CVE-2007-1320: Buffer Overflow
Multiple heap-based buffer overflows in the cirrusinvalidateregion function in the Cirrus VGA extension in QEMU 0.8.2, as used in Xen and possibly other products, might allow local users to execute arbitrary code via unspecified vectors related to "attempting to mark non-existent regions as dirty," aka the "bitblt" heap overflow.
Other sources
The cirrusinvalidateregion() routine used during video-to-video copy operations in the cirrus vga extension code omits bounds checking in multiple locations, allowing you to overwrite adjacent buffers by attempting to mark non-existent regions as dirty. Successful exploitation would result in a complete compromise of the qemu process. Additionally multiple bitblt operations omit bounds checking, where the srcpitch or dstpitch coefficients cause the operation to exceed the bounds of the vram buffer.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2007-1320?
CVE-2007-1320 is considered to have a high severity due to potential local code execution vulnerabilities.
How do I fix CVE-2007-1320?
To fix CVE-2007-1320, upgrade QEMU to a version later than 0.8.2 or apply patches provided by your operating system vendor.
Which software is affected by CVE-2007-1320?
CVE-2007-1320 affects QEMU version 0.8.2, as well as various distributions utilizing this version, such as Red Hat Xen and several Fedora and Debian releases.
Is CVE-2007-1320 a remote or local vulnerability?
CVE-2007-1320 is classified as a local vulnerability, allowing local users to execute arbitrary code.
What type of vulnerability is CVE-2007-1320?
CVE-2007-1320 is a heap-based buffer overflow vulnerability.