CVE-2017-7980 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Qemu

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory BufferCWE-787 — Out-of-bounds Write10 documents8 sources
Severity
7.8HIGHNVD
EPSS
0.2%
top 62.19%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
11
QemuCanonical Ubuntu LinuxDebian Linux+8 more
Timeline
PublishedJul 25
Latest updateMay 13

Description

Heap-based buffer overflow in Cirrus CLGD 54xx VGA Emulator in Quick Emulator (Qemu) 2.8 and earlier allows local guest OS users to execute arbitrary code or cause a denial of service (crash) via vectors related to a VNC client updating its display after a VGA operation.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages7 packages

▶Debianqemu/qemu< 1:2.8+dfsg-4+3
▶NVDqemu/qemu2.8
▶NVDredhat/openstack6 versions+5

Also affects: Debian Linux 8.0, Ubuntu Linux 14.04, 16.04, 16.10, 17.04, Enterprise Linux 7.3, 7.4, 7.6, 7.5

Patches

Patch: www.openwall.com ↗Patch: bugzilla.redhat.com ↗Patch: security.gentoo.org ↗

🔴Vulnerability Details

3
GHSA
GHSA-w847-jx6c-6j35: Heap-based buffer overflow in Cirrus CLGD 54xx VGA Emulator in Quick Emulator (Qemu) 2↗2022-05-13
▶
OSV
CVE-2017-7980: Heap-based buffer overflow in Cirrus CLGD 54xx VGA Emulator in Quick Emulator (Qemu) 2↗2017-07-25
▶
CVEList
CVE-2017-7980: Heap-based buffer overflow in Cirrus CLGD 54xx VGA Emulator in Quick Emulator (Qemu) 2↗2017-07-25
▶

📋Vendor Advisories

3
Ubuntu
QEMU vulnerabilities↗2017-05-16
▶
Red Hat
Qemu: display: cirrus: OOB r/w access issues in bitblt routines↗2017-03-15
▶
Debian
CVE-2017-7980: qemu - Heap-based buffer overflow in Cirrus CLGD 54xx VGA Emulator in Quick Emulator (Q...↗2017
▶

💬Community

3
Bugzilla
CVE-2017-7980 Qemu: display: cirrus: OOB r/w access issues in bitblt routines [fedora-all]↗2017-04-21
▶
Bugzilla
CVE-2017-7980 Qemu: display: cirrus: OOB r/w access issues in bitblt routines↗2017-04-21
▶
Bugzilla
CVE-2017-7980 xen: Qemu: display: cirrus: OOB r/w access issues in bitblt routines [fedora-all]↗2017-04-21
▶
CVE-2017-7980 — Qemu vulnerability | cvebase