PT-2017-18042 · Qemu+5 · Qemu+5

Published 2017-01-17 · Updated 2021-08-04 · CVE-2017-7980

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Qemu versions 2.8 and earlier

Description The issue allows local guest OS users to execute arbitrary code or cause a denial of service via vectors related to a VNC client updating its display after a VGA operation, specifically in the Cirrus CLGD 54xx VGA Emulator.

Recommendations For Qemu versions 2.8 and earlier, update to a version later than 2.8 to resolve the issue.

Exploit

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

ALT-PU-2017-1043

CESA-2017_1206

CESA-2017_1430

CVE-2017-7980

DLA-1035-1

DLA-1497-1

DLA-939-1

OPENSUSE-SU-2017_1872-1

RHSA-2017:0980

RHSA-2017:0981

RHSA-2017:0982

RHSA-2017:0983

RHSA-2017:0984

RHSA-2017:0988

RHSA-2017:1205

RHSA-2017:1206

RHSA-2017:1430

RHSA-2017:1441

RHSA-2017_1206

RHSA-2017_1430

SUSE-SU-2017:1145-1

SUSE-SU-2017:1146-1

SUSE-SU-2017:1147-1

SUSE-SU-2017:1148-1

SUSE-SU-2017:1774-1

SUSE-SU-2017:2946-1

SUSE-SU-2017:2963-1

SUSE-SU-2017:2969-1

SUSE-SU-2017:3084-1

USN-3289-1

Affected Products

Alt Linux

Centos

Qemu

Red Hat

Suse

Ubuntu

References · 356

• 🔥 https://github.com/qazbnm456/awesome-cve-poc/blob/master/CVE-2017-5715.md · Exploit
• 🔥 https://github.com/opsxcq/exploit-cve-2017-5715 · Exploit
• http://ubuntu.com/usn/usn-3289-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15289 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2017-7980 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:0984 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8577 · Security Note
• https://ubuntu.com/security/CVE-2017-8309 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14167 · Security Note
• https://bdu.fstec.ru/vul/2021-03332 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7377 · Security Note
• https://bdu.fstec.ru/vul/2017-00071 · Security Note
• https://bdu.fstec.ru/vul/2017-00069 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2017:1148-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7155 · Security Note