CVE-2017-2615

Published: 01 February 2017

Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue. It could occur while copying VGA data via bitblt copy in backward mode. A privileged user inside a guest could use this flaw to crash the QEMU process resulting in DoS or potentially execute arbitrary code on the host with privileges of QEMU process on the host.

Priority

Medium

CVSS 3 base score: 9.1

Status

Package Release Status
qemu
Launchpad, Ubuntu, Debian
Upstream Needed

Ubuntu 21.04 (Hirsute Hippo) Not vulnerable
(1:2.8+dfsg-3ubuntu2)
Ubuntu 20.10 (Groovy Gorilla) Not vulnerable
(1:2.8+dfsg-3ubuntu2)
Ubuntu 20.04 LTS (Focal Fossa) Not vulnerable
(1:2.8+dfsg-3ubuntu2)
Ubuntu 18.04 LTS (Bionic Beaver) Not vulnerable
(1:2.8+dfsg-3ubuntu2)
Ubuntu 16.04 ESM (Xenial Xerus)
Released (1:2.5+dfsg-5ubuntu10.11)
Ubuntu 14.04 ESM (Trusty Tahr)
Released (2.0.0+dfsg-2ubuntu1.33)
Patches:
Upstream: http://git.qemu-project.org/?p=qemu.git;a=commit;h=62d4c6bd5263bb8413a06c80144fc678df6dfb64
qemu-kvm
Launchpad, Ubuntu, Debian
Upstream Needed

Ubuntu 21.04 (Hirsute Hippo) Does not exist

Ubuntu 20.10 (Groovy Gorilla) Does not exist

Ubuntu 20.04 LTS (Focal Fossa) Does not exist

Ubuntu 18.04 LTS (Bionic Beaver) Does not exist

Ubuntu 16.04 ESM (Xenial Xerus) Does not exist

Ubuntu 14.04 ESM (Trusty Tahr) Does not exist

xen
Launchpad, Ubuntu, Debian
Upstream Needed

Ubuntu 21.04 (Hirsute Hippo) Not vulnerable
(uses system qemu)
Ubuntu 20.10 (Groovy Gorilla) Not vulnerable
(uses system qemu)
Ubuntu 20.04 LTS (Focal Fossa) Not vulnerable
(uses system qemu)
Ubuntu 18.04 LTS (Bionic Beaver) Not vulnerable
(uses system qemu)
Ubuntu 16.04 ESM (Xenial Xerus) Not vulnerable
(uses system qemu)
Ubuntu 14.04 ESM (Trusty Tahr) Does not exist
(trusty was released [4.4.2-0ubuntu0.14.04.11])
Binaries built from this source package are in Universe and so are supported by the community.