CVE-2017-15124: Input Validation
Last updated 25 August 2025
Other sources
VNC server implementation in Quick Emulator (QEMU) 2.11.0 and older was found to be vulnerable to an unbounded memory allocation issue, as it did not throttle the framebuffer updates sent to its client. If the client did not consume these updates, VNC server allocates growing memory to hold onto this data. A malicious remote VNC client could use this flaw to cause DoS to the server host.
— Launchpad
VNC server implementation in Quick Emulator(QEMU) was found to be vulnerable to an unbounded memory allocation issue, as it did not throttle the framebuffer updates sent to its client. If the client did not consume these updates, VNC server allocates growing memory to hold onto this data.
A malicious VNC client could use this flaw to cause DoS on the remote server host.
Upstream fix(es): ----------------- -> https://lists.gnu.org/archive/html/qemu-devel/2017-12/msg03715.html -> https://lists.gnu.org/archive/html/qemu-devel/2017-12/msg03713.html -> https://lists.gnu.org/archive/html/qemu-devel/2017-12/msg03711.html
Thread: ------- -> https://lists.gnu.org/archive/html/qemu-devel/2017-12/msg03705.html
Reference: ---------- -> http://www.openwall.com/lists/oss-security/2017/12/19/4
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/qemuto a version that resolves this vulnerability.Fixed in 1:5.2+dfsg-11+deb11u3Fixed in 1:5.2+dfsg-11+deb11u5Fixed in 1:7.2+dfsg-7+deb12u18Fixed in 1:7.2+dfsg-7+deb12u15Fixed in 1:10.0.11+ds-0+deb13u1Fixed in 1:10.0.2+ds-2+deb13u1Fixed in 1:11.0.2+ds-2 - Upgrade
Upgrade
QEMU VNC server (Quick Emulator)to a version that resolves this vulnerability.Fixed in 2.11.0
Event History
Frequently Asked Questions
What is the severity of CVE-2017-15124?
CVE-2017-15124 has been classified with a medium severity due to its potential for unbounded memory allocation.
How do I fix CVE-2017-15124?
To mitigate CVE-2017-15124, upgrade to QEMU versions higher than 2.11.0.
What software is affected by CVE-2017-15124?
CVE-2017-15124 affects QEMU versions 2.11.0 and older.
What are the consequences of not addressing CVE-2017-15124?
Failure to address CVE-2017-15124 may lead to denial of service due to excessive memory allocation.
Is CVE-2017-15124 applicable to all operating systems?
CVE-2017-15124 is primarily relevant for systems running affected versions of QEMU.