7_3.9.src as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.9.src"
},
"product_reference": "qemu-kvm-10:1.5.3-126.el7_3.9.src",
"relates_to_product_reference": "7Workstation-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-10:1.5.3-126.el7_3.9.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.9.x86_64"
},
"product_reference": "qemu-kvm-10:1.5.3-126.el7_3.9.x86_64",
"relates_to_product_reference": "7Workstation-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-common-10:1.5.3-126.el7_3.9.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.3.Z:qemu-kvm-common-10:1.5.3-126.el7_3.9.x86_64"
},
"product_reference": "qemu-kvm-common-10:1.5.3-126.el7_3.9.x86_64",
"relates_to_product_reference": "7Workstation-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.ppc64"
},
"product_reference": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.ppc64",
"relates_to_product_reference": "7Workstation-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.ppc64le as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.ppc64le"
},
"product_reference": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.ppc64le",
"relates_to_product_reference": "7Workstation-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.x86_64"
},
"product_reference": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.x86_64",
"relates_to_product_reference": "7Workstation-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-tools-10:1.5.3-126.el7_3.9.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.3.Z:qemu-kvm-tools-10:1.5.3-126.el7_3.9.x86_64"
},
"product_reference": "qemu-kvm-tools-10:1.5.3-126.el7_3.9.x86_64",
"relates_to_product_reference": "7Workstation-7.3.Z"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Jiangxin"
],
"organization": "PSIRT Huawei Inc."
}
],
"cve": "CVE-2017-7718",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2017-03-15T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1443441"
}
],
"notes": [
{
"category": "description",
"text": "An out-of-bounds access issue was found in QEMU\u0027s Cirrus CLGD 54xx VGA Emulator support. The vulnerability could occur while copying VGA data using bitblt functions (for example, cirrus_bitblt_rop_fwd_transp_). A privileged user inside a guest could use this flaw to crash the QEMU process, resulting in denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: display: cirrus: OOB read access issue",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Client-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.ppc64",
"7Client-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.ppc64le",
"7Client-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.x86_64",
"7Client-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.9.src",
"7Client-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.9.x86_64",
"7Client-7.3.Z:qemu-kvm-common-10:1.5.3-126.el7_3.9.x86_64",
"7Client-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.ppc64",
"7Client-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.ppc64le",
"7Client-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.x86_64",
"7Client-7.3.Z:qemu-kvm-tools-10:1.5.3-126.el7_3.9.x86_64",
"7ComputeNode-optional-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.ppc64",
"7ComputeNode-optional-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.ppc64le",
"7ComputeNode-optional-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.x86_64",
"7ComputeNode-optional-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.9.src",
"7ComputeNode-optional-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.9.x86_64",
"7ComputeNode-optional-7.3.Z:qemu-kvm-common-10:1.5.3-126.el7_3.9.x86_64",
"7ComputeNode-optional-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.ppc64",
"7ComputeNode-optional-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.ppc64le",
"7ComputeNode-optional-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.x86_64",
"7ComputeNode-optional-7.3.Z:qemu-kvm-tools-10:1.5.3-126.el7_3.9.x86_64",
"7Server-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.ppc64",
"7Server-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.ppc64le",
"7Server-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.x86_64",
"7Server-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.9.src",
"7Server-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.9.x86_64",
"7Server-7.3.Z:qemu-kvm-common-10:1.5.3-126.el7_3.9.x86_64",
"7Server-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.ppc64",
"7Server-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.ppc64le",
"7Server-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.x86_64",
"7Server-7.3.Z:qemu-kvm-tools-10:1.5.3-126.el7_3.9.x86_64",
"7Workstation-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.ppc64",
"7Workstation-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.ppc64le",
"7Workstation-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.x86_64",
"7Workstation-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.9.src",
"7Workstation-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.9.x86_64",
"7Workstation-7.3.Z:qemu-kvm-common-10:1.5.3-126.el7_3.9.x86_64",
"7Workstation-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.ppc64",
"7Workstation-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.ppc64le",
"7Workstation-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.x86_64",
"7Workstation-7.3.Z:qemu-kvm-tools-10:1.5.3-126.el7_3.9.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-7718"
},
{
"category": "external",
"summary": "RHBZ#1443441",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1443441"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-7718",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7718"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-7718",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7718"
}
],
"release_date": "2017-03-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-06-13T07:26:41+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"7Client-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.ppc64",
"7Client-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.ppc64le",
"7Client-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.x86_64",
"7Client-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.9.src",
"7Client-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.9.x86_64",
"7Client-7.3.Z:qemu-kvm-common-10:1.5.3-126.el7_3.9.x86_64",
"7Client-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.ppc64",
"7Client-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.ppc64le",
"7Client-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.x86_64",
"7Client-7.3.Z:qemu-kvm-tools-10:1.5.3-126.el7_3.9.x86_64",
"7ComputeNode-optional-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.ppc64",
"7ComputeNode-optional-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.ppc64le",
"7ComputeNode-optional-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.x86_64",
"7ComputeNode-optional-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.9.src",
"7ComputeNode-optional-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.9.x86_64",
"7ComputeNode-optional-7.3.Z:qemu-kvm-common-10:1.5.3-126.el7_3.9.x86_64",
"7ComputeNode-optional-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.ppc64",
"7ComputeNode-optional-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.ppc64le",
"7ComputeNode-optional-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.x86_64",
"7ComputeNode-optional-7.3.Z:qemu-kvm-tools-10:1.5.3-126.el7_3.9.x86_64",
"7Server-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.ppc64",
"7Server-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.ppc64le",
"7Server-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.x86_64",
"7Server-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.9.src",
"7Server-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.9.x86_64",
"7Server-7.3.Z:qemu-kvm-common-10:1.5.3-126.el7_3.9.x86_64",
"7Server-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.ppc64",
"7Server-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.ppc64le",
"7Server-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.x86_64",
"7Server-7.3.Z:qemu-kvm-tools-10:1.5.3-126.el7_3.9.x86_64",
"7Workstation-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.ppc64",
"7Workstation-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.ppc64le",
"7Workstation-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.x86_64",
"7Workstation-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.9.src",
"7Workstation-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.9.x86_64",
"7Workstation-7.3.Z:qemu-kvm-common-10:1.5.3-126.el7_3.9.x86_64",
"7Workstation-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.ppc64",
"7Workstation-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.ppc64le",
"7Workstation-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.x86_64",
"7Workstation-7.3.Z:qemu-kvm-tools-10:1.5.3-126.el7_3.9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:1430"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 2.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:A/AC:H/Au:S/C:P/I:N/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.0,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:L",
"version": "3.0"
},
"products": [
"7Client-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.ppc64",
"7Client-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.ppc64le",
"7Client-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.x86_64",
"7Client-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.9.src",
"7Client-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.9.x86_64",
"7Client-7.3.Z:qemu-kvm-common-10:1.5.3-126.el7_3.9.x86_64",
"7Client-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.ppc64",
"7Client-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.ppc64le",
"7Client-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.x86_64",
"7Client-7.3.Z:qemu-kvm-tools-10:1.5.3-126.el7_3.9.x86_64",
"7ComputeNode-optional-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.ppc64",
"7ComputeNode-optional-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.ppc64le",
"7ComputeNode-optional-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.x86_64",
"7ComputeNode-optional-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.9.src",
"7ComputeNode-optional-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.9.x86_64",
"7ComputeNode-optional-7.3.Z:qemu-kvm-common-10:1.5.3-126.el7_3.9.x86_64",
"7ComputeNode-optional-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.ppc64",
"7ComputeNode-optional-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.ppc64le",
"7ComputeNode-optional-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.x86_64",
"7ComputeNode-optional-7.3.Z:qemu-kvm-tools-10:1.5.3-126.el7_3.9.x86_64",
"7Server-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.ppc64",
"7Server-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.ppc64le",
"7Server-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.x86_64",
"7Server-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.9.src",
"7Server-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.9.x86_64",
"7Server-7.3.Z:qemu-kvm-common-10:1.5.3-126.el7_3.9.x86_64",
"7Server-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.ppc64",
"7Server-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.ppc64le",
"7Server-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.x86_64",
"7Server-7.3.Z:qemu-kvm-tools-10:1.5.3-126.el7_3.9.x86_64",
"7Workstation-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.ppc64",
"7Workstation-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.ppc64le",
"7Workstation-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.x86_64",
"7Workstation-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.9.src",
"7Workstation-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.9.x86_64",
"7Workstation-7.3.Z:qemu-kvm-common-10:1.5.3-126.el7_3.9.x86_64",
"7Workstation-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.ppc64",
"7Workstation-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.ppc64le",
"7Workstation-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.x86_64",
"7Workstation-7.3.Z:qemu-kvm-tools-10:1.5.3-126.el7_3.9.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Qemu: display: cirrus: OOB read access issue"
},
{
"acknowledgments": [
{
"names": [
"Jiangxin"
],
"organization": "PSIRT Huawei Inc."
},
{
"names": [
"Li Qiang"
],
"organization": "Qihoo 360 Gear Team"
}
],
"cve": "CVE-2017-7980",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2017-02-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1444371"
}
],
"notes": [
{
"category": "description",
"text": "An out-of-bounds r/w access issue was found in QEMU\u0027s Cirrus CLGD 54xx VGA Emulator support. The vulnerability could occur while copying VGA data via various bitblt functions. A privileged user inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: display: cirrus: OOB r/w access issues in bitblt routines",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Client-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.ppc64",
"7Client-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.ppc64le",
"7Client-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.x86_64",
"7Client-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.9.src",
"7Client-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.9.x86_64",
"7Client-7.3.Z:qemu-kvm-common-10:1.5.3-126.el7_3.9.x86_64",
"7Client-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.ppc64",
"7Client-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.ppc64le",
"7Client-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.x86_64",
"7Client-7.3.Z:qemu-kvm-tools-10:1.5.3-126.el7_3.9.x86_64",
"7ComputeNode-optional-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.ppc64",
"7ComputeNode-optional-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.ppc64le",
"7ComputeNode-optional-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.x86_64",
"7ComputeNode-optional-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.9.src",
"7ComputeNode-optional-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.9.x86_64",
"7ComputeNode-optional-7.3.Z:qemu-kvm-common-10:1.5.3-126.el7_3.9.x86_64",
"7ComputeNode-optional-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.ppc64",
"7ComputeNode-optional-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.ppc64le",
"7ComputeNode-optional-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.x86_64",
"7ComputeNode-optional-7.3.Z:qemu-kvm-tools-10:1.5.3-126.el7_3.9.x86_64",
"7Server-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.ppc64",
"7Server-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.ppc64le",
"7Server-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.x86_64",
"7Server-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.9.src",
"7Server-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.9.x86_64",
"7Server-7.3.Z:qemu-kvm-common-10:1.5.3-126.el7_3.9.x86_64",
"7Server-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.ppc64",
"7Server-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.ppc64le",
"7Server-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.x86_64",
"7Server-7.3.Z:qemu-kvm-tools-10:1.5.3-126.el7_3.9.x86_64",
"7Workstation-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.ppc64",
"7Workstation-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.ppc64le",
"7Workstation-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.x86_64",
"7Workstation-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.9.src",
"7Workstation-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.9.x86_64",
"7Workstation-7.3.Z:qemu-kvm-common-10:1.5.3-126.el7_3.9.x86_64",
"7Workstation-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.ppc64",
"7Workstation-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.ppc64le",
"7Workstation-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.x86_64",
"7Workstation-7.3.Z:qemu-kvm-tools-10:1.5.3-126.el7_3.9.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-7980"
},
{
"category": "external",
"summary": "RHBZ#1444371",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1444371"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-7980",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7980"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-7980",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7980"
}
],
"release_date": "2017-03-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-06-13T07:26:41+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"7Client-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.ppc64",
"7Client-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.ppc64le",
"7Client-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.x86_64",
"7Client-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.9.src",
"7Client-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.9.x86_64",
"7Client-7.3.Z:qemu-kvm-common-10:1.5.3-126.el7_3.9.x86_64",
"7Client-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.ppc64",
"7Client-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.ppc64le",
"7Client-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.x86_64",
"7Client-7.3.Z:qemu-kvm-tools-10:1.5.3-126.el7_3.9.x86_64",
"7ComputeNode-optional-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.ppc64",
"7ComputeNode-optional-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.ppc64le",
"7ComputeNode-optional-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.x86_64",
"7ComputeNode-optional-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.9.src",
"7ComputeNode-optional-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.9.x86_64",
"7ComputeNode-optional-7.3.Z:qemu-kvm-common-10:1.5.3-126.el7_3.9.x86_64",
"7ComputeNode-optional-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.ppc64",
"7ComputeNode-optional-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.ppc64le",
"7ComputeNode-optional-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.x86_64",
"7ComputeNode-optional-7.3.Z:qemu-kvm-tools-10:1.5.3-126.el7_3.9.x86_64",
"7Server-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.ppc64",
"7Server-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.ppc64le",
"7Server-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.x86_64",
"7Server-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.9.src",
"7Server-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.9.x86_64",
"7Server-7.3.Z:qemu-kvm-common-10:1.5.3-126.el7_3.9.x86_64",
"7Server-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.ppc64",
"7Server-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.ppc64le",
"7Server-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.x86_64",
"7Server-7.3.Z:qemu-kvm-tools-10:1.5.3-126.el7_3.9.x86_64",
"7Workstation-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.ppc64",
"7Workstation-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.ppc64le",
"7Workstation-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.x86_64",
"7Workstation-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.9.src",
"7Workstation-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.9.x86_64",
"7Workstation-7.3.Z:qemu-kvm-common-10:1.5.3-126.el7_3.9.x86_64",
"7Workstation-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.ppc64",
"7Workstation-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.ppc64le",
"7Workstation-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.x86_64",
"7Workstation-7.3.Z:qemu-kvm-tools-10:1.5.3-126.el7_3.9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:1430"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:A/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"7Client-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.ppc64",
"7Client-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.ppc64le",
"7Client-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.x86_64",
"7Client-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.9.src",
"7Client-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.9.x86_64",
"7Client-7.3.Z:qemu-kvm-common-10:1.5.3-126.el7_3.9.x86_64",
"7Client-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.ppc64",
"7Client-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.ppc64le",
"7Client-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.x86_64",
"7Client-7.3.Z:qemu-kvm-tools-10:1.5.3-126.el7_3.9.x86_64",
"7ComputeNode-optional-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.ppc64",
"7ComputeNode-optional-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.ppc64le",
"7ComputeNode-optional-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.x86_64",
"7ComputeNode-optional-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.9.src",
"7ComputeNode-optional-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.9.x86_64",
"7ComputeNode-optional-7.3.Z:qemu-kvm-common-10:1.5.3-126.el7_3.9.x86_64",
"7ComputeNode-optional-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.ppc64",
"7ComputeNode-optional-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.ppc64le",
"7ComputeNode-optional-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.x86_64",
"7ComputeNode-optional-7.3.Z:qemu-kvm-tools-10:1.5.3-126.el7_3.9.x86_64",
"7Server-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.ppc64",
"7Server-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.ppc64le",
"7Server-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.x86_64",
"7Server-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.9.src",
"7Server-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.9.x86_64",
"7Server-7.3.Z:qemu-kvm-common-10:1.5.3-126.el7_3.9.x86_64",
"7Server-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.ppc64",
"7Server-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.ppc64le",
"7Server-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.x86_64",
"7Server-7.3.Z:qemu-kvm-tools-10:1.5.3-126.el7_3.9.x86_64",
"7Workstation-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.ppc64",
"7Workstation-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.ppc64le",
"7Workstation-7.3.Z:qemu-img-10:1.5.3-126.el7_3.9.x86_64",
"7Workstation-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.9.src",
"7Workstation-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.9.x86_64",
"7Workstation-7.3.Z:qemu-kvm-common-10:1.5.3-126.el7_3.9.x86_64",
"7Workstation-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.ppc64",
"7Workstation-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.ppc64le",
"7Workstation-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.9.x86_64",
"7Workstation-7.3.Z:qemu-kvm-tools-10:1.5.3-126.el7_3.9.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Qemu: display: cirrus: OOB r/w access issues in bitblt routines"
}
]
}
rhsa-2017_0982
Vulnerability from csaf_redhat
Published
2017-04-18 04:56
Modified
2024-11-14 23:33
Summary
Red Hat Security Advisory: qemu-kvm-rhev security update
Notes
Topic
An update for qemu-kvm-rhev is now available for Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-rhev packages provide the user-space component for running virtual machines that use KVM in environments managed by Red Hat products.
Security Fix(es):
* Quick Emulator (QEMU), built with the Cirrus CLGD 54xx VGA Emulator and the VNC display driver support, is vulnerable to a heap buffer overflow issue. The issue could occur when a VNC client attempts to update its display after a VGA operation is performed by a guest. A privileged user/process inside guest could use this flaw to crash the QEMU process resulting in DoS or, potentially, leverage it to execute arbitrary code on the host with privileges of the QEMU process. (CVE-2016-9603)
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for qemu-kvm-rhev is now available for Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-rhev packages provide the user-space component for running virtual machines that use KVM in environments managed by Red Hat products.\n\nSecurity Fix(es):\n\n* Quick Emulator (QEMU), built with the Cirrus CLGD 54xx VGA Emulator and the VNC display driver support, is vulnerable to a heap buffer overflow issue. The issue could occur when a VNC client attempts to update its display after a VGA operation is performed by a guest. A privileged user/process inside guest could use this flaw to crash the QEMU process resulting in DoS or, potentially, leverage it to execute arbitrary code on the host with privileges of the QEMU process. (CVE-2016-9603)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2017:0982",
"url": "https://access.redhat.com/errata/RHSA-2017:0982"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "1430056",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1430056"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_0982.json"
}
],
"title": "Red Hat Security Advisory: qemu-kvm-rhev security update",
"tracking": {
"current_release_date": "2024-11-14T23:33:55+00:00",
"generator": {
"date": "2024-11-14T23:33:55+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2017:0982",
"initial_release_date": "2017-04-18T04:56:28+00:00",
"revision_history": [
{
"date": "2017-04-18T04:56:28+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2017-04-18T04:56:28+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-14T23:33:55+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7",
"product": {
"name": "Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7",
"product_id": "7Server-RH7-RHOS-7.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openstack:7::el7"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenStack Platform"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_id": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev@2.6.0-28.el7_3.9?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"product": {
"name": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"product_id": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev-debuginfo@2.6.0-28.el7_3.9?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product": {
"name": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_id": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-tools-rhev@2.6.0-28.el7_3.9?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product": {
"name": "qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_id": "qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-img-rhev@2.6.0-28.el7_3.9?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product": {
"name": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_id": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-common-rhev@2.6.0-28.el7_3.9?arch=x86_64\u0026epoch=10"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"product": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"product_id": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev@2.6.0-28.el7_3.9?arch=src\u0026epoch=10"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7",
"product_id": "7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64"
},
"product_reference": "qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7",
"product_id": "7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64"
},
"product_reference": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src as a component of Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7",
"product_id": "7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src"
},
"product_reference": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"relates_to_product_reference": "7Server-RH7-RHOS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7",
"product_id": "7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64"
},
"product_reference": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7",
"product_id": "7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64"
},
"product_reference": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7",
"product_id": "7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
},
"product_reference": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-7.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2016-9603",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2016-11-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1430056"
}
],
"notes": [
{
"category": "description",
"text": "A heap buffer overflow flaw was found in QEMU\u0027s Cirrus CLGD 54xx VGA emulator\u0027s VNC display driver support; the issue could occur when a VNC client attempted to update its display after a VGA operation is performed by a guest. A privileged user/process inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: cirrus: heap buffer overflow via vnc connection",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-9603"
},
{
"category": "external",
"summary": "RHBZ#1430056",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1430056"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-9603",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-9603"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-9603",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-9603"
}
],
"release_date": "2017-03-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-04-18T04:56:28+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:0982"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:A/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Qemu: cirrus: heap buffer overflow via vnc connection"
},
{
"acknowledgments": [
{
"names": [
"Jiangxin"
],
"organization": "PSIRT Huawei Inc."
}
],
"cve": "CVE-2017-7718",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2017-03-15T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1443441"
}
],
"notes": [
{
"category": "description",
"text": "An out-of-bounds access issue was found in QEMU\u0027s Cirrus CLGD 54xx VGA Emulator support. The vulnerability could occur while copying VGA data using bitblt functions (for example, cirrus_bitblt_rop_fwd_transp_). A privileged user inside a guest could use this flaw to crash the QEMU process, resulting in denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: display: cirrus: OOB read access issue",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-7718"
},
{
"category": "external",
"summary": "RHBZ#1443441",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1443441"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-7718",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7718"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-7718",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7718"
}
],
"release_date": "2017-03-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-04-18T04:56:28+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:0982"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 2.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:A/AC:H/Au:S/C:P/I:N/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.0,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:L",
"version": "3.0"
},
"products": [
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Qemu: display: cirrus: OOB read access issue"
},
{
"acknowledgments": [
{
"names": [
"Jiangxin"
],
"organization": "PSIRT Huawei Inc."
},
{
"names": [
"Li Qiang"
],
"organization": "Qihoo 360 Gear Team"
}
],
"cve": "CVE-2017-7980",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2017-02-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1444371"
}
],
"notes": [
{
"category": "description",
"text": "An out-of-bounds r/w access issue was found in QEMU\u0027s Cirrus CLGD 54xx VGA Emulator support. The vulnerability could occur while copying VGA data via various bitblt functions. A privileged user inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: display: cirrus: OOB r/w access issues in bitblt routines",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-7980"
},
{
"category": "external",
"summary": "RHBZ#1444371",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1444371"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-7980",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7980"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-7980",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7980"
}
],
"release_date": "2017-03-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-04-18T04:56:28+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:0982"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:A/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Qemu: display: cirrus: OOB r/w access issues in bitblt routines"
}
]
}
rhsa-2017_0981
Vulnerability from csaf_redhat
Published
2017-04-18 04:56
Modified
2024-11-14 23:34
Summary
Red Hat Security Advisory: qemu-kvm-rhev security update
Notes
Topic
An update for qemu-kvm-rhev is now available for Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-rhev packages provide the user-space component for running virtual machines that use KVM in environments managed by Red Hat products.
Security Fix(es):
* Quick Emulator (QEMU), built with the Cirrus CLGD 54xx VGA Emulator and the VNC display driver support, is vulnerable to a heap buffer overflow issue. The issue could occur when a VNC client attempts to update its display after a VGA operation is performed by a guest. A privileged user/process inside guest could use this flaw to crash the QEMU process resulting in DoS or, potentially, leverage it to execute arbitrary code on the host with privileges of the QEMU process. (CVE-2016-9603)
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for qemu-kvm-rhev is now available for Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-rhev packages provide the user-space component for running virtual machines that use KVM in environments managed by Red Hat products.\n\nSecurity Fix(es):\n\n* Quick Emulator (QEMU), built with the Cirrus CLGD 54xx VGA Emulator and the VNC display driver support, is vulnerable to a heap buffer overflow issue. The issue could occur when a VNC client attempts to update its display after a VGA operation is performed by a guest. A privileged user/process inside guest could use this flaw to crash the QEMU process resulting in DoS or, potentially, leverage it to execute arbitrary code on the host with privileges of the QEMU process. (CVE-2016-9603)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2017:0981",
"url": "https://access.redhat.com/errata/RHSA-2017:0981"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "1430056",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1430056"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_0981.json"
}
],
"title": "Red Hat Security Advisory: qemu-kvm-rhev security update",
"tracking": {
"current_release_date": "2024-11-14T23:34:00+00:00",
"generator": {
"date": "2024-11-14T23:34:00+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2017:0981",
"initial_release_date": "2017-04-18T04:56:42+00:00",
"revision_history": [
{
"date": "2017-04-18T04:56:42+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2017-04-18T04:56:42+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-14T23:34:00+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7",
"product": {
"name": "Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7",
"product_id": "7Server-RH7-RHOS-6.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openstack:6::el7"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenStack Platform"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_id": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev@2.6.0-28.el7_3.9?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"product": {
"name": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"product_id": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev-debuginfo@2.6.0-28.el7_3.9?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product": {
"name": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_id": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-tools-rhev@2.6.0-28.el7_3.9?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product": {
"name": "qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_id": "qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-img-rhev@2.6.0-28.el7_3.9?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product": {
"name": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_id": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-common-rhev@2.6.0-28.el7_3.9?arch=x86_64\u0026epoch=10"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"product": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"product_id": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev@2.6.0-28.el7_3.9?arch=src\u0026epoch=10"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7",
"product_id": "7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64"
},
"product_reference": "qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7",
"product_id": "7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64"
},
"product_reference": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src as a component of Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7",
"product_id": "7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src"
},
"product_reference": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"relates_to_product_reference": "7Server-RH7-RHOS-6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7",
"product_id": "7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64"
},
"product_reference": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7",
"product_id": "7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64"
},
"product_reference": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7",
"product_id": "7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
},
"product_reference": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-6.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2016-9603",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2016-11-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1430056"
}
],
"notes": [
{
"category": "description",
"text": "A heap buffer overflow flaw was found in QEMU\u0027s Cirrus CLGD 54xx VGA emulator\u0027s VNC display driver support; the issue could occur when a VNC client attempted to update its display after a VGA operation is performed by a guest. A privileged user/process inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: cirrus: heap buffer overflow via vnc connection",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-9603"
},
{
"category": "external",
"summary": "RHBZ#1430056",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1430056"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-9603",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-9603"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-9603",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-9603"
}
],
"release_date": "2017-03-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-04-18T04:56:42+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:0981"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:A/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Qemu: cirrus: heap buffer overflow via vnc connection"
},
{
"acknowledgments": [
{
"names": [
"Jiangxin"
],
"organization": "PSIRT Huawei Inc."
}
],
"cve": "CVE-2017-7718",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2017-03-15T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1443441"
}
],
"notes": [
{
"category": "description",
"text": "An out-of-bounds access issue was found in QEMU\u0027s Cirrus CLGD 54xx VGA Emulator support. The vulnerability could occur while copying VGA data using bitblt functions (for example, cirrus_bitblt_rop_fwd_transp_). A privileged user inside a guest could use this flaw to crash the QEMU process, resulting in denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: display: cirrus: OOB read access issue",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-7718"
},
{
"category": "external",
"summary": "RHBZ#1443441",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1443441"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-7718",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7718"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-7718",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7718"
}
],
"release_date": "2017-03-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-04-18T04:56:42+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:0981"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 2.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:A/AC:H/Au:S/C:P/I:N/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.0,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:L",
"version": "3.0"
},
"products": [
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Qemu: display: cirrus: OOB read access issue"
},
{
"acknowledgments": [
{
"names": [
"Jiangxin"
],
"organization": "PSIRT Huawei Inc."
},
{
"names": [
"Li Qiang"
],
"organization": "Qihoo 360 Gear Team"
}
],
"cve": "CVE-2017-7980",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2017-02-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1444371"
}
],
"notes": [
{
"category": "description",
"text": "An out-of-bounds r/w access issue was found in QEMU\u0027s Cirrus CLGD 54xx VGA Emulator support. The vulnerability could occur while copying VGA data via various bitblt functions. A privileged user inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: display: cirrus: OOB r/w access issues in bitblt routines",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-7980"
},
{
"category": "external",
"summary": "RHBZ#1444371",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1444371"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-7980",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7980"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-7980",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7980"
}
],
"release_date": "2017-03-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-04-18T04:56:42+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:0981"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:A/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Qemu: display: cirrus: OOB r/w access issues in bitblt routines"
}
]
}
rhsa-2017_0984
Vulnerability from csaf_redhat
Published
2017-04-18 04:56
Modified
2024-11-14 23:33
Summary
Red Hat Security Advisory: qemu-kvm-rhev security update
Notes
Topic
An update for qemu-kvm-rhev is now available for Red Hat OpenStack Platform 9.0 (Mitaka).
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-rhev packages provide the user-space component for running virtual machines that use KVM in environments managed by Red Hat products.
Security Fix(es):
* Quick Emulator (QEMU), built with the Cirrus CLGD 54xx VGA Emulator and the VNC display driver support, is vulnerable to a heap buffer overflow issue. The issue could occur when a VNC client attempts to update its display after a VGA operation is performed by a guest. A privileged user/process inside guest could use this flaw to crash the QEMU process resulting in DoS or, potentially, leverage it to execute arbitrary code on the host with privileges of the QEMU process. (CVE-2016-9603)
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for qemu-kvm-rhev is now available for Red Hat OpenStack Platform 9.0 (Mitaka).\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-rhev packages provide the user-space component for running virtual machines that use KVM in environments managed by Red Hat products.\n\nSecurity Fix(es):\n\n* Quick Emulator (QEMU), built with the Cirrus CLGD 54xx VGA Emulator and the VNC display driver support, is vulnerable to a heap buffer overflow issue. The issue could occur when a VNC client attempts to update its display after a VGA operation is performed by a guest. A privileged user/process inside guest could use this flaw to crash the QEMU process resulting in DoS or, potentially, leverage it to execute arbitrary code on the host with privileges of the QEMU process. (CVE-2016-9603)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2017:0984",
"url": "https://access.redhat.com/errata/RHSA-2017:0984"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "1430056",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1430056"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_0984.json"
}
],
"title": "Red Hat Security Advisory: qemu-kvm-rhev security update",
"tracking": {
"current_release_date": "2024-11-14T23:33:45+00:00",
"generator": {
"date": "2024-11-14T23:33:45+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2017:0984",
"initial_release_date": "2017-04-18T04:56:01+00:00",
"revision_history": [
{
"date": "2017-04-18T04:56:01+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2017-04-18T04:56:01+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-14T23:33:45+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenStack Platform 9.0",
"product": {
"name": "Red Hat OpenStack Platform 9.0",
"product_id": "7Server-RH7-RHOS-9.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openstack:9::el7"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenStack Platform"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_id": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev@2.6.0-28.el7_3.9?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"product": {
"name": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"product_id": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev-debuginfo@2.6.0-28.el7_3.9?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product": {
"name": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_id": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-tools-rhev@2.6.0-28.el7_3.9?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product": {
"name": "qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_id": "qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-img-rhev@2.6.0-28.el7_3.9?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product": {
"name": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_id": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-common-rhev@2.6.0-28.el7_3.9?arch=x86_64\u0026epoch=10"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"product": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"product_id": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev@2.6.0-28.el7_3.9?arch=src\u0026epoch=10"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64 as a component of Red Hat OpenStack Platform 9.0",
"product_id": "7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64"
},
"product_reference": "qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-9.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64 as a component of Red Hat OpenStack Platform 9.0",
"product_id": "7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64"
},
"product_reference": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-9.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src as a component of Red Hat OpenStack Platform 9.0",
"product_id": "7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src"
},
"product_reference": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"relates_to_product_reference": "7Server-RH7-RHOS-9.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64 as a component of Red Hat OpenStack Platform 9.0",
"product_id": "7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64"
},
"product_reference": "qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-9.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64 as a component of Red Hat OpenStack Platform 9.0",
"product_id": "7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64"
},
"product_reference": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-9.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64 as a component of Red Hat OpenStack Platform 9.0",
"product_id": "7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
},
"product_reference": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-9.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2016-9603",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2016-11-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1430056"
}
],
"notes": [
{
"category": "description",
"text": "A heap buffer overflow flaw was found in QEMU\u0027s Cirrus CLGD 54xx VGA emulator\u0027s VNC display driver support; the issue could occur when a VNC client attempted to update its display after a VGA operation is performed by a guest. A privileged user/process inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: cirrus: heap buffer overflow via vnc connection",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-9603"
},
{
"category": "external",
"summary": "RHBZ#1430056",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1430056"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-9603",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-9603"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-9603",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-9603"
}
],
"release_date": "2017-03-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-04-18T04:56:01+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:0984"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:A/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Qemu: cirrus: heap buffer overflow via vnc connection"
},
{
"acknowledgments": [
{
"names": [
"Jiangxin"
],
"organization": "PSIRT Huawei Inc."
}
],
"cve": "CVE-2017-7718",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2017-03-15T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1443441"
}
],
"notes": [
{
"category": "description",
"text": "An out-of-bounds access issue was found in QEMU\u0027s Cirrus CLGD 54xx VGA Emulator support. The vulnerability could occur while copying VGA data using bitblt functions (for example, cirrus_bitblt_rop_fwd_transp_). A privileged user inside a guest could use this flaw to crash the QEMU process, resulting in denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: display: cirrus: OOB read access issue",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-7718"
},
{
"category": "external",
"summary": "RHBZ#1443441",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1443441"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-7718",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7718"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-7718",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7718"
}
],
"release_date": "2017-03-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-04-18T04:56:01+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:0984"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 2.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:A/AC:H/Au:S/C:P/I:N/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.0,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:L",
"version": "3.0"
},
"products": [
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Qemu: display: cirrus: OOB read access issue"
},
{
"acknowledgments": [
{
"names": [
"Jiangxin"
],
"organization": "PSIRT Huawei Inc."
},
{
"names": [
"Li Qiang"
],
"organization": "Qihoo 360 Gear Team"
}
],
"cve": "CVE-2017-7980",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2017-02-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1444371"
}
],
"notes": [
{
"category": "description",
"text": "An out-of-bounds r/w access issue was found in QEMU\u0027s Cirrus CLGD 54xx VGA Emulator support. The vulnerability could occur while copying VGA data via various bitblt functions. A privileged user inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: display: cirrus: OOB r/w access issues in bitblt routines",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-7980"
},
{
"category": "external",
"summary": "RHBZ#1444371",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1444371"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-7980",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7980"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-7980",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7980"
}
],
"release_date": "2017-03-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-04-18T04:56:01+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:0984"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:A/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.9.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.9.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Qemu: display: cirrus: OOB r/w access issues in bitblt routines"
}
]
}
gsd-2017-7980
Vulnerability from gsd
Modified
2023-12-13 01:21
Details
Heap-based buffer overflow in Cirrus CLGD 54xx VGA Emulator in Quick Emulator (Qemu) 2.8 and earlier allows local guest OS users to execute arbitrary code or cause a denial of service (crash) via vectors related to a VNC client updating its display after a VGA operation.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2017-7980",
"description": "Heap-based buffer overflow in Cirrus CLGD 54xx VGA Emulator in Quick Emulator (Qemu) 2.8 and earlier allows local guest OS users to execute arbitrary code or cause a denial of service (crash) via vectors related to a VNC client updating its display after a VGA operation.",
"id": "GSD-2017-7980",
"references": [
"https://www.suse.com/security/cve/CVE-2017-7980.html",
"https://access.redhat.com/errata/RHSA-2017:1441",
"https://access.redhat.com/errata/RHSA-2017:1430",
"https://access.redhat.com/errata/RHSA-2017:1206",
"https://access.redhat.com/errata/RHSA-2017:1205",
"https://access.redhat.com/errata/RHSA-2017:0988",
"https://access.redhat.com/errata/RHSA-2017:0984",
"https://access.redhat.com/errata/RHSA-2017:0983",
"https://access.redhat.com/errata/RHSA-2017:0982",
"https://access.redhat.com/errata/RHSA-2017:0981",
"https://access.redhat.com/errata/RHSA-2017:0980",
"https://ubuntu.com/security/CVE-2017-7980",
"https://security.archlinux.org/CVE-2017-7980",
"https://linux.oracle.com/cve/CVE-2017-7980.html"
]
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2017-7980"
],
"details": "Heap-based buffer overflow in Cirrus CLGD 54xx VGA Emulator in Quick Emulator (Qemu) 2.8 and earlier allows local guest OS users to execute arbitrary code or cause a denial of service (crash) via vectors related to a VNC client updating its display after a VGA operation.",
"id": "GSD-2017-7980",
"modified": "2023-12-13T01:21:06.618311Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2017-7980",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Heap-based buffer overflow in Cirrus CLGD 54xx VGA Emulator in Quick Emulator (Qemu) 2.8 and earlier allows local guest OS users to execute arbitrary code or cause a denial of service (crash) via vectors related to a VNC client updating its display after a VGA operation."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "RHSA-2017:0983",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2017:0983"
},
{
"name": "[oss-security] 20170421 CVE-2017-7980 Qemu: display: cirrus: OOB r/w access issues in bitblt routines",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2017/04/21/1"
},
{
"name": "RHSA-2017:0982",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2017:0982"
},
{
"name": "[debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html"
},
{
"name": "RHSA-2017:1430",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2017:1430"
},
{
"name": "GLSA-201706-03",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201706-03"
},
{
"name": "USN-3289-1",
"refsource": "UBUNTU",
"url": "http://ubuntu.com/usn/usn-3289-1"
},
{
"name": "RHSA-2017:1206",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2017:1206"
},
{
"name": "97955",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/97955"
},
{
"name": "102129",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/102129"
},
{
"name": "RHSA-2017:0984",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2017:0984"
},
{
"name": "RHSA-2017:0988",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2017:0988"
},
{
"name": "RHSA-2017:1441",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2017:1441"
},
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=1430056",
"refsource": "CONFIRM",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1430056"
},
{
"name": "RHSA-2017:0981",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2017:0981"
},
{
"name": "RHSA-2017:0980",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2017:0980"
},
{
"name": "RHSA-2017:1205",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2017:1205"
},
{
"name": "https://support.citrix.com/article/CTX230138",
"refsource": "CONFIRM",
"url": "https://support.citrix.com/article/CTX230138"
}
]
}
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "2.8",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:16.10:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:17.04:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:redhat:openstack:6.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:redhat:openstack:7.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:redhat:openstack:8:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:redhat:openstack:10:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:redhat:openstack:9:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:redhat:openstack:5.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:redhat:virtualization:3.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:redhat:openstack:5.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_server_eus:7.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_server_tus:7.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2017-7980"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "Heap-based buffer overflow in Cirrus CLGD 54xx VGA Emulator in Quick Emulator (Qemu) 2.8 and earlier allows local guest OS users to execute arbitrary code or cause a denial of service (crash) via vectors related to a VNC client updating its display after a VGA operation."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-119"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=1430056",
"refsource": "CONFIRM",
"tags": [
"Issue Tracking",
"Patch",
"Third Party Advisory"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1430056"
},
{
"name": "[oss-security] 20170421 CVE-2017-7980 Qemu: display: cirrus: OOB r/w access issues in bitblt routines",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Patch",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2017/04/21/1"
},
{
"name": "USN-3289-1",
"refsource": "UBUNTU",
"tags": [
"Third Party Advisory"
],
"url": "http://ubuntu.com/usn/usn-3289-1"
},
{
"name": "GLSA-201706-03",
"refsource": "GENTOO",
"tags": [
"Patch",
"Third Party Advisory",
"VDB Entry"
],
"url": "https://security.gentoo.org/glsa/201706-03"
},
{
"name": "97955",
"refsource": "BID",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/97955"
},
{
"name": "https://support.citrix.com/article/CTX230138",
"refsource": "CONFIRM",
"tags": [
"Third Party Advisory"
],
"url": "https://support.citrix.com/article/CTX230138"
},
{
"name": "102129",
"refsource": "BID",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/102129"
},
{
"name": "RHSA-2017:1441",
"refsource": "REDHAT",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/errata/RHSA-2017:1441"
},
{
"name": "RHSA-2017:1430",
"refsource": "REDHAT",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/errata/RHSA-2017:1430"
},
{
"name": "RHSA-2017:1206",
"refsource": "REDHAT",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/errata/RHSA-2017:1206"
},
{
"name": "RHSA-2017:1205",
"refsource": "REDHAT",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/errata/RHSA-2017:1205"
},
{
"name": "RHSA-2017:0988",
"refsource": "REDHAT",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/errata/RHSA-2017:0988"
},
{
"name": "RHSA-2017:0984",
"refsource": "REDHAT",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/errata/RHSA-2017:0984"
},
{
"name": "RHSA-2017:0983",
"refsource": "REDHAT",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/errata/RHSA-2017:0983"
},
{
"name": "RHSA-2017:0982",
"refsource": "REDHAT",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/errata/RHSA-2017:0982"
},
{
"name": "RHSA-2017:0981",
"refsource": "REDHAT",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/errata/RHSA-2017:0981"
},
{
"name": "RHSA-2017:0980",
"refsource": "REDHAT",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/errata/RHSA-2017:0980"
},
{
"name": "[debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html"
}
]
}
},
"impact": {
"baseMetricV2": {
"acInsufInfo": false,
"cvssV2": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.6,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"userInteractionRequired": false
},
"baseMetricV3": {
"cvssV3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9
}
},
"lastModifiedDate": "2021-08-04T17:15Z",
"publishedDate": "2017-07-25T14:29Z"
}
}
}
ghsa-w847-jx6c-6j35
Vulnerability from github
Published
2022-05-13 01:07
Modified
2022-05-13 01:07
Severity ?
Details
Heap-based buffer overflow in Cirrus CLGD 54xx VGA Emulator in Quick Emulator (Qemu) 2.8 and earlier allows local guest OS users to execute arbitrary code or cause a denial of service (crash) via vectors related to a VNC client updating its display after a VGA operation.
{
"affected": [],
"aliases": [
"CVE-2017-7980"
],
"database_specific": {
"cwe_ids": [
"CWE-119"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-07-25T14:29:00Z",
"severity": "HIGH"
},
"details": "Heap-based buffer overflow in Cirrus CLGD 54xx VGA Emulator in Quick Emulator (Qemu) 2.8 and earlier allows local guest OS users to execute arbitrary code or cause a denial of service (crash) via vectors related to a VNC client updating its display after a VGA operation.",
"id": "GHSA-w847-jx6c-6j35",
"modified": "2022-05-13T01:07:32Z",
"published": "2022-05-13T01:07:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7980"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:0980"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:0981"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:0982"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:0983"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:0984"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:0988"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:1205"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:1206"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:1430"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:1441"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1430056"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/201706-03"
},
{
"type": "WEB",
"url": "https://support.citrix.com/article/CTX230138"
},
{
"type": "WEB",
"url": "http://ubuntu.com/usn/usn-3289-1"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2017/04/21/1"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/102129"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/97955"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.