Bug 1255896 (CVE-2015-5225)
| Summary: | CVE-2015-5225 Qemu: ui: vnc: heap memory corruption in vnc_refresh_server_surface | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Prasad Pandit <ppandit> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | abaron, ailan, amit.shah, aortega, apevec, areis, ayoung, berrange, carnil, cfergeau, chrisw, dallan, drjones, dwmw2, gkotton, gmollett, huding, imammedo, itamar, jen, jforbes, jschluet, juzhang, knoel, kraxel, lhh, lpeer, markmc, m.a.young, mkenneth, mrezanin, mst, mst, oblaut, pbonzini, rbalakri, rbryant, rjones, rkrcmar, sclewis, security-response-team, slong, tdecacqu, tspeetje, virt-maint, virt-maint, vkaigoro, vkuznets, xen-maint, xfu, yeylon |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: |
A heap-based buffer overflow issue was found in the QEMU emulator's VNC display driver. It could occur while refreshing the VNC server's display surface using the vnc_refresh_server_surface() routine. A privileged guest user could use this flaw to corrupt the heap memory and crash the QEMU process instance, or to potentially use it to execute arbitrary code on the host.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2015-10-15 20:03:57 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1255897, 1255898, 1255899, 1259190, 1259191, 1259192 | ||
| Bug Blocks: | 1253307 | ||
|
Description
Prasad Pandit
2015-08-21 19:57:43 UTC
Created qemu tracking bugs for this issue: Affects: fedora-all [bug 1255899] Statement: This issue does not affect the versions of kvm and xen packages as shipped with Red Hat Enterprise Linux 5. This issue does not affect the versions of the qemu-kvm packages as shipped with Red Hat Enterprise Linux 6 and 7. This issue does not affect the Red Hat Enterprise Linux 6 based versions of qemu-kvm-rhev packages as shipped with Red Hat Enterprise Virtualization 3. This issue does affect the Red Hat Enterprise Linux 7 based versions of the qemu-kvm-rhev packages as shipped with Red Hat Enterprise Virtualization 3. Future updates for this release may address this flaw. Acknowledgements: Red Hat would like to thank Mr Qinghao Tang from QIHU 360 Inc. and Mr Zuozhi from Alibaba Inc. for reporting this issue. qemu-2.4.0-2.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report. This issue has been addressed in the following products: OpenStack 5 for RHEL 7 OpenStack 6 for RHEL 7 OpenStack 7 For RHEL 7 Via RHSA-2015:1772 https://rhn.redhat.com/errata/RHSA-2015-1772.html qemu-2.3.1-3.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report. This issue has been addressed in the following products: RHEV-H and Agents for RHEL-7 Via RHSA-2015:1837 https://rhn.redhat.com/errata/RHSA-2015-1837.html qemu-2.1.3-11.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report. |