CVE-2013-4540
published 2014-11-04CVE-2013-4540: Buffer overflow in scoop_gpio_handler_update in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a large (1) prev_level, (2)…
PriorityP342high7.5CVSS 2.0
AVNACLAuNCPIPAP
EPSS
4.55%
90.6th percentile
Buffer overflow in scoop_gpio_handler_update in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a large (1) prev_level, (2) gpio_level, or (3) gpio_dir value in a savevm image.
Affected
75 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | qemu | < qemu 2.1+dfsg-1 (bookworm) | qemu 2.1+dfsg-1 (bookworm) |
| opensuse | opensuse | — | — |
| opensuse | opensuse | — | — |
| qemu | qemu | <= 1.7.1 | — |
| qemu | qemu | — | — |
| qemu | qemu | — | — |
| qemu | qemu | — | — |
| qemu | qemu | — | — |
| qemu | qemu | — | — |
| qemu | qemu | — | — |
| qemu | qemu | — | — |
| qemu | qemu | — | — |
| qemu | qemu | — | — |
| qemu | qemu | — | — |
| qemu | qemu | — | — |
| qemu | qemu | — | — |
| qemu | qemu | — | — |
| qemu | qemu | — | — |
| qemu | qemu | — | — |
| qemu | qemu | — | — |
| qemu | qemu | — | — |
| qemu | qemu | — | — |
| qemu | qemu | — | — |
| qemu | qemu | — | — |
| qemu | qemu | — | — |
CVSS provenance
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv7.5HIGH
vendor_debian7.5LOW
vendor_redhat7.5HIGH
vendor_ubuntu7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-67xx-4xq4-jj46: Buffer overflow in scoop_gpio_handler_update in QEMU before 1
ghsa_unreviewed·2022-05-13
CVE-2013-4540 [HIGH] CWE-119 GHSA-67xx-4xq4-jj46: Buffer overflow in scoop_gpio_handler_update in QEMU before 1
Buffer overflow in scoop_gpio_handler_update in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a large (1) prev_level, (2) gpio_level, or (3) gpio_dir value in a savevm image.
OSV
CVE-2013-4540: Buffer overflow in scoop_gpio_handler_update in QEMU before 1
osv·2014-11-04·CVSS 7.5
CVE-2013-4540 [HIGH] CVE-2013-4540: Buffer overflow in scoop_gpio_handler_update in QEMU before 1
Buffer overflow in scoop_gpio_handler_update in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a large (1) prev_level, (2) gpio_level, or (3) gpio_dir value in a savevm image.
OSV
qemu, qemu-kvm vulnerabilities
osv·2014-09-08·CVSS 7.5
CVE-2013-4148 [HIGH] qemu, qemu-kvm vulnerabilities
qemu, qemu-kvm vulnerabilities
Michael S. Tsirkin, Anthony Liguori, and Michael Roth discovered multiple
issues with QEMU state loading after migration. An attacker able to modify
the state data could use these issues to cause a denial of service, or
possibly execute arbitrary code. (CVE-2013-4148, CVE-2013-4149,
CVE-2013-4150, CVE-2013-4151, CVE-2013-4526, CVE-2013-4527, CVE-2013-4529,
CVE-2013-4530, CVE-2013-4531, CVE-2013-4532, CVE-2013-4533, CVE-2013-4534,
CVE-2013-4535, CVE-2013-4536, CVE-2013-4537, CVE-2013-4538, CVE-2013-4539,
CVE-2013-4540, CVE-2013-4541, CVE-2013-4542, CVE-2013-6399, CVE-2014-0182,
CVE-2014-3461)
Kevin Wolf, Stefan Hajnoczi, Fam Zheng, Jeff Cody, Stefan Hajnoczi, and
others discovered multiple issues in the QEMU block drivers. An attacker
able to modify disk ima
Ubuntu
QEMU vulnerabilities
vendor_ubuntu·2014-09-08·CVSS 7.5
CVE-2013-4148 [HIGH] QEMU vulnerabilities
Title: QEMU vulnerabilities
Summary: Several security issues were fixed in QEMU.
Michael S. Tsirkin, Anthony Liguori, and Michael Roth discovered multiple
issues with QEMU state loading after migration. An attacker able to modify
the state data could use these issues to cause a denial of service, or
possibly execute arbitrary code. (CVE-2013-4148, CVE-2013-4149,
CVE-2013-4150, CVE-2013-4151, CVE-2013-4526, CVE-2013-4527, CVE-2013-4529,
CVE-2013-4530, CVE-2013-4531, CVE-2013-4532, CVE-2013-4533, CVE-2013-4534,
CVE-2013-4535, CVE-2013-4536, CVE-2013-4537, CVE-2013-4538, CVE-2013-4539,
CVE-2013-4540, CVE-2013-4541, CVE-2013-4542, CVE-2013-6399, CVE-2014-0182,
CVE-2014-3461)
Kevin Wolf, Stefan Hajnoczi, Fam Zheng, Jeff Cody, Stefan Hajnoczi, and
others discovered multiple issues in the QEMU
Red Hat
qemu: zaurus: buffer overrun on invalid state load
vendor_redhat·2013-12-03·CVSS 7.5
CVE-2013-4540 [HIGH] qemu: zaurus: buffer overrun on invalid state load
qemu: zaurus: buffer overrun on invalid state load
Buffer overflow in scoop_gpio_handler_update in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a large (1) prev_level, (2) gpio_level, or (3) gpio_dir value in a savevm image.
Statement: Not vulnerable.
This issue does not affect the versions of kvm package as shipped with
Red Hat Enterprise Linux 5.
This issue does not affect the versions of qemu-kvm package as shipped
with Red Hat Enterprise Linux 6
Package: kvm (Red Hat Enterprise Linux 5) - Not affected
Package: qemu-kvm (Red Hat Enterprise Linux 6) - Not affected
Package: qemu-kvm (Red Hat Enterprise Linux 7) - Not affected
Red Hat
icedtea-web: issue not fixed in 1.4
vendor_redhat·2013-09-16·CVSS 6.8
CVE-2013-4349 [MEDIUM] icedtea-web: issue not fixed in 1.4
icedtea-web: issue not fixed in 1.4
No description is available for this CVE.
Statement: Not vulnerable. This issue did not affect the versions of icedtea-web as shipped with Red Hat Enterprise Linux 6. The CVE-2012-4540 issue was previously corrected via RHSA-2012:1434.
Package: icedtea-web (Red Hat Enterprise Linux 6) - Not affected
Package: icedtea-web (Red Hat Enterprise Linux 7) - Not affected
Debian
CVE-2013-4540: qemu - Buffer overflow in scoop_gpio_handler_update in QEMU before 1.7.2 might allow re...
vendor_debian·2013·CVSS 7.5
CVE-2013-4540 [HIGH] CVE-2013-4540: qemu - Buffer overflow in scoop_gpio_handler_update in QEMU before 1.7.2 might allow re...
Buffer overflow in scoop_gpio_handler_update in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a large (1) prev_level, (2) gpio_level, or (3) gpio_dir value in a savevm image.
Scope: local
bookworm: resolved (fixed in 2.1+dfsg-1)
bullseye: resolved (fixed in 2.1+dfsg-1)
forky: resolved (fixed in 2.1+dfsg-1)
sid: resolved (fixed in 2.1+dfsg-1)
trixie: resolved (fixed in 2.1+dfsg-1)
Red Hat
icedtea-web: IcedTeaScriptableJavaObject:: invoke off-by-one heap-based buffer overflow
vendor_redhat·2012-11-07·CVSS 6.8
CVE-2012-4540 [MEDIUM] CWE-122 icedtea-web: IcedTeaScriptableJavaObject:: invoke off-by-one heap-based buffer overflow
icedtea-web: IcedTeaScriptableJavaObject:: invoke off-by-one heap-based buffer overflow
Off-by-one error in the invoke function in IcedTeaScriptablePluginObject.cc in IcedTea-Web 1.1.x before 1.1.7, 1.2.x before 1.2.2, 1.3.x before 1.3.1, and 1.4.x before 1.4.1 allows remote attackers to obtain sensitive information, cause a denial of service (crash), or possibly execute arbitrary code via a crafted webpage that triggers a heap-based buffer overflow, related to an error message and a "triggering event attached to applet." NOTE: the 1.4.x versions were originally associated with CVE-2013-4349, but that entry has been MERGED with this one.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2013-4540 qemu: zaurus: buffer overrun on invalid state load [fedora-all]
bugzilla·2014-05-08·CVSS 7.5
CVE-2013-4540 [HIGH] CVE-2013-4540 qemu: zaurus: buffer overrun on invalid state load [fedora-all]
CVE-2013-4540 qemu: zaurus: buffer overrun on invalid state load [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, use the bodhi submission link noted
in the next comment(s). This will include the bug IDs of this tracking
bug as well as the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
Bodhi notes field when available.
NOTE: this issue affects multiple
Bugzilla
CVE-2013-4540 qemu: zaurus: buffer overrun on invalid state load
bugzilla·2014-02-18·CVSS 7.5
CVE-2013-4540 [HIGH] CVE-2013-4540 qemu: zaurus: buffer overrun on invalid state load
CVE-2013-4540 qemu: zaurus: buffer overrun on invalid state load
Within scoop_gpio_handler_update, if prev_level has a high bit set, then
we get bit > 16 and that does a buffer overrun.
An user able to alter the savevm data (either on the disk or over the wire
during migration) could use this flaw to to corrupt QEMU process memory on
the (destination) host, which could potentially result in arbitrary code
execution on the host with the privileges of the QEMU process.
Upstream fix:
-> http://git.qemu.org/?p=qemu.git;a=commit;h=52f91c3723932f8340fe36c8ec8b18a757c37b2b
Discussion:
Statement:
Not vulnerable.
This issue does not affect the versions of kvm package as shipped with
Red Hat Enterprise Linux 5.
This issue does not affect the versions of qemu-kvm package as shipped
with Red H
Bugzilla
CVE-2013-4349 icedtea-web: CVE-2012-4540 issue not fixed in 1.4 [fedora-all]
bugzilla·2013-09-16·CVSS 6.8
CVE-2013-4349 [MEDIUM] CVE-2013-4349 icedtea-web: CVE-2012-4540 issue not fixed in 1.4 [fedora-all]
CVE-2013-4349 icedtea-web: CVE-2012-4540 issue not fixed in 1.4 [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please use the bodhi submission link
noted in the next comment(s). This will include the bug IDs of this
tracking bug as well as the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
Bodhi notes field when available.
Please note: this issue affe
Bugzilla
CVE-2013-4349 icedtea-web: CVE-2012-4540 issue not fixed in 1.4
bugzilla·2013-09-13·CVSS 6.8
CVE-2013-4349 [MEDIUM] CVE-2013-4349 icedtea-web: CVE-2012-4540 issue not fixed in 1.4
CVE-2013-4349 icedtea-web: CVE-2012-4540 issue not fixed in 1.4
An off-by-one heap-based buffer overflow was found in IcedTeaScriptableJavaObject::invoke function. This problem was discovered in Oct 2012 and was assigned CVE-2012-4540. For more detailed description, refer to bug 869040 comment 5.
The patch for this issue was applied to 1.1, 1.2, and 1.3 IcedTea-Web branches, see bug 869040 comment 10. However, the fix did not get applied to head. Version 1.4 released in May 2013 did not include the fix and is affected by the issue.
http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2013-May/023195.html
A new CVE id CVE-2013-4349 was assigned for the missing fix in 1.4.
Discussion:
Statement:
Not vulnerable. This issue did not affect the versions of icedtea-web as shipped with Red
http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=52f91c3723932f8340fe36c8ec8b18a757c37b2bhttp://lists.fedoraproject.org/pipermail/package-announce/2014-May/133345.htmlhttp://lists.gnu.org/archive/html/qemu-devel/2013-12/msg00394.htmlhttp://lists.nongnu.org/archive/html/qemu-stable/2014-07/msg00187.htmlhttp://lists.opensuse.org/opensuse-security-announce/2014-10/msg00002.htmlhttp://lists.opensuse.org/opensuse-security-announce/2014-10/msg00003.htmlhttp://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=52f91c3723932f8340fe36c8ec8b18a757c37b2bhttp://lists.fedoraproject.org/pipermail/package-announce/2014-May/133345.htmlhttp://lists.gnu.org/archive/html/qemu-devel/2013-12/msg00394.htmlhttp://lists.nongnu.org/archive/html/qemu-stable/2014-07/msg00187.htmlhttp://lists.opensuse.org/opensuse-security-announce/2014-10/msg00002.htmlhttp://lists.opensuse.org/opensuse-security-announce/2014-10/msg00003.html
2014-11-04
Published