PT-2014-2164 · Qemu+2 · Qemu+2

Petr Matousek · Published 2011-12-06 · Updated 2023-02-13 · CVE-2011-4111

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:A/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions QEMU versions prior to 0.15.2 QEMU versions 1.x prior to 1.0-rc4

Description The issue is related to a buffer overflow in the ccid card vscard handle message function, which can be triggered by a crafted VSC ATR message. This could lead to a denial of service (crash) and potentially allow the execution of arbitrary code.

Recommendations For QEMU versions prior to 0.15.2, update to version 0.15.2 or later. For QEMU versions 1.x prior to 1.0-rc4, update to version 1.0-rc4 or later.

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CESA-2011_1777

CESA-2011_1801

CVE-2011-4111

RHSA-2011:1777

RHSA-2011:1801

RHSA-2011_1777

RHSA-2011_1801

Affected Products

Centos

Qemu

Red Hat

References · 24

• https://osv.dev/vulnerability/DEBIAN-CVE-2011-4111 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4111 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2011-4111 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2011-4111 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2011-1777.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-4111 · Security Note
• http://rhn.redhat.com/errata/RHSA-2011-1777.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2011-1801.html · Vendor Advisory
• http://git.qemu.org/?p=qemu-stable-0.15.git%3Ba=log · Note
• https://rhn.redhat.com/errata/RHSA-2011-1801.html · Note
• https://access.redhat.com/errata/RHSA-2011:1777 · Note
• https://lists.centos.org/pipermail/centos-announce/2011-December/067825.html · Note
• https://lists.centos.org/pipermail/centos-announce/2011-December/055269.html · Note
• https://access.redhat.com/errata/RHSA-2011:1801 · Note
• https://rhn.redhat.com/errata/RHSA-2011-1777.html · Note