CVE-2014-7840
published 2014-12-12CVE-2014-7840: The host_from_stream_offset function in arch_init.c in QEMU, when loading RAM during migration, allows remote attackers to execute arbitrary code via a crafted…
high7.5CVSS 3.1
AVNACLAuNCPIPAP
The host_from_stream_offset function in arch_init.c in QEMU, when loading RAM during migration, allows remote attackers to execute arbitrary code via a crafted (1) offset or (2) length value in savevm data.
Affected
20 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | qemu | < qemu 2.1+dfsg-8 (bookworm) | qemu 2.1+dfsg-8 (bookworm) |
| qemu | qemu | <= 2.1.3 | — |
| qemu | qemu | >= 0 < 2.1+dfsg-8 | 2.1+dfsg-8 |
| qemu | qemu | >= 0 < 2.1+dfsg-8 | 2.1+dfsg-8 |
| qemu | qemu | >= 0 < 2.1+dfsg-8 | 2.1+dfsg-8 |
| qemu | qemu | >= 0 < 2.1+dfsg-8 | 2.1+dfsg-8 |
| qemu | qemu | >= 0 < 2.0.0+dfsg-2ubuntu1.9 | 2.0.0+dfsg-2ubuntu1.9 |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_server_aus | — | — |
| redhat | enterprise_linux_server_aus | — | — |
| redhat | enterprise_linux_server_aus | — | — |
| redhat | enterprise_linux_server_aus | — | — |
| redhat | enterprise_linux_workstation | — | — |
| redhat | virtualization | — | — |
CVSS provenance
nvd7.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv7.5HIGH