#VU33993 Integer overflow in QEMU - CVE-2015-5239

Vulnerability identifier: #VU33993

Vulnerability risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2015-5239

CWE-ID: CWE-190

Exploitation vector: Local network

Exploit availability: No

Vulnerable software:
QEMU
Client/Desktop applications / Virtualization software

Vendor: QEMU

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to integer overflow in  the VNC display driver in QEMU. A remote attacker can pass specially crafted CLIENT_CUT_TEXT message to the application, trigger integer overflow and perform a denial of service attack via infinite loop.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

QEMU: 2.0 - 2.0.2

---

External links
https://lists.fedoraproject.org/pipermail/package-announce/2015-October/168077.html
https://lists.fedoraproject.org/pipermail/package-announce/2015-October/168646.html
https://lists.fedoraproject.org/pipermail/package-announce/2015-October/168671.html
https://lists.opensuse.org/opensuse-security-announce/2015-10/msg00026.html
https://lists.opensuse.org/opensuse-security-announce/2015-11/msg00005.html
https://lists.opensuse.org/opensuse-security-announce/2015-11/msg00011.html
https://www.openwall.com/lists/oss-security/2015/09/02/7
https://www.ubuntu.com/usn/USN-2745-1
https://github.com/qemu/qemu/commit/f9a70e79391f6d7c2a912d785239ee8effc1922d

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.