The CAC(Common Access Card) library, used by Quick Emulator(Qemu) to implement smartcard support, is vulnerable to a host memory leakage issue. It could occur while allocating a new APDU object using guest supplied raw byte stream in 'vcardapdunew'.

A guest user/process could use this flaw to leak host memory resulting in DoS.

Upstream patch: --------------- -> https://cgit.freedesktop.org/spice/libcacard/commit/?id=9113dc6a303604a2d9812ac70c17d076ef11886c

Reference: ---------- -> http://www.openwall.com/lists/oss-security/2017/03/01/11