CVE-2016-4439: Buffer Overflow
First published: Thu May 19 2016(Updated: )
Quick Emulator(Qemu) built with the ESP/NCR53C9x controller emulation support is vulnerable to an OOB write access issue. The controller uses 16-byte FIFO buffer for command and data transfer. The OOB write occurs while writing to this command buffer in esp_reg_write(). A privileged user inside guest could use this flaw to crash the Qemu process resulting in DoS OR potentially leverage it to execute arbitrary code with privileges of the Qemu process on the host. Upstream patch: --------------- -> <a href="https://lists.gnu.org/archive/html/qemu-devel/2016-05/msg03273.html">https://lists.gnu.org/archive/html/qemu-devel/2016-05/msg03273.html</a> Reference: ---------- -> <a href="http://www.openwall.com/lists/oss-security/2016/05/19/3">http://www.openwall.com/lists/oss-security/2016/05/19/3</a>
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Canonical Ubuntu Linux | =12.04 | |
| Canonical Ubuntu Linux | =14.04 | |
| Canonical Ubuntu Linux | =16.04 | |
| QEMU qemu | <=2.6.0 | |
| Debian Debian Linux | =8.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://lists.gnu.org/archive/html/qemu-devel/2016-05/msg03273.html
- http://www.openwall.com/lists/oss-security/2016/05/19/3
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1337503
- https://bugzilla.redhat.com/show_bug.cgi?id=1337502
- http://www.securityfocus.com/bid/90760
- http://www.ubuntu.com/usn/USN-3047-1
- http://www.ubuntu.com/usn/USN-3047-2
- https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
- https://security.gentoo.org/glsa/201609-01
- collector/nvd-index
- agent/type
- agent/remedy
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/severity
- agent/references
- agent/last-modified-date
- agent/description
- agent/author
- agent/event
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2016-4439
- agent/tags
- agent/trending
- vendor/canonical
- canonical/canonical ubuntu linux
- version/canonical ubuntu linux/12.04
- version/canonical ubuntu linux/14.04
- version/canonical ubuntu linux/16.04
- vendor/qemu
- canonical/qemu qemu
- version/qemu qemu/2.6.0
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/8.0