SB2017061635 - Integer overflow in qemu (Alpine package)
Published: June 16, 2017
Security Bulletin ID
SB2017061635
CSH Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Partial DoS
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 vulnerability.
1) Integer overflow (CVE-ID: CVE-2017-5898)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a local attacker to cause DoS condition on the target system.
The weakness exists in the emulated_apdu_from_guest function in usb/dev-smartcard-reader.c due to integer overflow when built with the CCID Card device emulator support. A local attacker can cause the service to crash via a large Application Protocol Data Units (APDU) unit
Remediation
Install update from vendor's website.
References
- https://git.alpinelinux.org/aports/commit/?id=64053e93d1b2192473cc16b8719d43e6b1c036a6
- https://git.alpinelinux.org/aports/commit/?id=95bc43da6b1937b995aa1c06eef35127556a33ed
- https://git.alpinelinux.org/aports/commit/?id=4fd42213196834bf5e7a33f83e9e6775606a9aba
- https://git.alpinelinux.org/aports/commit/?id=e96a03d924c9b59bb4c163581b1e7c22c0bb9f4c