CVE-2008-4539 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Qemu
CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer11 documents7 sources
Severity
7.2HIGHNVD
EPSS
0.0%
top 85.41%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedDec 29
Latest updateMay 2
Description
Heap-based buffer overflow in the Cirrus VGA implementation in (1) KVM before kvm-82 and (2) QEMU on Debian GNU/Linux and Ubuntu might allow local users to gain privileges by using the VNC console for a connection, aka the LGD-54XX "bitblt" heap overflow. NOTE: this issue exists because of an incorrect fix for CVE-2007-1320.
CVSS vector
AV:L/AC:L/C:C/I:C/A:CExploitability: 3.9 | Impact: 10.0
Affected Packages4 packages
Also affects: Debian Linux 4.0, 5.0, Ubuntu Linux 8.04, 8.10
🔴Vulnerability Details
2GHSA▶
GHSA-gq7c-3rjh-ggvh: Heap-based buffer overflow in the Cirrus VGA implementation in (1) KVM before kvm-82 and (2) QEMU on Debian GNU/Linux and Ubuntu might allow local use↗2022-05-02
OSV▶
CVE-2008-4539: Heap-based buffer overflow in the Cirrus VGA implementation in (1) KVM before kvm-82 and (2) QEMU on Debian GNU/Linux and Ubuntu might allow local use↗2008-12-29