Buffer overflow in Qemu
CVE-2015-5225
Buffer overflow in the vnc_refresh_server_surface function in the VNC display driver in QEMU before 2.4.0.1 allows guest users to cause a denial of service (heap memory corruption and process crash) or possibly execute arbitrary code on the host via unspecified vectors, related to refreshing the server display surface.
Vulnerability class: Buffer Overflow
EPSS: 0.005 (41.9th percentile) — read the EPSS interpretation.
Affected products
- Qemu
- Fedoraproject Fedora — versions 21, 22, 23
- Redhat Openstack — versions 5.0, 6.0, 7.0
- N/a — versions n/a
Weakness classification (CWE)
References
- secalert@redhat.com (Vendor Advisory, mailing-list, x_refsource_MLIST, Patch)
- secalert@redhat.com (mailing-list, x_refsource_MLIST)
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
- secalert@redhat.com (vendor-advisory, x_refsource_FEDORA)
- secalert@redhat.com (vendor-advisory, x_refsource_DEBIAN)
- secalert@redhat.com (vendor-advisory, x_refsource_FEDORA)
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
- secalert@redhat.com (vdb-entry, x_refsource_SECTRACK)
- secalert@redhat.com (mailing-list, x_refsource_MLIST)
- secalert@redhat.com (vdb-entry, x_refsource_BID)