CVE-2007-5729

Publication date 30 October 2007

Last updated 24 July 2024

Ubuntu priority

Medium

Why this priority?

The NE2000 emulator in QEMU 0.8.2 allows local users to execute arbitrary code by writing Ethernet frames with a size larger than the MTU to the EN0_TCNT register, which triggers a heap-based buffer overflow in the slirp library, aka NE2000 "mtu" heap overflow. NOTE: some sources have used CVE-2007-1321 to refer to this issue as part of "NE2000 network driver and the socket code," but this is the correct identifier for the mtu overflow vulnerability.

Read the notes from the security team

Status

Package Ubuntu Release Status
kvm 9.10 karmic Not in release
9.04 jaunty
Fixed 1:62+dfsg-0ubuntu3
8.10 intrepid
Fixed 1:62+dfsg-0ubuntu3
8.04 LTS hardy
Fixed 1:62+dfsg-0ubuntu3
7.10 gutsy Ignored end of life, was needed
7.04 feisty Ignored end of life, was needed
6.10 edgy Not in release
6.06 LTS dapper Not in release
qemu 9.10 karmic Not in release
9.04 jaunty
Fixed 0.9.0-2
8.10 intrepid
Fixed 0.9.0-2
8.04 LTS hardy
Fixed 0.9.0-2
7.10 gutsy
Fixed 0.9.0-2
7.04 feisty Ignored end of life, was needed
6.10 edgy Ignored end of life, was needed
6.06 LTS dapper Ignored end of life
qemu-kvm 9.10 karmic
Fixed 0.9.0-2
9.04 jaunty Not in release
8.10 intrepid Not in release
8.04 LTS hardy Not in release
6.06 LTS dapper Not in release

Notes

jdstrand

kvm includes qemu (0.9.1 on hardy) kvm does not use ne2000 by default Debian used CVE-2007-1321 for this issue

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
qemu