CVE-2015-5279 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Qemu

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory BufferCWE-122 — Heap-based Buffer Overflow10 documents7 sources
Severity
7.2HIGHNVD
OSV6.5
EPSS
10.2%
top 6.85%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
QemuDebian Qemu
Timeline
PublishedSep 28
Latest updateMay 13

Description

Heap-based buffer overflow in the ne2000_receive function in hw/net/ne2000.c in QEMU before 2.4.0.1 allows guest OS users to cause a denial of service (instance crash) or possibly execute arbitrary code via vectors related to receiving packets.

CVSS vector

AV:L/AC:L/C:C/I:C/A:CExploitability: 3.9 | Impact: 10.0

Affected Packages4 packages

▶debiandebian/qemu< qemu 1:2.4+dfsg-3 (bookworm)
▶Debianqemu/qemu< 1:2.4+dfsg-3+3
▶Ubuntuqemu/qemu< 2.0.0+dfsg-2ubuntu1.19
▶NVDqemu/qemu2.4.0

🔴Vulnerability Details

3
GHSA
GHSA-cppw-7q6r-phh2: Heap-based buffer overflow in the ne2000_receive function in hw/net/ne2000↗2022-05-13
▶
OSV
CVE-2015-5279: Heap-based buffer overflow in the ne2000_receive function in hw/net/ne2000↗2015-09-28
▶
OSV
qemu, qemu-kvm vulnerabilities↗2015-09-24
▶

📋Vendor Advisories

3
Ubuntu
QEMU vulnerabilities↗2015-09-24
▶
Red Hat
qemu: Heap overflow vulnerability in ne2000_receive() function↗2015-09-15
▶
Debian
CVE-2015-5279: qemu - Heap-based buffer overflow in the ne2000_receive function in hw/net/ne2000.c in ...↗2015
▶

💬Community

3
Bugzilla
CVE-2015-5279 qemu: Heap overflow vulnerability in ne2000_receive() function [fedora-all]↗2015-09-15
▶
Bugzilla
CVE-2015-5279 xen: qemu: Heap overflow vulnerability in ne2000_receive() function [fedora-all]↗2015-09-15
▶
Bugzilla
CVE-2015-5279 qemu: Heap overflow vulnerability in ne2000_receive() function↗2015-08-25
▶