PT-2023-8255 · Qemu+10 · Qemu+10

Fiona Ebner + 1 · Publicado 2023-12-16 · Atualizado 2025-05-02 · CVE-2023-6683

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions QEMU (affected versions not specified)

Description A flaw was found in the QEMU built-in VNC server while processing ClientCutText messages. The qemu clipboard request() function can be reached before vnc server cut text caps() was called and had the chance to initialize the clipboard peer, leading to a NULL pointer dereference. This could allow a malicious authenticated VNC client to crash QEMU and trigger a denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

NULL Pointer Dereference

Enumeração de Fraquezas

CWE-476

Identificadores relacionados

ALSA-2024:2135

ALT-PU-2024-10230

ALT-PU-2024-13687

ALT-PU-2024-14149

ALT-PU-2024-3359

ALT-PU-2024-6235

ALT-PU-2024-7201

AZL-40048

AZL-43054

BDU:2024-00308

CESA-2024_2962

CVE-2023-6683

INFSA-2024_2135

INFSA-2024_2962

MGASA-2024-0387

OESA-2024-1310

OESA-2024-1311

OESA-2024-1312

OESA-2024-1313

OPENSUSE-SU-2024_1394-1

OPENSUSE-SU-2024_1438-1

RHSA-2024:2135

RHSA-2024:2962

RHSA-2024_2135

RHSA-2024_2962

RLSA-2024:2135

RLSA-2024:2962

SUSE-SU-2024:1394-1

SUSE-SU-2024:1438-1

SUSE-SU-2024:1438-2

USN-6954-1

Produtos afetados

Alt Linux

Almalinux

Astra Linux

Centos

Linuxmint

Qemu

Red Hat

Red Os

Rocky Linux

Suse

Ubuntu

Referências · 95

• https://bugzilla.redhat.com/2254825 · Nota
• https://bdu.fstec.ru/vul/2024-00308 · Nota de Segurança
• https://linux.oracle.com/errata/ELSA-2024-2962.html · Aviso do Fabricante
• https://lists.opensuse.org/archives/list/[e-mail]/message/ES5DXAAMYUC767MUW4BPRP6ZPDL6SUW6 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-6683 · Nota de Segurança
• https://osv.dev/vulnerability/AZL-43054 · Aviso do Fabricante
• https://osv.dev/vulnerability/ALSA-2024:2135 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-3019 · Nota de Segurança
• https://suse.com/security/cve/CVE-2024-3447 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-6683 · Aviso do Fabricante
• https://security.netapp.com/advisory/ntap-20240223-0001 · Nota
• https://ubuntu.com/security/notices/USN-6954-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/USN-6954-1 · Aviso do Fabricante
• https://twitter.com/linuxpatch/status/1823257540836184238 · Publicação no Twitter
• https://osv.dev/vulnerability/OESA-2024-1312 · Aviso do Fabricante