CVE-2015-5279
published 2015-09-28CVE-2015-5279: Heap-based buffer overflow in the ne2000_receive function in hw/net/ne2000.c in QEMU before 2.4.0.1 allows guest OS users to cause a denial of service…
PriorityP334high7.2CVSS 2.0
AVLACLAuNCCICAC
EPSS
1.05%
60.6th percentile
Heap-based buffer overflow in the ne2000_receive function in hw/net/ne2000.c in QEMU before 2.4.0.1 allows guest OS users to cause a denial of service (instance crash) or possibly execute arbitrary code via vectors related to receiving packets.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | qemu | < qemu 1:2.4+dfsg-3 (bookworm) | qemu 1:2.4+dfsg-3 (bookworm) |
| qemu | qemu | <= 2.4.0 | — |
| qemu | qemu | >= 0 < 1:2.4+dfsg-3 | 1:2.4+dfsg-3 |
| qemu | qemu | >= 0 < 1:2.4+dfsg-3 | 1:2.4+dfsg-3 |
| qemu | qemu | >= 0 < 1:2.4+dfsg-3 | 1:2.4+dfsg-3 |
| qemu | qemu | >= 0 < 1:2.4+dfsg-3 | 1:2.4+dfsg-3 |
| qemu | qemu | >= 0 < 2.0.0+dfsg-2ubuntu1.19 | 2.0.0+dfsg-2ubuntu1.19 |
CVSS provenance
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
osv7.2HIGH
vendor_debian7.2HIGH
vendor_redhat7.2HIGH
vendor_ubuntu6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-cppw-7q6r-phh2: Heap-based buffer overflow in the ne2000_receive function in hw/net/ne2000
ghsa_unreviewed·2022-05-13
CVE-2015-5279 [HIGH] CWE-119 GHSA-cppw-7q6r-phh2: Heap-based buffer overflow in the ne2000_receive function in hw/net/ne2000
Heap-based buffer overflow in the ne2000_receive function in hw/net/ne2000.c in QEMU before 2.4.0.1 allows guest OS users to cause a denial of service (instance crash) or possibly execute arbitrary code via vectors related to receiving packets.
OSV
CVE-2015-5279: Heap-based buffer overflow in the ne2000_receive function in hw/net/ne2000
osv·2015-09-28·CVSS 7.2
CVE-2015-5279 [HIGH] CVE-2015-5279: Heap-based buffer overflow in the ne2000_receive function in hw/net/ne2000
Heap-based buffer overflow in the ne2000_receive function in hw/net/ne2000.c in QEMU before 2.4.0.1 allows guest OS users to cause a denial of service (instance crash) or possibly execute arbitrary code via vectors related to receiving packets.
OSV
qemu, qemu-kvm vulnerabilities
osv·2015-09-24·CVSS 6.5
CVE-2015-5239 [MEDIUM] qemu, qemu-kvm vulnerabilities
qemu, qemu-kvm vulnerabilities
Lian Yihan discovered that QEMU incorrectly handled certain payload
messages in the VNC display driver. A malicious guest could use this issue
to cause the QEMU process to hang, resulting in a denial of service. This
issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2015-5239)
Qinghao Tang discovered that QEMU incorrectly handled receiving certain
packets in the NE2000 network driver. A malicious guest could use this
issue to cause the QEMU process to hang, resulting in a denial of service.
(CVE-2015-5278)
Qinghao Tang discovered that QEMU incorrectly handled receiving certain
packets in the NE2000 network driver. A malicious guest could use this
issue to cause a denial of service, or possibly execute arbitrary code on
the host as the user ru
Ubuntu
QEMU vulnerabilities
vendor_ubuntu·2015-09-24·CVSS 6.5
CVE-2015-5239 [MEDIUM] QEMU vulnerabilities
Title: QEMU vulnerabilities
Summary: Several security issues were fixed in QEMU.
Lian Yihan discovered that QEMU incorrectly handled certain payload
messages in the VNC display driver. A malicious guest could use this issue
to cause the QEMU process to hang, resulting in a denial of service. This
issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2015-5239)
Qinghao Tang discovered that QEMU incorrectly handled receiving certain
packets in the NE2000 network driver. A malicious guest could use this
issue to cause the QEMU process to hang, resulting in a denial of service.
(CVE-2015-5278)
Qinghao Tang discovered that QEMU incorrectly handled receiving certain
packets in the NE2000 network driver. A malicious guest could use this
issue to cause a denial of service, or possibl
Red Hat
qemu: Heap overflow vulnerability in ne2000_receive() function
vendor_redhat·2015-09-15·CVSS 7.2
CVE-2015-5279 [HIGH] CWE-122 qemu: Heap overflow vulnerability in ne2000_receive() function
qemu: Heap overflow vulnerability in ne2000_receive() function
Heap-based buffer overflow in the ne2000_receive function in hw/net/ne2000.c in QEMU before 2.4.0.1 allows guest OS users to cause a denial of service (instance crash) or possibly execute arbitrary code via vectors related to receiving packets.
A heap buffer overflow flaw was found in the way QEMU's NE2000 NIC emulation implementation handled certain packets received over the network. A privileged user inside a guest could use this flaw to crash the QEMU instance (denial of service) or potentially execute arbitrary code on the host.
Statement: This issue affects the versions of kvm and xen packages as shipped with Red Hat Enterprise Linux 5.
This issue affects the versions of the qemu-kvm packages as shipped with Red Hat Ent
Debian
CVE-2015-5279: qemu - Heap-based buffer overflow in the ne2000_receive function in hw/net/ne2000.c in ...
vendor_debian·2015·CVSS 7.2
CVE-2015-5279 [HIGH] CVE-2015-5279: qemu - Heap-based buffer overflow in the ne2000_receive function in hw/net/ne2000.c in ...
Heap-based buffer overflow in the ne2000_receive function in hw/net/ne2000.c in QEMU before 2.4.0.1 allows guest OS users to cause a denial of service (instance crash) or possibly execute arbitrary code via vectors related to receiving packets.
Scope: local
bookworm: resolved (fixed in 1:2.4+dfsg-3)
bullseye: resolved (fixed in 1:2.4+dfsg-3)
forky: resolved (fixed in 1:2.4+dfsg-3)
sid: resolved (fixed in 1:2.4+dfsg-3)
trixie: resolved (fixed in 1:2.4+dfsg-3)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2015-5279 qemu: Heap overflow vulnerability in ne2000_receive() function [fedora-all]
bugzilla·2015-09-15·CVSS 7.2
CVE-2015-5279 [HIGH] CVE-2015-5279 qemu: Heap overflow vulnerability in ne2000_receive() function [fedora-all]
CVE-2015-5279 qemu: Heap overflow vulnerability in ne2000_receive() function [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported
Bugzilla
CVE-2015-5279 xen: qemu: Heap overflow vulnerability in ne2000_receive() function [fedora-all]
bugzilla·2015-09-15·CVSS 7.2
CVE-2015-5279 [HIGH] CVE-2015-5279 xen: qemu: Heap overflow vulnerability in ne2000_receive() function [fedora-all]
CVE-2015-5279 xen: qemu: Heap overflow vulnerability in ne2000_receive() function [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple suppo
Bugzilla
CVE-2015-5279 qemu: Heap overflow vulnerability in ne2000_receive() function
bugzilla·2015-08-25·CVSS 7.2
CVE-2015-5279 [HIGH] CVE-2015-5279 qemu: Heap overflow vulnerability in ne2000_receive() function
CVE-2015-5279 qemu: Heap overflow vulnerability in ne2000_receive() function
Qemu emulator built with the NE2000 NIC emulation support is vulnerable to a heap buffer overflow issue. It could occur when receiving packets over the network.
A privileged user inside guest could use this flaw to crash the Qemu instance or potentially execute arbitrary code on the host.
Upstream fix:
-> https://lists.gnu.org/archive/html/qemu-devel/2015-09/msg03984.html
Reference:
-> http://www.openwall.com/lists/oss-security/2015/09/15/3
Discussion:
Created attachment 1066783
Crash report
---
Statement:
This issue affects the versions of kvm and xen packages as shipped with Red Hat Enterprise Linux 5.
This issue affects the versions of the qemu-kvm packages as shipped with Red Hat Enterprise Linux 6.
http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=7aa2bcad0ca837dd6d4bf4fa38a80314b4a6b755http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169036.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-October/169039.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-September/167369.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-10/msg00019.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1896.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1923.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1924.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1925.htmlhttp://www.debian.org/security/2015/dsa-3361http://www.debian.org/security/2015/dsa-3362http://www.openwall.com/lists/oss-security/2015/09/15/3http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.htmlhttp://www.securityfocus.com/bid/76746http://www.securitytracker.com/id/1033569https://lists.gnu.org/archive/html/qemu-devel/2015-09/msg03984.htmlhttps://security.gentoo.org/glsa/201602-01https://www.arista.com/en/support/advisories-notices/security-advisories/1188-security-advisory-14http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=7aa2bcad0ca837dd6d4bf4fa38a80314b4a6b755http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169036.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-October/169039.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-September/167369.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-10/msg00019.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1896.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1923.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1924.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1925.htmlhttp://www.debian.org/security/2015/dsa-3361http://www.debian.org/security/2015/dsa-3362http://www.openwall.com/lists/oss-security/2015/09/15/3http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.htmlhttp://www.securityfocus.com/bid/76746http://www.securitytracker.com/id/1033569https://lists.gnu.org/archive/html/qemu-devel/2015-09/msg03984.htmlhttps://security.gentoo.org/glsa/201602-01https://www.arista.com/en/support/advisories-notices/security-advisories/1188-security-advisory-14
2015-09-28
Published