CVE-2015-5239
published 2020-01-23CVE-2015-5239: Integer overflow in the VNC display driver in QEMU before 2.1.0 allows attachers to cause a denial of service (process crash) via a CLIENT_CUT_TEXT message…
PriorityP430medium6.5CVSS 3.1
AVNACLPRLUINSUCNINAH
EPSS
3.61%
89.1th percentile
Integer overflow in the VNC display driver in QEMU before 2.1.0 allows attachers to cause a denial of service (process crash) via a CLIENT_CUT_TEXT message, which triggers an infinite loop.
Affected
25 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| arista | eos | — | — |
| arista | eos | — | — |
| arista | eos | — | — |
| arista | eos | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | qemu | < qemu 2.1+dfsg-1 (bookworm) | qemu 2.1+dfsg-1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| qemu | qemu | < 2.1.0 | 2.1.0 |
| qemu | qemu | — | — |
| qemu | qemu | >= 0 < 2.1+dfsg-1 | 2.1+dfsg-1 |
| qemu | qemu | >= 0 < 2.1+dfsg-1 | 2.1+dfsg-1 |
| qemu | qemu | >= 0 < 2.1+dfsg-1 | 2.1+dfsg-1 |
| qemu | qemu | >= 0 < 2.1+dfsg-1 | 2.1+dfsg-1 |
| qemu | qemu | >= 0 < 2.0.0+dfsg-2ubuntu1.19 | 2.0.0+dfsg-2ubuntu1.19 |
| suse | linux_enterprise_debuginfo | — | — |
| suse | linux_enterprise_desktop | — | — |
| suse | linux_enterprise_desktop | — | — |
| suse | linux_enterprise_server | — | — |
| suse | linux_enterprise_server | — | — |
| suse | linux_enterprise_software_development_kit | — | — |
| suse | linux_enterprise_software_development_kit | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:N/I:N/A:P
osv6.5MEDIUM
vendor_debian6.5MEDIUM
vendor_redhat6.5MEDIUM
vendor_ubuntu6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
QEMU vulnerabilities
vendor_ubuntu·2015-09-24·CVSS 6.5
CVE-2015-5239 [MEDIUM] QEMU vulnerabilities
Title: QEMU vulnerabilities
Summary: Several security issues were fixed in QEMU.
Lian Yihan discovered that QEMU incorrectly handled certain payload
messages in the VNC display driver. A malicious guest could use this issue
to cause the QEMU process to hang, resulting in a denial of service. This
issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2015-5239)
Qinghao Tang discovered that QEMU incorrectly handled receiving certain
packets in the NE2000 network driver. A malicious guest could use this
issue to cause the QEMU process to hang, resulting in a denial of service.
(CVE-2015-5278)
Qinghao Tang discovered that QEMU incorrectly handled receiving certain
packets in the NE2000 network driver. A malicious guest could use this
issue to cause a denial of service, or possibl
Debian
CVE-2015-5239: qemu - Integer overflow in the VNC display driver in QEMU before 2.1.0 allows attachers...
vendor_debian·2015·CVSS 6.5
CVE-2015-5239 [MEDIUM] CVE-2015-5239: qemu - Integer overflow in the VNC display driver in QEMU before 2.1.0 allows attachers...
Integer overflow in the VNC display driver in QEMU before 2.1.0 allows attachers to cause a denial of service (process crash) via a CLIENT_CUT_TEXT message, which triggers an infinite loop.
Scope: local
bookworm: resolved (fixed in 2.1+dfsg-1)
bullseye: resolved (fixed in 2.1+dfsg-1)
forky: resolved (fixed in 2.1+dfsg-1)
sid: resolved (fixed in 2.1+dfsg-1)
trixie: resolved (fixed in 2.1+dfsg-1)
Red Hat
qemu-kvm: Integer overflow in vnc_client_read() and protocol_client_msg()
vendor_redhat·2014-06-30·CVSS 6.5
CVE-2015-5239 [MEDIUM] CWE-835 qemu-kvm: Integer overflow in vnc_client_read() and protocol_client_msg()
qemu-kvm: Integer overflow in vnc_client_read() and protocol_client_msg()
Integer overflow in the VNC display driver in QEMU before 2.1.0 allows attachers to cause a denial of service (process crash) via a CLIENT_CUT_TEXT message, which triggers an infinite loop.
An integer overflow issue was found in the VNC display driver of the QEMU emulator, which could be used by a privileged guest user to create a denial of service attack. The overflow occurred when processing a CLIENT_CUT_TEXT message with too large a payload size. The integer overflow led to an infinite loop inside the VNC driver, eventually crashing the QEMU process on the host.
Statement: This issue affects the versions of kvm and xen packages as shipped with Red Hat Enterprise Linux 5.
This issue affects the versions of the q
GHSA
GHSA-9mm7-7f84-98c9: Integer overflow in the VNC display driver in QEMU before 2
ghsa_unreviewed·2022-05-24
CVE-2015-5239 [MEDIUM] CWE-835 GHSA-9mm7-7f84-98c9: Integer overflow in the VNC display driver in QEMU before 2
Integer overflow in the VNC display driver in QEMU before 2.1.0 allows attachers to cause a denial of service (process crash) via a CLIENT_CUT_TEXT message, which triggers an infinite loop.
OSV
CVE-2015-5239: Integer overflow in the VNC display driver in QEMU before 2
osv·2020-01-23·CVSS 6.5
CVE-2015-5239 [MEDIUM] CVE-2015-5239: Integer overflow in the VNC display driver in QEMU before 2
Integer overflow in the VNC display driver in QEMU before 2.1.0 allows attachers to cause a denial of service (process crash) via a CLIENT_CUT_TEXT message, which triggers an infinite loop.
OSV
qemu, qemu-kvm vulnerabilities
osv·2015-09-24·CVSS 6.5
CVE-2015-5239 [MEDIUM] qemu, qemu-kvm vulnerabilities
qemu, qemu-kvm vulnerabilities
Lian Yihan discovered that QEMU incorrectly handled certain payload
messages in the VNC display driver. A malicious guest could use this issue
to cause the QEMU process to hang, resulting in a denial of service. This
issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2015-5239)
Qinghao Tang discovered that QEMU incorrectly handled receiving certain
packets in the NE2000 network driver. A malicious guest could use this
issue to cause the QEMU process to hang, resulting in a denial of service.
(CVE-2015-5278)
Qinghao Tang discovered that QEMU incorrectly handled receiving certain
packets in the NE2000 network driver. A malicious guest could use this
issue to cause a denial of service, or possibly execute arbitrary code on
the host as the user ru
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2015-5239 xen: qemu-kvm: Integer overflow in vnc_client_read() and protocol_client_msg() [fedora-all]
bugzilla·2015-09-02·CVSS 6.5
CVE-2015-5239 [MEDIUM] CVE-2015-5239 xen: qemu-kvm: Integer overflow in vnc_client_read() and protocol_client_msg() [fedora-all]
CVE-2015-5239 xen: qemu-kvm: Integer overflow in vnc_client_read() and protocol_client_msg() [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects mul
Bugzilla
CVE-2015-5239 qemu-kvm: Integer overflow in vnc_client_read() and protocol_client_msg()
bugzilla·2015-08-27·CVSS 6.5
CVE-2015-5239 [MEDIUM] CVE-2015-5239 qemu-kvm: Integer overflow in vnc_client_read() and protocol_client_msg()
CVE-2015-5239 qemu-kvm: Integer overflow in vnc_client_read() and protocol_client_msg()
Qemu emulator built with the VNC display driver is vulnerable to an infinite loop issue. It could occur while processing a CLIENT_CUT_TEXT message with specially crafted payload message.
A privileged guest user could use this flaw to crash the Qemu process instance on the host, resulting in DoS.
Upstream fix:
-> git.qemu.org/?p=qemu.git;a=commit;h=f9a70e79391f6d7c2a912d785239ee8effc1922d
Discussion:
Statement:
This issue affects the versions of kvm and xen packages as shipped with Red Hat Enterprise Linux 5.
This issue affects the versions of the qemu-kvm packages as shipped with Red Hat Enterprise Linux 6 and 7.
This issue affects the Red Hat Enterprise Linux 6 based versions of qemu-kvm-rhev p
http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168077.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-October/168646.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-October/168671.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-10/msg00026.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-11/msg00005.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-11/msg00011.htmlhttp://www.openwall.com/lists/oss-security/2015/09/02/7http://www.ubuntu.com/usn/USN-2745-1https://github.com/qemu/qemu/commit/f9a70e79391f6d7c2a912d785239ee8effc1922dhttps://www.arista.com/en/support/advisories-notices/security-advisories/1188-security-advisory-14http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168077.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-October/168646.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-October/168671.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-10/msg00026.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-11/msg00005.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-11/msg00011.htmlhttp://www.openwall.com/lists/oss-security/2015/09/02/7http://www.ubuntu.com/usn/USN-2745-1https://github.com/qemu/qemu/commit/f9a70e79391f6d7c2a912d785239ee8effc1922dhttps://www.arista.com/en/support/advisories-notices/security-advisories/1188-security-advisory-14
2020-01-23
Published