Freely subscribe to our NEWSLETTER

This bulletin was written by Vigil@nce : http://vigilance.fr/offer

SYNTHESIS OF THE VULNERABILITY

An attacker, who is privileged in a guest system, can generate a
buffer overflow in the vnc_refresh_server_surface() function of
Qemu, in order to trigger a denial of service, and possibly to run
code on the host system.

Impacted products: Debian, Fedora, QEMU, RHEL, Ubuntu.

Severity: 2/4.

Creation date: 24/08/2015.

DESCRIPTION OF THE VULNERABILITY

The Qemu product implements a VNC display driver in the ui/vnc.c
file.

However, if the size of data is greater than the size of the
storage array, an overflow occurs in the vnc_refresh_server_surface()
function.

An attacker, who is privileged in a guest system, can therefore
generate a buffer overflow in the vnc_refresh_server_surface()
function of Qemu, in order to trigger a denial of service, and
possibly to run code on the host system.

ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN

http://vigilance.fr/vulnerability/Qemu-buffer-overflow-of-vnc-refresh-server-surface-17734