Action not permitted
Modal body text goes here.
cve-2017-2620
Vulnerability from cvelistv5
Published
2018-07-27 19:00
Modified
2024-08-05 14:02
Severity ?
EPSS score ?
Summary
Quick emulator (QEMU) before 2.8 built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T14:02:07.311Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "RHSA-2017:0329",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2017-0329.html"
},
{
"name": "RHSA-2017:0334",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2017-0334.html"
},
{
"name": "1037870",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1037870"
},
{
"name": "RHSA-2017:0328",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2017-0328.html"
},
{
"name": "[debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html"
},
{
"name": "RHSA-2017:0333",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2017-0333.html"
},
{
"name": "RHSA-2017:0351",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2017-0351.html"
},
{
"name": "RHSA-2017:0454",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2017-0454.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://xenbits.xen.org/xsa/advisory-209.html"
},
{
"name": "RHSA-2017:0331",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2017-0331.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2620"
},
{
"name": "[oss-security] 20170221 CVE-2017-2620 Qemu: display: cirrus: out-of-bounds access issue while in cirrus_bitblt_cputovideo",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2017/02/21/1"
},
{
"name": "RHSA-2017:0350",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2017-0350.html"
},
{
"name": "[debian-lts-announce] 20180206 [SECURITY] [DLA 1270-1] xen security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2018/02/msg00005.html"
},
{
"name": "RHSA-2017:0396",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2017-0396.html"
},
{
"name": "GLSA-201704-01",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201704-01"
},
{
"name": "[qemu-devel] 20170221 [PATCH] cirrus: add blit_is_unsafe call to cirrus_bitblt_cputovideo (CVE-2017-2620)",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.gnu.org/archive/html/qemu-devel/2017-02/msg04700.html"
},
{
"name": "RHSA-2017:0352",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2017-0352.html"
},
{
"name": "RHSA-2017:0330",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2017-0330.html"
},
{
"name": "RHSA-2017:0332",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2017-0332.html"
},
{
"name": "96378",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/96378"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://support.citrix.com/article/CTX220771"
},
{
"name": "GLSA-201703-07",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201703-07"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Qemu:",
"vendor": "QEMU",
"versions": [
{
"status": "affected",
"version": "2.8"
}
]
}
],
"datePublic": "2017-02-21T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Quick emulator (QEMU) before 2.8 built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-09-07T09:57:01",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "RHSA-2017:0329",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2017-0329.html"
},
{
"name": "RHSA-2017:0334",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2017-0334.html"
},
{
"name": "1037870",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1037870"
},
{
"name": "RHSA-2017:0328",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2017-0328.html"
},
{
"name": "[debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html"
},
{
"name": "RHSA-2017:0333",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2017-0333.html"
},
{
"name": "RHSA-2017:0351",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2017-0351.html"
},
{
"name": "RHSA-2017:0454",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2017-0454.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://xenbits.xen.org/xsa/advisory-209.html"
},
{
"name": "RHSA-2017:0331",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2017-0331.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2620"
},
{
"name": "[oss-security] 20170221 CVE-2017-2620 Qemu: display: cirrus: out-of-bounds access issue while in cirrus_bitblt_cputovideo",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2017/02/21/1"
},
{
"name": "RHSA-2017:0350",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2017-0350.html"
},
{
"name": "[debian-lts-announce] 20180206 [SECURITY] [DLA 1270-1] xen security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2018/02/msg00005.html"
},
{
"name": "RHSA-2017:0396",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2017-0396.html"
},
{
"name": "GLSA-201704-01",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201704-01"
},
{
"name": "[qemu-devel] 20170221 [PATCH] cirrus: add blit_is_unsafe call to cirrus_bitblt_cputovideo (CVE-2017-2620)",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.gnu.org/archive/html/qemu-devel/2017-02/msg04700.html"
},
{
"name": "RHSA-2017:0352",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2017-0352.html"
},
{
"name": "RHSA-2017:0330",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2017-0330.html"
},
{
"name": "RHSA-2017:0332",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2017-0332.html"
},
{
"name": "96378",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/96378"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://support.citrix.com/article/CTX220771"
},
{
"name": "GLSA-201703-07",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201703-07"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2017-2620",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Qemu:",
"version": {
"version_data": [
{
"version_value": "2.8"
}
]
}
}
]
},
"vendor_name": "QEMU"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Quick emulator (QEMU) before 2.8 built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process."
}
]
},
"impact": {
"cvss": [
[
{
"vectorString": "5.5/CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.0"
}
],
[
{
"vectorString": "4.9/AV:A/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
}
]
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-787"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "RHSA-2017:0329",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2017-0329.html"
},
{
"name": "RHSA-2017:0334",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2017-0334.html"
},
{
"name": "1037870",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1037870"
},
{
"name": "RHSA-2017:0328",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2017-0328.html"
},
{
"name": "[debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html"
},
{
"name": "RHSA-2017:0333",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2017-0333.html"
},
{
"name": "RHSA-2017:0351",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2017-0351.html"
},
{
"name": "RHSA-2017:0454",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2017-0454.html"
},
{
"name": "https://xenbits.xen.org/xsa/advisory-209.html",
"refsource": "CONFIRM",
"url": "https://xenbits.xen.org/xsa/advisory-209.html"
},
{
"name": "RHSA-2017:0331",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2017-0331.html"
},
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2620",
"refsource": "CONFIRM",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2620"
},
{
"name": "[oss-security] 20170221 CVE-2017-2620 Qemu: display: cirrus: out-of-bounds access issue while in cirrus_bitblt_cputovideo",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2017/02/21/1"
},
{
"name": "RHSA-2017:0350",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2017-0350.html"
},
{
"name": "[debian-lts-announce] 20180206 [SECURITY] [DLA 1270-1] xen security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2018/02/msg00005.html"
},
{
"name": "RHSA-2017:0396",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2017-0396.html"
},
{
"name": "GLSA-201704-01",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201704-01"
},
{
"name": "[qemu-devel] 20170221 [PATCH] cirrus: add blit_is_unsafe call to cirrus_bitblt_cputovideo (CVE-2017-2620)",
"refsource": "MLIST",
"url": "https://lists.gnu.org/archive/html/qemu-devel/2017-02/msg04700.html"
},
{
"name": "RHSA-2017:0352",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2017-0352.html"
},
{
"name": "RHSA-2017:0330",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2017-0330.html"
},
{
"name": "RHSA-2017:0332",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2017-0332.html"
},
{
"name": "96378",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/96378"
},
{
"name": "https://support.citrix.com/article/CTX220771",
"refsource": "CONFIRM",
"url": "https://support.citrix.com/article/CTX220771"
},
{
"name": "GLSA-201703-07",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201703-07"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2017-2620",
"datePublished": "2018-07-27T19:00:00",
"dateReserved": "2016-12-01T00:00:00",
"dateUpdated": "2024-08-05T14:02:07.311Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2017-2620\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2018-07-27T19:29:00.330\",\"lastModified\":\"2023-11-07T02:43:52.547\",\"vulnStatus\":\"Modified\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"Quick emulator (QEMU) before 2.8 built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process.\"},{\"lang\":\"es\",\"value\":\"Quick emulator (QEMU) en versiones anteriores a la 2.8 construido con el soporte del emulador Cirrus CLGD 54xx VGA Emulator es vulnerable a un problema de acceso fuera de l\u00edmites. El problema puede ocurrir al copiar datos VGA en cirrus_bitblt_cputovideo. Un usuario privilegiado dentro de guest podr\u00eda usar esta vulnerabilidad para bloquear el proceso de QEMU o potencialmente ejecutar c\u00f3digo arbitrario en el host con privilegios del proceso de QEMU.\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\",\"baseScore\":9.9,\"baseSeverity\":\"CRITICAL\"},\"exploitabilityScore\":3.1,\"impactScore\":6.0},{\"source\":\"secalert@redhat.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"LOW\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\"},\"exploitabilityScore\":1.3,\"impactScore\":3.7}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:S/C:C/I:C/A:C\",\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"COMPLETE\",\"integrityImpact\":\"COMPLETE\",\"availabilityImpact\":\"COMPLETE\",\"baseScore\":9.0},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":8.0,\"impactScore\":10.0,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"},{\"lang\":\"en\",\"value\":\"CWE-787\"}]},{\"source\":\"secalert@redhat.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2.8.0\",\"matchCriteriaId\":\"10EE7DD6-EC30-4385-A028-E579F232BEFA\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:citrix:xenserver:6.0.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5FCF191B-971A-4945-AB14-08091689BE2F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:citrix:xenserver:6.2.0:sp1:*:*:*:*:*:*\",\"matchCriteriaId\":\"878949E0-D656-4E0E-858A-C6AD948A2A2F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:citrix:xenserver:6.5:sp1:*:*:*:*:*:*\",\"matchCriteriaId\":\"DBCF6643-ACDE-4DDB-8B01-D952DDF8951E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:citrix:xenserver:7.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"405F950F-0772-41A3-8B72-B67151CC1376\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:citrix:xenserver:7.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B5647AEA-DCE6-4950-A7EB-05465ECDDE16\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:openstack:5.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B152EDF3-3140-4343-802F-F4F1C329F5C3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:openstack:6.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"31EC146C-A6F6-4C0D-AF87-685286262DAA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:openstack:7.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9DAA72A4-AC7D-4544-89D4-5B07961D5A95\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:openstack:8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E8B8C725-34CF-4340-BE7B-37E58CF706D6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:openstack:9:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F40C26BE-56CB-4022-A1D8-3CA0A8F87F4B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:openstack:10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E722FEF7-58A6-47AD-B1D0-DB0B71B0C7AA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"16F59A04-14CF-49E2-9973-645477EA09DA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EE249E1B-A1FD-4E08-AA71-A0E1F10FFE97\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"33C068A4-3780-4EAB-A937-6082DF847564\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9BBCD86A-E6C7-4444-9D74-F861084090F0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"51EF4996-72F4-4FA4-814F-F5991E7A8318\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"98381E61-F082-4302-B51F-5648884F998B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D99A687E-EAE6-417E-A88E-D0082BC194CD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_server_eus:7.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A8442C20-41F9-47FD-9A12-E724D3A31FD7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9EC0D196-F7B8-4BDD-9050-779F7A7FBEE4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A4E9DD8A-A68B-4A69-8B01-BFF92A2020A8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E5ED5807-55B7-47C5-97A6-03233F4FBC3A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"825ECE2D-E232-46E0-A047-074B34DB1E97\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:xen:xen:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"4.7.1\",\"matchCriteriaId\":\"E26BFEBF-36AE-4956-918E-0F3745F67103\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:xen:xen:4.7.1:r1:*:*:*:*:*:*\",\"matchCriteriaId\":\"28DC6689-C725-4A0D-B18F-F06C63F43AAA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:xen:xen:4.7.1:r2:*:*:*:*:*:*\",\"matchCriteriaId\":\"BDDCD905-A9D3-4BF7-BC92-35886465241E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:xen:xen:4.7.1:r3:*:*:*:*:*:*\",\"matchCriteriaId\":\"ADCF1B40-C3A8-4505-B8C9-2F2C7753BFC3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:xen:xen:4.7.1:r4:*:*:*:*:*:*\",\"matchCriteriaId\":\"E37280FF-ADAF-4829-9193-E1C203E1BE42\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:xen:xen:4.7.1:r5:*:*:*:*:*:*\",\"matchCriteriaId\":\"A0619169-9642-47F9-8F15-C5497E790CDE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:xen:xen:4.7.1:r6:*:*:*:*:*:*\",\"matchCriteriaId\":\"A4ECE000-A99A-4ED4-B5E3-5162EC48CFB2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:xen:xen:4.7.1:r7:*:*:*:*:*:*\",\"matchCriteriaId\":\"CF50E3A9-19A3-4015-BF56-070833B5D2CE\"}]}]}],\"references\":[{\"url\":\"http://rhn.redhat.com/errata/RHSA-2017-0328.html\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2017-0329.html\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2017-0330.html\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2017-0331.html\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2017-0332.html\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2017-0333.html\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2017-0334.html\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2017-0350.html\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2017-0351.html\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2017-0352.html\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2017-0396.html\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2017-0454.html\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2017/02/21/1\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://www.securityfocus.com/bid/96378\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://www.securitytracker.com/id/1037870\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2620\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Issue Tracking\",\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2018/02/msg00005.html\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://lists.gnu.org/archive/html/qemu-devel/2017-02/msg04700.html\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://security.gentoo.org/glsa/201703-07\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://security.gentoo.org/glsa/201704-01\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://support.citrix.com/article/CTX220771\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://xenbits.xen.org/xsa/advisory-209.html\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\"]}]}}"
}
}
rhsa-2017_0333
Vulnerability from csaf_redhat
Published
2017-02-27 23:12
Modified
2024-11-05 19:54
Summary
Red Hat Security Advisory: qemu-kvm-rhev security update
Notes
Topic
An update for qemu-kvm-rhev is now available for Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-rhev packages provide the user-space component for running virtual machines that use KVM in environments managed by Red Hat products.
Security Fix(es):
* Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue. It could occur while copying VGA data via bitblt copy in backward mode. A privileged user inside a guest could use this flaw to crash the QEMU process resulting in DoS or potentially execute arbitrary code on the host with privileges of QEMU process on the host. (CVE-2017-2615)
* Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process. (CVE-2017-2620)
Red Hat would like to thank Wjjzhang (Tencent.com Inc.) and Li Qiang (360.cn Inc.) for reporting CVE-2017-2615.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for qemu-kvm-rhev is now available for Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-rhev packages provide the user-space component for running virtual machines that use KVM in environments managed by Red Hat products.\n\nSecurity Fix(es):\n\n* Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue. It could occur while copying VGA data via bitblt copy in backward mode. A privileged user inside a guest could use this flaw to crash the QEMU process resulting in DoS or potentially execute arbitrary code on the host with privileges of QEMU process on the host. (CVE-2017-2615)\n\n* Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process. (CVE-2017-2620)\n\nRed Hat would like to thank Wjjzhang (Tencent.com Inc.) and Li Qiang (360.cn Inc.) for reporting CVE-2017-2615.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2017:0333",
"url": "https://access.redhat.com/errata/RHSA-2017:0333"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "1418200",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1418200"
},
{
"category": "external",
"summary": "1420484",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1420484"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_0333.json"
}
],
"title": "Red Hat Security Advisory: qemu-kvm-rhev security update",
"tracking": {
"current_release_date": "2024-11-05T19:54:26+00:00",
"generator": {
"date": "2024-11-05T19:54:26+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.1.1"
}
},
"id": "RHSA-2017:0333",
"initial_release_date": "2017-02-27T23:12:23+00:00",
"revision_history": [
{
"date": "2017-02-27T23:12:23+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2017-02-27T23:12:23+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-05T19:54:26+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7",
"product": {
"name": "Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7",
"product_id": "7Server-RH7-RHOS-5.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openstack:5::el7"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenStack Platform"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product": {
"name": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product_id": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-common-rhev@2.6.0-28.el7_3.6?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"product": {
"name": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"product_id": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev-debuginfo@2.6.0-28.el7_3.6?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product": {
"name": "qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product_id": "qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-img-rhev@2.6.0-28.el7_3.6?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product": {
"name": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product_id": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-tools-rhev@2.6.0-28.el7_3.6?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product_id": "qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev@2.6.0-28.el7_3.6?arch=x86_64\u0026epoch=10"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"product": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"product_id": "qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev@2.6.0-28.el7_3.6?arch=src\u0026epoch=10"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7",
"product_id": "7Server-RH7-RHOS-5.0:qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64"
},
"product_reference": "qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-5.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7",
"product_id": "7Server-RH7-RHOS-5.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64"
},
"product_reference": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-5.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7",
"product_id": "7Server-RH7-RHOS-5.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src"
},
"product_reference": "qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"relates_to_product_reference": "7Server-RH7-RHOS-5.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7",
"product_id": "7Server-RH7-RHOS-5.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64"
},
"product_reference": "qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-5.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7",
"product_id": "7Server-RH7-RHOS-5.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64"
},
"product_reference": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-5.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7",
"product_id": "7Server-RH7-RHOS-5.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64"
},
"product_reference": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-5.0"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Li Qiang"
],
"organization": "360.cn Inc."
},
{
"names": [
"Wjjzhang"
],
"organization": "Tencent.com Inc."
}
],
"cve": "CVE-2017-2615",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2017-01-25T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1418200"
}
],
"notes": [
{
"category": "description",
"text": "Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue. It could occur while copying VGA data via bitblt copy in backward mode. A privileged user inside a guest could use this flaw to crash the QEMU process resulting in DoS or potentially execute arbitrary code on the host with privileges of QEMU process on the host.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: display: cirrus: oob access while doing bitblt copy backward mode",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-5.0:qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"7Server-RH7-RHOS-5.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-2615"
},
{
"category": "external",
"summary": "RHBZ#1418200",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1418200"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-2615",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-2615"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-2615",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-2615"
}
],
"release_date": "2017-01-24T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-02-27T23:12:23+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"7Server-RH7-RHOS-5.0:qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"7Server-RH7-RHOS-5.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:0333"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:A/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"7Server-RH7-RHOS-5.0:qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"7Server-RH7-RHOS-5.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Qemu: display: cirrus: oob access while doing bitblt copy backward mode"
},
{
"cve": "CVE-2017-2620",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2017-02-09T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1420484"
}
],
"notes": [
{
"category": "description",
"text": "Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: display: cirrus: potential arbitrary code execution via cirrus_bitblt_cputovideo",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-5.0:qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"7Server-RH7-RHOS-5.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-2620"
},
{
"category": "external",
"summary": "RHBZ#1420484",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1420484"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-2620",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-2620"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-2620",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-2620"
},
{
"category": "external",
"summary": "https://xenbits.xen.org/xsa/advisory-209.html",
"url": "https://xenbits.xen.org/xsa/advisory-209.html"
}
],
"release_date": "2017-02-21T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-02-27T23:12:23+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"7Server-RH7-RHOS-5.0:qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"7Server-RH7-RHOS-5.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:0333"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:A/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"7Server-RH7-RHOS-5.0:qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"7Server-RH7-RHOS-5.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-5.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Qemu: display: cirrus: potential arbitrary code execution via cirrus_bitblt_cputovideo"
}
]
}
rhsa-2017_0331
Vulnerability from csaf_redhat
Published
2017-02-27 23:12
Modified
2024-11-05 19:54
Summary
Red Hat Security Advisory: qemu-kvm-rhev security update
Notes
Topic
An update for qemu-kvm-rhev is now available for Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-rhev packages provide the user-space component for running virtual machines that use KVM in environments managed by Red Hat products.
Security Fix(es):
* Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue. It could occur while copying VGA data via bitblt copy in backward mode. A privileged user inside a guest could use this flaw to crash the QEMU process resulting in DoS or potentially execute arbitrary code on the host with privileges of QEMU process on the host. (CVE-2017-2615)
* Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process. (CVE-2017-2620)
Red Hat would like to thank Wjjzhang (Tencent.com Inc.) and Li Qiang (360.cn Inc.) for reporting CVE-2017-2615.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for qemu-kvm-rhev is now available for Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-rhev packages provide the user-space component for running virtual machines that use KVM in environments managed by Red Hat products.\n\nSecurity Fix(es):\n\n* Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue. It could occur while copying VGA data via bitblt copy in backward mode. A privileged user inside a guest could use this flaw to crash the QEMU process resulting in DoS or potentially execute arbitrary code on the host with privileges of QEMU process on the host. (CVE-2017-2615)\n\n* Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process. (CVE-2017-2620)\n\nRed Hat would like to thank Wjjzhang (Tencent.com Inc.) and Li Qiang (360.cn Inc.) for reporting CVE-2017-2615.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2017:0331",
"url": "https://access.redhat.com/errata/RHSA-2017:0331"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "1418200",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1418200"
},
{
"category": "external",
"summary": "1420484",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1420484"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_0331.json"
}
],
"title": "Red Hat Security Advisory: qemu-kvm-rhev security update",
"tracking": {
"current_release_date": "2024-11-05T19:54:16+00:00",
"generator": {
"date": "2024-11-05T19:54:16+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.1.1"
}
},
"id": "RHSA-2017:0331",
"initial_release_date": "2017-02-27T23:12:35+00:00",
"revision_history": [
{
"date": "2017-02-27T23:12:35+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2017-02-27T23:12:35+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-05T19:54:16+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7",
"product": {
"name": "Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7",
"product_id": "7Server-RH7-RHOS-7.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openstack:7::el7"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenStack Platform"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product": {
"name": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product_id": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-common-rhev@2.6.0-28.el7_3.6?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"product": {
"name": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"product_id": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev-debuginfo@2.6.0-28.el7_3.6?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product": {
"name": "qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product_id": "qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-img-rhev@2.6.0-28.el7_3.6?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product": {
"name": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product_id": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-tools-rhev@2.6.0-28.el7_3.6?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product_id": "qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev@2.6.0-28.el7_3.6?arch=x86_64\u0026epoch=10"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"product": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"product_id": "qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev@2.6.0-28.el7_3.6?arch=src\u0026epoch=10"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7",
"product_id": "7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64"
},
"product_reference": "qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7",
"product_id": "7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64"
},
"product_reference": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src as a component of Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7",
"product_id": "7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src"
},
"product_reference": "qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"relates_to_product_reference": "7Server-RH7-RHOS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7",
"product_id": "7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64"
},
"product_reference": "qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7",
"product_id": "7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64"
},
"product_reference": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7",
"product_id": "7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64"
},
"product_reference": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-7.0"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Li Qiang"
],
"organization": "360.cn Inc."
},
{
"names": [
"Wjjzhang"
],
"organization": "Tencent.com Inc."
}
],
"cve": "CVE-2017-2615",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2017-01-25T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1418200"
}
],
"notes": [
{
"category": "description",
"text": "Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue. It could occur while copying VGA data via bitblt copy in backward mode. A privileged user inside a guest could use this flaw to crash the QEMU process resulting in DoS or potentially execute arbitrary code on the host with privileges of QEMU process on the host.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: display: cirrus: oob access while doing bitblt copy backward mode",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-2615"
},
{
"category": "external",
"summary": "RHBZ#1418200",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1418200"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-2615",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-2615"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-2615",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-2615"
}
],
"release_date": "2017-01-24T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-02-27T23:12:35+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:0331"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:A/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Qemu: display: cirrus: oob access while doing bitblt copy backward mode"
},
{
"cve": "CVE-2017-2620",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2017-02-09T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1420484"
}
],
"notes": [
{
"category": "description",
"text": "Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: display: cirrus: potential arbitrary code execution via cirrus_bitblt_cputovideo",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-2620"
},
{
"category": "external",
"summary": "RHBZ#1420484",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1420484"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-2620",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-2620"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-2620",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-2620"
},
{
"category": "external",
"summary": "https://xenbits.xen.org/xsa/advisory-209.html",
"url": "https://xenbits.xen.org/xsa/advisory-209.html"
}
],
"release_date": "2017-02-21T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-02-27T23:12:35+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:0331"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:A/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"7Server-RH7-RHOS-7.0:qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-7.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Qemu: display: cirrus: potential arbitrary code execution via cirrus_bitblt_cputovideo"
}
]
}
rhsa-2017_0396
Vulnerability from csaf_redhat
Published
2017-03-02 17:07
Modified
2024-11-05 19:55
Summary
Red Hat Security Advisory: qemu-kvm security and bug fix update
Notes
Topic
An update for qemu-kvm is now available for Red Hat Enterprise Linux 7.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM.
Security Fix(es):
* Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue. It could occur while copying VGA data via bitblt copy in backward mode. A privileged user inside a guest could use this flaw to crash the QEMU process resulting in DoS or potentially execute arbitrary code on the host with privileges of QEMU process on the host. (CVE-2017-2615)
* Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process. (CVE-2017-2620)
Red Hat would like to thank Wjjzhang (Tencent.com Inc.) and Li Qiang (360.cn Inc.) for reporting CVE-2017-2615.
Bug Fix(es):
* When using the virtio-blk driver on a guest virtual machine with no space on the virtual hard drive, the guest terminated unexpectedly with a "block I/O error in device" message and the qemu-kvm process exited with a segmentation fault. This update fixes how the system_reset QEMU signal is handled in the above scenario. As a result, if a guest crashes due to no space left on the device, qemu-kvm continues running and the guest can be reset as expected. (BZ#1420049)
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for qemu-kvm is now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM.\n\nSecurity Fix(es):\n\n* Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue. It could occur while copying VGA data via bitblt copy in backward mode. A privileged user inside a guest could use this flaw to crash the QEMU process resulting in DoS or potentially execute arbitrary code on the host with privileges of QEMU process on the host. (CVE-2017-2615)\n\n* Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process. (CVE-2017-2620)\n\nRed Hat would like to thank Wjjzhang (Tencent.com Inc.) and Li Qiang (360.cn Inc.) for reporting CVE-2017-2615.\n\nBug Fix(es):\n\n* When using the virtio-blk driver on a guest virtual machine with no space on the virtual hard drive, the guest terminated unexpectedly with a \"block I/O error in device\" message and the qemu-kvm process exited with a segmentation fault. This update fixes how the system_reset QEMU signal is handled in the above scenario. As a result, if a guest crashes due to no space left on the device, qemu-kvm continues running and the guest can be reset as expected. (BZ#1420049)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2017:0396",
"url": "https://access.redhat.com/errata/RHSA-2017:0396"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "1418200",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1418200"
},
{
"category": "external",
"summary": "1420049",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1420049"
},
{
"category": "external",
"summary": "1420428",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1420428"
},
{
"category": "external",
"summary": "1420484",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1420484"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_0396.json"
}
],
"title": "Red Hat Security Advisory: qemu-kvm security and bug fix update",
"tracking": {
"current_release_date": "2024-11-05T19:55:35+00:00",
"generator": {
"date": "2024-11-05T19:55:35+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.1.1"
}
},
"id": "RHSA-2017:0396",
"initial_release_date": "2017-03-02T17:07:28+00:00",
"revision_history": [
{
"date": "2017-03-02T17:07:28+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2017-03-02T17:07:28+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-05T19:55:35+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Client (v. 7)",
"product": {
"name": "Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client-7.3.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:7::client"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product": {
"name": "Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional-7.3.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:7::computenode"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Server (v. 7)",
"product": {
"name": "Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.3.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:7::server"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Workstation (v. 7)",
"product": {
"name": "Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.3.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:7::workstation"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-kvm-10:1.5.3-126.el7_3.5.x86_64",
"product": {
"name": "qemu-kvm-10:1.5.3-126.el7_3.5.x86_64",
"product_id": "qemu-kvm-10:1.5.3-126.el7_3.5.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm@1.5.3-126.el7_3.5?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.x86_64",
"product": {
"name": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.x86_64",
"product_id": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-debuginfo@1.5.3-126.el7_3.5?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-common-10:1.5.3-126.el7_3.5.x86_64",
"product": {
"name": "qemu-kvm-common-10:1.5.3-126.el7_3.5.x86_64",
"product_id": "qemu-kvm-common-10:1.5.3-126.el7_3.5.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-common@1.5.3-126.el7_3.5?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-tools-10:1.5.3-126.el7_3.5.x86_64",
"product": {
"name": "qemu-kvm-tools-10:1.5.3-126.el7_3.5.x86_64",
"product_id": "qemu-kvm-tools-10:1.5.3-126.el7_3.5.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-tools@1.5.3-126.el7_3.5?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-img-10:1.5.3-126.el7_3.5.x86_64",
"product": {
"name": "qemu-img-10:1.5.3-126.el7_3.5.x86_64",
"product_id": "qemu-img-10:1.5.3-126.el7_3.5.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-img@1.5.3-126.el7_3.5?arch=x86_64\u0026epoch=10"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-kvm-10:1.5.3-126.el7_3.5.src",
"product": {
"name": "qemu-kvm-10:1.5.3-126.el7_3.5.src",
"product_id": "qemu-kvm-10:1.5.3-126.el7_3.5.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm@1.5.3-126.el7_3.5?arch=src\u0026epoch=10"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.ppc64",
"product": {
"name": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.ppc64",
"product_id": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.ppc64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-debuginfo@1.5.3-126.el7_3.5?arch=ppc64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-img-10:1.5.3-126.el7_3.5.ppc64",
"product": {
"name": "qemu-img-10:1.5.3-126.el7_3.5.ppc64",
"product_id": "qemu-img-10:1.5.3-126.el7_3.5.ppc64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-img@1.5.3-126.el7_3.5?arch=ppc64\u0026epoch=10"
}
}
}
],
"category": "architecture",
"name": "ppc64"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.ppc64le",
"product": {
"name": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.ppc64le",
"product_id": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-debuginfo@1.5.3-126.el7_3.5?arch=ppc64le\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-img-10:1.5.3-126.el7_3.5.ppc64le",
"product": {
"name": "qemu-img-10:1.5.3-126.el7_3.5.ppc64le",
"product_id": "qemu-img-10:1.5.3-126.el7_3.5.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-img@1.5.3-126.el7_3.5?arch=ppc64le\u0026epoch=10"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-10:1.5.3-126.el7_3.5.ppc64 as a component of Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.ppc64"
},
"product_reference": "qemu-img-10:1.5.3-126.el7_3.5.ppc64",
"relates_to_product_reference": "7Client-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-10:1.5.3-126.el7_3.5.ppc64le as a component of Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.ppc64le"
},
"product_reference": "qemu-img-10:1.5.3-126.el7_3.5.ppc64le",
"relates_to_product_reference": "7Client-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-10:1.5.3-126.el7_3.5.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.x86_64"
},
"product_reference": "qemu-img-10:1.5.3-126.el7_3.5.x86_64",
"relates_to_product_reference": "7Client-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-10:1.5.3-126.el7_3.5.src as a component of Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.5.src"
},
"product_reference": "qemu-kvm-10:1.5.3-126.el7_3.5.src",
"relates_to_product_reference": "7Client-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-10:1.5.3-126.el7_3.5.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.5.x86_64"
},
"product_reference": "qemu-kvm-10:1.5.3-126.el7_3.5.x86_64",
"relates_to_product_reference": "7Client-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-common-10:1.5.3-126.el7_3.5.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client-7.3.Z:qemu-kvm-common-10:1.5.3-126.el7_3.5.x86_64"
},
"product_reference": "qemu-kvm-common-10:1.5.3-126.el7_3.5.x86_64",
"relates_to_product_reference": "7Client-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.ppc64 as a component of Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.ppc64"
},
"product_reference": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.ppc64",
"relates_to_product_reference": "7Client-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.ppc64le as a component of Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.ppc64le"
},
"product_reference": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.ppc64le",
"relates_to_product_reference": "7Client-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.x86_64"
},
"product_reference": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.x86_64",
"relates_to_product_reference": "7Client-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-tools-10:1.5.3-126.el7_3.5.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client-7.3.Z:qemu-kvm-tools-10:1.5.3-126.el7_3.5.x86_64"
},
"product_reference": "qemu-kvm-tools-10:1.5.3-126.el7_3.5.x86_64",
"relates_to_product_reference": "7Client-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-10:1.5.3-126.el7_3.5.ppc64 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.ppc64"
},
"product_reference": "qemu-img-10:1.5.3-126.el7_3.5.ppc64",
"relates_to_product_reference": "7ComputeNode-optional-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-10:1.5.3-126.el7_3.5.ppc64le as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.ppc64le"
},
"product_reference": "qemu-img-10:1.5.3-126.el7_3.5.ppc64le",
"relates_to_product_reference": "7ComputeNode-optional-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-10:1.5.3-126.el7_3.5.x86_64 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.x86_64"
},
"product_reference": "qemu-img-10:1.5.3-126.el7_3.5.x86_64",
"relates_to_product_reference": "7ComputeNode-optional-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-10:1.5.3-126.el7_3.5.src as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.5.src"
},
"product_reference": "qemu-kvm-10:1.5.3-126.el7_3.5.src",
"relates_to_product_reference": "7ComputeNode-optional-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-10:1.5.3-126.el7_3.5.x86_64 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.5.x86_64"
},
"product_reference": "qemu-kvm-10:1.5.3-126.el7_3.5.x86_64",
"relates_to_product_reference": "7ComputeNode-optional-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-common-10:1.5.3-126.el7_3.5.x86_64 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional-7.3.Z:qemu-kvm-common-10:1.5.3-126.el7_3.5.x86_64"
},
"product_reference": "qemu-kvm-common-10:1.5.3-126.el7_3.5.x86_64",
"relates_to_product_reference": "7ComputeNode-optional-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.ppc64 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.ppc64"
},
"product_reference": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.ppc64",
"relates_to_product_reference": "7ComputeNode-optional-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.ppc64le as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.ppc64le"
},
"product_reference": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.ppc64le",
"relates_to_product_reference": "7ComputeNode-optional-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.x86_64 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.x86_64"
},
"product_reference": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.x86_64",
"relates_to_product_reference": "7ComputeNode-optional-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-tools-10:1.5.3-126.el7_3.5.x86_64 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional-7.3.Z:qemu-kvm-tools-10:1.5.3-126.el7_3.5.x86_64"
},
"product_reference": "qemu-kvm-tools-10:1.5.3-126.el7_3.5.x86_64",
"relates_to_product_reference": "7ComputeNode-optional-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-10:1.5.3-126.el7_3.5.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.ppc64"
},
"product_reference": "qemu-img-10:1.5.3-126.el7_3.5.ppc64",
"relates_to_product_reference": "7Server-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-10:1.5.3-126.el7_3.5.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.ppc64le"
},
"product_reference": "qemu-img-10:1.5.3-126.el7_3.5.ppc64le",
"relates_to_product_reference": "7Server-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-10:1.5.3-126.el7_3.5.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.x86_64"
},
"product_reference": "qemu-img-10:1.5.3-126.el7_3.5.x86_64",
"relates_to_product_reference": "7Server-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-10:1.5.3-126.el7_3.5.src as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.5.src"
},
"product_reference": "qemu-kvm-10:1.5.3-126.el7_3.5.src",
"relates_to_product_reference": "7Server-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-10:1.5.3-126.el7_3.5.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.5.x86_64"
},
"product_reference": "qemu-kvm-10:1.5.3-126.el7_3.5.x86_64",
"relates_to_product_reference": "7Server-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-common-10:1.5.3-126.el7_3.5.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.3.Z:qemu-kvm-common-10:1.5.3-126.el7_3.5.x86_64"
},
"product_reference": "qemu-kvm-common-10:1.5.3-126.el7_3.5.x86_64",
"relates_to_product_reference": "7Server-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.ppc64"
},
"product_reference": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.ppc64",
"relates_to_product_reference": "7Server-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.ppc64le"
},
"product_reference": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.ppc64le",
"relates_to_product_reference": "7Server-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.x86_64"
},
"product_reference": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.x86_64",
"relates_to_product_reference": "7Server-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-tools-10:1.5.3-126.el7_3.5.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.3.Z:qemu-kvm-tools-10:1.5.3-126.el7_3.5.x86_64"
},
"product_reference": "qemu-kvm-tools-10:1.5.3-126.el7_3.5.x86_64",
"relates_to_product_reference": "7Server-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-10:1.5.3-126.el7_3.5.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.ppc64"
},
"product_reference": "qemu-img-10:1.5.3-126.el7_3.5.ppc64",
"relates_to_product_reference": "7Workstation-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-10:1.5.3-126.el7_3.5.ppc64le as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.ppc64le"
},
"product_reference": "qemu-img-10:1.5.3-126.el7_3.5.ppc64le",
"relates_to_product_reference": "7Workstation-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-10:1.5.3-126.el7_3.5.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.x86_64"
},
"product_reference": "qemu-img-10:1.5.3-126.el7_3.5.x86_64",
"relates_to_product_reference": "7Workstation-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-10:1.5.3-126.el7_3.5.src as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.5.src"
},
"product_reference": "qemu-kvm-10:1.5.3-126.el7_3.5.src",
"relates_to_product_reference": "7Workstation-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-10:1.5.3-126.el7_3.5.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.5.x86_64"
},
"product_reference": "qemu-kvm-10:1.5.3-126.el7_3.5.x86_64",
"relates_to_product_reference": "7Workstation-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-common-10:1.5.3-126.el7_3.5.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.3.Z:qemu-kvm-common-10:1.5.3-126.el7_3.5.x86_64"
},
"product_reference": "qemu-kvm-common-10:1.5.3-126.el7_3.5.x86_64",
"relates_to_product_reference": "7Workstation-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.ppc64"
},
"product_reference": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.ppc64",
"relates_to_product_reference": "7Workstation-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.ppc64le as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.ppc64le"
},
"product_reference": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.ppc64le",
"relates_to_product_reference": "7Workstation-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.x86_64"
},
"product_reference": "qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.x86_64",
"relates_to_product_reference": "7Workstation-7.3.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-tools-10:1.5.3-126.el7_3.5.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.3.Z:qemu-kvm-tools-10:1.5.3-126.el7_3.5.x86_64"
},
"product_reference": "qemu-kvm-tools-10:1.5.3-126.el7_3.5.x86_64",
"relates_to_product_reference": "7Workstation-7.3.Z"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Li Qiang"
],
"organization": "360.cn Inc."
},
{
"names": [
"Wjjzhang"
],
"organization": "Tencent.com Inc."
}
],
"cve": "CVE-2017-2615",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2017-01-25T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1418200"
}
],
"notes": [
{
"category": "description",
"text": "Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue. It could occur while copying VGA data via bitblt copy in backward mode. A privileged user inside a guest could use this flaw to crash the QEMU process resulting in DoS or potentially execute arbitrary code on the host with privileges of QEMU process on the host.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: display: cirrus: oob access while doing bitblt copy backward mode",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Client-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.ppc64",
"7Client-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.ppc64le",
"7Client-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.x86_64",
"7Client-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.5.src",
"7Client-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.5.x86_64",
"7Client-7.3.Z:qemu-kvm-common-10:1.5.3-126.el7_3.5.x86_64",
"7Client-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.ppc64",
"7Client-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.ppc64le",
"7Client-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.x86_64",
"7Client-7.3.Z:qemu-kvm-tools-10:1.5.3-126.el7_3.5.x86_64",
"7ComputeNode-optional-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.ppc64",
"7ComputeNode-optional-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.ppc64le",
"7ComputeNode-optional-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.x86_64",
"7ComputeNode-optional-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.5.src",
"7ComputeNode-optional-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.5.x86_64",
"7ComputeNode-optional-7.3.Z:qemu-kvm-common-10:1.5.3-126.el7_3.5.x86_64",
"7ComputeNode-optional-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.ppc64",
"7ComputeNode-optional-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.ppc64le",
"7ComputeNode-optional-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.x86_64",
"7ComputeNode-optional-7.3.Z:qemu-kvm-tools-10:1.5.3-126.el7_3.5.x86_64",
"7Server-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.ppc64",
"7Server-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.ppc64le",
"7Server-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.x86_64",
"7Server-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.5.src",
"7Server-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.5.x86_64",
"7Server-7.3.Z:qemu-kvm-common-10:1.5.3-126.el7_3.5.x86_64",
"7Server-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.ppc64",
"7Server-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.ppc64le",
"7Server-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.x86_64",
"7Server-7.3.Z:qemu-kvm-tools-10:1.5.3-126.el7_3.5.x86_64",
"7Workstation-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.ppc64",
"7Workstation-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.ppc64le",
"7Workstation-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.x86_64",
"7Workstation-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.5.src",
"7Workstation-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.5.x86_64",
"7Workstation-7.3.Z:qemu-kvm-common-10:1.5.3-126.el7_3.5.x86_64",
"7Workstation-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.ppc64",
"7Workstation-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.ppc64le",
"7Workstation-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.x86_64",
"7Workstation-7.3.Z:qemu-kvm-tools-10:1.5.3-126.el7_3.5.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-2615"
},
{
"category": "external",
"summary": "RHBZ#1418200",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1418200"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-2615",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-2615"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-2615",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-2615"
}
],
"release_date": "2017-01-24T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-03-02T17:07:28+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"7Client-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.ppc64",
"7Client-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.ppc64le",
"7Client-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.x86_64",
"7Client-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.5.src",
"7Client-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.5.x86_64",
"7Client-7.3.Z:qemu-kvm-common-10:1.5.3-126.el7_3.5.x86_64",
"7Client-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.ppc64",
"7Client-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.ppc64le",
"7Client-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.x86_64",
"7Client-7.3.Z:qemu-kvm-tools-10:1.5.3-126.el7_3.5.x86_64",
"7ComputeNode-optional-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.ppc64",
"7ComputeNode-optional-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.ppc64le",
"7ComputeNode-optional-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.x86_64",
"7ComputeNode-optional-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.5.src",
"7ComputeNode-optional-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.5.x86_64",
"7ComputeNode-optional-7.3.Z:qemu-kvm-common-10:1.5.3-126.el7_3.5.x86_64",
"7ComputeNode-optional-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.ppc64",
"7ComputeNode-optional-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.ppc64le",
"7ComputeNode-optional-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.x86_64",
"7ComputeNode-optional-7.3.Z:qemu-kvm-tools-10:1.5.3-126.el7_3.5.x86_64",
"7Server-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.ppc64",
"7Server-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.ppc64le",
"7Server-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.x86_64",
"7Server-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.5.src",
"7Server-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.5.x86_64",
"7Server-7.3.Z:qemu-kvm-common-10:1.5.3-126.el7_3.5.x86_64",
"7Server-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.ppc64",
"7Server-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.ppc64le",
"7Server-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.x86_64",
"7Server-7.3.Z:qemu-kvm-tools-10:1.5.3-126.el7_3.5.x86_64",
"7Workstation-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.ppc64",
"7Workstation-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.ppc64le",
"7Workstation-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.x86_64",
"7Workstation-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.5.src",
"7Workstation-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.5.x86_64",
"7Workstation-7.3.Z:qemu-kvm-common-10:1.5.3-126.el7_3.5.x86_64",
"7Workstation-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.ppc64",
"7Workstation-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.ppc64le",
"7Workstation-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.x86_64",
"7Workstation-7.3.Z:qemu-kvm-tools-10:1.5.3-126.el7_3.5.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:0396"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:A/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"7Client-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.ppc64",
"7Client-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.ppc64le",
"7Client-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.x86_64",
"7Client-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.5.src",
"7Client-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.5.x86_64",
"7Client-7.3.Z:qemu-kvm-common-10:1.5.3-126.el7_3.5.x86_64",
"7Client-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.ppc64",
"7Client-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.ppc64le",
"7Client-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.x86_64",
"7Client-7.3.Z:qemu-kvm-tools-10:1.5.3-126.el7_3.5.x86_64",
"7ComputeNode-optional-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.ppc64",
"7ComputeNode-optional-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.ppc64le",
"7ComputeNode-optional-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.x86_64",
"7ComputeNode-optional-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.5.src",
"7ComputeNode-optional-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.5.x86_64",
"7ComputeNode-optional-7.3.Z:qemu-kvm-common-10:1.5.3-126.el7_3.5.x86_64",
"7ComputeNode-optional-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.ppc64",
"7ComputeNode-optional-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.ppc64le",
"7ComputeNode-optional-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.x86_64",
"7ComputeNode-optional-7.3.Z:qemu-kvm-tools-10:1.5.3-126.el7_3.5.x86_64",
"7Server-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.ppc64",
"7Server-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.ppc64le",
"7Server-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.x86_64",
"7Server-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.5.src",
"7Server-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.5.x86_64",
"7Server-7.3.Z:qemu-kvm-common-10:1.5.3-126.el7_3.5.x86_64",
"7Server-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.ppc64",
"7Server-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.ppc64le",
"7Server-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.x86_64",
"7Server-7.3.Z:qemu-kvm-tools-10:1.5.3-126.el7_3.5.x86_64",
"7Workstation-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.ppc64",
"7Workstation-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.ppc64le",
"7Workstation-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.x86_64",
"7Workstation-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.5.src",
"7Workstation-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.5.x86_64",
"7Workstation-7.3.Z:qemu-kvm-common-10:1.5.3-126.el7_3.5.x86_64",
"7Workstation-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.ppc64",
"7Workstation-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.ppc64le",
"7Workstation-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.x86_64",
"7Workstation-7.3.Z:qemu-kvm-tools-10:1.5.3-126.el7_3.5.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Qemu: display: cirrus: oob access while doing bitblt copy backward mode"
},
{
"cve": "CVE-2017-2620",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2017-02-09T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1420484"
}
],
"notes": [
{
"category": "description",
"text": "Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: display: cirrus: potential arbitrary code execution via cirrus_bitblt_cputovideo",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Client-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.ppc64",
"7Client-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.ppc64le",
"7Client-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.x86_64",
"7Client-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.5.src",
"7Client-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.5.x86_64",
"7Client-7.3.Z:qemu-kvm-common-10:1.5.3-126.el7_3.5.x86_64",
"7Client-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.ppc64",
"7Client-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.ppc64le",
"7Client-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.x86_64",
"7Client-7.3.Z:qemu-kvm-tools-10:1.5.3-126.el7_3.5.x86_64",
"7ComputeNode-optional-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.ppc64",
"7ComputeNode-optional-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.ppc64le",
"7ComputeNode-optional-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.x86_64",
"7ComputeNode-optional-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.5.src",
"7ComputeNode-optional-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.5.x86_64",
"7ComputeNode-optional-7.3.Z:qemu-kvm-common-10:1.5.3-126.el7_3.5.x86_64",
"7ComputeNode-optional-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.ppc64",
"7ComputeNode-optional-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.ppc64le",
"7ComputeNode-optional-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.x86_64",
"7ComputeNode-optional-7.3.Z:qemu-kvm-tools-10:1.5.3-126.el7_3.5.x86_64",
"7Server-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.ppc64",
"7Server-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.ppc64le",
"7Server-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.x86_64",
"7Server-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.5.src",
"7Server-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.5.x86_64",
"7Server-7.3.Z:qemu-kvm-common-10:1.5.3-126.el7_3.5.x86_64",
"7Server-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.ppc64",
"7Server-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.ppc64le",
"7Server-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.x86_64",
"7Server-7.3.Z:qemu-kvm-tools-10:1.5.3-126.el7_3.5.x86_64",
"7Workstation-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.ppc64",
"7Workstation-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.ppc64le",
"7Workstation-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.x86_64",
"7Workstation-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.5.src",
"7Workstation-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.5.x86_64",
"7Workstation-7.3.Z:qemu-kvm-common-10:1.5.3-126.el7_3.5.x86_64",
"7Workstation-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.ppc64",
"7Workstation-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.ppc64le",
"7Workstation-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.x86_64",
"7Workstation-7.3.Z:qemu-kvm-tools-10:1.5.3-126.el7_3.5.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-2620"
},
{
"category": "external",
"summary": "RHBZ#1420484",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1420484"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-2620",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-2620"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-2620",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-2620"
},
{
"category": "external",
"summary": "https://xenbits.xen.org/xsa/advisory-209.html",
"url": "https://xenbits.xen.org/xsa/advisory-209.html"
}
],
"release_date": "2017-02-21T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-03-02T17:07:28+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"7Client-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.ppc64",
"7Client-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.ppc64le",
"7Client-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.x86_64",
"7Client-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.5.src",
"7Client-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.5.x86_64",
"7Client-7.3.Z:qemu-kvm-common-10:1.5.3-126.el7_3.5.x86_64",
"7Client-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.ppc64",
"7Client-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.ppc64le",
"7Client-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.x86_64",
"7Client-7.3.Z:qemu-kvm-tools-10:1.5.3-126.el7_3.5.x86_64",
"7ComputeNode-optional-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.ppc64",
"7ComputeNode-optional-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.ppc64le",
"7ComputeNode-optional-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.x86_64",
"7ComputeNode-optional-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.5.src",
"7ComputeNode-optional-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.5.x86_64",
"7ComputeNode-optional-7.3.Z:qemu-kvm-common-10:1.5.3-126.el7_3.5.x86_64",
"7ComputeNode-optional-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.ppc64",
"7ComputeNode-optional-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.ppc64le",
"7ComputeNode-optional-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.x86_64",
"7ComputeNode-optional-7.3.Z:qemu-kvm-tools-10:1.5.3-126.el7_3.5.x86_64",
"7Server-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.ppc64",
"7Server-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.ppc64le",
"7Server-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.x86_64",
"7Server-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.5.src",
"7Server-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.5.x86_64",
"7Server-7.3.Z:qemu-kvm-common-10:1.5.3-126.el7_3.5.x86_64",
"7Server-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.ppc64",
"7Server-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.ppc64le",
"7Server-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.x86_64",
"7Server-7.3.Z:qemu-kvm-tools-10:1.5.3-126.el7_3.5.x86_64",
"7Workstation-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.ppc64",
"7Workstation-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.ppc64le",
"7Workstation-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.x86_64",
"7Workstation-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.5.src",
"7Workstation-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.5.x86_64",
"7Workstation-7.3.Z:qemu-kvm-common-10:1.5.3-126.el7_3.5.x86_64",
"7Workstation-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.ppc64",
"7Workstation-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.ppc64le",
"7Workstation-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.x86_64",
"7Workstation-7.3.Z:qemu-kvm-tools-10:1.5.3-126.el7_3.5.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:0396"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:A/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"7Client-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.ppc64",
"7Client-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.ppc64le",
"7Client-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.x86_64",
"7Client-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.5.src",
"7Client-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.5.x86_64",
"7Client-7.3.Z:qemu-kvm-common-10:1.5.3-126.el7_3.5.x86_64",
"7Client-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.ppc64",
"7Client-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.ppc64le",
"7Client-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.x86_64",
"7Client-7.3.Z:qemu-kvm-tools-10:1.5.3-126.el7_3.5.x86_64",
"7ComputeNode-optional-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.ppc64",
"7ComputeNode-optional-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.ppc64le",
"7ComputeNode-optional-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.x86_64",
"7ComputeNode-optional-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.5.src",
"7ComputeNode-optional-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.5.x86_64",
"7ComputeNode-optional-7.3.Z:qemu-kvm-common-10:1.5.3-126.el7_3.5.x86_64",
"7ComputeNode-optional-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.ppc64",
"7ComputeNode-optional-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.ppc64le",
"7ComputeNode-optional-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.x86_64",
"7ComputeNode-optional-7.3.Z:qemu-kvm-tools-10:1.5.3-126.el7_3.5.x86_64",
"7Server-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.ppc64",
"7Server-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.ppc64le",
"7Server-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.x86_64",
"7Server-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.5.src",
"7Server-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.5.x86_64",
"7Server-7.3.Z:qemu-kvm-common-10:1.5.3-126.el7_3.5.x86_64",
"7Server-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.ppc64",
"7Server-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.ppc64le",
"7Server-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.x86_64",
"7Server-7.3.Z:qemu-kvm-tools-10:1.5.3-126.el7_3.5.x86_64",
"7Workstation-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.ppc64",
"7Workstation-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.ppc64le",
"7Workstation-7.3.Z:qemu-img-10:1.5.3-126.el7_3.5.x86_64",
"7Workstation-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.5.src",
"7Workstation-7.3.Z:qemu-kvm-10:1.5.3-126.el7_3.5.x86_64",
"7Workstation-7.3.Z:qemu-kvm-common-10:1.5.3-126.el7_3.5.x86_64",
"7Workstation-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.ppc64",
"7Workstation-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.ppc64le",
"7Workstation-7.3.Z:qemu-kvm-debuginfo-10:1.5.3-126.el7_3.5.x86_64",
"7Workstation-7.3.Z:qemu-kvm-tools-10:1.5.3-126.el7_3.5.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Qemu: display: cirrus: potential arbitrary code execution via cirrus_bitblt_cputovideo"
}
]
}
rhsa-2017_0454
Vulnerability from csaf_redhat
Published
2017-03-07 11:02
Modified
2024-11-05 19:55
Summary
Red Hat Security Advisory: kvm security update
Notes
Topic
An update for kvm is now available for Red Hat Enterprise Linux 5.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
KVM (for Kernel-based Virtual Machine) is a full virtualization solution for Linux on x86 hardware. Using KVM, one can run multiple virtual machines running unmodified Linux or Windows images. Each virtual machine has private virtualized hardware: a network card, disk, graphics adapter, etc.
Security Fix(es):
* Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue. It could occur while copying VGA data via bitblt copy in backward mode. A privileged user inside a guest could use this flaw to crash the QEMU process resulting in DoS or potentially execute arbitrary code on the host with privileges of QEMU process on the host. (CVE-2017-2615)
* Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process. (CVE-2017-2620)
Red Hat would like to thank Wjjzhang (Tencent.com Inc.) and Li Qiang (360.cn Inc.) for reporting CVE-2017-2615.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for kvm is now available for Red Hat Enterprise Linux 5.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "KVM (for Kernel-based Virtual Machine) is a full virtualization solution for Linux on x86 hardware. Using KVM, one can run multiple virtual machines running unmodified Linux or Windows images. Each virtual machine has private virtualized hardware: a network card, disk, graphics adapter, etc.\n\nSecurity Fix(es):\n\n* Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue. It could occur while copying VGA data via bitblt copy in backward mode. A privileged user inside a guest could use this flaw to crash the QEMU process resulting in DoS or potentially execute arbitrary code on the host with privileges of QEMU process on the host. (CVE-2017-2615)\n\n* Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process. (CVE-2017-2620)\n\nRed Hat would like to thank Wjjzhang (Tencent.com Inc.) and Li Qiang (360.cn Inc.) for reporting CVE-2017-2615.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2017:0454",
"url": "https://access.redhat.com/errata/RHSA-2017:0454"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "1418200",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1418200"
},
{
"category": "external",
"summary": "1420484",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1420484"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_0454.json"
}
],
"title": "Red Hat Security Advisory: kvm security update",
"tracking": {
"current_release_date": "2024-11-05T19:55:58+00:00",
"generator": {
"date": "2024-11-05T19:55:58+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.1.1"
}
},
"id": "RHSA-2017:0454",
"initial_release_date": "2017-03-07T11:02:09+00:00",
"revision_history": [
{
"date": "2017-03-07T11:02:09+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2017-03-07T11:02:09+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-05T19:55:58+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Desktop Multi OS (v. 5 client)",
"product": {
"name": "Red Hat Enterprise Linux Desktop Multi OS (v. 5 client)",
"product_id": "5Client-VT-5.11.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_virtualization:5::client"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Virtualization (v. 5 server)",
"product": {
"name": "Red Hat Enterprise Linux Virtualization (v. 5 server)",
"product_id": "5Server-VT-5.11.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_virtualization:5::server"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "kmod-kvm-0:83-277.el5_11.x86_64",
"product": {
"name": "kmod-kvm-0:83-277.el5_11.x86_64",
"product_id": "kmod-kvm-0:83-277.el5_11.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/kmod-kvm@83-277.el5_11?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "kvm-debuginfo-0:83-277.el5_11.x86_64",
"product": {
"name": "kvm-debuginfo-0:83-277.el5_11.x86_64",
"product_id": "kvm-debuginfo-0:83-277.el5_11.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/kvm-debuginfo@83-277.el5_11?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "kvm-tools-0:83-277.el5_11.x86_64",
"product": {
"name": "kvm-tools-0:83-277.el5_11.x86_64",
"product_id": "kvm-tools-0:83-277.el5_11.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/kvm-tools@83-277.el5_11?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "kmod-kvm-debug-0:83-277.el5_11.x86_64",
"product": {
"name": "kmod-kvm-debug-0:83-277.el5_11.x86_64",
"product_id": "kmod-kvm-debug-0:83-277.el5_11.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/kmod-kvm-debug@83-277.el5_11?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "kvm-qemu-img-0:83-277.el5_11.x86_64",
"product": {
"name": "kvm-qemu-img-0:83-277.el5_11.x86_64",
"product_id": "kvm-qemu-img-0:83-277.el5_11.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/kvm-qemu-img@83-277.el5_11?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "kvm-0:83-277.el5_11.x86_64",
"product": {
"name": "kvm-0:83-277.el5_11.x86_64",
"product_id": "kvm-0:83-277.el5_11.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/kvm@83-277.el5_11?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "kvm-0:83-277.el5_11.src",
"product": {
"name": "kvm-0:83-277.el5_11.src",
"product_id": "kvm-0:83-277.el5_11.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/kvm@83-277.el5_11?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "kmod-kvm-0:83-277.el5_11.x86_64 as a component of Red Hat Enterprise Linux Desktop Multi OS (v. 5 client)",
"product_id": "5Client-VT-5.11.Z:kmod-kvm-0:83-277.el5_11.x86_64"
},
"product_reference": "kmod-kvm-0:83-277.el5_11.x86_64",
"relates_to_product_reference": "5Client-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kmod-kvm-debug-0:83-277.el5_11.x86_64 as a component of Red Hat Enterprise Linux Desktop Multi OS (v. 5 client)",
"product_id": "5Client-VT-5.11.Z:kmod-kvm-debug-0:83-277.el5_11.x86_64"
},
"product_reference": "kmod-kvm-debug-0:83-277.el5_11.x86_64",
"relates_to_product_reference": "5Client-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kvm-0:83-277.el5_11.src as a component of Red Hat Enterprise Linux Desktop Multi OS (v. 5 client)",
"product_id": "5Client-VT-5.11.Z:kvm-0:83-277.el5_11.src"
},
"product_reference": "kvm-0:83-277.el5_11.src",
"relates_to_product_reference": "5Client-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kvm-0:83-277.el5_11.x86_64 as a component of Red Hat Enterprise Linux Desktop Multi OS (v. 5 client)",
"product_id": "5Client-VT-5.11.Z:kvm-0:83-277.el5_11.x86_64"
},
"product_reference": "kvm-0:83-277.el5_11.x86_64",
"relates_to_product_reference": "5Client-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kvm-debuginfo-0:83-277.el5_11.x86_64 as a component of Red Hat Enterprise Linux Desktop Multi OS (v. 5 client)",
"product_id": "5Client-VT-5.11.Z:kvm-debuginfo-0:83-277.el5_11.x86_64"
},
"product_reference": "kvm-debuginfo-0:83-277.el5_11.x86_64",
"relates_to_product_reference": "5Client-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kvm-qemu-img-0:83-277.el5_11.x86_64 as a component of Red Hat Enterprise Linux Desktop Multi OS (v. 5 client)",
"product_id": "5Client-VT-5.11.Z:kvm-qemu-img-0:83-277.el5_11.x86_64"
},
"product_reference": "kvm-qemu-img-0:83-277.el5_11.x86_64",
"relates_to_product_reference": "5Client-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kvm-tools-0:83-277.el5_11.x86_64 as a component of Red Hat Enterprise Linux Desktop Multi OS (v. 5 client)",
"product_id": "5Client-VT-5.11.Z:kvm-tools-0:83-277.el5_11.x86_64"
},
"product_reference": "kvm-tools-0:83-277.el5_11.x86_64",
"relates_to_product_reference": "5Client-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kmod-kvm-0:83-277.el5_11.x86_64 as a component of Red Hat Enterprise Linux Virtualization (v. 5 server)",
"product_id": "5Server-VT-5.11.Z:kmod-kvm-0:83-277.el5_11.x86_64"
},
"product_reference": "kmod-kvm-0:83-277.el5_11.x86_64",
"relates_to_product_reference": "5Server-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kmod-kvm-debug-0:83-277.el5_11.x86_64 as a component of Red Hat Enterprise Linux Virtualization (v. 5 server)",
"product_id": "5Server-VT-5.11.Z:kmod-kvm-debug-0:83-277.el5_11.x86_64"
},
"product_reference": "kmod-kvm-debug-0:83-277.el5_11.x86_64",
"relates_to_product_reference": "5Server-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kvm-0:83-277.el5_11.src as a component of Red Hat Enterprise Linux Virtualization (v. 5 server)",
"product_id": "5Server-VT-5.11.Z:kvm-0:83-277.el5_11.src"
},
"product_reference": "kvm-0:83-277.el5_11.src",
"relates_to_product_reference": "5Server-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kvm-0:83-277.el5_11.x86_64 as a component of Red Hat Enterprise Linux Virtualization (v. 5 server)",
"product_id": "5Server-VT-5.11.Z:kvm-0:83-277.el5_11.x86_64"
},
"product_reference": "kvm-0:83-277.el5_11.x86_64",
"relates_to_product_reference": "5Server-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kvm-debuginfo-0:83-277.el5_11.x86_64 as a component of Red Hat Enterprise Linux Virtualization (v. 5 server)",
"product_id": "5Server-VT-5.11.Z:kvm-debuginfo-0:83-277.el5_11.x86_64"
},
"product_reference": "kvm-debuginfo-0:83-277.el5_11.x86_64",
"relates_to_product_reference": "5Server-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kvm-qemu-img-0:83-277.el5_11.x86_64 as a component of Red Hat Enterprise Linux Virtualization (v. 5 server)",
"product_id": "5Server-VT-5.11.Z:kvm-qemu-img-0:83-277.el5_11.x86_64"
},
"product_reference": "kvm-qemu-img-0:83-277.el5_11.x86_64",
"relates_to_product_reference": "5Server-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kvm-tools-0:83-277.el5_11.x86_64 as a component of Red Hat Enterprise Linux Virtualization (v. 5 server)",
"product_id": "5Server-VT-5.11.Z:kvm-tools-0:83-277.el5_11.x86_64"
},
"product_reference": "kvm-tools-0:83-277.el5_11.x86_64",
"relates_to_product_reference": "5Server-VT-5.11.Z"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Li Qiang"
],
"organization": "360.cn Inc."
},
{
"names": [
"Wjjzhang"
],
"organization": "Tencent.com Inc."
}
],
"cve": "CVE-2017-2615",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2017-01-25T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1418200"
}
],
"notes": [
{
"category": "description",
"text": "Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue. It could occur while copying VGA data via bitblt copy in backward mode. A privileged user inside a guest could use this flaw to crash the QEMU process resulting in DoS or potentially execute arbitrary code on the host with privileges of QEMU process on the host.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: display: cirrus: oob access while doing bitblt copy backward mode",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Client-VT-5.11.Z:kmod-kvm-0:83-277.el5_11.x86_64",
"5Client-VT-5.11.Z:kmod-kvm-debug-0:83-277.el5_11.x86_64",
"5Client-VT-5.11.Z:kvm-0:83-277.el5_11.src",
"5Client-VT-5.11.Z:kvm-0:83-277.el5_11.x86_64",
"5Client-VT-5.11.Z:kvm-debuginfo-0:83-277.el5_11.x86_64",
"5Client-VT-5.11.Z:kvm-qemu-img-0:83-277.el5_11.x86_64",
"5Client-VT-5.11.Z:kvm-tools-0:83-277.el5_11.x86_64",
"5Server-VT-5.11.Z:kmod-kvm-0:83-277.el5_11.x86_64",
"5Server-VT-5.11.Z:kmod-kvm-debug-0:83-277.el5_11.x86_64",
"5Server-VT-5.11.Z:kvm-0:83-277.el5_11.src",
"5Server-VT-5.11.Z:kvm-0:83-277.el5_11.x86_64",
"5Server-VT-5.11.Z:kvm-debuginfo-0:83-277.el5_11.x86_64",
"5Server-VT-5.11.Z:kvm-qemu-img-0:83-277.el5_11.x86_64",
"5Server-VT-5.11.Z:kvm-tools-0:83-277.el5_11.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-2615"
},
{
"category": "external",
"summary": "RHBZ#1418200",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1418200"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-2615",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-2615"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-2615",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-2615"
}
],
"release_date": "2017-01-24T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-03-07T11:02:09+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nNote: The procedure in the Solution section must be performed before this update will take effect.",
"product_ids": [
"5Client-VT-5.11.Z:kmod-kvm-0:83-277.el5_11.x86_64",
"5Client-VT-5.11.Z:kmod-kvm-debug-0:83-277.el5_11.x86_64",
"5Client-VT-5.11.Z:kvm-0:83-277.el5_11.src",
"5Client-VT-5.11.Z:kvm-0:83-277.el5_11.x86_64",
"5Client-VT-5.11.Z:kvm-debuginfo-0:83-277.el5_11.x86_64",
"5Client-VT-5.11.Z:kvm-qemu-img-0:83-277.el5_11.x86_64",
"5Client-VT-5.11.Z:kvm-tools-0:83-277.el5_11.x86_64",
"5Server-VT-5.11.Z:kmod-kvm-0:83-277.el5_11.x86_64",
"5Server-VT-5.11.Z:kmod-kvm-debug-0:83-277.el5_11.x86_64",
"5Server-VT-5.11.Z:kvm-0:83-277.el5_11.src",
"5Server-VT-5.11.Z:kvm-0:83-277.el5_11.x86_64",
"5Server-VT-5.11.Z:kvm-debuginfo-0:83-277.el5_11.x86_64",
"5Server-VT-5.11.Z:kvm-qemu-img-0:83-277.el5_11.x86_64",
"5Server-VT-5.11.Z:kvm-tools-0:83-277.el5_11.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:0454"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:A/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"5Client-VT-5.11.Z:kmod-kvm-0:83-277.el5_11.x86_64",
"5Client-VT-5.11.Z:kmod-kvm-debug-0:83-277.el5_11.x86_64",
"5Client-VT-5.11.Z:kvm-0:83-277.el5_11.src",
"5Client-VT-5.11.Z:kvm-0:83-277.el5_11.x86_64",
"5Client-VT-5.11.Z:kvm-debuginfo-0:83-277.el5_11.x86_64",
"5Client-VT-5.11.Z:kvm-qemu-img-0:83-277.el5_11.x86_64",
"5Client-VT-5.11.Z:kvm-tools-0:83-277.el5_11.x86_64",
"5Server-VT-5.11.Z:kmod-kvm-0:83-277.el5_11.x86_64",
"5Server-VT-5.11.Z:kmod-kvm-debug-0:83-277.el5_11.x86_64",
"5Server-VT-5.11.Z:kvm-0:83-277.el5_11.src",
"5Server-VT-5.11.Z:kvm-0:83-277.el5_11.x86_64",
"5Server-VT-5.11.Z:kvm-debuginfo-0:83-277.el5_11.x86_64",
"5Server-VT-5.11.Z:kvm-qemu-img-0:83-277.el5_11.x86_64",
"5Server-VT-5.11.Z:kvm-tools-0:83-277.el5_11.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Qemu: display: cirrus: oob access while doing bitblt copy backward mode"
},
{
"cve": "CVE-2017-2620",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2017-02-09T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1420484"
}
],
"notes": [
{
"category": "description",
"text": "Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: display: cirrus: potential arbitrary code execution via cirrus_bitblt_cputovideo",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Client-VT-5.11.Z:kmod-kvm-0:83-277.el5_11.x86_64",
"5Client-VT-5.11.Z:kmod-kvm-debug-0:83-277.el5_11.x86_64",
"5Client-VT-5.11.Z:kvm-0:83-277.el5_11.src",
"5Client-VT-5.11.Z:kvm-0:83-277.el5_11.x86_64",
"5Client-VT-5.11.Z:kvm-debuginfo-0:83-277.el5_11.x86_64",
"5Client-VT-5.11.Z:kvm-qemu-img-0:83-277.el5_11.x86_64",
"5Client-VT-5.11.Z:kvm-tools-0:83-277.el5_11.x86_64",
"5Server-VT-5.11.Z:kmod-kvm-0:83-277.el5_11.x86_64",
"5Server-VT-5.11.Z:kmod-kvm-debug-0:83-277.el5_11.x86_64",
"5Server-VT-5.11.Z:kvm-0:83-277.el5_11.src",
"5Server-VT-5.11.Z:kvm-0:83-277.el5_11.x86_64",
"5Server-VT-5.11.Z:kvm-debuginfo-0:83-277.el5_11.x86_64",
"5Server-VT-5.11.Z:kvm-qemu-img-0:83-277.el5_11.x86_64",
"5Server-VT-5.11.Z:kvm-tools-0:83-277.el5_11.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-2620"
},
{
"category": "external",
"summary": "RHBZ#1420484",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1420484"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-2620",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-2620"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-2620",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-2620"
},
{
"category": "external",
"summary": "https://xenbits.xen.org/xsa/advisory-209.html",
"url": "https://xenbits.xen.org/xsa/advisory-209.html"
}
],
"release_date": "2017-02-21T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-03-07T11:02:09+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nNote: The procedure in the Solution section must be performed before this update will take effect.",
"product_ids": [
"5Client-VT-5.11.Z:kmod-kvm-0:83-277.el5_11.x86_64",
"5Client-VT-5.11.Z:kmod-kvm-debug-0:83-277.el5_11.x86_64",
"5Client-VT-5.11.Z:kvm-0:83-277.el5_11.src",
"5Client-VT-5.11.Z:kvm-0:83-277.el5_11.x86_64",
"5Client-VT-5.11.Z:kvm-debuginfo-0:83-277.el5_11.x86_64",
"5Client-VT-5.11.Z:kvm-qemu-img-0:83-277.el5_11.x86_64",
"5Client-VT-5.11.Z:kvm-tools-0:83-277.el5_11.x86_64",
"5Server-VT-5.11.Z:kmod-kvm-0:83-277.el5_11.x86_64",
"5Server-VT-5.11.Z:kmod-kvm-debug-0:83-277.el5_11.x86_64",
"5Server-VT-5.11.Z:kvm-0:83-277.el5_11.src",
"5Server-VT-5.11.Z:kvm-0:83-277.el5_11.x86_64",
"5Server-VT-5.11.Z:kvm-debuginfo-0:83-277.el5_11.x86_64",
"5Server-VT-5.11.Z:kvm-qemu-img-0:83-277.el5_11.x86_64",
"5Server-VT-5.11.Z:kvm-tools-0:83-277.el5_11.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:0454"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:A/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"5Client-VT-5.11.Z:kmod-kvm-0:83-277.el5_11.x86_64",
"5Client-VT-5.11.Z:kmod-kvm-debug-0:83-277.el5_11.x86_64",
"5Client-VT-5.11.Z:kvm-0:83-277.el5_11.src",
"5Client-VT-5.11.Z:kvm-0:83-277.el5_11.x86_64",
"5Client-VT-5.11.Z:kvm-debuginfo-0:83-277.el5_11.x86_64",
"5Client-VT-5.11.Z:kvm-qemu-img-0:83-277.el5_11.x86_64",
"5Client-VT-5.11.Z:kvm-tools-0:83-277.el5_11.x86_64",
"5Server-VT-5.11.Z:kmod-kvm-0:83-277.el5_11.x86_64",
"5Server-VT-5.11.Z:kmod-kvm-debug-0:83-277.el5_11.x86_64",
"5Server-VT-5.11.Z:kvm-0:83-277.el5_11.src",
"5Server-VT-5.11.Z:kvm-0:83-277.el5_11.x86_64",
"5Server-VT-5.11.Z:kvm-debuginfo-0:83-277.el5_11.x86_64",
"5Server-VT-5.11.Z:kvm-qemu-img-0:83-277.el5_11.x86_64",
"5Server-VT-5.11.Z:kvm-tools-0:83-277.el5_11.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Qemu: display: cirrus: potential arbitrary code execution via cirrus_bitblt_cputovideo"
}
]
}
rhsa-2017_0329
Vulnerability from csaf_redhat
Published
2017-02-27 23:12
Modified
2024-11-05 19:54
Summary
Red Hat Security Advisory: qemu-kvm-rhev security update
Notes
Topic
An update for qemu-kvm-rhev is now available for Red Hat OpenStack Platform 9.0 (Mitaka).
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-rhev packages provide the user-space component for running virtual machines that use KVM in environments managed by Red Hat products.
Security Fix(es):
* Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue. It could occur while copying VGA data via bitblt copy in backward mode. A privileged user inside a guest could use this flaw to crash the QEMU process resulting in DoS or potentially execute arbitrary code on the host with privileges of QEMU process on the host. (CVE-2017-2615)
* Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process. (CVE-2017-2620)
Red Hat would like to thank Wjjzhang (Tencent.com Inc.) and Li Qiang (360.cn Inc.) for reporting CVE-2017-2615.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for qemu-kvm-rhev is now available for Red Hat OpenStack Platform 9.0 (Mitaka).\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-rhev packages provide the user-space component for running virtual machines that use KVM in environments managed by Red Hat products.\n\nSecurity Fix(es):\n\n* Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue. It could occur while copying VGA data via bitblt copy in backward mode. A privileged user inside a guest could use this flaw to crash the QEMU process resulting in DoS or potentially execute arbitrary code on the host with privileges of QEMU process on the host. (CVE-2017-2615)\n\n* Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process. (CVE-2017-2620)\n\nRed Hat would like to thank Wjjzhang (Tencent.com Inc.) and Li Qiang (360.cn Inc.) for reporting CVE-2017-2615.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2017:0329",
"url": "https://access.redhat.com/errata/RHSA-2017:0329"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "1418200",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1418200"
},
{
"category": "external",
"summary": "1420484",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1420484"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_0329.json"
}
],
"title": "Red Hat Security Advisory: qemu-kvm-rhev security update",
"tracking": {
"current_release_date": "2024-11-05T19:54:17+00:00",
"generator": {
"date": "2024-11-05T19:54:17+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.1.1"
}
},
"id": "RHSA-2017:0329",
"initial_release_date": "2017-02-27T23:12:47+00:00",
"revision_history": [
{
"date": "2017-02-27T23:12:47+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2017-02-27T23:12:47+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-05T19:54:17+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenStack Platform 9.0",
"product": {
"name": "Red Hat OpenStack Platform 9.0",
"product_id": "7Server-RH7-RHOS-9.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openstack:9::el7"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenStack Platform"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product": {
"name": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product_id": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-common-rhev@2.6.0-28.el7_3.6?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"product": {
"name": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"product_id": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev-debuginfo@2.6.0-28.el7_3.6?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product": {
"name": "qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product_id": "qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-img-rhev@2.6.0-28.el7_3.6?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product": {
"name": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product_id": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-tools-rhev@2.6.0-28.el7_3.6?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product_id": "qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev@2.6.0-28.el7_3.6?arch=x86_64\u0026epoch=10"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"product": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"product_id": "qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev@2.6.0-28.el7_3.6?arch=src\u0026epoch=10"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64 as a component of Red Hat OpenStack Platform 9.0",
"product_id": "7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64"
},
"product_reference": "qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-9.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64 as a component of Red Hat OpenStack Platform 9.0",
"product_id": "7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64"
},
"product_reference": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-9.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src as a component of Red Hat OpenStack Platform 9.0",
"product_id": "7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src"
},
"product_reference": "qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"relates_to_product_reference": "7Server-RH7-RHOS-9.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64 as a component of Red Hat OpenStack Platform 9.0",
"product_id": "7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64"
},
"product_reference": "qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-9.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64 as a component of Red Hat OpenStack Platform 9.0",
"product_id": "7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64"
},
"product_reference": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-9.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64 as a component of Red Hat OpenStack Platform 9.0",
"product_id": "7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64"
},
"product_reference": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-9.0"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Li Qiang"
],
"organization": "360.cn Inc."
},
{
"names": [
"Wjjzhang"
],
"organization": "Tencent.com Inc."
}
],
"cve": "CVE-2017-2615",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2017-01-25T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1418200"
}
],
"notes": [
{
"category": "description",
"text": "Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue. It could occur while copying VGA data via bitblt copy in backward mode. A privileged user inside a guest could use this flaw to crash the QEMU process resulting in DoS or potentially execute arbitrary code on the host with privileges of QEMU process on the host.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: display: cirrus: oob access while doing bitblt copy backward mode",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-2615"
},
{
"category": "external",
"summary": "RHBZ#1418200",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1418200"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-2615",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-2615"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-2615",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-2615"
}
],
"release_date": "2017-01-24T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-02-27T23:12:47+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:0329"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:A/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Qemu: display: cirrus: oob access while doing bitblt copy backward mode"
},
{
"cve": "CVE-2017-2620",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2017-02-09T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1420484"
}
],
"notes": [
{
"category": "description",
"text": "Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: display: cirrus: potential arbitrary code execution via cirrus_bitblt_cputovideo",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-2620"
},
{
"category": "external",
"summary": "RHBZ#1420484",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1420484"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-2620",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-2620"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-2620",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-2620"
},
{
"category": "external",
"summary": "https://xenbits.xen.org/xsa/advisory-209.html",
"url": "https://xenbits.xen.org/xsa/advisory-209.html"
}
],
"release_date": "2017-02-21T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-02-27T23:12:47+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:0329"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:A/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"7Server-RH7-RHOS-9.0:qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-9.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Qemu: display: cirrus: potential arbitrary code execution via cirrus_bitblt_cputovideo"
}
]
}
rhsa-2017_0330
Vulnerability from csaf_redhat
Published
2017-02-27 23:12
Modified
2024-11-05 19:54
Summary
Red Hat Security Advisory: qemu-kvm-rhev security update
Notes
Topic
An update for qemu-kvm-rhev is now available for Red Hat OpenStack Platform 8.0 (Liberty).
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-rhev packages provide the user-space component for running virtual machines that use KVM in environments managed by Red Hat products.
Security Fix(es):
* Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue. It could occur while copying VGA data via bitblt copy in backward mode. A privileged user inside a guest could use this flaw to crash the QEMU process resulting in DoS or potentially execute arbitrary code on the host with privileges of QEMU process on the host. (CVE-2017-2615)
* Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process. (CVE-2017-2620)
Red Hat would like to thank Wjjzhang (Tencent.com Inc.) and Li Qiang (360.cn Inc.) for reporting CVE-2017-2615.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for qemu-kvm-rhev is now available for Red Hat OpenStack Platform 8.0 (Liberty).\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-rhev packages provide the user-space component for running virtual machines that use KVM in environments managed by Red Hat products.\n\nSecurity Fix(es):\n\n* Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue. It could occur while copying VGA data via bitblt copy in backward mode. A privileged user inside a guest could use this flaw to crash the QEMU process resulting in DoS or potentially execute arbitrary code on the host with privileges of QEMU process on the host. (CVE-2017-2615)\n\n* Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process. (CVE-2017-2620)\n\nRed Hat would like to thank Wjjzhang (Tencent.com Inc.) and Li Qiang (360.cn Inc.) for reporting CVE-2017-2615.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2017:0330",
"url": "https://access.redhat.com/errata/RHSA-2017:0330"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "1418200",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1418200"
},
{
"category": "external",
"summary": "1420484",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1420484"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_0330.json"
}
],
"title": "Red Hat Security Advisory: qemu-kvm-rhev security update",
"tracking": {
"current_release_date": "2024-11-05T19:54:11+00:00",
"generator": {
"date": "2024-11-05T19:54:11+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.1.1"
}
},
"id": "RHSA-2017:0330",
"initial_release_date": "2017-02-27T23:12:41+00:00",
"revision_history": [
{
"date": "2017-02-27T23:12:41+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2017-02-27T23:12:41+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-05T19:54:11+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenStack Platform 8.0 (Liberty)",
"product": {
"name": "Red Hat OpenStack Platform 8.0 (Liberty)",
"product_id": "7Server-RH7-RHOS-8.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openstack:8::el7"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenStack Platform"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product": {
"name": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product_id": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-common-rhev@2.6.0-28.el7_3.6?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"product": {
"name": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"product_id": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev-debuginfo@2.6.0-28.el7_3.6?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product": {
"name": "qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product_id": "qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-img-rhev@2.6.0-28.el7_3.6?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product": {
"name": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product_id": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-tools-rhev@2.6.0-28.el7_3.6?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product_id": "qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev@2.6.0-28.el7_3.6?arch=x86_64\u0026epoch=10"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"product": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"product_id": "qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev@2.6.0-28.el7_3.6?arch=src\u0026epoch=10"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64 as a component of Red Hat OpenStack Platform 8.0 (Liberty)",
"product_id": "7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64"
},
"product_reference": "qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-8.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64 as a component of Red Hat OpenStack Platform 8.0 (Liberty)",
"product_id": "7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64"
},
"product_reference": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-8.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src as a component of Red Hat OpenStack Platform 8.0 (Liberty)",
"product_id": "7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src"
},
"product_reference": "qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"relates_to_product_reference": "7Server-RH7-RHOS-8.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64 as a component of Red Hat OpenStack Platform 8.0 (Liberty)",
"product_id": "7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64"
},
"product_reference": "qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-8.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64 as a component of Red Hat OpenStack Platform 8.0 (Liberty)",
"product_id": "7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64"
},
"product_reference": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-8.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64 as a component of Red Hat OpenStack Platform 8.0 (Liberty)",
"product_id": "7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64"
},
"product_reference": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-8.0"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Li Qiang"
],
"organization": "360.cn Inc."
},
{
"names": [
"Wjjzhang"
],
"organization": "Tencent.com Inc."
}
],
"cve": "CVE-2017-2615",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2017-01-25T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1418200"
}
],
"notes": [
{
"category": "description",
"text": "Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue. It could occur while copying VGA data via bitblt copy in backward mode. A privileged user inside a guest could use this flaw to crash the QEMU process resulting in DoS or potentially execute arbitrary code on the host with privileges of QEMU process on the host.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: display: cirrus: oob access while doing bitblt copy backward mode",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-2615"
},
{
"category": "external",
"summary": "RHBZ#1418200",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1418200"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-2615",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-2615"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-2615",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-2615"
}
],
"release_date": "2017-01-24T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-02-27T23:12:41+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:0330"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:A/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Qemu: display: cirrus: oob access while doing bitblt copy backward mode"
},
{
"cve": "CVE-2017-2620",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2017-02-09T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1420484"
}
],
"notes": [
{
"category": "description",
"text": "Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: display: cirrus: potential arbitrary code execution via cirrus_bitblt_cputovideo",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-2620"
},
{
"category": "external",
"summary": "RHBZ#1420484",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1420484"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-2620",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-2620"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-2620",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-2620"
},
{
"category": "external",
"summary": "https://xenbits.xen.org/xsa/advisory-209.html",
"url": "https://xenbits.xen.org/xsa/advisory-209.html"
}
],
"release_date": "2017-02-21T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-02-27T23:12:41+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:0330"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:A/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"7Server-RH7-RHOS-8.0:qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-8.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Qemu: display: cirrus: potential arbitrary code execution via cirrus_bitblt_cputovideo"
}
]
}
rhsa-2017_0350
Vulnerability from csaf_redhat
Published
2017-03-01 07:59
Modified
2024-11-05 19:54
Summary
Red Hat Security Advisory: qemu-kvm-rhev security and bug fix update
Notes
Topic
An update for qemu-kvm-rhev is now available for RHEV 3.X Hypervisor and Agents for RHEL-7 and RHEV 4.X RHEV-H and Agents for RHEL-7.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-rhev packages provide the user-space component for running virtual machines that use KVM in environments managed by Red Hat products.
Security Fix(es):
* Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue. It could occur while copying VGA data via bitblt copy in backward mode. A privileged user inside a guest could use this flaw to crash the QEMU process resulting in DoS or potentially execute arbitrary code on the host with privileges of QEMU process on the host. (CVE-2017-2615)
* Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process. (CVE-2017-2620)
* An out-of-bounds read-access flaw was found in the QEMU emulator built with IP checksum routines. The flaw could occur when computing a TCP/UDP packet's checksum, because a QEMU function used the packet's payload length without checking against the data buffer's size. A user inside a guest could use this flaw to crash the QEMU process (denial of service). (CVE-2016-2857)
Red Hat would like to thank Wjjzhang (Tencent.com Inc.) and Li Qiang (360.cn Inc.) for reporting CVE-2017-2615 and Ling Liu (Qihoo 360 Inc.) for reporting CVE-2016-2857.
Bug Fix(es):
* Prior to this update, after migrating a guest virtual machine on the little-endian variant of IBM Power Systems and resetting the guest, the guest boot process failed with a "tcmalloc: large alloc" error message. This update fixes the bug, and the described problem no longer occurs. (BZ#1420456)
* The qemu-kvm-rhev package depends on the usbredir and libcacard packages. However, on the little-endian variant of IBM Power Systems, smartcard use is not supported and usbredir and libcacard are thus only available in the Optional channel. As a consequence, qemu-kvm-rhev was previously not installable on these systems if the Optional channel was not available for the user. This update removes usbredir and libcacard as dependencies of qemu-kvm-rhev on little-endian IBM Power Systems, and qemu-kvm-rhev can now be installed as expected in the described scenario. (BZ#1420428)
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for qemu-kvm-rhev is now available for RHEV 3.X Hypervisor and Agents for RHEL-7 and RHEV 4.X RHEV-H and Agents for RHEL-7.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-rhev packages provide the user-space component for running virtual machines that use KVM in environments managed by Red Hat products.\n\nSecurity Fix(es):\n\n* Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue. It could occur while copying VGA data via bitblt copy in backward mode. A privileged user inside a guest could use this flaw to crash the QEMU process resulting in DoS or potentially execute arbitrary code on the host with privileges of QEMU process on the host. (CVE-2017-2615)\n\n* Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process. (CVE-2017-2620)\n\n* An out-of-bounds read-access flaw was found in the QEMU emulator built with IP checksum routines. The flaw could occur when computing a TCP/UDP packet\u0027s checksum, because a QEMU function used the packet\u0027s payload length without checking against the data buffer\u0027s size. A user inside a guest could use this flaw to crash the QEMU process (denial of service). (CVE-2016-2857)\n\nRed Hat would like to thank Wjjzhang (Tencent.com Inc.) and Li Qiang (360.cn Inc.) for reporting CVE-2017-2615 and Ling Liu (Qihoo 360 Inc.) for reporting CVE-2016-2857.\n\nBug Fix(es):\n\n* Prior to this update, after migrating a guest virtual machine on the little-endian variant of IBM Power Systems and resetting the guest, the guest boot process failed with a \"tcmalloc: large alloc\" error message. This update fixes the bug, and the described problem no longer occurs. (BZ#1420456)\n\n* The qemu-kvm-rhev package depends on the usbredir and libcacard packages. However, on the little-endian variant of IBM Power Systems, smartcard use is not supported and usbredir and libcacard are thus only available in the Optional channel. As a consequence, qemu-kvm-rhev was previously not installable on these systems if the Optional channel was not available for the user. This update removes usbredir and libcacard as dependencies of qemu-kvm-rhev on little-endian IBM Power Systems, and qemu-kvm-rhev can now be installed as expected in the described scenario. (BZ#1420428)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2017:0350",
"url": "https://access.redhat.com/errata/RHSA-2017:0350"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "1296567",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1296567"
},
{
"category": "external",
"summary": "1418200",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1418200"
},
{
"category": "external",
"summary": "1420428",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1420428"
},
{
"category": "external",
"summary": "1420456",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1420456"
},
{
"category": "external",
"summary": "1420484",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1420484"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_0350.json"
}
],
"title": "Red Hat Security Advisory: qemu-kvm-rhev security and bug fix update",
"tracking": {
"current_release_date": "2024-11-05T19:54:43+00:00",
"generator": {
"date": "2024-11-05T19:54:43+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.1.1"
}
},
"id": "RHSA-2017:0350",
"initial_release_date": "2017-03-01T07:59:14+00:00",
"revision_history": [
{
"date": "2017-03-01T07:59:14+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2017-03-01T07:59:14+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-05T19:54:43+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "RHEV-H and VDSM for 7 Hosts",
"product": {
"name": "RHEV-H and VDSM for 7 Hosts",
"product_id": "7Server-RHEV-Agents-7",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:7::hypervisor"
}
}
},
{
"category": "product_name",
"name": "Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts",
"product": {
"name": "Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts",
"product_id": "7Server-RHEV-4-Agents-7",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:7::hypervisor"
}
}
}
],
"category": "product_family",
"name": "Red Hat Virtualization"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product": {
"name": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product_id": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-common-rhev@2.6.0-28.el7_3.6?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"product": {
"name": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"product_id": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev-debuginfo@2.6.0-28.el7_3.6?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product": {
"name": "qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product_id": "qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-img-rhev@2.6.0-28.el7_3.6?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product": {
"name": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product_id": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-tools-rhev@2.6.0-28.el7_3.6?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product_id": "qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev@2.6.0-28.el7_3.6?arch=x86_64\u0026epoch=10"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"product": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"product_id": "qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev@2.6.0-28.el7_3.6?arch=src\u0026epoch=10"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"product": {
"name": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"product_id": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-common-rhev@2.6.0-28.el7_3.6?arch=ppc64le\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.ppc64le",
"product": {
"name": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.ppc64le",
"product_id": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev-debuginfo@2.6.0-28.el7_3.6?arch=ppc64le\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-img-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"product": {
"name": "qemu-img-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"product_id": "qemu-img-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-img-rhev@2.6.0-28.el7_3.6?arch=ppc64le\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"product": {
"name": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"product_id": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-tools-rhev@2.6.0-28.el7_3.6?arch=ppc64le\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"product": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"product_id": "qemu-kvm-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev@2.6.0-28.el7_3.6?arch=ppc64le\u0026epoch=10"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-rhev-10:2.6.0-28.el7_3.6.ppc64le as a component of Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts",
"product_id": "7Server-RHEV-4-Agents-7:qemu-img-rhev-10:2.6.0-28.el7_3.6.ppc64le"
},
"product_reference": "qemu-img-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"relates_to_product_reference": "7Server-RHEV-4-Agents-7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64 as a component of Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts",
"product_id": "7Server-RHEV-4-Agents-7:qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64"
},
"product_reference": "qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"relates_to_product_reference": "7Server-RHEV-4-Agents-7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.ppc64le as a component of Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts",
"product_id": "7Server-RHEV-4-Agents-7:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.ppc64le"
},
"product_reference": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"relates_to_product_reference": "7Server-RHEV-4-Agents-7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64 as a component of Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts",
"product_id": "7Server-RHEV-4-Agents-7:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64"
},
"product_reference": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"relates_to_product_reference": "7Server-RHEV-4-Agents-7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.6.ppc64le as a component of Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts",
"product_id": "7Server-RHEV-4-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.ppc64le"
},
"product_reference": "qemu-kvm-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"relates_to_product_reference": "7Server-RHEV-4-Agents-7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src as a component of Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts",
"product_id": "7Server-RHEV-4-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src"
},
"product_reference": "qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"relates_to_product_reference": "7Server-RHEV-4-Agents-7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64 as a component of Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts",
"product_id": "7Server-RHEV-4-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64"
},
"product_reference": "qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"relates_to_product_reference": "7Server-RHEV-4-Agents-7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.ppc64le as a component of Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts",
"product_id": "7Server-RHEV-4-Agents-7:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.ppc64le"
},
"product_reference": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.ppc64le",
"relates_to_product_reference": "7Server-RHEV-4-Agents-7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64 as a component of Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts",
"product_id": "7Server-RHEV-4-Agents-7:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64"
},
"product_reference": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"relates_to_product_reference": "7Server-RHEV-4-Agents-7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.ppc64le as a component of Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts",
"product_id": "7Server-RHEV-4-Agents-7:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.ppc64le"
},
"product_reference": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"relates_to_product_reference": "7Server-RHEV-4-Agents-7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64 as a component of Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts",
"product_id": "7Server-RHEV-4-Agents-7:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64"
},
"product_reference": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64",
"relates_to_product_reference": "7Server-RHEV-4-Agents-7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-rhev-10:2.6.0-28.el7_3.6.ppc64le as a component of RHEV-H and VDSM for 7 Hosts",
"product_id": "7Server-RHEV-Agents-7:qemu-img-rhev-10:2.6.0-28.el7_3.6.ppc64le"
},
"product_reference": "qemu-img-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"relates_to_product_reference": "7Server-RHEV-Agents-7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64 as a component of RHEV-H and VDSM for 7 Hosts",
"product_id": "7Server-RHEV-Agents-7:qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64"
},
"product_reference": "qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"relates_to_product_reference": "7Server-RHEV-Agents-7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.ppc64le as a component of RHEV-H and VDSM for 7 Hosts",
"product_id": "7Server-RHEV-Agents-7:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.ppc64le"
},
"product_reference": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"relates_to_product_reference": "7Server-RHEV-Agents-7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64 as a component of RHEV-H and VDSM for 7 Hosts",
"product_id": "7Server-RHEV-Agents-7:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64"
},
"product_reference": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"relates_to_product_reference": "7Server-RHEV-Agents-7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.6.ppc64le as a component of RHEV-H and VDSM for 7 Hosts",
"product_id": "7Server-RHEV-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.ppc64le"
},
"product_reference": "qemu-kvm-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"relates_to_product_reference": "7Server-RHEV-Agents-7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src as a component of RHEV-H and VDSM for 7 Hosts",
"product_id": "7Server-RHEV-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src"
},
"product_reference": "qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"relates_to_product_reference": "7Server-RHEV-Agents-7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64 as a component of RHEV-H and VDSM for 7 Hosts",
"product_id": "7Server-RHEV-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64"
},
"product_reference": "qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"relates_to_product_reference": "7Server-RHEV-Agents-7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.ppc64le as a component of RHEV-H and VDSM for 7 Hosts",
"product_id": "7Server-RHEV-Agents-7:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.ppc64le"
},
"product_reference": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.ppc64le",
"relates_to_product_reference": "7Server-RHEV-Agents-7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64 as a component of RHEV-H and VDSM for 7 Hosts",
"product_id": "7Server-RHEV-Agents-7:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64"
},
"product_reference": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"relates_to_product_reference": "7Server-RHEV-Agents-7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.ppc64le as a component of RHEV-H and VDSM for 7 Hosts",
"product_id": "7Server-RHEV-Agents-7:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.ppc64le"
},
"product_reference": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"relates_to_product_reference": "7Server-RHEV-Agents-7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64 as a component of RHEV-H and VDSM for 7 Hosts",
"product_id": "7Server-RHEV-Agents-7:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64"
},
"product_reference": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64",
"relates_to_product_reference": "7Server-RHEV-Agents-7"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Ling Liu"
],
"organization": "Qihoo 360 Inc."
}
],
"cve": "CVE-2016-2857",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2016-01-07T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1296567"
}
],
"notes": [
{
"category": "description",
"text": "An out-of-bounds read-access flaw was found in the QEMU emulator built with IP checksum routines. The flaw could occur when computing a TCP/UDP packet\u0027s checksum, because a QEMU function used the packet\u0027s payload length without checking against the data buffer\u0027s size. A user inside a guest could use this flaw to crash the QEMU process (denial of service).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: net: out of bounds read in net_checksum_calculate()",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This has been rated as having Low security impact and is not currently\nplanned to be addressed in future updates. For additional information, refer\nto the Red Hat Enterprise Linux Life Cycle:\nhttps://access.redhat.com/support/policy/updates/errata/.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHEV-4-Agents-7:qemu-img-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-4-Agents-7:qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RHEV-4-Agents-7:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-4-Agents-7:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RHEV-4-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-4-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"7Server-RHEV-4-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RHEV-4-Agents-7:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-4-Agents-7:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RHEV-4-Agents-7:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-4-Agents-7:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RHEV-Agents-7:qemu-img-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-Agents-7:qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RHEV-Agents-7:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-Agents-7:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RHEV-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"7Server-RHEV-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RHEV-Agents-7:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-Agents-7:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RHEV-Agents-7:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-Agents-7:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-2857"
},
{
"category": "external",
"summary": "RHBZ#1296567",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1296567"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-2857",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-2857"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-2857",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2857"
}
],
"release_date": "2016-02-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-03-01T07:59:14+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"7Server-RHEV-4-Agents-7:qemu-img-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-4-Agents-7:qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RHEV-4-Agents-7:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-4-Agents-7:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RHEV-4-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-4-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"7Server-RHEV-4-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RHEV-4-Agents-7:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-4-Agents-7:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RHEV-4-Agents-7:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-4-Agents-7:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RHEV-Agents-7:qemu-img-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-Agents-7:qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RHEV-Agents-7:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-Agents-7:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RHEV-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"7Server-RHEV-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RHEV-Agents-7:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-Agents-7:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RHEV-Agents-7:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-Agents-7:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:0350"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:A/AC:M/Au:N/C:P/I:N/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:L",
"version": "3.0"
},
"products": [
"7Server-RHEV-4-Agents-7:qemu-img-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-4-Agents-7:qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RHEV-4-Agents-7:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-4-Agents-7:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RHEV-4-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-4-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"7Server-RHEV-4-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RHEV-4-Agents-7:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-4-Agents-7:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RHEV-4-Agents-7:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-4-Agents-7:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RHEV-Agents-7:qemu-img-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-Agents-7:qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RHEV-Agents-7:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-Agents-7:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RHEV-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"7Server-RHEV-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RHEV-Agents-7:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-Agents-7:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RHEV-Agents-7:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-Agents-7:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Qemu: net: out of bounds read in net_checksum_calculate()"
},
{
"acknowledgments": [
{
"names": [
"Li Qiang"
],
"organization": "360.cn Inc."
},
{
"names": [
"Wjjzhang"
],
"organization": "Tencent.com Inc."
}
],
"cve": "CVE-2017-2615",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2017-01-25T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1418200"
}
],
"notes": [
{
"category": "description",
"text": "Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue. It could occur while copying VGA data via bitblt copy in backward mode. A privileged user inside a guest could use this flaw to crash the QEMU process resulting in DoS or potentially execute arbitrary code on the host with privileges of QEMU process on the host.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: display: cirrus: oob access while doing bitblt copy backward mode",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHEV-4-Agents-7:qemu-img-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-4-Agents-7:qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RHEV-4-Agents-7:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-4-Agents-7:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RHEV-4-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-4-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"7Server-RHEV-4-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RHEV-4-Agents-7:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-4-Agents-7:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RHEV-4-Agents-7:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-4-Agents-7:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RHEV-Agents-7:qemu-img-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-Agents-7:qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RHEV-Agents-7:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-Agents-7:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RHEV-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"7Server-RHEV-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RHEV-Agents-7:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-Agents-7:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RHEV-Agents-7:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-Agents-7:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-2615"
},
{
"category": "external",
"summary": "RHBZ#1418200",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1418200"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-2615",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-2615"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-2615",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-2615"
}
],
"release_date": "2017-01-24T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-03-01T07:59:14+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"7Server-RHEV-4-Agents-7:qemu-img-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-4-Agents-7:qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RHEV-4-Agents-7:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-4-Agents-7:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RHEV-4-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-4-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"7Server-RHEV-4-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RHEV-4-Agents-7:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-4-Agents-7:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RHEV-4-Agents-7:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-4-Agents-7:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RHEV-Agents-7:qemu-img-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-Agents-7:qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RHEV-Agents-7:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-Agents-7:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RHEV-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"7Server-RHEV-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RHEV-Agents-7:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-Agents-7:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RHEV-Agents-7:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-Agents-7:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:0350"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:A/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"7Server-RHEV-4-Agents-7:qemu-img-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-4-Agents-7:qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RHEV-4-Agents-7:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-4-Agents-7:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RHEV-4-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-4-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"7Server-RHEV-4-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RHEV-4-Agents-7:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-4-Agents-7:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RHEV-4-Agents-7:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-4-Agents-7:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RHEV-Agents-7:qemu-img-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-Agents-7:qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RHEV-Agents-7:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-Agents-7:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RHEV-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"7Server-RHEV-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RHEV-Agents-7:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-Agents-7:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RHEV-Agents-7:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-Agents-7:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Qemu: display: cirrus: oob access while doing bitblt copy backward mode"
},
{
"cve": "CVE-2017-2620",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2017-02-09T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1420484"
}
],
"notes": [
{
"category": "description",
"text": "Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: display: cirrus: potential arbitrary code execution via cirrus_bitblt_cputovideo",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHEV-4-Agents-7:qemu-img-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-4-Agents-7:qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RHEV-4-Agents-7:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-4-Agents-7:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RHEV-4-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-4-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"7Server-RHEV-4-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RHEV-4-Agents-7:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-4-Agents-7:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RHEV-4-Agents-7:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-4-Agents-7:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RHEV-Agents-7:qemu-img-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-Agents-7:qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RHEV-Agents-7:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-Agents-7:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RHEV-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"7Server-RHEV-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RHEV-Agents-7:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-Agents-7:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RHEV-Agents-7:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-Agents-7:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-2620"
},
{
"category": "external",
"summary": "RHBZ#1420484",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1420484"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-2620",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-2620"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-2620",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-2620"
},
{
"category": "external",
"summary": "https://xenbits.xen.org/xsa/advisory-209.html",
"url": "https://xenbits.xen.org/xsa/advisory-209.html"
}
],
"release_date": "2017-02-21T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-03-01T07:59:14+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"7Server-RHEV-4-Agents-7:qemu-img-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-4-Agents-7:qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RHEV-4-Agents-7:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-4-Agents-7:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RHEV-4-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-4-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"7Server-RHEV-4-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RHEV-4-Agents-7:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-4-Agents-7:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RHEV-4-Agents-7:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-4-Agents-7:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RHEV-Agents-7:qemu-img-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-Agents-7:qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RHEV-Agents-7:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-Agents-7:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RHEV-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"7Server-RHEV-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RHEV-Agents-7:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-Agents-7:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RHEV-Agents-7:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-Agents-7:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:0350"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:A/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"7Server-RHEV-4-Agents-7:qemu-img-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-4-Agents-7:qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RHEV-4-Agents-7:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-4-Agents-7:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RHEV-4-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-4-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"7Server-RHEV-4-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RHEV-4-Agents-7:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-4-Agents-7:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RHEV-4-Agents-7:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-4-Agents-7:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RHEV-Agents-7:qemu-img-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-Agents-7:qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RHEV-Agents-7:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-Agents-7:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RHEV-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"7Server-RHEV-Agents-7:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RHEV-Agents-7:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-Agents-7:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RHEV-Agents-7:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.ppc64le",
"7Server-RHEV-Agents-7:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Qemu: display: cirrus: potential arbitrary code execution via cirrus_bitblt_cputovideo"
}
]
}
rhsa-2017_0334
Vulnerability from csaf_redhat
Published
2017-02-27 23:12
Modified
2024-11-05 19:54
Summary
Red Hat Security Advisory: qemu-kvm-rhev security update
Notes
Topic
An update for qemu-kvm-rhev is now available for Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-rhev packages provide the user-space component for running virtual machines that use KVM in environments managed by Red Hat products.
Security Fix(es):
* Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue. It could occur while copying VGA data via bitblt copy in backward mode. A privileged user inside a guest could use this flaw to crash the QEMU process resulting in DoS or potentially execute arbitrary code on the host with privileges of QEMU process on the host. (CVE-2017-2615)
* Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process. (CVE-2017-2620)
* An out-of-bounds read-access flaw was found in the QEMU emulator built with IP checksum routines. The flaw could occur when computing a TCP/UDP packet's checksum, because a QEMU function used the packet's payload length without checking against the data buffer's size. A user inside a guest could use this flaw to crash the QEMU process (denial of service). (CVE-2016-2857)
Red Hat would like to thank Wjjzhang (Tencent.com Inc.) and Li Qiang (360.cn Inc.) for reporting CVE-2017-2615 and Ling Liu (Qihoo 360 Inc.) for reporting CVE-2016-2857.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for qemu-kvm-rhev is now available for Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-rhev packages provide the user-space component for running virtual machines that use KVM in environments managed by Red Hat products.\n\nSecurity Fix(es):\n\n* Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue. It could occur while copying VGA data via bitblt copy in backward mode. A privileged user inside a guest could use this flaw to crash the QEMU process resulting in DoS or potentially execute arbitrary code on the host with privileges of QEMU process on the host. (CVE-2017-2615)\n\n* Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process. (CVE-2017-2620)\n\n* An out-of-bounds read-access flaw was found in the QEMU emulator built with IP checksum routines. The flaw could occur when computing a TCP/UDP packet\u0027s checksum, because a QEMU function used the packet\u0027s payload length without checking against the data buffer\u0027s size. A user inside a guest could use this flaw to crash the QEMU process (denial of service). (CVE-2016-2857)\n\nRed Hat would like to thank Wjjzhang (Tencent.com Inc.) and Li Qiang (360.cn Inc.) for reporting CVE-2017-2615 and Ling Liu (Qihoo 360 Inc.) for reporting CVE-2016-2857.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2017:0334",
"url": "https://access.redhat.com/errata/RHSA-2017:0334"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "1296567",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1296567"
},
{
"category": "external",
"summary": "1418200",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1418200"
},
{
"category": "external",
"summary": "1420484",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1420484"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_0334.json"
}
],
"title": "Red Hat Security Advisory: qemu-kvm-rhev security update",
"tracking": {
"current_release_date": "2024-11-05T19:54:32+00:00",
"generator": {
"date": "2024-11-05T19:54:32+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.1.1"
}
},
"id": "RHSA-2017:0334",
"initial_release_date": "2017-02-27T23:12:16+00:00",
"revision_history": [
{
"date": "2017-02-27T23:12:16+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2017-02-27T23:12:16+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-05T19:54:32+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6",
"product": {
"name": "Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6",
"product_id": "6Server-RH6-RHOS-5.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openstack:5::el6"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenStack Platform"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-kvm-rhev-2:0.12.1.2-2.491.el6_8.7.x86_64",
"product": {
"name": "qemu-kvm-rhev-2:0.12.1.2-2.491.el6_8.7.x86_64",
"product_id": "qemu-kvm-rhev-2:0.12.1.2-2.491.el6_8.7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev@0.12.1.2-2.491.el6_8.7?arch=x86_64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "qemu-img-rhev-2:0.12.1.2-2.491.el6_8.7.x86_64",
"product": {
"name": "qemu-img-rhev-2:0.12.1.2-2.491.el6_8.7.x86_64",
"product_id": "qemu-img-rhev-2:0.12.1.2-2.491.el6_8.7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-img-rhev@0.12.1.2-2.491.el6_8.7?arch=x86_64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.491.el6_8.7.x86_64",
"product": {
"name": "qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.491.el6_8.7.x86_64",
"product_id": "qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.491.el6_8.7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev-debuginfo@0.12.1.2-2.491.el6_8.7?arch=x86_64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-rhev-tools-2:0.12.1.2-2.491.el6_8.7.x86_64",
"product": {
"name": "qemu-kvm-rhev-tools-2:0.12.1.2-2.491.el6_8.7.x86_64",
"product_id": "qemu-kvm-rhev-tools-2:0.12.1.2-2.491.el6_8.7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev-tools@0.12.1.2-2.491.el6_8.7?arch=x86_64\u0026epoch=2"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-kvm-rhev-2:0.12.1.2-2.491.el6_8.7.src",
"product": {
"name": "qemu-kvm-rhev-2:0.12.1.2-2.491.el6_8.7.src",
"product_id": "qemu-kvm-rhev-2:0.12.1.2-2.491.el6_8.7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev@0.12.1.2-2.491.el6_8.7?arch=src\u0026epoch=2"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-rhev-2:0.12.1.2-2.491.el6_8.7.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6",
"product_id": "6Server-RH6-RHOS-5.0:qemu-img-rhev-2:0.12.1.2-2.491.el6_8.7.x86_64"
},
"product_reference": "qemu-img-rhev-2:0.12.1.2-2.491.el6_8.7.x86_64",
"relates_to_product_reference": "6Server-RH6-RHOS-5.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-2:0.12.1.2-2.491.el6_8.7.src as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6",
"product_id": "6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.491.el6_8.7.src"
},
"product_reference": "qemu-kvm-rhev-2:0.12.1.2-2.491.el6_8.7.src",
"relates_to_product_reference": "6Server-RH6-RHOS-5.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-2:0.12.1.2-2.491.el6_8.7.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6",
"product_id": "6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.491.el6_8.7.x86_64"
},
"product_reference": "qemu-kvm-rhev-2:0.12.1.2-2.491.el6_8.7.x86_64",
"relates_to_product_reference": "6Server-RH6-RHOS-5.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.491.el6_8.7.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6",
"product_id": "6Server-RH6-RHOS-5.0:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.491.el6_8.7.x86_64"
},
"product_reference": "qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.491.el6_8.7.x86_64",
"relates_to_product_reference": "6Server-RH6-RHOS-5.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-tools-2:0.12.1.2-2.491.el6_8.7.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6",
"product_id": "6Server-RH6-RHOS-5.0:qemu-kvm-rhev-tools-2:0.12.1.2-2.491.el6_8.7.x86_64"
},
"product_reference": "qemu-kvm-rhev-tools-2:0.12.1.2-2.491.el6_8.7.x86_64",
"relates_to_product_reference": "6Server-RH6-RHOS-5.0"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Ling Liu"
],
"organization": "Qihoo 360 Inc."
}
],
"cve": "CVE-2016-2857",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2016-01-07T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1296567"
}
],
"notes": [
{
"category": "description",
"text": "An out-of-bounds read-access flaw was found in the QEMU emulator built with IP checksum routines. The flaw could occur when computing a TCP/UDP packet\u0027s checksum, because a QEMU function used the packet\u0027s payload length without checking against the data buffer\u0027s size. A user inside a guest could use this flaw to crash the QEMU process (denial of service).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: net: out of bounds read in net_checksum_calculate()",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This has been rated as having Low security impact and is not currently\nplanned to be addressed in future updates. For additional information, refer\nto the Red Hat Enterprise Linux Life Cycle:\nhttps://access.redhat.com/support/policy/updates/errata/.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RH6-RHOS-5.0:qemu-img-rhev-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.491.el6_8.7.src",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-tools-2:0.12.1.2-2.491.el6_8.7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-2857"
},
{
"category": "external",
"summary": "RHBZ#1296567",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1296567"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-2857",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-2857"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-2857",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2857"
}
],
"release_date": "2016-02-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-02-27T23:12:16+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"6Server-RH6-RHOS-5.0:qemu-img-rhev-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.491.el6_8.7.src",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-tools-2:0.12.1.2-2.491.el6_8.7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:0334"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:A/AC:M/Au:N/C:P/I:N/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:L",
"version": "3.0"
},
"products": [
"6Server-RH6-RHOS-5.0:qemu-img-rhev-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.491.el6_8.7.src",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-tools-2:0.12.1.2-2.491.el6_8.7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Qemu: net: out of bounds read in net_checksum_calculate()"
},
{
"acknowledgments": [
{
"names": [
"Li Qiang"
],
"organization": "360.cn Inc."
},
{
"names": [
"Wjjzhang"
],
"organization": "Tencent.com Inc."
}
],
"cve": "CVE-2017-2615",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2017-01-25T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1418200"
}
],
"notes": [
{
"category": "description",
"text": "Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue. It could occur while copying VGA data via bitblt copy in backward mode. A privileged user inside a guest could use this flaw to crash the QEMU process resulting in DoS or potentially execute arbitrary code on the host with privileges of QEMU process on the host.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: display: cirrus: oob access while doing bitblt copy backward mode",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RH6-RHOS-5.0:qemu-img-rhev-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.491.el6_8.7.src",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-tools-2:0.12.1.2-2.491.el6_8.7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-2615"
},
{
"category": "external",
"summary": "RHBZ#1418200",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1418200"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-2615",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-2615"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-2615",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-2615"
}
],
"release_date": "2017-01-24T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-02-27T23:12:16+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"6Server-RH6-RHOS-5.0:qemu-img-rhev-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.491.el6_8.7.src",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-tools-2:0.12.1.2-2.491.el6_8.7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:0334"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:A/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"6Server-RH6-RHOS-5.0:qemu-img-rhev-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.491.el6_8.7.src",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-tools-2:0.12.1.2-2.491.el6_8.7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Qemu: display: cirrus: oob access while doing bitblt copy backward mode"
},
{
"cve": "CVE-2017-2620",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2017-02-09T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1420484"
}
],
"notes": [
{
"category": "description",
"text": "Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: display: cirrus: potential arbitrary code execution via cirrus_bitblt_cputovideo",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RH6-RHOS-5.0:qemu-img-rhev-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.491.el6_8.7.src",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-tools-2:0.12.1.2-2.491.el6_8.7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-2620"
},
{
"category": "external",
"summary": "RHBZ#1420484",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1420484"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-2620",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-2620"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-2620",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-2620"
},
{
"category": "external",
"summary": "https://xenbits.xen.org/xsa/advisory-209.html",
"url": "https://xenbits.xen.org/xsa/advisory-209.html"
}
],
"release_date": "2017-02-21T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-02-27T23:12:16+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"6Server-RH6-RHOS-5.0:qemu-img-rhev-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.491.el6_8.7.src",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-tools-2:0.12.1.2-2.491.el6_8.7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:0334"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:A/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"6Server-RH6-RHOS-5.0:qemu-img-rhev-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.491.el6_8.7.src",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6Server-RH6-RHOS-5.0:qemu-kvm-rhev-tools-2:0.12.1.2-2.491.el6_8.7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Qemu: display: cirrus: potential arbitrary code execution via cirrus_bitblt_cputovideo"
}
]
}
rhsa-2017_0352
Vulnerability from csaf_redhat
Published
2017-03-01 09:40
Modified
2024-11-05 19:54
Summary
Red Hat Security Advisory: qemu-kvm security update
Notes
Topic
An update for qemu-kvm is now available for Red Hat Enterprise Linux 6.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM.
Security Fix(es):
* Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process. (CVE-2017-2620)
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for qemu-kvm is now available for Red Hat Enterprise Linux 6.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM.\n\nSecurity Fix(es):\n\n* Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process. (CVE-2017-2620)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2017:0352",
"url": "https://access.redhat.com/errata/RHSA-2017:0352"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "1420484",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1420484"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_0352.json"
}
],
"title": "Red Hat Security Advisory: qemu-kvm security update",
"tracking": {
"current_release_date": "2024-11-05T19:54:48+00:00",
"generator": {
"date": "2024-11-05T19:54:48+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.1.1"
}
},
"id": "RHSA-2017:0352",
"initial_release_date": "2017-03-01T09:40:28+00:00",
"revision_history": [
{
"date": "2017-03-01T09:40:28+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2017-03-01T09:40:28+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-05T19:54:48+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Desktop (v. 6)",
"product": {
"name": "Red Hat Enterprise Linux Desktop (v. 6)",
"product_id": "6Client-6.8.z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:6::client"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux HPC Node (v. 6)",
"product": {
"name": "Red Hat Enterprise Linux HPC Node (v. 6)",
"product_id": "6ComputeNode-6.8.z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:6::computenode"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Server (v. 6)",
"product": {
"name": "Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-6.8.z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:6::server"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Workstation (v. 6)",
"product": {
"name": "Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-6.8.z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:6::workstation"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-img-2:0.12.1.2-2.491.el6_8.7.x86_64",
"product": {
"name": "qemu-img-2:0.12.1.2-2.491.el6_8.7.x86_64",
"product_id": "qemu-img-2:0.12.1.2-2.491.el6_8.7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-img@0.12.1.2-2.491.el6_8.7?arch=x86_64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-debuginfo-2:0.12.1.2-2.491.el6_8.7.x86_64",
"product": {
"name": "qemu-kvm-debuginfo-2:0.12.1.2-2.491.el6_8.7.x86_64",
"product_id": "qemu-kvm-debuginfo-2:0.12.1.2-2.491.el6_8.7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-debuginfo@0.12.1.2-2.491.el6_8.7?arch=x86_64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "qemu-guest-agent-2:0.12.1.2-2.491.el6_8.7.x86_64",
"product": {
"name": "qemu-guest-agent-2:0.12.1.2-2.491.el6_8.7.x86_64",
"product_id": "qemu-guest-agent-2:0.12.1.2-2.491.el6_8.7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-guest-agent@0.12.1.2-2.491.el6_8.7?arch=x86_64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-tools-2:0.12.1.2-2.491.el6_8.7.x86_64",
"product": {
"name": "qemu-kvm-tools-2:0.12.1.2-2.491.el6_8.7.x86_64",
"product_id": "qemu-kvm-tools-2:0.12.1.2-2.491.el6_8.7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-tools@0.12.1.2-2.491.el6_8.7?arch=x86_64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-2:0.12.1.2-2.491.el6_8.7.x86_64",
"product": {
"name": "qemu-kvm-2:0.12.1.2-2.491.el6_8.7.x86_64",
"product_id": "qemu-kvm-2:0.12.1.2-2.491.el6_8.7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm@0.12.1.2-2.491.el6_8.7?arch=x86_64\u0026epoch=2"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-kvm-debuginfo-2:0.12.1.2-2.491.el6_8.7.i686",
"product": {
"name": "qemu-kvm-debuginfo-2:0.12.1.2-2.491.el6_8.7.i686",
"product_id": "qemu-kvm-debuginfo-2:0.12.1.2-2.491.el6_8.7.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-debuginfo@0.12.1.2-2.491.el6_8.7?arch=i686\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "qemu-guest-agent-2:0.12.1.2-2.491.el6_8.7.i686",
"product": {
"name": "qemu-guest-agent-2:0.12.1.2-2.491.el6_8.7.i686",
"product_id": "qemu-guest-agent-2:0.12.1.2-2.491.el6_8.7.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-guest-agent@0.12.1.2-2.491.el6_8.7?arch=i686\u0026epoch=2"
}
}
}
],
"category": "architecture",
"name": "i686"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-kvm-2:0.12.1.2-2.491.el6_8.7.src",
"product": {
"name": "qemu-kvm-2:0.12.1.2-2.491.el6_8.7.src",
"product_id": "qemu-kvm-2:0.12.1.2-2.491.el6_8.7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm@0.12.1.2-2.491.el6_8.7?arch=src\u0026epoch=2"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-kvm-debuginfo-2:0.12.1.2-2.491.el6_8.7.ppc64",
"product": {
"name": "qemu-kvm-debuginfo-2:0.12.1.2-2.491.el6_8.7.ppc64",
"product_id": "qemu-kvm-debuginfo-2:0.12.1.2-2.491.el6_8.7.ppc64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-debuginfo@0.12.1.2-2.491.el6_8.7?arch=ppc64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "qemu-guest-agent-2:0.12.1.2-2.491.el6_8.7.ppc64",
"product": {
"name": "qemu-guest-agent-2:0.12.1.2-2.491.el6_8.7.ppc64",
"product_id": "qemu-guest-agent-2:0.12.1.2-2.491.el6_8.7.ppc64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-guest-agent@0.12.1.2-2.491.el6_8.7?arch=ppc64\u0026epoch=2"
}
}
}
],
"category": "architecture",
"name": "ppc64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-guest-agent-2:0.12.1.2-2.491.el6_8.7.i686 as a component of Red Hat Enterprise Linux Desktop (v. 6)",
"product_id": "6Client-6.8.z:qemu-guest-agent-2:0.12.1.2-2.491.el6_8.7.i686"
},
"product_reference": "qemu-guest-agent-2:0.12.1.2-2.491.el6_8.7.i686",
"relates_to_product_reference": "6Client-6.8.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-guest-agent-2:0.12.1.2-2.491.el6_8.7.ppc64 as a component of Red Hat Enterprise Linux Desktop (v. 6)",
"product_id": "6Client-6.8.z:qemu-guest-agent-2:0.12.1.2-2.491.el6_8.7.ppc64"
},
"product_reference": "qemu-guest-agent-2:0.12.1.2-2.491.el6_8.7.ppc64",
"relates_to_product_reference": "6Client-6.8.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-guest-agent-2:0.12.1.2-2.491.el6_8.7.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 6)",
"product_id": "6Client-6.8.z:qemu-guest-agent-2:0.12.1.2-2.491.el6_8.7.x86_64"
},
"product_reference": "qemu-guest-agent-2:0.12.1.2-2.491.el6_8.7.x86_64",
"relates_to_product_reference": "6Client-6.8.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-2:0.12.1.2-2.491.el6_8.7.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 6)",
"product_id": "6Client-6.8.z:qemu-img-2:0.12.1.2-2.491.el6_8.7.x86_64"
},
"product_reference": "qemu-img-2:0.12.1.2-2.491.el6_8.7.x86_64",
"relates_to_product_reference": "6Client-6.8.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-2:0.12.1.2-2.491.el6_8.7.src as a component of Red Hat Enterprise Linux Desktop (v. 6)",
"product_id": "6Client-6.8.z:qemu-kvm-2:0.12.1.2-2.491.el6_8.7.src"
},
"product_reference": "qemu-kvm-2:0.12.1.2-2.491.el6_8.7.src",
"relates_to_product_reference": "6Client-6.8.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-2:0.12.1.2-2.491.el6_8.7.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 6)",
"product_id": "6Client-6.8.z:qemu-kvm-2:0.12.1.2-2.491.el6_8.7.x86_64"
},
"product_reference": "qemu-kvm-2:0.12.1.2-2.491.el6_8.7.x86_64",
"relates_to_product_reference": "6Client-6.8.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-2:0.12.1.2-2.491.el6_8.7.i686 as a component of Red Hat Enterprise Linux Desktop (v. 6)",
"product_id": "6Client-6.8.z:qemu-kvm-debuginfo-2:0.12.1.2-2.491.el6_8.7.i686"
},
"product_reference": "qemu-kvm-debuginfo-2:0.12.1.2-2.491.el6_8.7.i686",
"relates_to_product_reference": "6Client-6.8.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-2:0.12.1.2-2.491.el6_8.7.ppc64 as a component of Red Hat Enterprise Linux Desktop (v. 6)",
"product_id": "6Client-6.8.z:qemu-kvm-debuginfo-2:0.12.1.2-2.491.el6_8.7.ppc64"
},
"product_reference": "qemu-kvm-debuginfo-2:0.12.1.2-2.491.el6_8.7.ppc64",
"relates_to_product_reference": "6Client-6.8.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-2:0.12.1.2-2.491.el6_8.7.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 6)",
"product_id": "6Client-6.8.z:qemu-kvm-debuginfo-2:0.12.1.2-2.491.el6_8.7.x86_64"
},
"product_reference": "qemu-kvm-debuginfo-2:0.12.1.2-2.491.el6_8.7.x86_64",
"relates_to_product_reference": "6Client-6.8.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-tools-2:0.12.1.2-2.491.el6_8.7.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 6)",
"product_id": "6Client-6.8.z:qemu-kvm-tools-2:0.12.1.2-2.491.el6_8.7.x86_64"
},
"product_reference": "qemu-kvm-tools-2:0.12.1.2-2.491.el6_8.7.x86_64",
"relates_to_product_reference": "6Client-6.8.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-guest-agent-2:0.12.1.2-2.491.el6_8.7.i686 as a component of Red Hat Enterprise Linux HPC Node (v. 6)",
"product_id": "6ComputeNode-6.8.z:qemu-guest-agent-2:0.12.1.2-2.491.el6_8.7.i686"
},
"product_reference": "qemu-guest-agent-2:0.12.1.2-2.491.el6_8.7.i686",
"relates_to_product_reference": "6ComputeNode-6.8.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-guest-agent-2:0.12.1.2-2.491.el6_8.7.ppc64 as a component of Red Hat Enterprise Linux HPC Node (v. 6)",
"product_id": "6ComputeNode-6.8.z:qemu-guest-agent-2:0.12.1.2-2.491.el6_8.7.ppc64"
},
"product_reference": "qemu-guest-agent-2:0.12.1.2-2.491.el6_8.7.ppc64",
"relates_to_product_reference": "6ComputeNode-6.8.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-guest-agent-2:0.12.1.2-2.491.el6_8.7.x86_64 as a component of Red Hat Enterprise Linux HPC Node (v. 6)",
"product_id": "6ComputeNode-6.8.z:qemu-guest-agent-2:0.12.1.2-2.491.el6_8.7.x86_64"
},
"product_reference": "qemu-guest-agent-2:0.12.1.2-2.491.el6_8.7.x86_64",
"relates_to_product_reference": "6ComputeNode-6.8.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-2:0.12.1.2-2.491.el6_8.7.x86_64 as a component of Red Hat Enterprise Linux HPC Node (v. 6)",
"product_id": "6ComputeNode-6.8.z:qemu-img-2:0.12.1.2-2.491.el6_8.7.x86_64"
},
"product_reference": "qemu-img-2:0.12.1.2-2.491.el6_8.7.x86_64",
"relates_to_product_reference": "6ComputeNode-6.8.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-2:0.12.1.2-2.491.el6_8.7.src as a component of Red Hat Enterprise Linux HPC Node (v. 6)",
"product_id": "6ComputeNode-6.8.z:qemu-kvm-2:0.12.1.2-2.491.el6_8.7.src"
},
"product_reference": "qemu-kvm-2:0.12.1.2-2.491.el6_8.7.src",
"relates_to_product_reference": "6ComputeNode-6.8.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-2:0.12.1.2-2.491.el6_8.7.x86_64 as a component of Red Hat Enterprise Linux HPC Node (v. 6)",
"product_id": "6ComputeNode-6.8.z:qemu-kvm-2:0.12.1.2-2.491.el6_8.7.x86_64"
},
"product_reference": "qemu-kvm-2:0.12.1.2-2.491.el6_8.7.x86_64",
"relates_to_product_reference": "6ComputeNode-6.8.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-2:0.12.1.2-2.491.el6_8.7.i686 as a component of Red Hat Enterprise Linux HPC Node (v. 6)",
"product_id": "6ComputeNode-6.8.z:qemu-kvm-debuginfo-2:0.12.1.2-2.491.el6_8.7.i686"
},
"product_reference": "qemu-kvm-debuginfo-2:0.12.1.2-2.491.el6_8.7.i686",
"relates_to_product_reference": "6ComputeNode-6.8.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-2:0.12.1.2-2.491.el6_8.7.ppc64 as a component of Red Hat Enterprise Linux HPC Node (v. 6)",
"product_id": "6ComputeNode-6.8.z:qemu-kvm-debuginfo-2:0.12.1.2-2.491.el6_8.7.ppc64"
},
"product_reference": "qemu-kvm-debuginfo-2:0.12.1.2-2.491.el6_8.7.ppc64",
"relates_to_product_reference": "6ComputeNode-6.8.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-2:0.12.1.2-2.491.el6_8.7.x86_64 as a component of Red Hat Enterprise Linux HPC Node (v. 6)",
"product_id": "6ComputeNode-6.8.z:qemu-kvm-debuginfo-2:0.12.1.2-2.491.el6_8.7.x86_64"
},
"product_reference": "qemu-kvm-debuginfo-2:0.12.1.2-2.491.el6_8.7.x86_64",
"relates_to_product_reference": "6ComputeNode-6.8.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-tools-2:0.12.1.2-2.491.el6_8.7.x86_64 as a component of Red Hat Enterprise Linux HPC Node (v. 6)",
"product_id": "6ComputeNode-6.8.z:qemu-kvm-tools-2:0.12.1.2-2.491.el6_8.7.x86_64"
},
"product_reference": "qemu-kvm-tools-2:0.12.1.2-2.491.el6_8.7.x86_64",
"relates_to_product_reference": "6ComputeNode-6.8.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-guest-agent-2:0.12.1.2-2.491.el6_8.7.i686 as a component of Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-6.8.z:qemu-guest-agent-2:0.12.1.2-2.491.el6_8.7.i686"
},
"product_reference": "qemu-guest-agent-2:0.12.1.2-2.491.el6_8.7.i686",
"relates_to_product_reference": "6Server-6.8.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-guest-agent-2:0.12.1.2-2.491.el6_8.7.ppc64 as a component of Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-6.8.z:qemu-guest-agent-2:0.12.1.2-2.491.el6_8.7.ppc64"
},
"product_reference": "qemu-guest-agent-2:0.12.1.2-2.491.el6_8.7.ppc64",
"relates_to_product_reference": "6Server-6.8.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-guest-agent-2:0.12.1.2-2.491.el6_8.7.x86_64 as a component of Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-6.8.z:qemu-guest-agent-2:0.12.1.2-2.491.el6_8.7.x86_64"
},
"product_reference": "qemu-guest-agent-2:0.12.1.2-2.491.el6_8.7.x86_64",
"relates_to_product_reference": "6Server-6.8.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-2:0.12.1.2-2.491.el6_8.7.x86_64 as a component of Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-6.8.z:qemu-img-2:0.12.1.2-2.491.el6_8.7.x86_64"
},
"product_reference": "qemu-img-2:0.12.1.2-2.491.el6_8.7.x86_64",
"relates_to_product_reference": "6Server-6.8.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-2:0.12.1.2-2.491.el6_8.7.src as a component of Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-6.8.z:qemu-kvm-2:0.12.1.2-2.491.el6_8.7.src"
},
"product_reference": "qemu-kvm-2:0.12.1.2-2.491.el6_8.7.src",
"relates_to_product_reference": "6Server-6.8.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-2:0.12.1.2-2.491.el6_8.7.x86_64 as a component of Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-6.8.z:qemu-kvm-2:0.12.1.2-2.491.el6_8.7.x86_64"
},
"product_reference": "qemu-kvm-2:0.12.1.2-2.491.el6_8.7.x86_64",
"relates_to_product_reference": "6Server-6.8.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-2:0.12.1.2-2.491.el6_8.7.i686 as a component of Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-6.8.z:qemu-kvm-debuginfo-2:0.12.1.2-2.491.el6_8.7.i686"
},
"product_reference": "qemu-kvm-debuginfo-2:0.12.1.2-2.491.el6_8.7.i686",
"relates_to_product_reference": "6Server-6.8.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-2:0.12.1.2-2.491.el6_8.7.ppc64 as a component of Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-6.8.z:qemu-kvm-debuginfo-2:0.12.1.2-2.491.el6_8.7.ppc64"
},
"product_reference": "qemu-kvm-debuginfo-2:0.12.1.2-2.491.el6_8.7.ppc64",
"relates_to_product_reference": "6Server-6.8.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-2:0.12.1.2-2.491.el6_8.7.x86_64 as a component of Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-6.8.z:qemu-kvm-debuginfo-2:0.12.1.2-2.491.el6_8.7.x86_64"
},
"product_reference": "qemu-kvm-debuginfo-2:0.12.1.2-2.491.el6_8.7.x86_64",
"relates_to_product_reference": "6Server-6.8.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-tools-2:0.12.1.2-2.491.el6_8.7.x86_64 as a component of Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-6.8.z:qemu-kvm-tools-2:0.12.1.2-2.491.el6_8.7.x86_64"
},
"product_reference": "qemu-kvm-tools-2:0.12.1.2-2.491.el6_8.7.x86_64",
"relates_to_product_reference": "6Server-6.8.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-guest-agent-2:0.12.1.2-2.491.el6_8.7.i686 as a component of Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-6.8.z:qemu-guest-agent-2:0.12.1.2-2.491.el6_8.7.i686"
},
"product_reference": "qemu-guest-agent-2:0.12.1.2-2.491.el6_8.7.i686",
"relates_to_product_reference": "6Workstation-6.8.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-guest-agent-2:0.12.1.2-2.491.el6_8.7.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-6.8.z:qemu-guest-agent-2:0.12.1.2-2.491.el6_8.7.ppc64"
},
"product_reference": "qemu-guest-agent-2:0.12.1.2-2.491.el6_8.7.ppc64",
"relates_to_product_reference": "6Workstation-6.8.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-guest-agent-2:0.12.1.2-2.491.el6_8.7.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-6.8.z:qemu-guest-agent-2:0.12.1.2-2.491.el6_8.7.x86_64"
},
"product_reference": "qemu-guest-agent-2:0.12.1.2-2.491.el6_8.7.x86_64",
"relates_to_product_reference": "6Workstation-6.8.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-2:0.12.1.2-2.491.el6_8.7.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-6.8.z:qemu-img-2:0.12.1.2-2.491.el6_8.7.x86_64"
},
"product_reference": "qemu-img-2:0.12.1.2-2.491.el6_8.7.x86_64",
"relates_to_product_reference": "6Workstation-6.8.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-2:0.12.1.2-2.491.el6_8.7.src as a component of Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-6.8.z:qemu-kvm-2:0.12.1.2-2.491.el6_8.7.src"
},
"product_reference": "qemu-kvm-2:0.12.1.2-2.491.el6_8.7.src",
"relates_to_product_reference": "6Workstation-6.8.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-2:0.12.1.2-2.491.el6_8.7.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-6.8.z:qemu-kvm-2:0.12.1.2-2.491.el6_8.7.x86_64"
},
"product_reference": "qemu-kvm-2:0.12.1.2-2.491.el6_8.7.x86_64",
"relates_to_product_reference": "6Workstation-6.8.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-2:0.12.1.2-2.491.el6_8.7.i686 as a component of Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-6.8.z:qemu-kvm-debuginfo-2:0.12.1.2-2.491.el6_8.7.i686"
},
"product_reference": "qemu-kvm-debuginfo-2:0.12.1.2-2.491.el6_8.7.i686",
"relates_to_product_reference": "6Workstation-6.8.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-2:0.12.1.2-2.491.el6_8.7.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-6.8.z:qemu-kvm-debuginfo-2:0.12.1.2-2.491.el6_8.7.ppc64"
},
"product_reference": "qemu-kvm-debuginfo-2:0.12.1.2-2.491.el6_8.7.ppc64",
"relates_to_product_reference": "6Workstation-6.8.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-debuginfo-2:0.12.1.2-2.491.el6_8.7.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-6.8.z:qemu-kvm-debuginfo-2:0.12.1.2-2.491.el6_8.7.x86_64"
},
"product_reference": "qemu-kvm-debuginfo-2:0.12.1.2-2.491.el6_8.7.x86_64",
"relates_to_product_reference": "6Workstation-6.8.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-tools-2:0.12.1.2-2.491.el6_8.7.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-6.8.z:qemu-kvm-tools-2:0.12.1.2-2.491.el6_8.7.x86_64"
},
"product_reference": "qemu-kvm-tools-2:0.12.1.2-2.491.el6_8.7.x86_64",
"relates_to_product_reference": "6Workstation-6.8.z"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2017-2620",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2017-02-09T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1420484"
}
],
"notes": [
{
"category": "description",
"text": "Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: display: cirrus: potential arbitrary code execution via cirrus_bitblt_cputovideo",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Client-6.8.z:qemu-guest-agent-2:0.12.1.2-2.491.el6_8.7.i686",
"6Client-6.8.z:qemu-guest-agent-2:0.12.1.2-2.491.el6_8.7.ppc64",
"6Client-6.8.z:qemu-guest-agent-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6Client-6.8.z:qemu-img-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6Client-6.8.z:qemu-kvm-2:0.12.1.2-2.491.el6_8.7.src",
"6Client-6.8.z:qemu-kvm-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6Client-6.8.z:qemu-kvm-debuginfo-2:0.12.1.2-2.491.el6_8.7.i686",
"6Client-6.8.z:qemu-kvm-debuginfo-2:0.12.1.2-2.491.el6_8.7.ppc64",
"6Client-6.8.z:qemu-kvm-debuginfo-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6Client-6.8.z:qemu-kvm-tools-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6ComputeNode-6.8.z:qemu-guest-agent-2:0.12.1.2-2.491.el6_8.7.i686",
"6ComputeNode-6.8.z:qemu-guest-agent-2:0.12.1.2-2.491.el6_8.7.ppc64",
"6ComputeNode-6.8.z:qemu-guest-agent-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6ComputeNode-6.8.z:qemu-img-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6ComputeNode-6.8.z:qemu-kvm-2:0.12.1.2-2.491.el6_8.7.src",
"6ComputeNode-6.8.z:qemu-kvm-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6ComputeNode-6.8.z:qemu-kvm-debuginfo-2:0.12.1.2-2.491.el6_8.7.i686",
"6ComputeNode-6.8.z:qemu-kvm-debuginfo-2:0.12.1.2-2.491.el6_8.7.ppc64",
"6ComputeNode-6.8.z:qemu-kvm-debuginfo-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6ComputeNode-6.8.z:qemu-kvm-tools-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6Server-6.8.z:qemu-guest-agent-2:0.12.1.2-2.491.el6_8.7.i686",
"6Server-6.8.z:qemu-guest-agent-2:0.12.1.2-2.491.el6_8.7.ppc64",
"6Server-6.8.z:qemu-guest-agent-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6Server-6.8.z:qemu-img-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6Server-6.8.z:qemu-kvm-2:0.12.1.2-2.491.el6_8.7.src",
"6Server-6.8.z:qemu-kvm-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6Server-6.8.z:qemu-kvm-debuginfo-2:0.12.1.2-2.491.el6_8.7.i686",
"6Server-6.8.z:qemu-kvm-debuginfo-2:0.12.1.2-2.491.el6_8.7.ppc64",
"6Server-6.8.z:qemu-kvm-debuginfo-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6Server-6.8.z:qemu-kvm-tools-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6Workstation-6.8.z:qemu-guest-agent-2:0.12.1.2-2.491.el6_8.7.i686",
"6Workstation-6.8.z:qemu-guest-agent-2:0.12.1.2-2.491.el6_8.7.ppc64",
"6Workstation-6.8.z:qemu-guest-agent-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6Workstation-6.8.z:qemu-img-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6Workstation-6.8.z:qemu-kvm-2:0.12.1.2-2.491.el6_8.7.src",
"6Workstation-6.8.z:qemu-kvm-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6Workstation-6.8.z:qemu-kvm-debuginfo-2:0.12.1.2-2.491.el6_8.7.i686",
"6Workstation-6.8.z:qemu-kvm-debuginfo-2:0.12.1.2-2.491.el6_8.7.ppc64",
"6Workstation-6.8.z:qemu-kvm-debuginfo-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6Workstation-6.8.z:qemu-kvm-tools-2:0.12.1.2-2.491.el6_8.7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-2620"
},
{
"category": "external",
"summary": "RHBZ#1420484",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1420484"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-2620",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-2620"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-2620",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-2620"
},
{
"category": "external",
"summary": "https://xenbits.xen.org/xsa/advisory-209.html",
"url": "https://xenbits.xen.org/xsa/advisory-209.html"
}
],
"release_date": "2017-02-21T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-03-01T09:40:28+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"6Client-6.8.z:qemu-guest-agent-2:0.12.1.2-2.491.el6_8.7.i686",
"6Client-6.8.z:qemu-guest-agent-2:0.12.1.2-2.491.el6_8.7.ppc64",
"6Client-6.8.z:qemu-guest-agent-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6Client-6.8.z:qemu-img-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6Client-6.8.z:qemu-kvm-2:0.12.1.2-2.491.el6_8.7.src",
"6Client-6.8.z:qemu-kvm-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6Client-6.8.z:qemu-kvm-debuginfo-2:0.12.1.2-2.491.el6_8.7.i686",
"6Client-6.8.z:qemu-kvm-debuginfo-2:0.12.1.2-2.491.el6_8.7.ppc64",
"6Client-6.8.z:qemu-kvm-debuginfo-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6Client-6.8.z:qemu-kvm-tools-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6ComputeNode-6.8.z:qemu-guest-agent-2:0.12.1.2-2.491.el6_8.7.i686",
"6ComputeNode-6.8.z:qemu-guest-agent-2:0.12.1.2-2.491.el6_8.7.ppc64",
"6ComputeNode-6.8.z:qemu-guest-agent-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6ComputeNode-6.8.z:qemu-img-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6ComputeNode-6.8.z:qemu-kvm-2:0.12.1.2-2.491.el6_8.7.src",
"6ComputeNode-6.8.z:qemu-kvm-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6ComputeNode-6.8.z:qemu-kvm-debuginfo-2:0.12.1.2-2.491.el6_8.7.i686",
"6ComputeNode-6.8.z:qemu-kvm-debuginfo-2:0.12.1.2-2.491.el6_8.7.ppc64",
"6ComputeNode-6.8.z:qemu-kvm-debuginfo-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6ComputeNode-6.8.z:qemu-kvm-tools-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6Server-6.8.z:qemu-guest-agent-2:0.12.1.2-2.491.el6_8.7.i686",
"6Server-6.8.z:qemu-guest-agent-2:0.12.1.2-2.491.el6_8.7.ppc64",
"6Server-6.8.z:qemu-guest-agent-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6Server-6.8.z:qemu-img-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6Server-6.8.z:qemu-kvm-2:0.12.1.2-2.491.el6_8.7.src",
"6Server-6.8.z:qemu-kvm-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6Server-6.8.z:qemu-kvm-debuginfo-2:0.12.1.2-2.491.el6_8.7.i686",
"6Server-6.8.z:qemu-kvm-debuginfo-2:0.12.1.2-2.491.el6_8.7.ppc64",
"6Server-6.8.z:qemu-kvm-debuginfo-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6Server-6.8.z:qemu-kvm-tools-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6Workstation-6.8.z:qemu-guest-agent-2:0.12.1.2-2.491.el6_8.7.i686",
"6Workstation-6.8.z:qemu-guest-agent-2:0.12.1.2-2.491.el6_8.7.ppc64",
"6Workstation-6.8.z:qemu-guest-agent-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6Workstation-6.8.z:qemu-img-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6Workstation-6.8.z:qemu-kvm-2:0.12.1.2-2.491.el6_8.7.src",
"6Workstation-6.8.z:qemu-kvm-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6Workstation-6.8.z:qemu-kvm-debuginfo-2:0.12.1.2-2.491.el6_8.7.i686",
"6Workstation-6.8.z:qemu-kvm-debuginfo-2:0.12.1.2-2.491.el6_8.7.ppc64",
"6Workstation-6.8.z:qemu-kvm-debuginfo-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6Workstation-6.8.z:qemu-kvm-tools-2:0.12.1.2-2.491.el6_8.7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:0352"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:A/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"6Client-6.8.z:qemu-guest-agent-2:0.12.1.2-2.491.el6_8.7.i686",
"6Client-6.8.z:qemu-guest-agent-2:0.12.1.2-2.491.el6_8.7.ppc64",
"6Client-6.8.z:qemu-guest-agent-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6Client-6.8.z:qemu-img-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6Client-6.8.z:qemu-kvm-2:0.12.1.2-2.491.el6_8.7.src",
"6Client-6.8.z:qemu-kvm-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6Client-6.8.z:qemu-kvm-debuginfo-2:0.12.1.2-2.491.el6_8.7.i686",
"6Client-6.8.z:qemu-kvm-debuginfo-2:0.12.1.2-2.491.el6_8.7.ppc64",
"6Client-6.8.z:qemu-kvm-debuginfo-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6Client-6.8.z:qemu-kvm-tools-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6ComputeNode-6.8.z:qemu-guest-agent-2:0.12.1.2-2.491.el6_8.7.i686",
"6ComputeNode-6.8.z:qemu-guest-agent-2:0.12.1.2-2.491.el6_8.7.ppc64",
"6ComputeNode-6.8.z:qemu-guest-agent-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6ComputeNode-6.8.z:qemu-img-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6ComputeNode-6.8.z:qemu-kvm-2:0.12.1.2-2.491.el6_8.7.src",
"6ComputeNode-6.8.z:qemu-kvm-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6ComputeNode-6.8.z:qemu-kvm-debuginfo-2:0.12.1.2-2.491.el6_8.7.i686",
"6ComputeNode-6.8.z:qemu-kvm-debuginfo-2:0.12.1.2-2.491.el6_8.7.ppc64",
"6ComputeNode-6.8.z:qemu-kvm-debuginfo-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6ComputeNode-6.8.z:qemu-kvm-tools-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6Server-6.8.z:qemu-guest-agent-2:0.12.1.2-2.491.el6_8.7.i686",
"6Server-6.8.z:qemu-guest-agent-2:0.12.1.2-2.491.el6_8.7.ppc64",
"6Server-6.8.z:qemu-guest-agent-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6Server-6.8.z:qemu-img-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6Server-6.8.z:qemu-kvm-2:0.12.1.2-2.491.el6_8.7.src",
"6Server-6.8.z:qemu-kvm-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6Server-6.8.z:qemu-kvm-debuginfo-2:0.12.1.2-2.491.el6_8.7.i686",
"6Server-6.8.z:qemu-kvm-debuginfo-2:0.12.1.2-2.491.el6_8.7.ppc64",
"6Server-6.8.z:qemu-kvm-debuginfo-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6Server-6.8.z:qemu-kvm-tools-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6Workstation-6.8.z:qemu-guest-agent-2:0.12.1.2-2.491.el6_8.7.i686",
"6Workstation-6.8.z:qemu-guest-agent-2:0.12.1.2-2.491.el6_8.7.ppc64",
"6Workstation-6.8.z:qemu-guest-agent-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6Workstation-6.8.z:qemu-img-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6Workstation-6.8.z:qemu-kvm-2:0.12.1.2-2.491.el6_8.7.src",
"6Workstation-6.8.z:qemu-kvm-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6Workstation-6.8.z:qemu-kvm-debuginfo-2:0.12.1.2-2.491.el6_8.7.i686",
"6Workstation-6.8.z:qemu-kvm-debuginfo-2:0.12.1.2-2.491.el6_8.7.ppc64",
"6Workstation-6.8.z:qemu-kvm-debuginfo-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6Workstation-6.8.z:qemu-kvm-tools-2:0.12.1.2-2.491.el6_8.7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Qemu: display: cirrus: potential arbitrary code execution via cirrus_bitblt_cputovideo"
}
]
}
rhsa-2017_0328
Vulnerability from csaf_redhat
Published
2017-02-27 23:12
Modified
2024-11-05 19:54
Summary
Red Hat Security Advisory: qemu-kvm-rhev security update
Notes
Topic
An update for qemu-kvm-rhev is now available for Red Hat OpenStack Platform 10.0 (Newton).
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-rhev packages provide the user-space component for running virtual machines that use KVM in environments managed by Red Hat products.
Security Fix(es):
* Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue. It could occur while copying VGA data via bitblt copy in backward mode. A privileged user inside a guest could use this flaw to crash the QEMU process resulting in DoS or potentially execute arbitrary code on the host with privileges of QEMU process on the host. (CVE-2017-2615)
* Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process. (CVE-2017-2620)
Red Hat would like to thank Wjjzhang (Tencent.com Inc.) and Li Qiang (360.cn Inc.) for reporting CVE-2017-2615.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for qemu-kvm-rhev is now available for Red Hat OpenStack Platform 10.0 (Newton).\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-rhev packages provide the user-space component for running virtual machines that use KVM in environments managed by Red Hat products.\n\nSecurity Fix(es):\n\n* Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue. It could occur while copying VGA data via bitblt copy in backward mode. A privileged user inside a guest could use this flaw to crash the QEMU process resulting in DoS or potentially execute arbitrary code on the host with privileges of QEMU process on the host. (CVE-2017-2615)\n\n* Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process. (CVE-2017-2620)\n\nRed Hat would like to thank Wjjzhang (Tencent.com Inc.) and Li Qiang (360.cn Inc.) for reporting CVE-2017-2615.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2017:0328",
"url": "https://access.redhat.com/errata/RHSA-2017:0328"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "1418200",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1418200"
},
{
"category": "external",
"summary": "1420484",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1420484"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_0328.json"
}
],
"title": "Red Hat Security Advisory: qemu-kvm-rhev security update",
"tracking": {
"current_release_date": "2024-11-05T19:54:12+00:00",
"generator": {
"date": "2024-11-05T19:54:12+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.1.1"
}
},
"id": "RHSA-2017:0328",
"initial_release_date": "2017-02-27T23:12:53+00:00",
"revision_history": [
{
"date": "2017-02-27T23:12:53+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2017-02-27T23:12:53+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-05T19:54:12+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenStack Platform 10.0",
"product": {
"name": "Red Hat OpenStack Platform 10.0",
"product_id": "7Server-RH7-RHOS-10.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openstack:10::el7"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenStack Platform"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product": {
"name": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product_id": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-common-rhev@2.6.0-28.el7_3.6?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"product": {
"name": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"product_id": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev-debuginfo@2.6.0-28.el7_3.6?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product": {
"name": "qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product_id": "qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-img-rhev@2.6.0-28.el7_3.6?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product": {
"name": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product_id": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-tools-rhev@2.6.0-28.el7_3.6?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product_id": "qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev@2.6.0-28.el7_3.6?arch=x86_64\u0026epoch=10"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"product": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"product_id": "qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev@2.6.0-28.el7_3.6?arch=src\u0026epoch=10"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64 as a component of Red Hat OpenStack Platform 10.0",
"product_id": "7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64"
},
"product_reference": "qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-10.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64 as a component of Red Hat OpenStack Platform 10.0",
"product_id": "7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64"
},
"product_reference": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-10.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src as a component of Red Hat OpenStack Platform 10.0",
"product_id": "7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src"
},
"product_reference": "qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"relates_to_product_reference": "7Server-RH7-RHOS-10.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64 as a component of Red Hat OpenStack Platform 10.0",
"product_id": "7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64"
},
"product_reference": "qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-10.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64 as a component of Red Hat OpenStack Platform 10.0",
"product_id": "7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64"
},
"product_reference": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-10.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64 as a component of Red Hat OpenStack Platform 10.0",
"product_id": "7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64"
},
"product_reference": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-10.0"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Li Qiang"
],
"organization": "360.cn Inc."
},
{
"names": [
"Wjjzhang"
],
"organization": "Tencent.com Inc."
}
],
"cve": "CVE-2017-2615",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2017-01-25T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1418200"
}
],
"notes": [
{
"category": "description",
"text": "Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue. It could occur while copying VGA data via bitblt copy in backward mode. A privileged user inside a guest could use this flaw to crash the QEMU process resulting in DoS or potentially execute arbitrary code on the host with privileges of QEMU process on the host.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: display: cirrus: oob access while doing bitblt copy backward mode",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-2615"
},
{
"category": "external",
"summary": "RHBZ#1418200",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1418200"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-2615",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-2615"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-2615",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-2615"
}
],
"release_date": "2017-01-24T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-02-27T23:12:53+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:0328"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:A/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Qemu: display: cirrus: oob access while doing bitblt copy backward mode"
},
{
"cve": "CVE-2017-2620",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2017-02-09T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1420484"
}
],
"notes": [
{
"category": "description",
"text": "Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: display: cirrus: potential arbitrary code execution via cirrus_bitblt_cputovideo",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-2620"
},
{
"category": "external",
"summary": "RHBZ#1420484",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1420484"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-2620",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-2620"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-2620",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-2620"
},
{
"category": "external",
"summary": "https://xenbits.xen.org/xsa/advisory-209.html",
"url": "https://xenbits.xen.org/xsa/advisory-209.html"
}
],
"release_date": "2017-02-21T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-02-27T23:12:53+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:0328"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:A/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"7Server-RH7-RHOS-10.0:qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-10.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Qemu: display: cirrus: potential arbitrary code execution via cirrus_bitblt_cputovideo"
}
]
}
rhsa-2017_0351
Vulnerability from csaf_redhat
Published
2017-03-01 07:59
Modified
2024-11-05 19:54
Summary
Red Hat Security Advisory: qemu-kvm-rhev security update
Notes
Topic
An update for qemu-kvm-rhev is now available for RHEV 3.X Hypervisor and Agents for RHEL-6.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-rhev packages provide the user-space component for running virtual machines that use KVM in environments managed by Red Hat products.
Security Fix(es):
* Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process. (CVE-2017-2620)
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for qemu-kvm-rhev is now available for RHEV 3.X Hypervisor and Agents for RHEL-6.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-rhev packages provide the user-space component for running virtual machines that use KVM in environments managed by Red Hat products.\n\nSecurity Fix(es):\n\n* Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process. (CVE-2017-2620)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2017:0351",
"url": "https://access.redhat.com/errata/RHSA-2017:0351"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "1420484",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1420484"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_0351.json"
}
],
"title": "Red Hat Security Advisory: qemu-kvm-rhev security update",
"tracking": {
"current_release_date": "2024-11-05T19:54:54+00:00",
"generator": {
"date": "2024-11-05T19:54:54+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.1.1"
}
},
"id": "RHSA-2017:0351",
"initial_release_date": "2017-03-01T07:59:05+00:00",
"revision_history": [
{
"date": "2017-03-01T07:59:05+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2017-03-01T07:59:05+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-05T19:54:54+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "RHEV Agents (vdsm)",
"product": {
"name": "RHEV Agents (vdsm)",
"product_id": "6Server-RHEV-Agents",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:enterprise_linux:6::hypervisor"
}
}
}
],
"category": "product_family",
"name": "Red Hat Virtualization"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-kvm-rhev-2:0.12.1.2-2.491.el6_8.7.x86_64",
"product": {
"name": "qemu-kvm-rhev-2:0.12.1.2-2.491.el6_8.7.x86_64",
"product_id": "qemu-kvm-rhev-2:0.12.1.2-2.491.el6_8.7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev@0.12.1.2-2.491.el6_8.7?arch=x86_64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "qemu-img-rhev-2:0.12.1.2-2.491.el6_8.7.x86_64",
"product": {
"name": "qemu-img-rhev-2:0.12.1.2-2.491.el6_8.7.x86_64",
"product_id": "qemu-img-rhev-2:0.12.1.2-2.491.el6_8.7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-img-rhev@0.12.1.2-2.491.el6_8.7?arch=x86_64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.491.el6_8.7.x86_64",
"product": {
"name": "qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.491.el6_8.7.x86_64",
"product_id": "qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.491.el6_8.7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev-debuginfo@0.12.1.2-2.491.el6_8.7?arch=x86_64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-rhev-tools-2:0.12.1.2-2.491.el6_8.7.x86_64",
"product": {
"name": "qemu-kvm-rhev-tools-2:0.12.1.2-2.491.el6_8.7.x86_64",
"product_id": "qemu-kvm-rhev-tools-2:0.12.1.2-2.491.el6_8.7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev-tools@0.12.1.2-2.491.el6_8.7?arch=x86_64\u0026epoch=2"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-kvm-rhev-2:0.12.1.2-2.491.el6_8.7.src",
"product": {
"name": "qemu-kvm-rhev-2:0.12.1.2-2.491.el6_8.7.src",
"product_id": "qemu-kvm-rhev-2:0.12.1.2-2.491.el6_8.7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev@0.12.1.2-2.491.el6_8.7?arch=src\u0026epoch=2"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-rhev-2:0.12.1.2-2.491.el6_8.7.x86_64 as a component of RHEV Agents (vdsm)",
"product_id": "6Server-RHEV-Agents:qemu-img-rhev-2:0.12.1.2-2.491.el6_8.7.x86_64"
},
"product_reference": "qemu-img-rhev-2:0.12.1.2-2.491.el6_8.7.x86_64",
"relates_to_product_reference": "6Server-RHEV-Agents"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-2:0.12.1.2-2.491.el6_8.7.src as a component of RHEV Agents (vdsm)",
"product_id": "6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.491.el6_8.7.src"
},
"product_reference": "qemu-kvm-rhev-2:0.12.1.2-2.491.el6_8.7.src",
"relates_to_product_reference": "6Server-RHEV-Agents"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-2:0.12.1.2-2.491.el6_8.7.x86_64 as a component of RHEV Agents (vdsm)",
"product_id": "6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.491.el6_8.7.x86_64"
},
"product_reference": "qemu-kvm-rhev-2:0.12.1.2-2.491.el6_8.7.x86_64",
"relates_to_product_reference": "6Server-RHEV-Agents"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.491.el6_8.7.x86_64 as a component of RHEV Agents (vdsm)",
"product_id": "6Server-RHEV-Agents:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.491.el6_8.7.x86_64"
},
"product_reference": "qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.491.el6_8.7.x86_64",
"relates_to_product_reference": "6Server-RHEV-Agents"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-tools-2:0.12.1.2-2.491.el6_8.7.x86_64 as a component of RHEV Agents (vdsm)",
"product_id": "6Server-RHEV-Agents:qemu-kvm-rhev-tools-2:0.12.1.2-2.491.el6_8.7.x86_64"
},
"product_reference": "qemu-kvm-rhev-tools-2:0.12.1.2-2.491.el6_8.7.x86_64",
"relates_to_product_reference": "6Server-RHEV-Agents"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2017-2620",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2017-02-09T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1420484"
}
],
"notes": [
{
"category": "description",
"text": "Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: display: cirrus: potential arbitrary code execution via cirrus_bitblt_cputovideo",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RHEV-Agents:qemu-img-rhev-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.491.el6_8.7.src",
"6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-tools-2:0.12.1.2-2.491.el6_8.7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-2620"
},
{
"category": "external",
"summary": "RHBZ#1420484",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1420484"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-2620",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-2620"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-2620",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-2620"
},
{
"category": "external",
"summary": "https://xenbits.xen.org/xsa/advisory-209.html",
"url": "https://xenbits.xen.org/xsa/advisory-209.html"
}
],
"release_date": "2017-02-21T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-03-01T07:59:05+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"6Server-RHEV-Agents:qemu-img-rhev-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.491.el6_8.7.src",
"6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-tools-2:0.12.1.2-2.491.el6_8.7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:0351"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:A/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"6Server-RHEV-Agents:qemu-img-rhev-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.491.el6_8.7.src",
"6Server-RHEV-Agents:qemu-kvm-rhev-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-debuginfo-2:0.12.1.2-2.491.el6_8.7.x86_64",
"6Server-RHEV-Agents:qemu-kvm-rhev-tools-2:0.12.1.2-2.491.el6_8.7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Qemu: display: cirrus: potential arbitrary code execution via cirrus_bitblt_cputovideo"
}
]
}
rhsa-2017_0332
Vulnerability from csaf_redhat
Published
2017-02-27 23:12
Modified
2024-11-05 19:54
Summary
Red Hat Security Advisory: qemu-kvm-rhev security update
Notes
Topic
An update for qemu-kvm-rhev is now available for Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-rhev packages provide the user-space component for running virtual machines that use KVM in environments managed by Red Hat products.
Security Fix(es):
* Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue. It could occur while copying VGA data via bitblt copy in backward mode. A privileged user inside a guest could use this flaw to crash the QEMU process resulting in DoS or potentially execute arbitrary code on the host with privileges of QEMU process on the host. (CVE-2017-2615)
* Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process. (CVE-2017-2620)
Red Hat would like to thank Wjjzhang (Tencent.com Inc.) and Li Qiang (360.cn Inc.) for reporting CVE-2017-2615.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for qemu-kvm-rhev is now available for Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-rhev packages provide the user-space component for running virtual machines that use KVM in environments managed by Red Hat products.\n\nSecurity Fix(es):\n\n* Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue. It could occur while copying VGA data via bitblt copy in backward mode. A privileged user inside a guest could use this flaw to crash the QEMU process resulting in DoS or potentially execute arbitrary code on the host with privileges of QEMU process on the host. (CVE-2017-2615)\n\n* Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process. (CVE-2017-2620)\n\nRed Hat would like to thank Wjjzhang (Tencent.com Inc.) and Li Qiang (360.cn Inc.) for reporting CVE-2017-2615.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2017:0332",
"url": "https://access.redhat.com/errata/RHSA-2017:0332"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "1418200",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1418200"
},
{
"category": "external",
"summary": "1420484",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1420484"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_0332.json"
}
],
"title": "Red Hat Security Advisory: qemu-kvm-rhev security update",
"tracking": {
"current_release_date": "2024-11-05T19:54:21+00:00",
"generator": {
"date": "2024-11-05T19:54:21+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.1.1"
}
},
"id": "RHSA-2017:0332",
"initial_release_date": "2017-02-27T23:12:29+00:00",
"revision_history": [
{
"date": "2017-02-27T23:12:29+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2017-02-27T23:12:29+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-05T19:54:21+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7",
"product": {
"name": "Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7",
"product_id": "7Server-RH7-RHOS-6.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openstack:6::el7"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenStack Platform"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product": {
"name": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product_id": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-common-rhev@2.6.0-28.el7_3.6?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"product": {
"name": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"product_id": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev-debuginfo@2.6.0-28.el7_3.6?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product": {
"name": "qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product_id": "qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-img-rhev@2.6.0-28.el7_3.6?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product": {
"name": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product_id": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-tools-rhev@2.6.0-28.el7_3.6?arch=x86_64\u0026epoch=10"
}
}
},
{
"category": "product_version",
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product_id": "qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev@2.6.0-28.el7_3.6?arch=x86_64\u0026epoch=10"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"product": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"product_id": "qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qemu-kvm-rhev@2.6.0-28.el7_3.6?arch=src\u0026epoch=10"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7",
"product_id": "7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64"
},
"product_reference": "qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7",
"product_id": "7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64"
},
"product_reference": "qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src as a component of Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7",
"product_id": "7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src"
},
"product_reference": "qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"relates_to_product_reference": "7Server-RH7-RHOS-6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7",
"product_id": "7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64"
},
"product_reference": "qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7",
"product_id": "7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64"
},
"product_reference": "qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7",
"product_id": "7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64"
},
"product_reference": "qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOS-6.0"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Li Qiang"
],
"organization": "360.cn Inc."
},
{
"names": [
"Wjjzhang"
],
"organization": "Tencent.com Inc."
}
],
"cve": "CVE-2017-2615",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2017-01-25T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1418200"
}
],
"notes": [
{
"category": "description",
"text": "Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue. It could occur while copying VGA data via bitblt copy in backward mode. A privileged user inside a guest could use this flaw to crash the QEMU process resulting in DoS or potentially execute arbitrary code on the host with privileges of QEMU process on the host.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: display: cirrus: oob access while doing bitblt copy backward mode",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-2615"
},
{
"category": "external",
"summary": "RHBZ#1418200",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1418200"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-2615",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-2615"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-2615",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-2615"
}
],
"release_date": "2017-01-24T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-02-27T23:12:29+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:0332"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:A/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Qemu: display: cirrus: oob access while doing bitblt copy backward mode"
},
{
"cve": "CVE-2017-2620",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2017-02-09T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1420484"
}
],
"notes": [
{
"category": "description",
"text": "Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: display: cirrus: potential arbitrary code execution via cirrus_bitblt_cputovideo",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-2620"
},
{
"category": "external",
"summary": "RHBZ#1420484",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1420484"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-2620",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-2620"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-2620",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-2620"
},
{
"category": "external",
"summary": "https://xenbits.xen.org/xsa/advisory-209.html",
"url": "https://xenbits.xen.org/xsa/advisory-209.html"
}
],
"release_date": "2017-02-21T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-02-27T23:12:29+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.",
"product_ids": [
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:0332"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:A/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"7Server-RH7-RHOS-6.0:qemu-img-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-common-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.src",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-rhev-debuginfo-10:2.6.0-28.el7_3.6.x86_64",
"7Server-RH7-RHOS-6.0:qemu-kvm-tools-rhev-10:2.6.0-28.el7_3.6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Qemu: display: cirrus: potential arbitrary code execution via cirrus_bitblt_cputovideo"
}
]
}
ghsa-v6gr-ph59-9hqm
Vulnerability from github
Published
2022-05-13 01:07
Modified
2022-05-13 01:07
Severity ?
Details
Quick emulator (QEMU) before 2.8 built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process.
{
"affected": [],
"aliases": [
"CVE-2017-2620"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-07-27T19:29:00Z",
"severity": "CRITICAL"
},
"details": "Quick emulator (QEMU) before 2.8 built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process.",
"id": "GHSA-v6gr-ph59-9hqm",
"modified": "2022-05-13T01:07:31Z",
"published": "2022-05-13T01:07:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-2620"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2620"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2018/02/msg00005.html"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html"
},
{
"type": "WEB",
"url": "https://lists.gnu.org/archive/html/qemu-devel/2017-02/msg04700.html"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/201703-07"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/201704-01"
},
{
"type": "WEB",
"url": "https://support.citrix.com/article/CTX220771"
},
{
"type": "WEB",
"url": "https://xenbits.xen.org/xsa/advisory-209.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2017-0328.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2017-0329.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2017-0330.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2017-0331.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2017-0332.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2017-0333.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2017-0334.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2017-0350.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2017-0351.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2017-0352.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2017-0396.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2017-0454.html"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2017/02/21/1"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/96378"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1037870"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
gsd-2017-2620
Vulnerability from gsd
Modified
2023-12-13 01:21
Details
Quick emulator (QEMU) before 2.8 built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2017-2620",
"description": "Quick emulator (QEMU) before 2.8 built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process.",
"id": "GSD-2017-2620",
"references": [
"https://www.suse.com/security/cve/CVE-2017-2620.html",
"https://access.redhat.com/errata/RHSA-2017:0454",
"https://access.redhat.com/errata/RHSA-2017:0396",
"https://access.redhat.com/errata/RHSA-2017:0352",
"https://access.redhat.com/errata/RHSA-2017:0351",
"https://access.redhat.com/errata/RHSA-2017:0350",
"https://access.redhat.com/errata/RHSA-2017:0334",
"https://access.redhat.com/errata/RHSA-2017:0333",
"https://access.redhat.com/errata/RHSA-2017:0332",
"https://access.redhat.com/errata/RHSA-2017:0331",
"https://access.redhat.com/errata/RHSA-2017:0330",
"https://access.redhat.com/errata/RHSA-2017:0329",
"https://access.redhat.com/errata/RHSA-2017:0328",
"https://ubuntu.com/security/CVE-2017-2620",
"https://linux.oracle.com/cve/CVE-2017-2620.html"
]
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2017-2620"
],
"details": "Quick emulator (QEMU) before 2.8 built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process.",
"id": "GSD-2017-2620",
"modified": "2023-12-13T01:21:05.233996Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2017-2620",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Qemu:",
"version": {
"version_data": [
{
"version_value": "2.8"
}
]
}
}
]
},
"vendor_name": "QEMU"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Quick emulator (QEMU) before 2.8 built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process."
}
]
},
"impact": {
"cvss": [
[
{
"vectorString": "5.5/CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.0"
}
],
[
{
"vectorString": "4.9/AV:A/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
}
]
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-787"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "RHSA-2017:0329",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2017-0329.html"
},
{
"name": "RHSA-2017:0334",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2017-0334.html"
},
{
"name": "1037870",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1037870"
},
{
"name": "RHSA-2017:0328",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2017-0328.html"
},
{
"name": "[debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html"
},
{
"name": "RHSA-2017:0333",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2017-0333.html"
},
{
"name": "RHSA-2017:0351",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2017-0351.html"
},
{
"name": "RHSA-2017:0454",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2017-0454.html"
},
{
"name": "https://xenbits.xen.org/xsa/advisory-209.html",
"refsource": "CONFIRM",
"url": "https://xenbits.xen.org/xsa/advisory-209.html"
},
{
"name": "RHSA-2017:0331",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2017-0331.html"
},
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2620",
"refsource": "CONFIRM",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2620"
},
{
"name": "[oss-security] 20170221 CVE-2017-2620 Qemu: display: cirrus: out-of-bounds access issue while in cirrus_bitblt_cputovideo",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2017/02/21/1"
},
{
"name": "RHSA-2017:0350",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2017-0350.html"
},
{
"name": "[debian-lts-announce] 20180206 [SECURITY] [DLA 1270-1] xen security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2018/02/msg00005.html"
},
{
"name": "RHSA-2017:0396",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2017-0396.html"
},
{
"name": "GLSA-201704-01",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201704-01"
},
{
"name": "[qemu-devel] 20170221 [PATCH] cirrus: add blit_is_unsafe call to cirrus_bitblt_cputovideo (CVE-2017-2620)",
"refsource": "MLIST",
"url": "https://lists.gnu.org/archive/html/qemu-devel/2017-02/msg04700.html"
},
{
"name": "RHSA-2017:0352",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2017-0352.html"
},
{
"name": "RHSA-2017:0330",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2017-0330.html"
},
{
"name": "RHSA-2017:0332",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2017-0332.html"
},
{
"name": "96378",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/96378"
},
{
"name": "https://support.citrix.com/article/CTX220771",
"refsource": "CONFIRM",
"url": "https://support.citrix.com/article/CTX220771"
},
{
"name": "GLSA-201703-07",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201703-07"
}
]
}
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "2.8.0",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:redhat:openstack:8:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:redhat:openstack:7.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:citrix:xenserver:7.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:xen:xen:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "4.7.1",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:xen:xen:4.7.1:r7:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_server_eus:7.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:redhat:openstack:6.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:redhat:openstack:5.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:xen:xen:4.7.1:r6:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:xen:xen:4.7.1:r5:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:redhat:openstack:10:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:redhat:openstack:9:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:citrix:xenserver:6.5:sp1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:citrix:xenserver:7.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:xen:xen:4.7.1:r2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:xen:xen:4.7.1:r1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:citrix:xenserver:6.0.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:citrix:xenserver:6.2.0:sp1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:xen:xen:4.7.1:r4:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:xen:xen:4.7.1:r3:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2017-2620"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "Quick emulator (QEMU) before 2.8 built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-125"
},
{
"lang": "en",
"value": "CWE-787"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://xenbits.xen.org/xsa/advisory-209.html",
"refsource": "CONFIRM",
"tags": [
"Third Party Advisory"
],
"url": "https://xenbits.xen.org/xsa/advisory-209.html"
},
{
"name": "[qemu-devel] 20170221 [PATCH] cirrus: add blit_is_unsafe call to cirrus_bitblt_cputovideo (CVE-2017-2620)",
"refsource": "MLIST",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://lists.gnu.org/archive/html/qemu-devel/2017-02/msg04700.html"
},
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2620",
"refsource": "CONFIRM",
"tags": [
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2620"
},
{
"name": "[oss-security] 20170221 CVE-2017-2620 Qemu: display: cirrus: out-of-bounds access issue while in cirrus_bitblt_cputovideo",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2017/02/21/1"
},
{
"name": "https://support.citrix.com/article/CTX220771",
"refsource": "CONFIRM",
"tags": [
"Third Party Advisory"
],
"url": "https://support.citrix.com/article/CTX220771"
},
{
"name": "GLSA-201704-01",
"refsource": "GENTOO",
"tags": [
"Third Party Advisory"
],
"url": "https://security.gentoo.org/glsa/201704-01"
},
{
"name": "GLSA-201703-07",
"refsource": "GENTOO",
"tags": [
"Third Party Advisory"
],
"url": "https://security.gentoo.org/glsa/201703-07"
},
{
"name": "[debian-lts-announce] 20180206 [SECURITY] [DLA 1270-1] xen security update",
"refsource": "MLIST",
"tags": [
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2018/02/msg00005.html"
},
{
"name": "1037870",
"refsource": "SECTRACK",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securitytracker.com/id/1037870"
},
{
"name": "96378",
"refsource": "BID",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/96378"
},
{
"name": "RHSA-2017:0454",
"refsource": "REDHAT",
"tags": [
"Third Party Advisory"
],
"url": "http://rhn.redhat.com/errata/RHSA-2017-0454.html"
},
{
"name": "RHSA-2017:0396",
"refsource": "REDHAT",
"tags": [
"Third Party Advisory"
],
"url": "http://rhn.redhat.com/errata/RHSA-2017-0396.html"
},
{
"name": "RHSA-2017:0352",
"refsource": "REDHAT",
"tags": [
"Third Party Advisory"
],
"url": "http://rhn.redhat.com/errata/RHSA-2017-0352.html"
},
{
"name": "RHSA-2017:0351",
"refsource": "REDHAT",
"tags": [
"Third Party Advisory"
],
"url": "http://rhn.redhat.com/errata/RHSA-2017-0351.html"
},
{
"name": "RHSA-2017:0350",
"refsource": "REDHAT",
"tags": [
"Third Party Advisory"
],
"url": "http://rhn.redhat.com/errata/RHSA-2017-0350.html"
},
{
"name": "RHSA-2017:0334",
"refsource": "REDHAT",
"tags": [
"Third Party Advisory"
],
"url": "http://rhn.redhat.com/errata/RHSA-2017-0334.html"
},
{
"name": "RHSA-2017:0333",
"refsource": "REDHAT",
"tags": [
"Third Party Advisory"
],
"url": "http://rhn.redhat.com/errata/RHSA-2017-0333.html"
},
{
"name": "RHSA-2017:0332",
"refsource": "REDHAT",
"tags": [
"Third Party Advisory"
],
"url": "http://rhn.redhat.com/errata/RHSA-2017-0332.html"
},
{
"name": "RHSA-2017:0331",
"refsource": "REDHAT",
"tags": [
"Third Party Advisory"
],
"url": "http://rhn.redhat.com/errata/RHSA-2017-0331.html"
},
{
"name": "RHSA-2017:0330",
"refsource": "REDHAT",
"tags": [
"Third Party Advisory"
],
"url": "http://rhn.redhat.com/errata/RHSA-2017-0330.html"
},
{
"name": "RHSA-2017:0329",
"refsource": "REDHAT",
"tags": [
"Third Party Advisory"
],
"url": "http://rhn.redhat.com/errata/RHSA-2017-0329.html"
},
{
"name": "RHSA-2017:0328",
"refsource": "REDHAT",
"tags": [
"Third Party Advisory"
],
"url": "http://rhn.redhat.com/errata/RHSA-2017-0328.html"
},
{
"name": "[debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update",
"refsource": "MLIST",
"tags": [],
"url": "https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html"
}
]
}
},
"impact": {
"baseMetricV2": {
"cvssV2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "COMPLETE",
"baseScore": 9.0,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"userInteractionRequired": false
},
"baseMetricV3": {
"cvssV3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 3.1,
"impactScore": 6.0
}
},
"lastModifiedDate": "2021-08-04T17:15Z",
"publishedDate": "2018-07-27T19:29Z"
}
}
}
Loading...
Loading...
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.