Bug 466890 (CVE-2008-4539)

Summary: CVE-2008-4539 kvm/qemu/xen: Incomplete upstream fix for CVE-2007-1320
Product: [Other] Security Response Reporter: Jan Lieskovsky <jlieskov>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: armbru, bburns, berrange, chrisw, jrusnack, security-response-team
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2010-12-24 00:14:17 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 467680, 467681, 467682, 467683    
Bug Blocks: 237342    
Attachments:
Description Flags
Proposed actualized upstream qemu patch to resolve the Cirrus LGD-54XX "bitblt" heap overflow (CVE-2007-1320) none

Description Jan Lieskovsky 2008-10-14 11:37:30 UTC 
Created attachment 320281 [details]
Proposed actualized upstream qemu patch to resolve the Cirrus LGD-54XX "bitblt" heap overflow (CVE-2007-1320)

Jan Niehusmann discovered that the upstream fix for the CVE-2007-1320 is
incomplete and still allows local users to cause a heap-based buffer overlow,
when connecting via the VNC console.

Steps to reproduce:

No reproducer.

Upstream qemu patch for the initial CVE-2007-1320 issue:
 https://svn.pardus.org.tr/pardus/2007/applications/emulators/qemu/files/CVE-2007-1320.patch

Proposed upstream correction of this patch - see attachment.
Comment 3 Tomas Hoger 2008-11-11 14:57:30 UTC 
QEMU upstream commit:
http://git.kernel.dk/?p=qemu.git;a=commitdiff;h=65d35a09979e63541afc5bfc595b9f1b1b4ae069

More on current status of this issue and original CVE-2007-1320 wrt Fedora
qemu/kvm packages is in:
  https://bugzilla.redhat.com/show_bug.cgi?id=237342#c20
Comment 4 Fedora Update System 2008-12-22 19:51:46 UTC 
kvm-65-15.fc9 has been submitted as an update for Fedora 9.
http://admin.fedoraproject.org/updates/kvm-65-15.fc9
Comment 5 Fedora Update System 2008-12-24 12:58:04 UTC 
kvm-65-15.fc9 has been pushed to the Fedora 9 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 6 Fedora Update System 2008-12-24 18:40:43 UTC 
kvm-65-15.fc9 has been pushed to the Fedora 9 stable repository.  If problems still persist, please make note of it in this bug report.