Home > Vulnerability Database > CVE-2016-3710

Mend.io Vulnerability Database

CVE-2016-3710

Good to know:

Date: May 11, 2016

The VGA module in QEMU improperly performs bounds checking on banked access to video memory, which allows local guest OS administrators to execute arbitrary code on the host by changing access modes after setting the bank register, aka the "Dark Portal" issue.

Language: C

Severity Score

8.8

Related Resources (27)

Url: http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html

Url: http://rhn.redhat.com/errata/RHSA-2016-0999.html

Url: http://support.citrix.com/article/CTX212736

Url: https://security-tracker.debian.org/tracker/CVE-2016-3710

Url: http://rhn.redhat.com/errata/RHSA-2016-1001.html

Url: http://www.openwall.com/lists/oss-security/2016/05/09/3

Url: http://www.ubuntu.com/usn/USN-2974-1

Url: http://www.securityfocus.com/bid/90316

Url: http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html

Url: http://rhn.redhat.com/errata/RHSA-2016-1000.html

Url: https://access.redhat.com/errata/RHSA-2016:1224

Url: https://people.canonical.com/~ubuntu-security/cve/CVE-2016-3710

Url: http://xenbits.xen.org/xsa/advisory-179.html

Url: http://rhn.redhat.com/errata/RHSA-2016-0997.html

Url: https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05164862

Url: http://rhn.redhat.com/errata/RHSA-2016-0725.html

Url: http://www.debian.org/security/2016/dsa-3573

Url: http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html

Url: http://rhn.redhat.com/errata/RHSA-2016-1002.html

Url: http://www.securitytracker.com/id/1035794

Url: https://access.redhat.com/security/cve/CVE-2016-3710

Url: http://rhn.redhat.com/errata/RHSA-2016-1943.html

Url: http://rhn.redhat.com/errata/RHSA-2016-1019.html

Url: http://rhn.redhat.com/errata/RHSA-2016-0724.html

Url: https://nvd.nist.gov/vuln/detail/CVE-2016-3710

Url: https://lists.gnu.org/archive/html/qemu-devel/2016-05/msg01197.html

Url: https://www.mend.io/vulnerability-database/CVE-2016-3710

Severity Score

8.8

Weakness Type (CWE)

Buffer Errors

CWE-119

Improper Access Control

CWE-284

Top Fix

Upgrade Version

Upgrade to version v2.6.0-rc5

Learn More

CVSS v3.1

Base Score:	8.8
Attack Vector (AV):	LOCAL
Attack Complexity (AC):	LOW
Privileges Required (PR):	LOW
User Interaction (UI):	NONE
Scope (S):	CHANGED
Confidentiality (C):	HIGH
Integrity (I):	HIGH
Availability (A):	HIGH

CVSS v2

Base Score:	7.2
Access Vector (AV):	LOCAL
Access Complexity (AC):	LOW
Authentication (AU):	NONE
Confidentiality (C):	COMPLETE
Integrity (I):	COMPLETE
Availability (A):	COMPLETE
Additional information:

Mend.io Vulnerability Database

We found results for “”

CVE-2016-3710

Good to know:

Date: May 11, 2016

Language: C

Severity Score

Related Resources (27)

Severity Score

Weakness Type (CWE)

Top Fix

Upgrade Version

CVSS v3.1

CVSS v2

Do you need more information?