bits_per_pixel that are less than 8 could result in accessing non-initialized buffers later in the code due to the expectation that bytes_per_pixel value that is used to initialize these buffers is never zero. An attacker having access to the guest's VNC console could use this flaw to crash the guest. Acknowledgements: Red Hat would like to thank James Spadaro of Cisco for reporting this issue.
Upstream patch submission: http://lists.gnu.org/archive/html/qemu-devel/2014-10/msg03210.html
Statement: This issue did not affect the kvm package as shipped with Red Hat Enterprise Linux 5. Future qemu-kvm updates for Red Hat Enterprise Linux 6 and 7 may address this issue.
Created qemu tracking bugs for this issue: Affects: fedora-all [bug 1157647]
upstream commit e6908bfe8e07f2b452e78e677da1b45b1c0f6829
qemu-2.1.2-6.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.
qemu-1.6.2-10.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2015:0349 https://rhn.redhat.com/errata/RHSA-2015-0349.html
This issue has been addressed in the following products: RHEV-H and Agents for RHEL-7 Via RHSA-2015:0624 https://rhn.redhat.com/errata/RHSA-2015-0624.html