Home > Vulnerability Database > CVE-2017-2615

Mend.io Vulnerability Database

CVE-2017-2615

Date: July 2, 2018

Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue. It could occur while copying VGA data via bitblt copy in backward mode. A privileged user inside a guest could use this flaw to crash the QEMU process resulting in DoS or potentially execute arbitrary code on the host with privileges of QEMU process on the host.

Severity Score

9.1

Related Resources (26)

Url: https://security.gentoo.org/glsa/201702-27

Url: https://security.gentoo.org/glsa/201702-28

Url: http://rhn.redhat.com/errata/RHSA-2017-0330.html

Url: https://access.redhat.com/security/cve/CVE-2017-2615

Url: https://people.canonical.com/~ubuntu-security/cve/CVE-2017-2615

Url: http://rhn.redhat.com/errata/RHSA-2017-0344.html

Url: http://rhn.redhat.com/errata/RHSA-2017-0328.html

Url: http://www.securityfocus.com/bid/95990

Url: http://rhn.redhat.com/errata/RHSA-2017-0333.html

Url: http://www.openwall.com/lists/oss-security/2017/02/01/6

Url: https://support.citrix.com/article/CTX220771

Url: http://www.securitytracker.com/id/1037804

Url: http://rhn.redhat.com/errata/RHSA-2017-0332.html

Url: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2615

Url: http://rhn.redhat.com/errata/RHSA-2017-0454.html

Url: http://rhn.redhat.com/errata/RHSA-2017-0396.html

Url: http://rhn.redhat.com/errata/RHSA-2017-0331.html

Url: http://rhn.redhat.com/errata/RHSA-2017-0309.html

Url: http://rhn.redhat.com/errata/RHSA-2017-0334.html

Url: https://lists.gnu.org/archive/html/qemu-devel/2017-02/msg00015.html

Url: https://nvd.nist.gov/vuln/detail/CVE-2017-2615

Url: https://security-tracker.debian.org/tracker/CVE-2017-2615

Url: https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html

Url: http://rhn.redhat.com/errata/RHSA-2017-0350.html

Url: http://rhn.redhat.com/errata/RHSA-2017-0329.html

Url: https://www.mend.io/vulnerability-database/CVE-2017-2615

Severity Score

9.1

Weakness Type (CWE)

Out-of-bounds Read

CWE-125

Out-of-bounds Write

CWE-787

CVSS v3.1

Base Score:	9.1
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	HIGH
User Interaction (UI):	NONE
Scope (S):	CHANGED
Confidentiality (C):	HIGH
Integrity (I):	HIGH
Availability (A):	HIGH

CVSS v2

Base Score:	9.0
Access Vector (AV):	NETWORK
Access Complexity (AC):	LOW
Authentication (AU):	SINGLE
Confidentiality (C):	COMPLETE
Integrity (I):	COMPLETE
Availability (A):	COMPLETE
Additional information:

Mend.io Vulnerability Database

We found results for “”

CVE-2017-2615

Date: July 2, 2018

Severity Score

Related Resources (26)

Severity Score

Weakness Type (CWE)

CVSS v3.1

CVSS v2

Do you need more information?