4.6

CVE-2014-8106

Heap-based buffer overflow in the Cirrus VGA emulator (hw/display/cirrus_vga.c) in QEMU before 2.2.0 allows local guest users to execute arbitrary code via vectors related to blit regions. NOTE: this vulnerability exists because an incomplete fix for CVE-2007-1320.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Qemu ≫ Qemu Version <= 2.1.2
Qemu ≫ Qemu Version2.1.0
Qemu ≫ Qemu Version2.1.0 Updaterc0
Qemu ≫ Qemu Version2.1.0 Updaterc1
Qemu ≫ Qemu Version2.1.0 Updaterc2
Qemu ≫ Qemu Version2.1.0 Updaterc3
Qemu ≫ Qemu Version2.1.0 Updaterc5
Qemu ≫ Qemu Version2.1.1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.6% 0.441
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 4.6 3.9 6.4
AV:L/AC:L/Au:N/C:P/I:P/A:P
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

http://support.citrix.com/article/CTX200892
http://rhn.redhat.com/errata/RHSA-2015-0349.html
http://rhn.redhat.com/errata/RHSA-2015-0624.html
http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=bf25983345ca44aec3dd92c57142be45452bd38a
http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=d3532a0db02296e687711b8cdc7791924efccea0
http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154656.html
http://lists.gnu.org/archive/html/qemu-devel/2014-12/msg00508.html
http://rhn.redhat.com/errata/RHSA-2015-0643.html
http://rhn.redhat.com/errata/RHSA-2015-0795.html
http://rhn.redhat.com/errata/RHSA-2015-0867.html
http://rhn.redhat.com/errata/RHSA-2015-0868.html
http://rhn.redhat.com/errata/RHSA-2015-0891.html
http://secunia.com/advisories/60364
http://www.debian.org/security/2014/dsa-3087
Vendor Advisory
http://www.debian.org/security/2014/dsa-3088
Vendor Advisory
http://www.openwall.com/lists/oss-security/2014/12/04/8
http://www.securityfocus.com/bid/71477
https://exchange.xforce.ibmcloud.com/vulnerabilities/99126