Buffer overflow in Qemu

CVE-2013-4149

Buffer overflow in virtio_net_load function in net/virtio-net.c in QEMU 1.3.0 through 1.7.x before 1.7.2 might allow remote attackers to execute arbitrary code via a large MAC table.

Vulnerability class: Buffer Overflow

EPSS: 0.053 (91.7th percentile) — read the EPSS interpretation.

Affected products

Qemu — versions 1.3.0, 1.3.1, 1.4.1
N/a — versions n/a

Weakness classification (CWE)

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer

References

secalert@redhat.com (mailing-list, x_refsource_MLIST, Patch)
secalert@redhat.com (x_refsource_REDHAT, vendor-advisory, Patch, Vendor Advisory)
secalert@redhat.com (vendor-advisory, x_refsource_FEDORA)
secalert@redhat.com (x_refsource_CONFIRM)